Thread: [Dev-C++] Re: newbie string parsing question
Open Source C & C++ IDE for Windows
Brought to you by:
claplace
Menu
▾
▴
dev-cpp-users
|
From: Pascal <p.t...@ti...> - 2004-08-18 06:05:35
|
Why not using the fully std c++ function like <cin> to manipulate string input in file? |
|
From: Scott S. <age...@co...> - 2004-08-18 11:48:07
|
Here are some links: http://www.acm.uiuc.edu/webmonkeys/book/c_guide/ http://www.eskimo.com/~scs/cclass/notes/top.html http://people.cs.uchicago.edu/~iancooke/osstuff/ccc.html w0rldd0m wrote: >This looks like a great solution. ><Humble> >Is there a way translate this into a 'Comp. Sci 1' solution? >I just finished the class and Im not familiar fgets(), sscanf() and >String sanitizing yet, although Im a swashbuckler with making a new string >variables. >My classmates will be impressed when I drop a "buffer overflow attack" >problem on them. ></Humble> > >Thank you in advance for any help you can offer. > > >-----Original Message----- >From: dev...@li... >[mailto:dev...@li...] On Behalf Of Scott >Simontis >Sent: Tuesday, August 17, 2004 5:06 PM >To: Per Westermark >Cc: Matt Valerio; wor...@so...; dev...@li... >Subject: Re: [Dev-C++] newbie string parsing question > >This is probably the smartest solution. I was going to suggest C functions. >Also, you can include <cstdio> instead of stdio.h. That will include all of >the C headers in namespace std. >Per Westermark wrote: > > > >>Note 1: fscanf will not allocate any memory. first_name and last_name >>must already point to large enough memory buffers. >> >>Note 2: that scanf functions are a common road of buffer overflow attacks. >>If one of the names in the string is very long, it will overwrite >>unallocated memory. Whenever strings are loaded, a maximum field width >>should be specified in the formatting string! >> >>One other common method of loading text lines using C, i.e. without use >>of the string data type, is to load each text line with >> fgets(buf,sizeof(buf),file) >>and then use sscanf() on a sanitized string, or use strchr(), strtok() >>or similar to find the separator character(s) between the tokens. >> >>/Per W >> >>On Tue, 17 Aug 2004, Matt Valerio wrote: >> >> >> >> >> >>>Look up the fscanf() function. >>> >>>pseudo-code: >>>#include <stdio.h> >>> >>>char* first_name; >>>char* last_name; >>>int age; >>>FILE* in_file; >>>infile = fopen("data.txt","r"); >>>while ( !eof(infile) ) { >>> fscanf( infile, "%s\t%s\t%d\r", first_name, last_name, &age); >>> // do something with the first_name, last_name, and age variables >>> >>> >here. > > >>>} >>>close(infile); >>> >>> >>>I think that's right -- might want to double check all of the pointers >>>and stuff (the * and & operators). I'm just typing this off the top >>>of my head so double check the syntax. >>> >>>-Matt >>> >>> >>> >>> >>>wor...@so... wrote: >>> >>> >>> >>> >>> >>>>Hi all, >>>> >>>>Thank you in advance for any help that you can offer. >>>> >>>>I have a text file that has records like this: >>>> >>>>Firstname Lastname age //seperated by the \t character. >>>> >>>>I want to run a while loop and parse the record to populate a struct >>>> >>>> >array. > > >>>>I have looked into the getline(string, max, delimiter) function but it >>>> >>>> >needs char[]'s. > > >>>>Since I don't know the length of the string that I need can someone >>>>recommend an existing different class function or something? >>>> >>>>Best regards, >>>> >>>>Dane >>>> >>>> >>>>------------------------------------------------------- >>>>SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank >>>>Media 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only >>>>$33 Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift. >>>>http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285 >>>>_______________________________________________ >>>>Dev-cpp-users mailing list >>>>Dev...@li... >>>>TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm >>>>https://lists.sourceforge.net/lists/listinfo/dev-cpp-users >>>> >>>> >>>> >>>> >>>> >>>------------------------------------------------------- >>>SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media >>>100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 Save >>>50% off Retail on Ink & Toner - Free Shipping and Free Gift. >>>http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285 >>>_______________________________________________ >>>Dev-cpp-users mailing list >>>Dev...@li... >>>TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm >>>https://lists.sourceforge.net/lists/listinfo/dev-cpp-users >>> >>> >>> >>> >>> >> >>------------------------------------------------------- >>SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media >>100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 Save >>50% off Retail on Ink & Toner - Free Shipping and Free Gift. >>http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285 >>_______________________________________________ >>Dev-cpp-users mailing list >>Dev...