Crash C++ application using sprintf_s without specifying string length

Question

I have a c++ application, in which customer reported a crash.But the crash is not easily reproducible. After analysing some logs and all i found that the crash may occure in between the following code portions. Please tell me there is any chance of getting crashed the application if i have these code statements in it?

    //Tesrt
    std::string strAppName = "App1\0";
    int nSize = 10;
    sprintf_s(szBuff, "The appname %s have %d dependancies ", strAppName.c_str(), nSize);
    //Then use the szBuff to log to a text file
    //Test end

The null character in the literal assigned to strAppName is redundant. — Niklas B.
– Niklas B., Commented Jun 29, 2012 at 11:27
@nhahtdh: I think you are confusing sprintf_s with sprintf. Also, assuming an int to be 32-bit is not very portable. — Niklas B.
– Niklas B., Commented Jun 29, 2012 at 11:27
@NiklasB.: OK. I got the point, since this is the safe version from Windows. About int, I'm not sure if there is any implementation with 64-bit, though (according to Wikipedia). — nhahtdh
– nhahtdh, Commented Jun 29, 2012 at 11:35
sprintf_s either takes a char array by reference OR a pointer to char and a size parameter. — Lara Bailey
– Lara Bailey, Commented Jun 29, 2012 at 11:39

Niklas B. · Accepted Answer · 2012-06-29 11:32:21Z

2

The problem is that you've not provided the correct arguments to sprintf_s:

int sprintf_s(
   char *buffer,
   size_t sizeOfBuffer,
   const char *format [,
      argument] ... 
);

sprintf_s takes a size_t as it's second argument (the size of szBuff), but you've not provided that. Instead, you've given it a const char * where that parameter should be. The only way to have compiled this is for you to have ignored compiler warnings.

So what sprintf_s is seeing is: buffer to print into large number of characters allowed to go into buffer strAppName.c_str() as the format string

In other words, this isn't doing anything like what you want. Provide the size of szBuff as the second parameter, and I'll bet your problems go away.

And yes, given what you've done I'd expect crashes all over the place.

edited Jun 29, 2012 at 11:32

Niklas B.

95.8k18 gold badges201 silver badges228 bronze badges

answered Jun 29, 2012 at 11:22

Michael Kohne

12.1k3 gold badges52 silver badges85 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Minnu Over a year ago

szBuff is declared as follows char szBuff[1024];

Lara Bailey Over a year ago

Unless szBuff really is an array and he is using the template version. (Aside: how someone can develop a template overload where the parameters shift around in such a dangerous way and still use _s as a suffix, I don't know.)

Niklas B. Over a year ago

@Charles: Wow, didn't even see that. Really bad design. Sorry, Minnu, maybe I was wrong there.

Minnu Over a year ago

Ok, but i have another code portion as follows "sprintf_s(szBuff, "Handle %d has %d items ",nSize,nItemSize) ie, with fixed integer arguments ..is it become problem?

Collectives™ on Stack Overflow

Crash C++ application using sprintf_s without specifying string length

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related