### **问题诊断与修复方案** #### **1. 警告分析** 编译器警告指出： - **问题类型**：格式化字符串可能截断 - **危险点**：`%s`可能写入最多4095字节，但目标缓冲区只有4004字节 - **相关参数**：`FACEFUNCTION_TABLE_NAME_V2` 或 `chn_select_condition` 可能导致溢出 #### **2. 危险场景还原** ```c char sql[4004]; // 固定大小缓冲区 snprintf(sql, sizeof(sql), "SELECT ... FROM %s WHERE ...", // %s可能超长 table_name, // 潜在长字符串 condition, ...); ``` #### **3. 解决方案** ##### **方案A：扩大缓冲区（最直接）** ```c // 原始大小4004 → 扩展到足够安全的大小 #define SAFE_SQL_BUF_SIZE 8192 char sql[SAFE_SQL_BUF_SIZE]; ``` ##### **方案B：动态分配（灵活但需管理内存）** ```c size_t needed_size = snprintf(NULL, 0, format, ...) + 1; char *sql = malloc(needed_size); if (sql) { snprintf(sql, needed_size, format, ...); // 使用后记得free } ``` ##### **方案C：输入验证（防御性编程）** ```c // 验证表名长度 if (strlen(FACEFUNCTION_TABLE_NAME_V2) > MAX_TABLE_NAME_LEN) { return ERROR_TABLE_NAME_TOO_LONG; } // 验证条件字符串长度 if (strlen(chn_select_condition) > MAX_CONDITION_LEN) { return ERROR_CONDITION_TOO_COMPLEX; } ``` ##### **方案D：分段构建SQL（最安全）** ```c strncpy(sql, "SELECT ... FROM ", buffer_remain); append_safe(sql, sizeof(sql), FACEFUNCTION_TABLE_NAME_V2); append_safe(sql, sizeof(sql), " WHERE ..."); ``` #### **4. 完整修复示例** ```c #define MAX_SQL_LENGTH 8000 #define MAX_TABLE_NAME 128 #define MAX_CONDITION_LEN 2000 void build_search_sql(const SearchParam* param) { // 输入验证 if (strlen(FACEFUNCTION_TABLE_NAME_V2) > MAX_TABLE_NAME) { log_error("Table name too long"); return; } // 安全缓冲区 char sql[MAX_SQL_LENGTH]; // 安全格式化 int written = snprintf(sql, sizeof(sql), "SELECT ID, channelId, snapTime, startTime, endTime FROM %s " "WHERE channelId IN %s AND snapTime>=%lld AND snapTime<=%lld " "ORDER BY snapTime DESC LIMIT %d;", FACEFUNCTION_TABLE_NAME_V2, chn_select_condition, SECOND_TO_US(param->start_time), SECOND_TO_US(param->end_time), FACEFUNC_SEARCH_NUM_MAX); // 检查截断 if (written >= sizeof(sql)) { log_error("SQL truncated! Need %d bytes", written+1); } } ``` #### **5. 防御性编程增强** ```c // 安全字符串追加函数 size_t append_safe(char* dest, size_t dest_size, const char* src) { size_t used = strlen(dest); size_t remain = dest_size - used - 1; strncat(dest, src, remain); return used + strlen(src); // 返回实际需要长度 } // 编译时检查 static_assert(MAX_SQL_LENGTH > (MAX_TABLE_NAME + MAX_CONDITION_LEN + 200), "SQL buffer too small for worst case"); ``` #### **6. 设计建议** 1. **SQL构建规范**： - 为所有表名定义最大长度常量 - 使用预编译语句（如SQLite的`sqlite3_prepare_v2`） 2. **安全模板**： ```c #define BUILD_SQL(buffer, buf_size, ...) \ do { \ static_assert(sizeof(buffer) >= MIN_SQL_BUF_SIZE, "Buffer too small"); \ snprintf(buffer, buf_size, __VA_ARGS__); \ if (strlen(buffer) == buf_size-1) \ log_warning("SQL may be truncated"); \ } while(0) ``` 3. **审计追踪**： ```c void log_sql(const char* sql) { if (strlen(sql) > MAX_LOG_SQL_LEN) { log_debug("Large SQL (%zu bytes): %.100s...", strlen(sql), sql); } } ```