blocks|key|1208540|text|直接使用scanf(3)及其变体会带来许多问题。通常，用户和非交互式用例是根据输入行来定义的。很少会出现这样的情况，如果没有找到足够的对象，更多的行就可以解决问题，但这是scanf的默认模式。(如果用户不知道在第一行输入数字，那么第二行和第三行可能不会有帮助。)|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1208541|至少如果你fgets(3)你知道你的程序需要多少输入行，你就不会有任何缓冲区溢出……|1208542|entityMap^0|4|8|0|5|8|0^^$0|@$1|2|3|4|5|6|7|J|8|@$9|K|A|L|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|M|8|@$9|N|A|O|B|C]]|D|@]|E|$]]|$1|H|3|-4|5|6|7|P|8|@]|D|@]|E|$]]]|I|$]]

Directly using <code>scanf(3)</code> and its variants poses a number of problems. Typically, users and non-interactive use cases are defined in terms of lines of input. It's rare to see a case where, if enough objects are not found, more lines will solve the problem, yet that's the default mode for scanf. (If a user didn't know to enter a number on the first line, a second and third line will probably not help.)

At least if you <code>fgets(3)</code> you know how many input lines your program will need, and you won't have any buffer overflows...

blocks|key|1423557|text|限制输入的长度肯定更容易。您可以通过使用循环接受任意长度的输入，一次读入一位，根据需要为字符串重新分配空间……|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1423558|但这是大量的工作，所以大多数C程序员只是在任意长度上砍掉输入。我想您已经知道了这一点，但是使用fgets()不会允许您接受任意数量的文本-您仍然需要设置一个限制。|1423559|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

Limiting the length of the input is definitely easier. You could accept an arbitrarily-long input by using a loop, reading in a bit at a time, re-allocating space for the string as necessary...

But that's a lot of work, so most C programmers just chop off the input at some arbitrary length. I suppose you know this already, but using fgets() isn't going to allow you to accept arbitrary amounts of text - you're still going to need to set a limit.

blocks|key|1208679|text|大多数情况下，fgets和sscanf的组合可以完成这项工作。另一件事是编写自己的解析器，如果输入格式良好的话。还要注意，您的第二个示例需要进行一些修改才能安全使用：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1208680|#define+LENGTH++++++++++42
#define+str(x)++++++++++#+x
#define+xstr(x)+++++++++str(x)

/*+...+*/+
int+nc+=+scanf("%25"xstr(LENGTH)"[%5E\n]%25*[%5E\n]",+array);+|code-block|syntax|javascript|1208681|上面的代码丢弃输入流，但不包括换行符(\n)。您需要添加一个getchar()来使用它。还要检查你是否到达了流的末尾：|1208682|if+(!feof(stdin))+{+...|1208683|仅此而已。|1208684|entityMap^0|7|5|D|6|0|0|J|2|U|9|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@$9|T|A|U|B|C]|$9|V|A|W|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|X|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|Y|8|@$9|Z|A|10|B|C]|$9|11|A|12|B|C]]|D|@]|E|$]]|$1|M|3|N|5|H|7|13|8|@]|D|@]|E|$I|J]]|$1|O|3|P|5|6|7|14|8|@]|D|@]|E|$]]|$1|Q|3|-4|5|6|7|15|8|@]|D|@]|E|$]]]|R|$]]

Most of the time a combination of <code>fgets</code> and <code>sscanf</code> does the job. The other thing would be to write your own parser, if the input is well formatted. Also note your second example needs a bit of modification to be used safely:

<pre><code>#define LENGTH 42
#define str(x) # x
#define xstr(x) str(x)

/* ... */ 
int nc = scanf("%"xstr(LENGTH)"[^\n]%*[^\n]", array); 
</code></pre>

The above discards the input stream upto but not including the newline (<code>\n</code>) character. You will need to add a <code>getchar()</code> to consume this. Also do check if you reached the end-of-stream: 

<pre><code>if (!feof(stdin)) { ...
</code></pre>

and that's about it.

blocks|key|1208766|text|创建一个为字符串分配所需内存的函数并不需要太多的工作。这是我前段时间写的一个小c函数，我总是用它来读入字符串。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1208767|它将返回读取的字符串，或者如果发生内存错误，则返回NULL。但请注意，您必须释放()字符串，并始终检查它的返回值。|1208768|#define+BUFFER+32

char+*readString()
{
++++char+*str+=+malloc(sizeof(char)+*+BUFFER),+*err;
++++int+pos;
++++for(pos+=+0;+str+!=+NULL+&&+(str[pos]+=+getchar())+!=+'\n';+pos%2B%2B)
++++{
++++++++if(pos+%25+BUFFER+==+BUFFER+-+1)
++++++++{
++++++++++++if((err+=+realloc(str,+sizeof(char)+*+(BUFFER+%2B+pos+%2B+1)))+==+NULL)
++++++++++++++++free(str);
++++++++++++str+=+err;
++++++++}
++++}
++++if(str+!=+NULL)
++++++++str[pos]+=+'\0';
++++return+str;
}|code-block|syntax|javascript|1208769|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|L|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|M|8|@]|9|@]|A|$G|H]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

It's not that much work to make a function that's allocating the needed memory for your string.
That's a little c-function i wrote some time ago, i always use it to read in strings.

It will return the read string or if a memory error occurs NULL.
But be aware that you have to free() your string and always check for it's return value.

<pre><code>#define BUFFER 32

char *readString()
{
 char *str = malloc(sizeof(char) * BUFFER), *err;
 int pos;
 for(pos = 0; str != NULL &amp;&amp; (str[pos] = getchar()) != '\n'; pos++)
 {
 if(pos % BUFFER == BUFFER - 1)
 {
 if((err = realloc(str, sizeof(char) * (BUFFER + pos + 1))) == NULL)
 free(str);
 str = err;
 }
 }
 if(str != NULL)
 str[pos] = '\0';
 return str;
}
</code></pre>

I use this code:

<pre><code>while ( scanf("%s", buf) == 1 ){
</code></pre>

What would be the best way to prevent possible buffer overflow so that it can be passed strings of random lengths? 

I know I can limit the input string by calling for example:

<pre><code>while ( scanf("%20s", buf) == 1 ){
</code></pre>

But I'd prefer to be able to process whatever the user inputs.
Or can't this be done safely using scanf and I should use fgets?

How to prevent scanf causing a buffer overflow in C?

我使用以下代码：while ( scanf("%s", buf) == 1 ){防止缓冲区溢出的最好方法是什么，这样它就可以传递随机长度的字符串？我知道我可以通过调用以下示例来限制输入字符串：while ( scanf("%20s", buf) == 1 ){但我更希望能够处理用户输入的任何内容。或者，不能使用scan...

问如何防止scanf在C中引起缓冲区溢出？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何防止scanf在C中引起缓冲区溢出？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何防止scanf在C中引起缓冲区溢出？
EN