【C++】C4996「This function or variable may be unsafe」とは？｜_CRT_SECURE_NO_WARNINGSを書く位置の罠と、警告を消す前に知りたい実測結果

▼c1_warn.cpp
#include <cstdio>
#include <cstring>

int main()
{
    FILE* fp = fopen("test.txt", "w");   // 警告の対象①
    char buf[16];
    strcpy(buf, "hello");                // 警告の対象②
    sprintf(buf, "%d", 123);             // 警告の対象③
    if (fp)
    {
        fputs(buf, fp);
        fclose(fp);
    }
    std::printf("書き込み完了: %s\n", buf);
    return 0;
}

c1_warn.cpp
c1_warn.cpp(6): warning C4996: 'fopen': This function or variable may be unsafe. Consider using fopen_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.
c1_warn.cpp(8): warning C4996: 'strcpy': This function or variable may be unsafe. Consider using strcpy_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.
c1_warn.cpp(9): warning C4996: 'sprintf': This function or variable may be unsafe. Consider using sprintf_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.

書き込み完了: 123

c1_warn.cpp
c1_warn.cpp(6): error C4996: 'fopen': This function or variable may be unsafe. Consider using fopen_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.
c1_warn.cpp(8): error C4996: 'strcpy': This function or variable may be unsafe. Consider using strcpy_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.
c1_warn.cpp(9): error C4996: 'sprintf': This function or variable may be unsafe. Consider using sprintf_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.

▼c2_define_before.cpp(先頭で定義)
#define _CRT_SECURE_NO_WARNINGS   // 必ず、最初のincludeより前に書く
#include <cstdio>
#include <cstring>

int main()
{
    FILE* fp = fopen("test.txt", "w");
    char buf[16];
    strcpy(buf, "hello");
    sprintf(buf, "%d", 123);
    if (fp)
    {
        fputs(buf, fp);
        fclose(fp);
    }
    std::printf("書き込み完了: %s\n", buf);
    return 0;
}

c2_define_before.cpp

▼c3_define_after.cpp(#includeのあとで定義)
#include <cstdio>
#include <cstring>
#define _CRT_SECURE_NO_WARNINGS   // includeより「後」に書いた(効かない)

int main()
{
    FILE* fp = fopen("test.txt", "w");
    char buf[16];
    strcpy(buf, "hello");
    sprintf(buf, "%d", 123);
    if (fp)
    {
        fputs(buf, fp);
        fclose(fp);
    }
    std::printf("書き込み完了: %s\n", buf);
    return 0;
}

c3_define_after.cpp
c3_define_after.cpp(7): warning C4996: 'fopen': This function or variable may be unsafe. Consider using fopen_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.
c3_define_after.cpp(9): warning C4996: 'strcpy': This function or variable may be unsafe. Consider using strcpy_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.
c3_define_after.cpp(10): warning C4996: 'sprintf': This function or variable may be unsafe. Consider using sprintf_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.

cl /W3 /D_CRT_SECURE_NO_WARNINGS c1_warn.cpp

c1_warn.cpp

▼c6_overflow_cpy.cpp(8バイトの箱に、44バイトをコピー)
#include <cstdio>
#include <cstring>

int main()
{
    char buf[8];
    std::printf("コピー前\n");
    std::fflush(stdout);
    strcpy(buf, "this string is much longer than eight bytes");   // 8バイトに入らない
    std::printf("コピー後: %s\n", buf);
    std::fflush(stdout);
    return 0;
}

c6_overflow_cpy.cpp
C:\blogtest\c4996\c6_overflow_cpy.cpp(9) : warning C4789: 関数 'main' で バッファー 'buf' (サイズが 8 バイト) はオーバーランされます; 44 バイトがオフセット 0 から書き込まれます

終了コード: 0xC0000409
--- 標準出力 ---
コピー前
コピー後: this string is much longer than eight bytes

▼c7_overflow_cpy_s.cpp
#include <cstdio>
#include <cstring>

int main()
{
    char buf[8];
    std::printf("コピー前\n");
    std::fflush(stdout);
    strcpy_s(buf, sizeof(buf), "this string is much longer than eight bytes");   // 8バイトに入らない
    std::printf("コピー後: %s\n", buf);
    std::fflush(stdout);
    return 0;
}

終了コード: 0xC0000409
--- 標準出力 ---
コピー前

Debug Assertion Failed!
Program: C:\blogtest\c4996\ov_strcpys_dbg.exe
File: minkernel\crts\ucrt\inc\corecrt_internal_string_templates.h
Line: 81
Expression: (L"Buffer is too small" && 0)
For information on how your program can cause an assertion
failure, see the Visual C++ documentation on asserts.
(Press Retry to debug the application)

▼c4_safe.cpp
#include <cstdio>
#include <cstring>

int main()
{
    FILE* fp = nullptr;
    if (fopen_s(&fp, "test.txt", "w") != 0)   // 戻り値(エラー番号)で成否が分かる
    {
        std::printf("ファイルを開けませんでした\n");
        return 1;
    }
    char buf[16];
    strcpy_s(buf, sizeof(buf), "hello");      // 書き込み先のサイズを渡す
    sprintf_s(buf, sizeof(buf), "%d", 123);
    fputs(buf, fp);
    fclose(fp);
    std::printf("書き込み完了: %s\n", buf);
    return 0;
}

c4_safe.cpp

書き込み完了: 123

▼c5_cpp.cpp
#include <fstream>
#include <iostream>
#include <string>

int main()
{
    std::ofstream ofs("test.txt");
    if (!ofs)
    {
        std::cout << "ファイルを開けませんでした\n";
        return 1;
    }
    std::string s = "hello";
    s = std::to_string(123);
    ofs << s;
    std::cout << "書き込み完了: " << s << "\n";
    return 0;
}

c5_cpp.cpp

書き込み完了: 123

▼c8_codecvt.cpp
#include <codecvt>
#include <locale>
#include <string>

int main()
{
    std::wstring_convert<std::codecvt_utf8<wchar_t>> conv;   // C++17で非推奨
    std::string s = conv.to_bytes(L"hello");
    return (int)s.size();
}

c8_codecvt.cpp(7): warning C4996: 'std::codecvt_utf8<wchar_t,1114111,(std::codecvt_mode)0>': warning STL4017: std::wbuffer_convert, std::wstring_convert, and the <codecvt> header (containing std::codecvt_mode, std::codecvt_utf8, std::codecvt_utf16, and std::codecvt_utf8_utf16) are deprecated in C++17. (中略) consider using MultiByteToWideChar() and WideCharToMultiByte() from <Windows.h> instead. You can define _SILENCE_CXX17_CODECVT_HEADER_DEPRECATION_WARNING or _SILENCE_ALL_CXX17_DEPRECATION_WARNINGS to suppress this warning.
(同じ警告が、ほかに3行出た)