@li... >>TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm >>https://lists.sourceforge.net/lists/listinfo/dev-cpp-users >> >> >> >> >> > > > >------------------------------------------------------- >SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media 100pk >Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 Save 50% off >Retail on Ink & Toner - Free Shipping and Free Gift. >http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285 >_______________________________________________ >Dev-cpp-users mailing list >Dev...@li... >TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm >https://lists.sourceforge.net/lists/listinfo/dev-cpp-users > > > > |
|
From: <or...@vp...> - 2004-08-18 09:07:25
|
Pascal wrote: > Why not using the fully std c++ function like <cin> to manipulate =20 > string input in file? Indeed, that would be the simplest. Using C for string manipulation is ve= ry dangerous, and=20 awkward. Use the >> operator, like this: file >> first_name; file >> last_name; ... where "file" is an "ifstream" and "xxx_name" is a "string". -- Greetings, Bal=E1zs |
|
From: Per W. <pw...@ia...> - 2004-08-18 10:15:49
|
Using C for string manipulation isn't dangerous unless you don't know what to do. Same thing with using a hammer. Don't forget that the majority of all operating systems in existence uses C with great success. file >> first_name still gives you the possibility of loading a multi-megabyte text string, possibly exhausting the available memory. In reality, easy code is good when everything is already controlled, or you don't care about error behaviour. Production quality code normally need extra tests and protection. /Per W On Wed, 18 Aug 2004, [ISO-8859-15] OROSZI Bal=E1zs wrote: > Pascal wrote: > > Why not using the fully std c++ function like <cin> to manipulate > > string input in file? > > Indeed, that would be the simplest. Using C for string manipulation is ve= ry dangerous, and > awkward. Use the >> operator, like this: > > file >> first_name; > file >> last_name; > ... > > where "file" is an "ifstream" and "xxx_name" is a "string". > > -- > Greetings, > Bal=E1zs > > > ------------------------------------------------------- > SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media > 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 > Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift. > http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285 > _______________________________________________ > Dev-cpp-users mailing list > Dev...@li... > TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm > https://lists.sourceforge.net/lists/listinfo/dev-cpp-users > |
|
From: <or...@vp...> - 2004-08-19 00:51:10
|
Per Westermark wrote: > Using C for string manipulation isn't dangerous unless you don't know w= hat > to do. Same thing with using a hammer. Don't forget that the majority o= f > all operating systems in existence uses C with great success. >=20 > file >> first_name >=20 > still gives you the possibility of loading a multi-megabyte text string= , > possibly exhausting the available memory. Is getting a buffer overflow better? IMO C string manipulation is very awkward, and hard to use. You always ha= ve to worry about=20 things like: "Now have I counted that \0 terminating character or not?" and others. Why bother with low-level, error prone functions, when C++ introduced the= string class to=20 address these problems? -- Greetings, Bal=E1zs |
|
From: Per W. <pw...@ia...> - 2004-08-19 11:01:28
|
Is getting a buffer overflow better, you ask. You see, I don't have any problem with buffer overflow and I don't worry about having counted the terminating zero. Last time I had a problem with zero termination was when using a broken strncmp() function written by InterNiche Technologies and used in an embedded project. When you have used the functions and know what they do you don't worry about it, just as you don't worry about NULL pointers or division-by-zero. All of them are easy to avoid. If we should talk about limitations in the strxx() functions it is substring and regexp manipulation or internationalization. Since substring manipulation normally requires string copying I can understand why the c library didn't supply so much support. Anyway, where I have found weeknesses in the standard library, I have added my own functions, so I don't think much about that either. Just doing cin >> name assumes that the input file is nice. You don't get buffer overflow in the string but you can still get memory overflow, i.e. failed memory allocation - or a very slow and swapping machine. If an attacker may supply his own file he can do a DOS-attack on the machine. Of course I use the