Merge pull request #6842 from PatTheMav/sprintf-deprecation

Remove discouraged and deprecated usage of sprintf across the codebase

UI/obs-app.cpp

@@ -376,7 +376,7 @@ static void do_log(int log_level, const char *msg, va_list args, void *param)
 	va_copy(args2, args);
 #endif
 
-	vsnprintf(str, 4095, msg, args);
+	vsnprintf(str, sizeof(str), msg, args);
 
 #ifdef _WIN32
 	if (IsDebuggerPresent()) {
@@ -2658,16 +2658,16 @@ static void move_to_xdg(void)
 	if (!home)
 		return;
 
-	if (snprintf(old_path, 512, "%s/.obs-studio", home) <= 0)
+	if (snprintf(old_path, sizeof(old_path), "%s/.obs-studio", home) <= 0)
 		return;
 
 	/* make base xdg path if it doesn't already exist */
-	if (GetConfigPath(new_path, 512, "") <= 0)
+	if (GetConfigPath(new_path, sizeof(new_path), "") <= 0)
 		return;
 	if (os_mkdirs(new_path) == MKDIR_ERROR)
 		return;
 
-	if (GetConfigPath(new_path, 512, "obs-studio") <= 0)
+	if (GetConfigPath(new_path, sizeof(new_path), "obs-studio") <= 0)
 		return;
 
 	if (os_file_exists(old_path) && !os_file_exists(new_path)) {

UI/qt-wrappers.cpp

@@ -42,7 +42,7 @@
 static inline void OBSErrorBoxva(QWidget *parent, const char *msg, va_list args)
 {
 	char full_message[4096];
-	vsnprintf(full_message, 4095, msg, args);
+	vsnprintf(full_message, sizeof(full_message), msg, args);
 
 	QMessageBox::critical(parent, "Error", full_message);
 }

UI/window-basic-main-outputs.cpp

@@ -1346,7 +1346,7 @@ AdvancedOutput::AdvancedOutput(OBSBasic *main_) : BasicOutputHandler(main_)
 
 	for (int i = 0; i < MAX_AUDIO_MIXES; i++) {
 		char name[9];
-		sprintf(name, "adv_aac%d", i);
+		snprintf(name, sizeof(name), "adv_aac%d", i);
 
 		if (!CreateAACEncoder(aacTrack[i], aacEncoderID[i],
 				      GetAudioBitrate(i), name, i))

UI/window-basic-main-profiles.cpp

@@ -373,13 +373,15 @@ void OBSBasic::DeleteProfile(const char *profileName, const char *profileDir)
 	char profilePath[512];
 	char basePath[512];
 
-	int ret = GetConfigPath(basePath, 512, "obs-studio/basic/profiles");
+	int ret = GetConfigPath(basePath, sizeof(basePath),
+				"obs-studio/basic/profiles");
 	if (ret <= 0) {
 		blog(LOG_WARNING, "Failed to get profiles config path");
 		return;
 	}
 
-	ret = snprintf(profilePath, 512, "%s/%s/*", basePath, profileDir);
+	ret = snprintf(profilePath, sizeof(profilePath), "%s/%s/*", basePath,
+		       profileDir);
 	if (ret <= 0) {
 		blog(LOG_WARNING, "Failed to get path for profile dir '%s'",
 		     profileDir);
@@ -404,7 +406,8 @@ void OBSBasic::DeleteProfile(const char *profileName, const char *profileDir)
 
 	os_globfree(glob);
 
-	ret = snprintf(profilePath, 512, "%s/%s", basePath, profileDir);
+	ret = snprintf(profilePath, sizeof(profilePath), "%s/%s", basePath,
+		       profileDir);
 	if (ret <= 0) {
 		blog(LOG_WARNING, "Failed to get path for profile dir '%s'",
 		     profileDir);

deps/libcaption/caption/caption.h

@@ -134,10 +134,6 @@ size_t caption_frame_to_text(caption_frame_t* frame, utf8_char_t* data);
 /*! \brief
     \param
 */
-#define CAPTION_FRAME_DUMP_BUF_SIZE 8192
-size_t caption_frame_dump_buffer(caption_frame_t* frame, utf8_char_t* buf);
-void caption_frame_dump(caption_frame_t* frame);
-
 #ifdef __cplusplus
 }
 #endif

deps/libcaption/src/caption.c

@@ -403,57 +403,3 @@ size_t caption_frame_to_text(caption_frame_t* frame, utf8_char_t* data)
 
