Re: [Dev-C++] Re: newbie string parsing question

[Per W. <pw...@ia...>]

Is getting a buffer overflow better, you ask.

You see, I don't have any problem with buffer overflow and I don't worry
about having counted the terminating zero. Last time I had a problem with
zero termination was when using a broken strncmp() function written by
InterNiche Technologies and used in an embedded project. When you have
used the functions and know what they do you don't worry about it, just
as you don't worry about NULL pointers or division-by-zero. All of them
are easy to avoid.

If we should talk about limitations in the strxx() functions it is
substring and regexp manipulation or internationalization. Since substring
manipulation normally requires string copying I can understand why the c
library didn't supply so much support. Anyway, where I have found
weeknesses in the standard library, I have added my own functions, so I
don't think much about that either.

Just doing
  cin >> name
assumes that the input file is nice. You don't get buffer overflow in the
string but you can still get memory overflow, i.e. failed memory
allocation - or a very slow and swapping machine. If an attacker may
supply his own file he can do a DOS-attack on the machine.

Of course I use the string type in my C++ applications, but I normally
don't limit myself to _only_ the string type. The power of the pointer
types in C/C++ is one of the reasons why C/C++ have been such large
languages.

/Per W

On Thu, 19 Aug 2004, OROSZI Bal=E1zs wrote:

> Per Westermark wrote:
> > Using C for string manipulation isn't dangerous unless you don't know w=
hat
> > to do. Same thing with using a hammer. Don't forget that the majority o=
f
> > all operating systems in existence uses C with great success.
> >
> > file >> first_name
> >
> > still gives you the possibility of loading a multi-megabyte text string=
,
> > possibly exhausting the available memory.
>
> Is getting a buffer overflow better?
>
> IMO C string manipulation is very awkward, and hard to use. You always ha=
ve to worry about
> things like:
> "Now have I counted that \0 terminating character or not?"
> and others.
>
> Why bother with low-level, error prone functions, when C++ introduced the=
 string class to
> address these problems?
>
> --
> Greetings,
>    Bal=E1zs
>
>
> -------------------------------------------------------
> SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
> 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
> Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
> http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
> _______________________________________________
> Dev-cpp-users mailing list
> Dev...@li...
> TO UNSUBSCRIBE: http://www23.brinkster.com/noicys/devcpp/ub.htm
> https://lists.sourceforge.net/lists/listinfo/dev-cpp-users
>