为什么要在C ++中避免使用输入操作符（operator >>）？

Question

In this question the author of the accepted answer does not recommend the usage of the input operator, because:

operator>> is subject to iomanip stream manipulators and other "funny" stuff, so you can never be sure that it does what's advertised.

But what does it mean? Why should we avoid the input operator of the C++ when we are programming in C++?

The books I have read from The Definitive C++ Book Guide and List did not mention this, they introduced and used the input operator. I have not found anything useful in this topic on the internet neither.

Thanks!

ps: I am sorry, but I do not have enough reputation to ask my question in that topic.

Answer 1

The only things I can think of are the fact that operator>> retains a lot of settings between uses. For example:

std::ifstream fin("input.txt");
std::string str;
double num;

someOtherFunction(fin);

while (fin >> str >> num)
{
   //do something
}

looks pretty innocent unless we consider:

void someOtherFunction(std::ifstream& fin){
    fin.width(1); 
    fin.setf(/* some flags here */); 
    //...
}

I personally read the file raw and do parsing with regex but I am by no means an expert on the subject so that advice should be taken with a big grain of salt.

Answer 2

If the user input length is larger than the allocated buffer, this could lead to a buffer overflow. Hackers may use this in order to overwrite the return address and run malicious code.