     return size;
 }
-////////////////////////////////////////////////////////////////////////////////
-size_t caption_frame_dump_buffer(caption_frame_t* frame, utf8_char_t* buf)
-{
-    int r, c;
-    size_t bytes, total = 0;
-    bytes = sprintf(buf, "   timestamp: %f\n   row: %02d    col: %02d    roll-up: %d\n",
-        frame->timestamp, frame->state.row, frame->state.col, caption_frame_rollup(frame));
-    total += bytes, buf += bytes;
-    bytes = sprintf(buf, "   00000000001111111111222222222233\t   00000000001111111111222222222233\n"
-                         "   01234567890123456789012345678901\t   01234567890123456789012345678901\n"
-                         "  %s--------------------------------%s\t  %s--------------------------------%s\n",
-        EIA608_CHAR_BOX_DRAWINGS_LIGHT_DOWN_AND_RIGHT, EIA608_CHAR_BOX_DRAWINGS_LIGHT_DOWN_AND_LEFT,
-        EIA608_CHAR_BOX_DRAWINGS_LIGHT_DOWN_AND_RIGHT, EIA608_CHAR_BOX_DRAWINGS_LIGHT_DOWN_AND_LEFT);
-    total += bytes;
-    buf += bytes;
-
-    for (r = 0; r < SCREEN_ROWS; ++r) {
-        bytes = sprintf(buf, "%02d%s", r, EIA608_CHAR_VERTICAL_LINE);
-        total += bytes, buf += bytes;
-
-        // front buffer
-        for (c = 0; c < SCREEN_COLS; ++c) {
-            caption_frame_cell_t* cell = frame_buffer_cell(&frame->front, r, c);
-            bytes = utf8_char_copy(buf, (!cell || 0 == cell->data[0]) ? EIA608_CHAR_SPACE : &cell->data[0]);
-            total += bytes, buf += bytes;
-        }
-
-        bytes = sprintf(buf, "%s\t%02d%s", EIA608_CHAR_VERTICAL_LINE, r, EIA608_CHAR_VERTICAL_LINE);
-        total += bytes, buf += bytes;
-
-        // back buffer
-        for (c = 0; c < SCREEN_COLS; ++c) {
-            caption_frame_cell_t* cell = frame_buffer_cell(&frame->back, r, c);
-            bytes = utf8_char_copy(buf, (!cell || 0 == cell->data[0]) ? EIA608_CHAR_SPACE : &cell->data[0]);
-            total += bytes, buf += bytes;
-        }
-
-        bytes = sprintf(buf, "%s\n", EIA608_CHAR_VERTICAL_LINE);
-        total += bytes, buf += bytes;
-    }
-
-    bytes = sprintf(buf, "  %s--------------------------------%s\t  %s--------------------------------%s\n",
-        EIA608_CHAR_BOX_DRAWINGS_LIGHT_UP_AND_RIGHT, EIA608_CHAR_BOX_DRAWINGS_LIGHT_UP_AND_LEFT,
-        EIA608_CHAR_BOX_DRAWINGS_LIGHT_UP_AND_RIGHT, EIA608_CHAR_BOX_DRAWINGS_LIGHT_UP_AND_LEFT);
-    total += bytes, buf += bytes;
-    return total;
-}
-
-void caption_frame_dump(caption_frame_t* frame)
-{
-    utf8_char_t buff[CAPTION_FRAME_DUMP_BUF_SIZE];
-    caption_frame_dump_buffer(frame, buff);
-    fprintf(stderr, "%s\n", buff);
-}

deps/obs-scripting/obs-scripting-python-import.c

@@ -71,9 +71,9 @@ bool import_python(const char *python_path, python_version_t *python_version)
 
 	char temp[PATH_MAX];
 
-	sprintf(cur_version, VERSION_PATTERN, PY_MAJOR_VERSION_MAX,
-		PY_MINOR_VERSION_MAX);
-	sprintf(temp, FILE_PATTERN, cur_version);
+	snprintf(cur_version, sizeof(cur_version), VERSION_PATTERN,
+		 PY_MAJOR_VERSION_MAX, PY_MINOR_VERSION_MAX);
+	snprintf(temp, sizeof(temp), FILE_PATTERN, cur_version);
 
 	dstr_cat(&lib_candidate_path, temp);
 
@@ -87,10 +87,10 @@ bool import_python(const char *python_path, python_version_t *python_version)
 			break;
 		}
 
