这有什么错STRCMP？ [英] What's wrong with strcmp?

问题描述

在回答这个问题阅读在一个字符串和比较它ç，
不止一个人劝阻使用的strcmp（），说这样

  

我也强烈，强烈建议您习惯使用STRNCMP（）
  现在，...避免很多问题的道路。

或（在<一href=\"http://stackoverflow.com/questions/4069925/using-if-statement-to-compare-strings/4070043#4070043\">Using if语句比较字符串）

  

请确定你使用STRNCMP而不是strcmp的。 STRCMP是深刻
  不安全的。

什么问题，他们暗指？

原因 scanf（）的用绳子符和 获得（），强烈建议不要
是因为他们几乎不可避免地导致缓冲区溢出漏洞。
但是，这是不可能的溢出与 STRCMP缓冲（），对吧？

缓冲区溢出或缓冲区溢出，是一种反常现象，其中一个计划，而将数据写入缓冲区溢出缓冲区的边界并覆盖相邻的记忆。
（ - 百科：缓冲区溢出）。
由于STRCMP（）函数永远不会写入任何缓冲区，STRCMP（）函数不能导致缓冲区溢出，对吧？

什么是人之所以不鼓励使用的strcmp（），并推荐 STRNCMP（）而不是<？ / p>

解决方案

在 STRNCMP 可以prevent你超越一个缓冲区，其主要目的不是为的安全的。相反，它的存在对其中一个想要只比较的第一N个字符的情况下的（正确可能NUL结束）字符串

从手册页：

  

的的strcmp（）函数的两个字符串比较 S1 和 S2 。它返回一个小于整数，等于或大于零，如果 S1 被发现，分别是小于，匹配，或比<$ C $更大C> S2 。

  
  

的 STRNCMP（）功能类似，只是它比较只有第一个（最多） N 字节 S1 和 S2 。

注意 STRNCMP 在这种情况下，不能被替换成一个简单的 memcmp ，因为你仍然需要充分利用其停止上NUL的行为，如果其中一个字符串短于 N 。

如果 STRCMP 导致缓冲区溢出，那么两件事情之一是真实的：

预计不会
1. 您的数据要NUL结束，并且你应该使用 memcmp 代替。


2. 您的数据的是的预期为NULL结尾的，但你已经搞砸了，当你填入缓冲区，通过某种方式不是NUL终止它。

---

注意阅读的过去缓冲区末尾仍然被认为是一个缓冲区溢出。虽然它可能的看起来的无害的，它可以是一样危险的写的过去的结束。

读，写，执行......没关系。任何内存引用到一个意想不到的地址是不确定的行为。在最明显的情况下，您试图访问未映射到进程的地址空间的页面，导致页面错误，和随后的SIGSEGV。在最坏的情况下，你有时会碰到一个\\ 0字节，但其他时候，你会碰到一些其他的缓冲，从而导致变化无常的程序的行为。

In the responses to the question Reading In A String and comparing it C , more than one person discouraged the use of strcmp(), saying things like

I also strongly, strongly advise you to get used to using strncmp() now, ... to avoid many problems down the road.

or (in Using if statement to compare strings )

Make certain you use strncmp and not strcmp. strcmp is profoundly unsafe.

What problems are they alluding to?

The reason scanf() with string specifiers and gets() are strongly discouraged is because they almost inevitably lead to buffer overflow vulnerabilities. However, it's not possible to overflow a buffer with strcmp(), right?

"A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory." ( -- Wikipedia: buffer overflow ). Since the strcmp() function never writes to any buffer, the strcmp() function cannot cause a buffer overflow, right?

What is the reason people discourage the use of strcmp(), and recommend strncmp() instead?

解决方案

While strncmp can prevent you from overrunning a buffer, its primary purpose isn't for safety. Rather, it exists for the case where one wants to compare only the first N characters of a (properly possibly NUL-terminated) string.

From the man page:

The strcmp() function compares the two strings s1 and s2. It returns an integer less than, equal to, or greater than zero if s1 is found, respectively, to be less than, to match, or be greater than s2.

The strncmp() function is similar, except it compares the only first (at most) n bytes of s1 and s2.

Note that strncmp in this case cannot be replaced with a simple memcmp, because you still need to take advantage of its stop-on-NUL behavior, in case one of the strings is shorter than n.

If strcmp causes a buffer overrun, then one of two things is true:

1. Your data isn't expected to be NUL-terminated, and you should be using memcmp instead.
2. Your data is expected to be NUL-terminated, but you've already screwed up when you populated the buffer, by somehow not NUL-terminating it.

---

Note that reading past the end of a buffer is still considered a buffer overrun. While it may seem harmless, it can be just as dangerous as writing past the end.

Reading, writing, executing... it doesn't matter. Any memory reference to an unintended address is undefined behavior. In the most apparent scenario, you attempt to access a page that isn't mapped into your process's address space, causing a page fault, and subsequent SIGSEGV. In the worst case, you sometimes run into a \0 byte, but other times you run into some other buffer, causing inconstant program behavior.

这篇关于这有什么错STRCMP？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！