Re: [PATCH 01/12] ui/console-vc: Replace sprintf() by g_strdup_printf()

[Philippe Mathieu-Daudé]

On 11/4/24 09:47, Gerd Hoffmann wrote:
>    Hi,
>
> >      Due to security concerns inherent in the design of sprintf(3),
> >      it is highly recommended that you use snprintf(3) instead.
>
> > -    char response[40];
> > +    g_autofree char *response = NULL;
>
> > -                    sprintf(response, "\033[%d;%dR",
> > +                    response = g_strdup_printf("\033[%d;%dR",
>
> Any specific reason why you don't go with the recommendation above?
>
> While using g_strdup_printf() isn't wrong it allocates memory which
> is not needed here because you can continue to use the stack buffer
> this way:
>
>         snprintf(response, sizeof(response), ...);

I thought GLib/GString was recommended for formatting, so choose
this thinking mostly about style. Indeed in this case snprintf()
is sufficient. I'll respin, thanks.

> take care,
>    Gerd