bug#58966: [Trunk] Xcode 14.1+ (and macOS 13.0+) deprecate sprintf()

[Paul Eggert <eggert@cs.ucla.edu>]

On 2022-11-05 09:26, Stefan Kangas wrote:
> snprintf is part of the C99 standard, so I think we can always rely on
> it being there.  Switching sounds like a good idea.

sprintf is also part of the C99 (and C17 and C23) standards, so "it's in 
the standard" does not mean we need to switch away from sprintf.

While we're on the topic: sprintf and snprintf both have serious design 
flaws, in that they cannot generate output longer than INT_MAX bytes, 
and this contradicts the GNU design philosophy to avoid arbitrary 
limits. Instead, code that needs low level formatting should use Emacs's 
own esprintf family of functions, which don't have the INT_MAX limit. 
(Often it's better for code to use Fformat etc. and generate a Lisp 
string, which doesn't have that limit either.)

Admittedly we haven't always been good about this, as sprintf/snprintf 
are standard and are tempting to use. It might be a good idea, though, 
for someone to go through the code and see if there are any 
INT_MAX-related bugs lurking in Emacs now due to its use of sprintf 
and/or snprintf, and replace these calls with something better.


On 2022-11-04 20:12, Richard Stallman wrote:
 > We could switch to snprintf, and define snprintf to call sprintf
 > in systems where snprintf isn't available.

That wouldn't that easy to do, and would make code more awkward and slow 
it down a bit. The current 3-line change to configure.ac is much 
simpler. It's pretty implausible that Apple will make sprintf go away 
entirely - and if Apple is foolish enough to do so, there are simple 
workarounds for that that don't involve messing with our legacy code.

> It is possible to verify
> that sprintf did not overwrite the buffer.

Sorry, I don't know what this comment is trying to say.

In my experience, with a debugging runtime sprintf is better than 
snprintf, as sprintf reliably reports bugs whereas snprintf silently 
truncates and continues with hard-to-debug behavior occuring later. Of 
course with traditional non-debugging runtimes one loses with sprintf, 
but in practice it's a tradeoff often worth making.