C 标准库的更安全替代品
C 标准库在 I/O 安全方面是出了名的差劲。 许多函数都会发生缓冲区溢出（gets、scanf），或者如果没有给出正确的参数（scanf），可能会破坏内存，等等。 每隔一段时间，我就会遇到一位有进取心的黑客，他编写了自己的库，但没有这些缺陷。
您见过的这些库中最好的是什么？ 您是否在生产代码中使用过它们？如果使用过，这不仅仅是业余爱好项目？
The C standard library is notoriously poor when it comes to I/O safety. Many functions have buffer overflows (gets, scanf), or can clobber memory if not given proper arguments (scanf), and so on. Every once in a while, I come across an enterprising hacker who has written his own library that lacks these flaws.
What are the best of these libraries you have seen? Have you used them in production code, and if so, which held up as more than hobby projects?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
我使用GLib库，它有许多好的标准和非标准函数。
请参阅 https://developer.gnome.org/glib/stable/
，也许你会失败恋爱中... :)
例如：
https://developer.gnome.org/glib/stable/glib-String-Utility-Functions.html#g-strdup-printf
解释了 g_strdup_printf 是：
I use GLib library, it has many good standard and non standard functions.
See https://developer.gnome.org/glib/stable/
and maybe you fall in love... :)
For example:
https://developer.gnome.org/glib/stable/glib-String-Utility-Functions.html#g-strdup-printf
explains that g_strdup_printf is:
这并没有真正回答您关于最安全的库使用的问题，但是您提到的大多数容易受到缓冲区溢出影响的函数都有更安全的版本，这些版本将缓冲区长度作为参数来防止安全漏洞使用标准方法时打开的。
除非您放宽了警告级别，否则当您使用已弃用的方法时，通常会收到编译器警告，建议您改用更安全的方法。
This isn't really answering your question about the safest libraries to use, but most functions that are vulnerable to buffer overflows that you mentioned have safer versions which take the buffer length as an argument to prevent the security holes that are opened up when the standard methods are used.
Unless you have relaxed the level of warnings, you will usually get compiler warnings when you use the deprecated methods, suggesting you use the safer methods instead.
我相信 Apache Portable Runtime (apr) 库比标准 C 库更安全。 我将它用作 apache 模块的一部分，但也用于独立进程。
I believe the Apache Portable Runtime (apr) library is safer than the standard C library. I use it, well, as part of an apache module, but also for independent processes.
对于 Windows，有一个“安全”C/C++ 库。
For Windows there is a 'safe' C/C++ library.
您始终可以自由地实现并使用您喜欢的任何库 - 困难的部分是确保它在您需要软件运行的平台上可用。 您还可以在适当的情况下使用标准函数的包装器。
这是否真的是一个好主意还存在争议，但 C 标准委员会发布了 TR24731 - 用于更安全的 C 函数集。 里面肯定有好东西。 请参阅此问题：您是否使用TR 24731 C 代码中的安全函数？，其中包含技术报告的链接。
You're always at liberty to implement any library you like and to use it - the hard part is making sure it is available on the platforms you need your software to work on. You can also use wrappers around the standard functions where appropriate.
Whether it is really a good idea is somewhat debatable, but there is TR24731 published by the C standard committee - for a safer set of C functions. There's definitely some good stuff in there. See this question: Do you use the TR 24731 Safe Functions in your C code?, which includes links to the technical report.
也许要问的第一个问题是您是否真的需要纯 C 语言？ （也许像 .net 或 java 这样的语言是一种选择 - 那么缓冲区溢出就不再是真正的问题了）
另一种选择是如果无法选择其他高级语言，则可以用 C++ 编写项目的部分内容。 如果您确实需要 C，那么您可以拥有一个封装 C++ 代码的 C 接口。
因为如果您添加 C++ 标准库内置的所有高级函数 - 您的 C 代码大多数时候只会稍微快一点（并且包含更多内容）比现有的和经过测试的框架存在错误）。
Maybe the first question to ask is if your really need plain C? (maybe a language like .net or java is an option - then e.g. buffer overflows are not really a problem anymore)
Another option is maybe to write parts of your project in C++ if other higher level languages are not an option. You can then have a C interface which encapsulates the C++ code if you really need C.
Because if you add all the advanced functions the C++ standard library has build in - your C code would only be marginally faster most times (and contain a lot more bugs than an existing and tested framework).