C library function - scanf()

The C library function int scanf(const char *format, ...) reads formatted input from stdin.
Following is the declaration for scanf() function.
int scanf(const char *format, ...)
format − This is the C string that contains one or more of the following items −
Whitespace character, Non-whitespace character and Format specifiers. A format specifier  will be like [=%[*][width][modifiers]type=] as explained below −
format − This is the C string that contains one or more of the following items −
Whitespace character, Non-whitespace character and Format specifiers. A format specifier  will be like [=%[*][width][modifiers]type=] as explained below −
*
This is an optional starting asterisk indicates that the data is to be read from the stream but ignored, i.e. it is not stored in the corresponding argument.
width
This specifies the maximum number of characters to be read in the current reading operation.
modifiers
Specifies a size different from int (in the case of d, i and n), unsigned int (in the case of o, u and x) or float (in the case of e, f and g) for the data pointed by the corresponding additional argument: h : short int (for d, i and n), or unsigned short int (for o, u and x) l : long int (for d, i and n), or unsigned long int (for o, u and x), or double (for e, f and g) L : long double (for e, f and g)
type
A character specifying the type of data to be read and how it is expected to be read. See next table.
additional arguments − Depending on the format string, the function may expect a sequence of additional arguments, each containing one value to be inserted instead of each %-tag specified in the format parameter, if any. There should be the same number of these arguments as the number of %-tags that expect a value.
additional arguments − Depending on the format string, the function may expect a sequence of additional arguments, each containing one value to be inserted instead of each %-tag specified in the format parameter, if any. There should be the same number of these arguments as the number of %-tags that expect a value.
On success, the function returns the number of items of the argument list successfully read. If a reading error happens or the end-of-file is reached while reading, the proper indicator is set (feof or ferror) and, if either happens before any data could be successfully read, EOF is returned.
The following example shows the usage of scanf() function.
#include <stdio.h>

int main () {
   char str1[20], str2[30];

   printf("Enter name: ");
   scanf("%19s", str1);

   printf("Enter your website name: ");
   scanf("%29s", str2);

   printf("Entered Name: %s\n", str1);
   printf("Entered Website:%s", str2);
   
   return(0);
}
Let us compile and run the above program that will produce the following result in interactive mode −
Enter name: admin
Enter your website name: www.tutorialspoint.com

Entered Name: admin
Entered Website: www.tutorialspoint.com

Please note: if we enter a name longer than 20 characters, or a website longer than 30, it will overflow the buffers provided. And if we enter a name longer than 19 characters, or a website longer than 29, then printf will not find a trailing null byte, so it will start reading other parts of the stack and random garbage - in other words a buffer overrun. 
So in this one code example you have both a buffer overflow and a buffer overrun. In many cases a vulnerability like this is enough to compromise an application written in C.
We should use %19s and %29s instead of %s to prevent this vulnerability. It will cut off the extra characters, but it will be safe.