On Thu, Apr 11, 2024 at 11:36:10AM +0200, Philippe Mathieu-Daudé wrote: > On 11/4/24 09:47, Gerd Hoffmann wrote: > > Hi, > > > > > Due to security concerns inherent in the design of sprintf(3), > > > it is highly recommended that you use snprintf(3) instead. > > > > > - char response[40]; > > > + g_autofree char *response = NULL; > > > > > - sprintf(response, "\033[%d;%dR", > > > + response = g_strdup_printf("\033[%d;%dR", > > > > Any specific reason why you don't go with the recommendation above? > > > > While using g_strdup_printf() isn't wrong it allocates memory which > > is not needed here because you can continue to use the stack buffer > > this way: > > > > snprintf(response, sizeof(response), ...); > > I thought GLib/GString was recommended for formatting,
If you allocate the output buffer anyway (and there are patches in this series where this is the case) it's clearly better to use g_strdup_printf instead of malloc + snprintf. In case a fixed-size buffer can be used I wouldn't switch to dynamic allocation ... take care, Gerd