C / C++ / MFC

Stephen Hewitt2-May-06 21:53

2-May-06 21:53

I would suggest you don't use the sprintf family of functions. It has just so many problems it's not funny. Here's some of them:
- It's not type safe.
- It's not extensible.
- It's plain not safe. How big do you make the buffer? Make it too small and you're in for a buffer overrun, which is no fun.

I'd use code like the following:

ostringstream ss;
ss << "The number is " << 42;
cout << ss.str() << endl;

This code assumes the following includes:
<iostream>
<string>
<sstream>

And this:
using namespace std;

With this code none of the listed problems occur.

Steve

Cedric Moonen2-May-06 21:58

Cedric Moonen

2-May-06 21:58

Stephen Hewitt wrote:
ss << "The number is " << 42;

Now you'll have to find the universal question Poke tongue | ;-P

George_George2-May-06 23:20

2-May-06 23:20

Hi Cedric,

What do you mean univeral question?

regards,
George

Stephen Hewitt2-May-06 23:25

2-May-06 23:25

No one knows. I have it on good authority that the answer is 42 however.

Steve

George_George3-May-06 2:24

3-May-06 2:24

What do you mean 42?

regards,
George

Cedric Moonen2-May-06 23:27

Cedric Moonen

2-May-06 23:27

No, it is just a popular joke. Did you see the movie "The Hitchhiker's Guide to the Galaxy" ?
42 is the answer to the universal question. But it isn't funny at all if you didn't see the movie Wink | ;)

George_George3-May-06 2:27

3-May-06 2:27

I see. I have not seen the movie before. I have a lot of souce codes to read. Could you come back to this question and show me an example of mixed unicode type (wchar_t* and _T) and non-unicode type (char*), just as I mentioned at the beginning of this thread, like,

_stprintf (wchar_t*, _T("%S"), char*);

I just can not imagine that we can mix unicode type and non-unicode type in one statement.

regards,
George

George_George2-May-06 22:05

2-May-06 22:05

Thank you Steve!

What means "plain not safe"?

Actually, I like your style. But I am reading and learning programs written by others. So, could you come back to the sample I wrote above to comment whether it is correct to use char* (non-unicode type) as the 3rd parameter of _stprintf? Thank a lot! Smile | :)

regards,
George

Stephen Hewitt2-May-06 22:09

2-May-06 22:09

George_George wrote:
What means "plain not safe"?

This is what I had in mind:

// Bad code!!!
char buffer[1];
sprintf(buffer, "The number is %d", 42);

This code will result in a buffer overrun which at best will crash the program and at worst will open up a security flaw will can be exploited.

Steve

George_George2-May-06 22:18

2-May-06 22:18

Thank you Steve!

Maybe I have not made myself understood. My question is not whether the buffer (as the 1st parameter) is large enough (suppose it is large enough in this case, I agree with you about the setbacks of this method), my question is that whether I can input char* (non-unicode type) as the 3rd parameter, while the 1st parameter is wchar_t* type and the 2nd parameter is L (constant string) type.

regards,
George

Stephen Hewitt2-May-06 23:23

2-May-06 23:23

Yes. Use %S instead of %s.

Steve

George_George3-May-06 2:23

3-May-06 2:23

Thanks Stephen,

I have found that %S is used to specify a wide-character string. Could you show me an example of mixed using of unicode type and non-unicode type, in the following format -- without any errors to print out anything?

I just can not imagine why we can mix the use of unicode type (w_char* and _T) and non-unicode type (char*).

_stprintf (wchar_t*, _T"%s", char*)

regards,
George

Michael Dunn2-May-06 22:54

Michael Dunn

2-May-06 22:54

You can pass anything at all in the ... part of the parameter list.

--Mike--
Visual C++ MVP Cool | :cool:

LINKS~! Ericahist | PimpFish | CP SearchBar v3.0 | C++ Forum FAQ

George_George2-May-06 23:19

2-May-06 23:19

Thanks Michael!

Suppose that UNICODE macro is define and we can pass char* type parameter to _stprintf? I can not imagine that -- I think it is not safe. Could you show me an example please to show it works to pass char*?

regards,
George

Michael Dunn2-May-06 23:27

Michael Dunn

2-May-06 23:27

Now that I looked more closely at your question Blush | :O

I see where the confusion is coming from. %s means a string of TCHARs, so that will change between ANSI and Unicode builds. The ... in a parameter list means "any number of parameters of any type" - it's totally unrelated to the character set you're building with, but the format string does have to take character sets into account:

TCHAR sz[100];
_stprintf(sz, _T("Hello %hs"), "Bob");

Note that I used %hs to mean an ANSI string.

--Mike--
Visual C++ MVP Cool | :cool:

LINKS~! Ericahist | PimpFish | CP SearchBar v3.0 | C++ Forum FAQ

George_George3-May-06 2:37

3-May-06 2:37

Thank you Mike!

If UNICODE is defined, then in your above example, TCHAR will be wchar_t, _T will be defined as L and "Bob" will still be char* type (non-unicode type). Is that correct?

I am not sure whether your above example will still work if UNICODE is defined since you print a non-unicode type (char*) to a unicode type _T. If your example works, could you show me please?

regards,
George

Michael Dunn3-May-06 7:28

Michael Dunn

3-May-06 7:28

Compile it and step through the sprintf code, you'll see. Smile | :)

--Mike--
Visual C++ MVP Cool | :cool:

LINKS~! Ericahist | PimpFish | CP SearchBar v3.0 | C++ Forum FAQ

George_George3-May-06 20:09