c - scanf 字段宽度字符串溢出

Question

关于缓冲区溢出，以下哪一项是安全的？

char buf[10] = {0};
scanf("%10s", buf);

或

char buf[10] = {0};
scanf("%9s", buf);

从我读到的内容来看，我打算选择第二个(sizeof 减一)，但问题非常微妙，我已经看到代码建议两者之一。有志愿引用标准的吗？

Answer 1

C standard指出:

An input item shall be defined as the longest sequence of input bytes (up to any specified maximum field width, which may be measured in characters or bytes dependent on the conversion specifier) which is an initial subsequence of a matching sequence.

即最大字段宽度表示输入中可以有多少个字符。末尾的额外零值不是输入的一部分，需要额外的空间。

GNU libc manual明确这一点:

String input conversions store a null character to mark the end of the input; the maximum field width does not include this terminator.

因此，唯一安全的版本是 scanf("%9s", buf)。