Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gh-101703: use snprintf instead of sprintf #101729

Open
wants to merge 14 commits into
base: main
Choose a base branch
from

Conversation

sobolevn
Copy link
Member

@sobolevn sobolevn commented Feb 9, 2023

Several points of interest:

  1. sprintf is indeed insecure generally: https://rules.sonarsource.com/c/RSPEC-6069 But, for our cases - I was not able to find a single insecure place, so I don't mark this PR as :security:
  2. snprintf is also listed as not secure here: https://clang.llvm.org/docs/analyzer/checkers.html#security-insecureapi-deprecatedorunsafebufferhandling-c
  3. snprintf is reported to be slightly slower than sprintf

@sobolevn
Copy link
Member Author

sobolevn commented Feb 9, 2023

Ok, the first part with constant sized elements is done. Now, more complex ones.

@sobolevn
Copy link
Member Author

sobolevn commented Feb 9, 2023

Looks like we have PyOS_snprintf instead of just snprintf 🤔

@sobolevn
Copy link
Member Author

sobolevn commented Feb 9, 2023

Almost done!

There are a couple left, but I don't quite understand the code and I will highly appreciate help / advice on these cases:

@sobolevn sobolevn added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Feb 9, 2023
@bedevere-bot
Copy link

🤖 New build scheduled with the buildbot fleet by @sobolevn for commit 9bc0864 🤖

If you want to schedule another build, you need to add the :hammer: test-with-buildbots label again.

@bedevere-bot bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Feb 9, 2023
@sobolevn sobolevn added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Feb 9, 2023
@bedevere-bot
Copy link

🤖 New build scheduled with the buildbot fleet by @sobolevn for commit c7dd348 🤖

If you want to schedule another build, you need to add the :hammer: test-with-buildbots label again.

@bedevere-bot bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Feb 9, 2023
@sobolevn
Copy link
Member Author

sobolevn commented Feb 9, 2023

CI results:

@sobolevn sobolevn added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Feb 10, 2023
@bedevere-bot
Copy link

🤖 New build scheduled with the buildbot fleet by @sobolevn for commit 0e7bce1 🤖

If you want to schedule another build, you need to add the :hammer: test-with-buildbots label again.

@bedevere-bot bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Feb 10, 2023
@sobolevn sobolevn marked this pull request as ready for review February 10, 2023 10:03
@sobolevn
Copy link
Member Author

@Yhg1s @gvanrossum it is ready to be reviewed :)

Objects/unicodeobject.c Outdated Show resolved Hide resolved
Objects/unicodeobject.c Outdated Show resolved Hide resolved
@sobolevn
Copy link
Member Author

I've made the requested changes, thanks for the suggestions 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants