Thread: Memory leak by simple char

Originally Posted by Daved

This is another reason why the C++ string class is preferred. You don't have to worry about overstepping the bounds of the array. It will expand automatically as necessary. Also, it is much more intuitive to most programmers to use operators like = and += instead of functions like strcpy and strcat.

This was why I recommended std::string.

A buffer overrun error (writing beyond the end of an array) is one of the worst bugs you can have; it's far more serious than a memory leak from a security point of view. A buffer overrun error with user-submitted data is a powerful method for a malware programmer to execute arbitrary code.

A buffer overrun is always worse than a memory leak (when all things equal). The latter means that in time your application will fail to allocate. a bad_alloc exception will be thrown and your program will most probably crash in an anti-climatic way.

But a buffer overrun is a different kind of animal. It means that your array accessed memory that doesn't belong to it. A fairly decent programmer (probably not even that considering there are websites that teach you how to do this) that detected a buffer overrun, can force it to happen and use the memory where it is going to happen to run any code they like. Effectively using your application to gain access to the system where it is running.

Well you included more code in your application. The code that handles strings.

You shouldn't worry about that. Wait untill you need to include vector... and iostreams!... and static boost libraries... and... don't worry with your executable size. It grew that much, but it won't grow any bigger no matter where you use std::string from here on.

An LPSTR is a typedef. It is simply a windows API specific name for char*.

I wouldn't say crap. There a fair good use for char*. But yes, it is not some new form of string handling.

I am curious though? After seeing std::string you are still looking for alternatives? You can't beat std::string... take a look here, if you are having problems understanding how to use them:

http://www.cprogramming.com/tutorial/string.html

any specific need for char arrays is quiet easily fulfilled with the c_str() member function. If you have a function needing a char array:

void somefunction(char* buffer);
or
void somefunction(char[] buffer);

The following will do it.

Code:

std::string foo = "pass me as c-style string";

/*... do here all the nifty things C++ Strings allow you to do ...*/

somefunction(foo.c_str());

Originally Posted by Ktulu

It's because it gives me a lot of more work and I will need to create more variables and I still need to use CHAR buffers for some windows functions.
Oh and, can LPSTR's give buffer overrun errors, like the same as CHAR.

LPSTR is really just another name for CHAR[], so they behave the same way, with all the same problems.

BTW this URL is a security report of a buffer overrun in some versions of Flash that could in theory spread a virus to your PC simply by viewing a website with a specially-designed flash video. The malware programmer would need to specially modify the flash file so that when your browser tried to read the size of the flash file, it caused a buffer overrun which would write virus code inside the your browser's memory and then execute it.

In fact fixing buffer overruns are a very common reason for many of the critical security updates you get from Windows Update.