-		sprintf(cur_version, VERSION_PATTERN, PY_MAJOR_VERSION_MAX,
-			minor_version);
-		sprintf(next_version, VERSION_PATTERN, PY_MAJOR_VERSION_MAX,
-			--minor_version);
+		snprintf(cur_version, sizeof(cur_version), VERSION_PATTERN,
+			 PY_MAJOR_VERSION_MAX, minor_version);
+		snprintf(next_version, sizeof(next_version), VERSION_PATTERN,
+			 PY_MAJOR_VERSION_MAX, --minor_version);
 		dstr_replace(&lib_candidate_path, cur_version, next_version);
 	} while (minor_version > 5);
 

deps/obs-scripting/obs-scripting-python.c

@@ -1666,8 +1666,8 @@ bool obs_scripting_load_python(const char *python_path)
 	if (python_path && *python_path) {
 #ifdef __APPLE__
 		char temp[PATH_MAX];
-		sprintf(temp, "%s/Python.framework/Versions/Current",
-			python_path);
+		snprintf(temp, sizeof(temp),
+			 "%s/Python.framework/Versions/Current", python_path);
 		os_utf8_to_wcs(temp, 0, home_path, PATH_MAX);
 		Py_SetPythonHome(home_path);
 #else

libobs-d3d11/d3d11-subsystem.cpp

@@ -330,7 +330,8 @@ void gs_device::InitCompiler()
 	int ver = 49;
 
 	while (ver > 30) {
-		sprintf(d3dcompiler, "D3DCompiler_%02d.dll", ver);
+		snprintf(d3dcompiler, sizeof(d3dcompiler),
+			 "D3DCompiler_%02d.dll", ver);
 
 		HMODULE module = LoadLibraryA(d3dcompiler);
 		if (module) {

libobs/util/platform.c

@@ -559,7 +559,8 @@ static inline void from_locale(char *buffer)
 double os_strtod(const char *str)
 {
 	char buf[64];
-	snprintf(buf, 64, "%s", str);
+	strncpy(buf, str, sizeof(buf) - 1);
+	buf[sizeof(buf) - 1] = 0;
 	to_locale(buf);
 	return strtod(buf, NULL);
 }
@@ -760,23 +761,25 @@ char *os_generate_formatted_filename(const char *extension, bool space,
 		if (!convert[0]) {
 			if (astrcmp_n(cmp, "%FPS", 4) == 0) {
 				if (ovi.fps_den <= 1) {
-					sprintf(convert, "%u", ovi.fps_num);
+					snprintf(convert, sizeof(convert), "%u",
+						 ovi.fps_num);
 				} else {
 					const double obsFPS =
 						(double)ovi.fps_num /
 						(double)ovi.fps_den;
-					sprintf(convert, "%.2f", obsFPS);
+					snprintf(convert, sizeof(convert),
+						 "%.2f", obsFPS);
 				}
 				replace_text(&sf, pos, 4, convert);
 
 			} else if (astrcmp_n(cmp, "%CRES", 5) == 0) {
-				sprintf(convert, "%ux%u", ovi.base_width,
-					ovi.base_height);
+				snprintf(convert, sizeof(convert), "%ux%u",
+					 ovi.base_width, ovi.base_height);
 				replace_text(&sf, pos, 5, convert);
 
 			} else if (astrcmp_n(cmp, "%ORES", 5) == 0) {
-				sprintf(convert, "%ux%u", ovi.output_width,
-					ovi.output_height);
+				snprintf(convert, sizeof(convert), "%ux%u",
+					 ovi.output_width, ovi.output_height);
 				replace_text(&sf, pos, 5, convert);
 
 			} else if (astrcmp_n(cmp, "%VF", 3) == 0) {
@@ -785,7 +788,8 @@ char *os_generate_formatted_filename(const char *extension, bool space,
 				replace_text(&sf, pos, 3, convert);
 
 			} else if (astrcmp_n(cmp, "%s", 2) == 0) {
-				sprintf(convert, "%" PRId64, (int64_t)now);
+				snprintf(convert, sizeof(convert), "%" PRId64,
+					 (int64_t)now);
 				replace_text(&sf, pos, 2, convert);
 			}
 		}

plugins/coreaudio-encoder/encoder.cpp

@@ -175,7 +175,7 @@ log_to_dstr(DStr &str, ca_encoder *ca, const char *fmt, ...)
 
