So is there a safer (not subject to buffer overflows) version of sprintf() I can use? sprintf_s() is VC++-only, and C99 support in VC is abysmal, meaning no snprintf() either. See, my code for normalizing paths looks like this:
char*
normalize_path(const char* path, const char* base_dir, char* out_abs_path)
{
char* game_path = "C:/cowz";
char* norm_path = strdup(path);
size_t path_len = strlen(norm_path);
for (char* c = norm_path; *c != '\0'; ++c) {
if (*c == '\\') *c = '/';
}
if (norm_path[0] == '/' || norm_path[1] == ':')
// absolute path - not allowed
return NULL;
bool is_homed = (strstr(norm_path, "~/") == norm_path);
if (is_homed) {
sprintf(out_abs_path, "%s/%s", game_path, norm_path + 2);
}
else {
sprintf(out_abs_path, "%s/%s/%s", game_path, base_dir, norm_path);
}
free(norm_path);
return out_abs_path;
}
Which is obviously subject to buffer overflow. Not a good thing considering Sphere takes JS as input--too much leeway for exploits using overly-long paths.