string type in my C++ applications, but I normally don't limit myself to _only_ the string type. The power of the pointer types in C/C++ is one of the reasons why C/C++ have been such large languages. /Per W On Thu, 19 Aug 2004, OROSZI Bal=E1zs wrote: > Per Westermark wrote: > > Using C for string manipulation isn't dangerous unless you don't know w= hat > > to do. Same thing with using a hammer. Don't forget that the majority o= f > > all operating systems in existence uses C with great success. > > > > file >> first_name > > > > still gives you the possibility of loading a multi-megabyte text string= , > > possibly exhausting the available memory. > > Is getting a buffer overflow better? > > IMO C string manipulation is very awkward, and hard to use. You always ha= ve to worry about > things like: > "Now have I counted that \0 terminating character or not?" > and others. > > Why bother with low-level, error prone functions, when C++ introduced the= string class to > address these problems? > > -- > Greetings, > Bal=E1zs > > > ------------------------------------------------------- > SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media > 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 > Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift. > http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285 > _______________________________________________ > Dev-cpp-users mailing list > Dev...@li... > TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm > https://lists.sourceforge.net/lists/listinfo/dev-cpp-users > |
|
From: <or...@vp...> - 2004-08-19 17:47:18
|
Per Westermark wrote: > Of course I use the string type in my C++ applications, but I normally > don't limit myself to _only_ the string type. That's the point. A year ago, when I only knew C, I didn't even want to h= ear about C++,=20 because I was satisfied with my knowledge of "pointer hacking". But I got= myself troubled=20 whenever I wanted to do string stuff: passing "strings" to functions, usi= ng malloc,=20 realloc, free, writing my own (rather awkward) string handler library too= k a lot of=20 productive time away from me. That's why I'm so against using strxxx, bec= ause I used them=20 extensively, and I only see how stupid I was, that I wasted so much time = on already=20 existant and well-written things. -- Greetings, Bal=E1zs |
|
From: Per W. <pw...@ia...> - 2004-08-19 20:41:26
|
I have written compilers, XML editors and a number of other string-manipulating things, but 99% of the time when I use C-strings, I work with static buffers or make one-time assignments with strdup(). A lot of the manipulation doesn't even need any new buffers but may use direct pointer substrings. The only realloc code I have are 3 or 4 small functions, about 5 lines each, that I wrote about 15 years ago to insert and remove text in a dynamically allocated buffer. Hardly any bother to write. Hardly any bother to use. For doing reg-exp it doesn't matter if I use my code, or if I use a third-part library, such as the wxRegEx class from wxWidgets. The point is, I don't spend any time fighting any strxx() functions, since they are not enemies. They are one of several useful (good) tools to use, not something to ignore because god has created std::string. There are a number of reasons to keep all options open. Some of them are: - C++ not available for a specific embedded environment. - The application may not include libstd++ because of code size (may cost huge amounts of money if application is updated through mobile phone) - Application must dynamically link with modules written using other compiler. - Application must interact with existing C libraries. - Preformance. std::string can not do anything that C/C++ can't do directly. Direct manipulation can do things that requires extra book-keeping (reference counting etc.) for a std::string solution. For most problems, there are a number of available solutions. Even if we go to the extreme and compare C with C++, most problems can be solved in a good way with or without objects or templates. The C implementation does not automatically need twice as much code or gets twice as many bugs. That is why - if people ask about a "C-type" problem - I don't say they have to use streams, strings etc. I mention that they are available, but at the same time discuss what to think about if the C functions are used. In this case, that scanf() shouldn't be used without specifying maximum sizes for the strings, that it doesn't allocate the strings (except in a gnu extension) and that fgets()/strchr()/strtok() are the other common C-library solution to the problem. People becomes better programmers if they learn multiple solutions to the same problem. /Per W On Thu, 19 Aug 2004, OROSZI Bal=E1zs wrote: > Per Westermark wrote: > > Of course I use the string