Replace sprintf with snprintf (drogonframework#1758)

Co-authored-by: francesco.laplaca <[email protected]> Co-authored-by: Ken Matsui <[email protected]>
hwc0919 · Aug 28, 2023 · 816684e · 816684e
1 parent 40aa034
commit 816684e
Show file tree

Hide file tree

Showing 2 changed files with 33 additions and 9 deletions.
diff --git a/drogon_ctl/templates/model_h.csp b/drogon_ctl/templates/model_h.csp
@@ -508,7 +508,7 @@ if(@@.get<std::string>("rdbms")=="postgresql")
                 if(@@.get<std::string>("rdbms")=="postgresql")
                 {
 %>
-            n = sprintf(placeholderStr,"$%d,",placeholder++);
+            n = snprintf(placeholderStr,sizeof(placeholderStr),"$%d,",placeholder++);
             sql.append(placeholderStr, n);
 <%c++
                 }else

diff --git a/orm_lib/tests/postgresql/Users.h b/orm_lib/tests/postgresql/Users.h
@@ -352,43 +352,67 @@ class Users
         size_t n = 0;
         if (dirtyFlag_[0])
         {
-            n = sprintf(placeholderStr, "$%d,", placeholder++);
+            n = snprintf(placeholderStr,
+                         sizeof(placeholderStr),
+                         "$%d,",
+                         placeholder++);
             sql.append(placeholderStr, n);
         }
         if (dirtyFlag_[1])
         {
-            n = sprintf(placeholderStr, "$%d,", placeholder++);
+            n = snprintf(placeholderStr,
+                         sizeof(placeholderStr),
+                         "$%d,",
+                         placeholder++);
             sql.append(placeholderStr, n);
         }
         if (dirtyFlag_[2])
         {
-            n = sprintf(placeholderStr, "$%d,", placeholder++);
+            n = snprintf(placeholderStr,
+                         sizeof(placeholderStr),
+                         "$%d,",
+                         placeholder++);
             sql.append(placeholderStr, n);
         }
         if (dirtyFlag_[3])
         {
-            n = sprintf(placeholderStr, "$%d,", placeholder++);
+            n = snprintf(placeholderStr,
+                         sizeof(placeholderStr),
+                         "$%d,",
+                         placeholder++);
             sql.append(placeholderStr, n);
         }
         if (dirtyFlag_[4])
         {
-            n = sprintf(placeholderStr, "$%d,", placeholder++);
+            n = snprintf(placeholderStr,
+                         sizeof(placeholderStr),
+                         "$%d,",
+                         placeholder++);
             sql.append(placeholderStr, n);
         }
         if (dirtyFlag_[5])
         {
-            n = sprintf(placeholderStr, "$%d,", placeholder++);
+            n = snprintf(placeholderStr,
+                         sizeof(placeholderStr),
+                         "$%d,",
+                         placeholder++);
             sql.append(placeholderStr, n);
         }
         sql += "default,";
         if (dirtyFlag_[7])
         {
-            n = sprintf(placeholderStr, "$%d,", placeholder++);
+            n = snprintf(placeholderStr,
+                         sizeof(placeholderStr),
+                         "$%d,",
+                         placeholder++);
             sql.append(placeholderStr, n);
         }
         if (dirtyFlag_[8])
         {
-            n = sprintf(placeholderStr, "$%d,", placeholder++);
+            n = snprintf(placeholderStr,
+                         sizeof(placeholderStr),
+                         "$%d,",
+                         placeholder++);
             sql.append(placeholderStr, n);
         }
         else