Warning C28726

Banned API Usage: '*function-name' is insecure and has been marked deprecated.

This warning indicates that a function is being used that has been banned and has a more robust or secure replacement. This specific error indicates that the banned function has potential to overflow a buffer.

Remarks

A list of all banned functions covered by this error, why they are banned, and recommended replacements can be found after the following example.

Code analysis name: BANNED_API_USAGEL2

Example

The following code generates this warning:

void example_func() 
{ 
    char user_input[10]; 
    scanf(“%s”, input); // scanf is banned for security purposes 
} 

This is due to the use of the unsafe function scanf. scanf does place any limit on the size of the data copied to the buffer. To fix this issue, we can use scanf_s, the safer replacement to this function. scanf_s requires the developer to specify how many bytes are intended to be copied. scanf_s will ensure only that many bytes are copied. For example, the following code is safer:

void example_func() 
{ 
    char user_input[10]; 
    scanf_s(“%9s”, input, sizeof(input)); // 9 bytes leaves room for the \0 byte at the end  
} 

Banned Functions

NOTE: This list is actively being updated and improved