tstream 可以防止缓冲区溢出吗？
TStream 是一个抽象类。
然而，关于它的实现，它们能证明缓冲区溢出吗？
如果我从互联网上的非我来源获取流，我如何验证它没有损坏并导致缓冲区溢出？
假设流是一个 xml 文件。
编辑： 所有答案都表明您需要检查缓冲区溢出。 您能否演示如何检查输入文件上的缓冲区溢出，其中我们知道流的定义可能是无限的？
TStream is an abstract class.
However about its implementations, are they buffer overflow proof?
If I'm fetching a stream from the internet, from a source that is not me, how do I verify that it is not corrupted and cause buffer overflow?
Lets say that the stream is an xml file.
edit:
all the answers indicate you need to check for buffer overflow.
could you demonstrate how to check a buffer overflow on an input file, where we know that a stream could be infinite by its definition?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
据我所知，TStream 及其各种 RTL 后代不存在任何导致缓冲区溢出的错误。
然而，使用 Delphi 流的代码很容易超出缓冲区。
TStreamand its various RTL descendents do not have any bugs that result in buffer overruns, to the best of my knowledge.However, your code using Delphi streams could easily overrun a buffer.
TStream读入调用者提供的任何缓冲区。调用者有责任确保提供的缓冲区及其大小有效。TStreamreads into whatever buffer the caller supplies. It is the caller's responsibility to make sure the supplied buffer and its size are valid.通常，您应该在填充之前根据所显示流的
Size属性来设置自己的缓冲区的大小。Size属性未提供实际大小的唯一原因是Seek方法的实现错误。除非该方法根据奇怪的边界假设确定流的大小，否则单个测试应该排除任何问题。无论如何，无论流是否包含损坏的数据，只要您下载的数据不超过自己缓冲区的大小，就永远不会遇到缓冲区溢出问题。
您还可以请求所呈现的流的类型并验证它是否是标准的 Delphi 流。如果是这样，那么您不必担心。
Normally, you should depend on the
Sizeproperty of the presented stream to set the size of your own buffer before filling it. The only reason for thatSizeproperty not delivering the real size would be a wrong implementation of eitherSeekmethods. Unless that method determines the size of the stream on weird boundary assumptions, a single test should rule out any problems.In any case, whether the stream contains corrupted data or not, it should néver run into a buffer overflow on your side if you just not download more than the size of your own buffer.
You could also request the type of the presented stream and verify if it is a standard Delphi stream. If so, then you need not be worried.
不，TStream 后代不是“防溢出”的。但如果您遵循 Remy 和 NGLN 的建议，您将使用 Delphi 流编写尽可能安全的代码。
如果您担心某些恶意内容，请在 try/ except 和/或 try/finally 阻止中处理它并清除任何潜在的损害。
正确使用“try”是 Delphi 编程安全的关键——没有灵丹妙药。这就是当您使用编译语言时所付出的代价，而不是让您“接近金属”。
No, TStream descendants are not 'overflow proof'. But if you follow the advice of Remy and NGLN, you will write code that is as safe as possible with Delphi streams.
If you are afraid of something malicious, handle it within a try/except and/or try/finally block and clean up any potential damage.
Correct usage of 'try' is the key to SAFE Delphi programming - there are no silver bullets. That is the price you pay when you use a compiled language than allows you to get 'close to the metal'.