A lot of the time it is the fault of the compiler.
here's a short quote from the man page on gets().

Never use gets(). Because it is impossible to tell without
knowing the data in advance how many characters gets()
will read, and because gets() will continue to store characters
past the end of the buffer, it is extremely dangerous to use. It has
been used to break computer security. Use fgets() instead.
They still ship these functions with the compiler, and then
tell you not to use them.