On 1. 6. 2026 23:07, Timofei Zhakov wrote:
On Mon, 01 Jun 2026 at 10:55 PM, Sean McBride <[email protected]> wrote:

    On 1 Jun 2026, at 16:46, Branko Čibej wrote:

    > I prefer to just silence the brain-dead warning...

    The warning is hardly brain-dead. sprintf() cannot be implemented
    safely as it has no idea how big the buffer is. Memory overruns
    are an infamous problem in C, and using sprintf() in 2026 is
    madness IMNSHO.

    OpenBSD has this same warning as macOS BTW.



Well, at the end of the day macos is in fact a BSD based system ;)

About memory safety, if we know the buffer has enough memory, it’s okay. I completely agree with Branko. I believe in that snippet of code, the function is used to format a number which realistically could never exceed like 16 bytes.


5 actually, unless someone tweaks their locale to use numerals that aren't in the ASCII subset, in which case it's 11 bytes but still 5 characters. Oh, it could be more if the locale uses Babylonian or Roman numerals, I guess. I won't loose sleep over that remote possibility. I don't expect Hammurabi's scribes will use Subversion any time in the recent past.


I wouldn’t say you should avoid a specific function just because you don’t like it or somebody on the internet says so. It’s fine whenever you know what you’re doing.


That's really my problem. This warning caters to the lowest common denominator and hurts everyone else. Fine, create a warning flag specifically to note these kinds of issues. Apple did that very well when they added -W64-to-32 to clang. Don't just "deprecate" a function from the standard library that is not deprecated in the standard. Whichever standard; if I'm using some POSIX functions, I don't expect macOS or any other POSIX compliant system to complain that a function was introduced in 2001 and I should use this other function that was introduced in 2017 instead.


Then, some day it leads to Rust rewrites…

That'll come anyway, once the rusties have broken and thrown away all other perfectly good code that has worked for the last 30 years.

-- Brane

Reply via email to