avoid buffer overflow using sprintf?

Discussion in 'C++' started by Susan Rice, Jul 3, 2006.

  1. Susan Rice

    Susan Rice Guest

    How can I rewrite this code to avoid the possibility of a
    buffer overflow?

    sprintf(errbuf, "%s\nError is: %u: %s\n", errmsg, dwErrCode, s );

    Here:
    errmsg = a string
    dwErrCode = a number
    s = a string
    I do have value 'errbuflen' = length of buffer 'errbuf'.
    I'm just not using it.
    Is there any easy way? Or is there only the hard way?
     
    Susan Rice, Jul 3, 2006
    #1
    1. Advertisements

  2. Susan Rice

    mlimber Guest

    Susan Rice wrote:
    > How can I rewrite this code to avoid the possibility of a
    > buffer overflow?
    >
    > sprintf(errbuf, "%s\nError is: %u: %s\n", errmsg, dwErrCode, s );
    >
    > Here:
    > errmsg = a string
    > dwErrCode = a number
    > s = a string
    > I do have value 'errbuflen' = length of buffer 'errbuf'.
    > I'm just not using it.
    > Is there any easy way? Or is there only the hard way?


    Use std::strings and std::stringstreams instead:

    ostringstream errbuf;
    errbuf << errmsg << "\nError is: " << dwErrCode << ':' << s << '\n';

    You can retrieve the resulting message with "errbuf.str()" which, if
    needed, can be converted to a C-style string like this:
    "errbuf.str().c_str()".

    Cheers! --M
     
    mlimber, Jul 3, 2006
    #2
    1. Advertisements

  3. * Susan Rice:
    > How can I rewrite this code to avoid the possibility of a
    > buffer overflow?
    >
    > sprintf(errbuf, "%s\nError is: %u: %s\n", errmsg, dwErrCode, s );
    >
    > Here:
    > errmsg = a string
    > dwErrCode = a number
    > s = a string
    > I do have value 'errbuflen' = length of buffer 'errbuf'.
    > I'm just not using it.
    > Is there any easy way? Or is there only the hard way?


    std::eek:stringstream stream;
    stream << errmsg << "\nError is: " << dwErrCode << ": " << s << "\n";
    // Do something with stream.str()

    Btw., Hungarian notation like the prefix 'dw' is likely to cause you all
    kinds of trouble, and reduces readability, without conferring /any/
    advantage with modern tools.

    --
    A: Because it messes up the order in which people normally read text.
    Q: Why is it such a bad thing?
    A: Top-posting.
    Q: What is the most annoying thing on usenet and in e-mail?
     
    Alf P. Steinbach, Jul 3, 2006
    #3
  4. Susan Rice wrote:
    > How can I rewrite this code to avoid the possibility of a
    > buffer overflow?
    >
    > sprintf(errbuf, "%s\nError is: %u: %s\n", errmsg, dwErrCode, s );
    >
    > Here:
    > errmsg = a string
    > dwErrCode = a number
    > s = a string
    > I do have value 'errbuflen' = length of buffer 'errbuf'.
    > I'm just not using it.
    > Is there any easy way? Or is there only the hard way?


    An easy way to do it is with snprintf(), which lets you specify the
    maximum number of characters to store in the output buffer. Your code
    would become:

    snprintf(errbuf, errbuflen, "%s\nError is: %u: %s\n", errmsg,
    dwErrCode, s);

    If your C library does not snprintf(), you can get a free
    implementation here:

    http://www.ijs.si/software/snprintf/

    Regards,
    Markus.
     
    Markus Svilans, Jul 4, 2006
    #4
    1. Advertisements

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. =?Utf-8?B?Lk5FVCBEZXY=?=

    ASP.NET Crashing on IIS 5.0 - Buffer overflow

    =?Utf-8?B?Lk5FVCBEZXY=?=, Aug 11, 2005, in forum: ASP .Net
    Replies:
    1
    Views:
    3,259
    =?Utf-8?B?Lk5FVCBEZXY=?=
    Aug 11, 2005
  2. =?Utf-8?B?VGltOjouLg==?=

    ??? Possible Buffer Overflow ???

    =?Utf-8?B?VGltOjouLg==?=, Aug 31, 2005, in forum: ASP .Net
    Replies:
    2
    Views:
    712
    Oliver Wong
    Aug 31, 2005
  3. Replies:
    2
    Views:
    2,018
    GloryFish
    Oct 21, 2005
  4. Robert Mark Bram

    Buffer Overflow Errors

    Robert Mark Bram, Jul 17, 2004, in forum: Java
    Replies:
    10
    Views:
    1,044
    Tony Morris
    Jul 18, 2004
  5. Ioannis Vranos

    Buffer overflow protection

    Ioannis Vranos, Apr 13, 2004, in forum: C++
    Replies:
    13
    Views:
    823
    tom_usenet
    Apr 14, 2004
  6. Replies:
    7
    Views:
    601
    Matt Kowalczyk
    Feb 14, 2007
  7. Steven D'Aprano

    How to avoid overflow errors

    Steven D'Aprano, Sep 15, 2007, in forum: Python
    Replies:
    10
    Views:
    649
    Steven D'Aprano
    Sep 16, 2007
  8. A.E lover

    large array?? how to avoid stack overflow?

    A.E lover, Jan 13, 2009, in forum: C Programming
    Replies:
    5
    Views:
    4,006
    Keith Thompson
    Jan 14, 2009
Loading...