C language is not a very convenient language, its string is an example. As defined by the C language, "a string is a memory space containing ASCII characters and, at the end of", "a total of n-1 characters can be stored. "According to this description, string handling is really cumbersome and prone to error."
In order to facilitate users, the C language standard library provides users with some string functions, such as String copy, construction, empty functions, to a certain extent, to facilitate the user's use. However, I stumbled upon that these functions are still somewhat hidden.
The thing is simple, I noticed that I wrote some programs, always have memory read and write errors, but, after careful examination of all my data buffer, as well as the relevant processing functions, and did not find anything wrong. So I turned my suspicions to some of the string-processing functions I used, such as strcpy, sprintf, and so on. After several carefully tracked, I found that the memory error originated from here. So I began to look at the topic of how to safely use strings.
1. String copy function
1.1 Unsafe strcpy.
First, I wrote a test function like this:
void strcpyTest0()
{
int i;
char szBuf[128];
for(i=0;i<128;i++) szBuf[i]='*';
szBuf[127]='\0'; //构造一个全部是*的字符串
char szBuf2[256];
for(i=0;i<256;i++) szBuf2[i]='#';
szBuf2[255]='\0'; //构造一个全部是#的字符串
strcpy(szBuf,szBuf2);
printf("%s\n",szBuf);
}
It's easy to copy a string to another space, but unfortunately, the source string is longer than the destination address, so the program is tragically dead.
1.2 is still unsafe strncpy.
In the above example, I found that I need to enter a parameter in the copy, to indicate how long the destination address, check the C language Library function Description, there is a strncpy can achieve this purpose, the function of the prototype is as follows:
Char *strncpy (char *strdest, const char *strsource, size_t count);
OK, now that our problem is solved, I wrote the following code:
void strcpyTest1()
{
int i;
char szBuf[128];
for(i=0;i<128;i++) szBuf[i]='*';
szBuf[127]='\0';
char szBuf2[256];
for(i=0;i<256;i++) szBuf2[i]='#';
szBuf2[255]='\0';
strncpy(szBuf,szBuf2,128);
printf("%s\n",szBuf);
}
Everything seems to be all right however, when I output the result, I found the problem, the string is sometimes followed by a few strange characters, seems not to end with "", so I change the above copy statement to "strncpy (szbuf,szbuf2,8);", only 8 characters, the problem appears, The program output is as follows:
########******************************************************************************************************* ****************
Sure enough, when the requested destination address space is smaller than the source string space, strncpy will no longer end the string with "". Huge hidden trouble.