Re: Print warnings at configuration time? Build time?

[Ethan M. <merritt@u.washington.edu>]

On Tuesday 17 October 2006 01:41 pm, Daniel J Sebald wrote:
> >
> > Should we have ./configure print out a warning if snprintf is not
> > found?
> >
> > WARNING:  Could not find a working snprintf() function.
> > 	  Buffer overflows and segfaults may be triggered by
> > 	  overlong format specifiers provided to gnuplot by the user.
> > 	  Please consider providing snprintf via an external library.
>
>  * FIXME: 10 is a purely arbitrary upper limit on args

That limit has nothing to do with the presence or absence of snprintf.

> And here is the source of the problem, right?
>
> /* FIXME - this is bad; we should dummy up an snprintf equivalent */

That's one place, one that actually has a comment noting the problem.
But there are other places as well.

> Do we really want to go the route of implementing our own snprintf? 

The suggestion in TODO is to find one with a compatible license.
I did a bit of poking around on the web and found one with a BSD
license and reference to one with an Apache implementation.
But I have neither time nor inclination to deal with evaluation
of licensing issues if we were to include these as source. 

The current code does the right thing on any system modern enough
to provide snprintf.  I think it is sufficient to give a warning
when gnuplot is built on a legacy system that doesn't.

> implementing a crude version wouldn't be too difficult.

You might be surprised.
The versions I found ran to hundreds of lines of code.

-- 
Ethan A Merritt
Biomolecular Structure Center
University of Washington, Seattle WA