Re: master 8ff7338fdd0 1/4: When debugging image.c, abort if silent truncation

[Paul Eggert]

On 1/22/25 14:24, Stefan Kangas wrote:
> the eassert you added should do that job too, so what
> would be the reasons for still preferring sprintf?

For instance, I might have made a mistake writing the eassert. (I 
actually did make such mistakes in earlier editions of that patch, which 
you didn't see....)

There's a philosophical issue here. Some people feel safer writing code 
that double- or triple-checks. Others feel safer having just one check 
but having it be really reliable. I'm more in the latter camp, partly 
because the extra checking is a maintenance cost that in turn makes 
software less reliable because maintainers waste their time dealing with 
these feel-good checks.

Besides, GNU Emacs and the GNU Coding Standards fall squarely in the "no 
arbitrary limits" camp, and snprintf inherently is a bad fit. It's the 
same reason Emacs doesn't use strlcpy.