使用BIO_printf（）代替printf（）有什么好处？

Question

I have been reviewing example code for using OpenSSL and in every example I locate, the creator has chosen to use BIO_printf() to write things to stdout instead of printf().

I have taken their code, removed the openssl/bio.h header declaration, and changed all calls to BIO_printf() to regular printf() statements. The programs ran with identical results.

The problem I'm grasping with is why these coders use BIO_printf() when it takes a lot more to setup than just using printf(). You have to include another header (which will increase program size), you need to set the file pointer to the stream you want to write to. Then you can print your message to stdout. It seems a lot more complicated than using printf().

When I do a search on BIO_printf() it lists possible man pages for BIO_printf (3), but none of the pages actually contain any information!

I decided to do a benchmark test on both methods. I looped printf("Hey\\n"); 1,000,000 times. Then I did it for BIO_printf(fp, "Hey\\n"); . I only timed the BIO_printf() statement and not the setting up of the file pointer (which would have increased the time). The difference came out to printf() being ~4.7x faster than using BIO_printf().

Why are they using it? What is the benefit? It's my understanding that in programming you either want code to be simple or efficient, and in the case of BIO_printf() it's neither.

Answer 1

In general, a BIO might not be writing to stdout.

You can have a BIO that writes to a file, or null, or a socket, or a network drive, or another BIO, etc.

By using the BIO_printf family, the code can easily be changed to have its output sent to a different location or another BIO which might do some further filtering and then pass the output onto wherever else.

Answer 2

As pointed by others, BIO can be stacked contrary to FILE . snprintf() and vnsprintf() were added in C99. OpenSSL/SSLeay is older than this. Hence, the SSLeay developpers had to write their own implementation. Unfortunately, having a little used implementation leads to the performance issues described by the OP or to CVE-2016-0799 .