Secure CRT string functions

Question

4.00/5 (1 vote)

See more:

VS2010

I've just converted our VS6 MFC project to VS2010 and keep getting:

warning C4996: 'fscanf': This function or variable may be unsafe.

et cetera.

However, when I try to define _CRT_SECURE_CPP_OVERLOAD_STANDARD_NAMES it either doesn't do anything, or tells me it is already defined (in crtdefs.h).

I don't really want to have to defin it all over the place so is my StdAfx.h the correct (and best) place for these definitions?

Posted 14-Jun-11 14:42pm

Kyudos

Add a Solution

2 solutions

Solution 1

This may answer your question...
http://msdn.microsoft.com/en-us/library/ms175759%28v=VS.100%29.aspx[^]

Posted 14-Jun-11 15:02pm

Albert Holguin

Comments

Sergey Alexandrovich Kryukov 14-Jun-11 21:52pm

My 5.
--SA

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

TRK3 · Accepted Answer · 2011-06-14T15:07:00

Solution 2

See: http://msdn.microsoft.com/en-us/library/6ybhk9kc.aspx[^]

"The main difference between the secure functions (with the _s suffix) and the older functions is that the secure functions require the size in characters of each c, C, s, S and [ type field to be passed as an argument immediately following the variable."

There is no way the preprocessor can automatically substitute the secure version fscanf_s for fscanf because the secure version requires different parameters.

You'll have to either fix the fscanf calls yourself or decide to ignore those warnings.

As for where to define _CRT_SECURE_CPP_OVERLOAD_STANDARD_NAMES, I would either do it on the compiler command line, or in StdAfx.h at the top.

Posted 14-Jun-11 15:07pm

TRK3

Comments

Kyudos 14-Jun-11 21:17pm

Is defining the overload macro supposed to suppress the warnings? Or do I need to define _CRT_SECURE_NO_WARNINGS too?

Sergey Alexandrovich Kryukov 14-Jun-11 21:50pm

Don't suppress it, fix the function calls!
--SA

Kyudos 14-Jun-11 22:45pm

Isn't that the point of defining _CRT_SECURE_CPP_OVERLOAD_STANDARD_NAMES? So I don't have to fix all the functions calls?

TRK3 15-Jun-11 13:37pm

Defining it will override the function calls that it can. It doesn't suppress the warning. The warning goes away if the function gets overridden with a secure version. Unfortunately not all of the functions can be automatically overridden. Those ones you have to fix.

Generally it's a bad idea to globally suppress the warnings. But you could probably ignore the CRT warning on your initial port -- turn them off so you aren't overwhelmed with them. Fix the other warnings, then turn them on and fix the CRT warnings.

Of course sometimes there really is no security issue (such as fopen vs fopen_s when you are already checking for NULL and aren't multi-threaded or don't care about the error code) -- in those cases you can suppress individual warnings with a #pragma. But that means examining each case (which you should do) and it's usually easier just to fix the function calls then it is to prove your implementation is secure and add the #pragma.

Sergey Alexandrovich Kryukov 14-Jun-11 21:51pm

My 5.
--SA