Problem - Kevin Tafuro

All of the string-handling improvements we’ve discussed so far operate using traditional
C-style NULL-terminated strings. While strlcat( ), strlcpy( ), and Microsoft’s
new string-handling functions are vast improvements over the traditional C stringhandling
functions, they all still require diligence on the part of the programmer to
maintain information regarding the allocated size of destination buffers.
An alternative to using traditional C style strings is to use the SafeStr library, which is
available from http://www.zork.org/safestr/. The library is a safe string implementation
that provides a new, high-level data type for strings, tracks accounting information
for strings, and performs many other operations. For interoperability purposes,
SafeStr strings can be passed to C string functions, as long as those functions use the
string in a read-only manner. (We discuss SafeStr in some detail in Recipe 3.4.)
Finally, applications that transfer strings across a network should consider including
a string’s length along with the string itself, rather than requiring the recipient to rely
on finding the NULL-terminating character to determine the length of the string. If the
length of the string is known up front, the recipient can allocate a buffer of the proper
size up front and read the appropriate amount of data into it. The alternative is to
read byte-by-byte, looking for the NULL-terminator, and possibly repeatedly resizing
the buffer. Dan J. Bernstein has defined a convention called Netstrings (http://cr.yp.to/
proto/netstrings.txt) for encoding the length of a string with the strings. This protocol
simply has you send the length of the string represented in ASCII, then a colon, then
the string itself, then a trailing comma. For example, if you were to send the string
“Hello, World!” over a network, you would send:
14:Hello, World!,
Note that the Netstrings representation does not include the NULL-terminator, as that
is really part of the machine-specific representation of a string, and is not necessary
on the network.
Using C++
When using C++, you generally have a lot less to worry about when using the standard
C++ string library, std::string. This library is designed in such a way that
buffer overflows are less likely. Standard I/O using the stream operators (>> and