Re: Buffer overflow in documentation

[Bruno Haible]

Hi Roland,

> https://www.gnu.org/software/gettext/manual/html_node/Preparing-Strings.html
> 
> The above documentation mentions the sprintf function. It should rather
> mention snprintf instead, to protect against buffer overflows.

These two code snippets

  strcpy (s, "Replace ");
  strcat (s, object1);
  strcat (s, " with ");
  strcat (s, object2);
  strcat (s, "?");

and

  sprintf (s, "Replace %s with %s?", object1, object2);

are meant to highlight the difference between pieces of strings and a format
string.

In both snippets, enough memory must be present at 's'.

If the doc were to use safer string primitives, like snprintf, it would only
distract from what the example is meant to focus on.

Bruno