Re: Print warnings at configuration time? Build time?

[Daniel J S. <dan...@ie...>]

> Question
> ========
> 
> Should we have ./configure print out a warning if snprintf is not found?
> 
> WARNING:  Could not find a working snprintf() function.
> 	  Buffer overflows and segfaults may be triggered by
> 	  overlong format specifiers provided to gnuplot by the user.
> 	  Please consider providing snprintf via an external library.
> 
> Should we issue the same warning at build time?  Run time?

I see this comment:

 * FIXME: 10 is a purely arbitrary upper limit on args

This could probably be changed so that the arguments are allocated using the heap, making it not limited.

And here is the source of the problem, right?

/* FIXME - this is bad; we should dummy up an snprintf equivalent */

Do we really want to go the route of implementing our own snprintf?  That is a fairly low level routine, isn't it?  Of course, implementing a crude version wouldn't be too difficult.  There is already a search for

    next_length = strcspn(next_start,"%");

one can then look for a size specification fairly easily by trying to read what follows the % as an int, if it fails, then assume some size of, oh, 20 characters.

Would there be some way we can use buffered i/o in the case of not having snprintf?  E.g., send the data to a file, when all done, check the file size then create a memory buffer big enough to hold the contents, then read it back in?  It would be slow on machines that don't have snprintf, but so be it.

Dan