mprintf: use snprintf if available

This is the single place in libcurl code where it uses the "native"
s(n)printf() function. Used for writing floats. The use has been
reviewed and vetted and uses a HUGE target buffer, but switching to
snprintf() still makes this safer and removes build-time warnings.

Reported-by: Philip Heiduck
Fixes #9569
Closes #9570

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 564c4dbc50818f1885826e8da07ab59a361c3291..5fa8956febaab583bef7209e090a451707ccdea7 100644 (file)
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1079,6 +1079,11 @@ check_symbol_exists(getrlimit      "${CURL_INCLUDES}" HAVE_GETRLIMIT)
 check_symbol_exists(setlocale      "${CURL_INCLUDES}" HAVE_SETLOCALE)
 check_symbol_exists(setmode        "${CURL_INCLUDES}" HAVE_SETMODE)
 check_symbol_exists(setrlimit      "${CURL_INCLUDES}" HAVE_SETRLIMIT)
+
+if(NOT MSVC OR (MSVC_VERSION GREATER_EQUAL 1900))
+  # earlier MSVC compilers had faulty snprintf implementations
+  check_symbol_exists(snprintf       "${CURL_INCLUDES}" HAVE_SNPRINTF)
+endif()
 check_function_exists(mach_absolute_time HAVE_MACH_ABSOLUTE_TIME)
 check_symbol_exists(inet_pton      "${CURL_INCLUDES}" HAVE_INET_PTON)
 

diff --git a/configure.ac b/configure.ac
index 1f114002b15db30cbfd64e5a9a6d7e11d4e55a27..9739eab2c216fde8dccd1add75e873630e29b7c7 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -3535,6 +3535,7 @@ AC_CHECK_FUNCS([fnmatch \
   setlocale \
   setmode \
   setrlimit \
+  snprintf \
   utime \
   utimes
 ],[

diff --git a/lib/config-win32.h b/lib/config-win32.h
index 0ac529d25017dc1537e78df9a97eea0b6e4e7a35..7c9cdf1fc2c2dfb0352eaf43d61158630556243d 100644 (file)
--- a/lib/config-win32.h
+++ b/lib/config-win32.h
@@ -254,6 +254,11 @@
 /* Define to the function return type for send. */
 #define SEND_TYPE_RETV int
 
+/* Define to 1 if you have the snprintf function. */
+#if defined(_MSC_VER) && (_MSC_VER >= 1900)
+#define HAVE_SNPRINTF 1
+#endif
+
 /* ---------------------------------------------------------------- */
 /*                       TYPEDEF REPLACEMENTS                       */
 /* ---------------------------------------------------------------- */

diff --git a/lib/mprintf.c b/lib/mprintf.c
index 6bf55f661e5275ff1e330eddf45e22d5cd1a139a..24c1dd555e6ff046117acb4d3b7bb9830f862e05 100644 (file)
--- a/lib/mprintf.c
+++ b/lib/mprintf.c
@@ -964,7 +964,11 @@ static int dprintf_formatf(
 #endif
         /* NOTE NOTE NOTE!! Not all sprintf implementations return number of
            output characters */
+#ifdef HAVE_SNPRINTF
+        (snprintf)(work, sizeof(work), formatbuf, p->data.dnum);
+#else
         (sprintf)(work, formatbuf, p->data.dnum);
+#endif
 #ifdef __clang__
 #pragma clang diagnostic pop
 #endif