type in my C++ applications, but I normally > > don't limit myself to _only_ the string type. > > That's the point. A year ago, when I only knew C, I didn't even want to h= ear about C++, > because I was satisfied with my knowledge of "pointer hacking". But I got= myself troubled > whenever I wanted to do string stuff: passing "strings" to functions, usi= ng malloc, > realloc, free, writing my own (rather awkward) string handler library too= k a lot of > productive time away from me. That's why I'm so against using strxxx, bec= ause I used them > extensively, and I only see how stupid I was, that I wasted so much time = on already > existant and well-written things. > > -- > Greetings, > Bal=E1zs > > > > ------------------------------------------------------- > SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media > 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 > Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift. > http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285 > _______________________________________________ > Dev-cpp-users mailing list > Dev...@li... > TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm > https://lists.sourceforge.net/lists/listinfo/dev-cpp-users > |
|
From: <or...@vp...> - 2004-08-20 01:50:38
|
Hi! Could you pass me your XML editor? I currently have need of a good XML ed= itor (only if=20 it's free of course). Using generic code-editors isn't the most comfortab= le for me. -- Greetings, Bal=E1zs Per Westermark wrote: > I have written compilers, XML editors and a number of other > string-manipulating things, but 99% of the time when I use C-strings, I > work with static buffers or make one-time assignments with strdup(). A = lot > of the manipulation doesn't even need any new buffers but may use direc= t > pointer substrings. The only realloc code I have are 3 or 4 small > functions, about 5 lines each, that I wrote about 15 years ago to inser= t > and remove text in a dynamically allocated buffer. Hardly any bother to > write. Hardly any bother to use. >=20 > For doing reg-exp it doesn't matter if I use my code, or if I use a > third-part library, such as the wxRegEx class from wxWidgets. >=20 > The point is, I don't spend any time fighting any strxx() functions, si= nce > they are not enemies. They are one of several useful (good) tools to us= e, > not something to ignore because god has created std::string. >=20 > There are a number of reasons to keep all options open. Some of them ar= e: > - C++ not available for a specific embedded environment. > - The application may not include libstd++ because of code size (may co= st > huge amounts of money if application is updated through mobile phone) > - Application must dynamically link with modules written using other > compiler. > - Application must interact with existing C libraries. > - Preformance. std::string can not do anything that C/C++ can't do > directly. Direct manipulation can do things that requires extra > book-keeping (reference counting etc.) for a std::string solution. >=20 > For most problems, there are a number of available solutions. Even if w= e > go to the extreme and compare C with C++, most problems can be solved i= n a > good way with or without objects or templates. The C implementation doe= s > not automatically need twice as much code or gets twice as many bugs. >=20 > That is why - if people ask about a "C-type" problem - I don't say they > have to use streams, strings etc. I mention that they are available, bu= t > at the same time discuss what to think about if the C functions are use= d. > In this case, that scanf() shouldn't be used without specifying maximum > sizes for the strings, that it doesn't allocate the strings (except in = a > gnu extension) and that fgets()/strchr()/strtok() are the other common > C-library solution to the problem. People becomes better programmers if > they learn multiple solutions to the same problem. >=20 > /Per W |
|
From: Per W. <pw...@ia...> - 2004-08-20 07:58:15
|
That is one of the disadvantages with being a software developer. A lot of the time, I have to solve a problem I have already solved before. However, I can't resuse the solution because it was made for another employer or customer. Alas, it's the same thing with the XML editor :( On the bright side, it is also a big reason why it is always important to do a thorough google before solving a problem. Can I use a 3rd-party library for it, then the solution isn't locked to a single customer, or at least only a few code lines gets branded as proprietary. /Per W On Fri, 20 Aug 2004, OROSZI Bal=E1zs wrote: > Hi! > > Could you pass me your XML editor? I currently have need of a good XML ed= itor (only if > it's free of course). Using generic code-editors isn't the most comfortab= le for me. > > -- > Greetings, > Bal=E1zs |
