4 ms·
I am happy to see snprintf isn't on the list. It's the best C99 string function, both safe and useful.
by TazeTSchnitzel 6y ago
I am happy to see snprintf isn't on the list. It's the best C99 string function, both safe and useful.
- EdSchouten 6y agoIt took ages for Microsoft to add it, though. They only implemented it as part of Visual Studio 2015.
- hnick 6y agosnprintf still has the typical format string vulnerabilities doesn't it? Information leaks, buffer overflows, etc.
- TazeTSchnitzel 6y agoYou can do silly things with the format string, but it will never overflow the output buffer if you invoke snprintf properly, nor will it ever not be null terminated, and snprintf can even tell you how large a buffer you need.
- hnick 6y agoOh yea, I was just thinking there are still limits to what 'safe' means though. My memory on the exact exploits was hazy so I had to look it up but I know it includes sending user defined data to the format string, which is not advised, but people do silly things all the time when coding which is why snprintf exists to start with. People can't be trusted to bounds check. In my mind a safer version for daily use wouldn't support the more problematic format options but maybe other people use them far more widely than me.
- TazeTSchnitzel 6y agoRight, yeah, I should say snprintf() is safer than sprintf(), but it still has the unsafe features of printf().
- rurban 6y agoTotally unsafe. It also allows %n. If possible use a proper format library, or at the least the _s variant.
- TazeTSchnitzel 6y ago> Totally unsafe. Please justify that claim. snprintf() limits itself to the specified buffer size (in the way safe from off-by-one errors) and always null-terminates. What more do you want?
- TazeTSchnitzel 6y ago(Ah, sorry, if it's about format strings, I know they're potentially dangerous. I think they're fine in practice though so long as you have compiler warnings for type mismatches and non-literal strings turned on.)