 	char array[4096];
 	va_start(args, fmt);
-	vsnprintf(array, 4096, fmt, args);
+	vsnprintf(array, sizeof(array), fmt, args);
 	va_end(args);
 
 	array[4095] = 0;

plugins/image-source/obs-slideshow.c

@@ -922,7 +922,7 @@ static obs_properties_t *ss_properties(void *data)
 		obs_property_list_add_string(p, aspects[i], aspects[i]);
 
 	char str[32];
-	snprintf(str, 32, "%dx%d", cx, cy);
+	snprintf(str, sizeof(str), "%dx%d", cx, cy);
 	obs_property_list_add_string(p, str, str);
 
 	if (ss) {

plugins/linux-capture/xshm-input.c

@@ -365,7 +365,13 @@ static bool xshm_server_changed(obs_properties_t *props, obs_property_t *p,
 			x11_screen_geo(xcb, i, &w, &h);
 
 		if (name == NULL) {
-			sprintf(name_tmp, "%" PRIuFAST32, i);
+			int ret = snprintf(name_tmp, sizeof(name_tmp),
+					   "%" PRIuFAST32, i);
+			if (ret >= sizeof(name_tmp))
+				blog(LOG_DEBUG,
+				     "linux-capture: A format truncation may have occurred."
+				     " This can be ignored since it is quite improbable.");
+
 			name = name_tmp;
 		}
 

plugins/linux-v4l2/v4l2-input.c

@@ -416,8 +416,14 @@ static void v4l2_device_list(obs_property_t *prop, obs_data_t *settings)
 
 		/* make sure device names are unique */
 		char unique_device_name[68];
-		sprintf(unique_device_name, "%s (%s)", video_cap.card,
-			video_cap.bus_info);
+		int ret = snprintf(unique_device_name,
+				   sizeof(unique_device_name), "%s (%s)",
+				   video_cap.card, video_cap.bus_info);
+		if (ret >= sizeof(unique_device_name))
+			blog(LOG_DEBUG,
+			     "linux-v4l2: A format truncation may have occurred."
+			     " This can be ignored since it is quite improbable.");
+
 		obs_property_list_add_string(prop, unique_device_name,
 					     device.array);
 		blog(LOG_INFO, "Found device '%s' at %s", video_cap.card,

plugins/mac-capture/mac-display-capture.m

@@ -605,19 +605,20 @@ static obs_properties_t *display_capture_properties(void *unused)
 				    __attribute__((unused))) {
 		char dimension_buffer[4][12];
 		char name_buffer[256];
-		sprintf(dimension_buffer[0], "%u",
-			(uint32_t)[screen frame].size.width);
-		sprintf(dimension_buffer[1], "%u",
-			(uint32_t)[screen frame].size.height);
-		sprintf(dimension_buffer[2], "%d",
-			(int32_t)[screen frame].origin.x);
-		sprintf(dimension_buffer[3], "%d",
-			(int32_t)[screen frame].origin.y);
-
-		sprintf(name_buffer, "%.200s: %.12sx%.12s @ %.12s,%.12s",
-			[[screen localizedName] UTF8String],
-			dimension_buffer[0], dimension_buffer[1],
-			dimension_buffer[2], dimension_buffer[3]);
+		snprintf(dimension_buffer[0], sizeof(dimension_buffer[0]), "%u",
+			 (uint32_t)[screen frame].size.width);
+		snprintf(dimension_buffer[1], sizeof(dimension_buffer[0]), "%u",
+			 (uint32_t)[screen frame].size.height);
+		snprintf(dimension_buffer[2], sizeof(dimension_buffer[0]), "%d",
+			 (int32_t)[screen frame].origin.x);
+		snprintf(dimension_buffer[3], sizeof(dimension_buffer[0]), "%d",
+			 (int32_t)[screen frame].origin.y);
+
+		snprintf(name_buffer, sizeof(name_buffer),
+			 "%.200s: %.12sx%.12s @ %.12s,%.12s",
+			 [[screen localizedName] UTF8String],
+			 dimension_buffer[0], dimension_buffer[1],
+			 dimension_buffer[2], dimension_buffer[3]);
 
 		obs_property_list_add_int(list, name_buffer, index);
 	}];

plugins/mac-capture/mac-screen-capture.m

@@ -800,19 +800,20 @@ static bool build_display_list(struct screen_capture *sc,
 
 		char dimension_buffer[4][12] = {};
 		char name_buffer[256] = {};
-		sprintf(dimension_buffer[0], "%u",
-			(uint32_t)screen.frame.size.width);
-		sprintf(dimension_buffer[1], "%u",
-			(uint32_t)screen.frame.size.height);
-		sprintf(dimension_buffer[2], "%d",
-			(int32_t)screen.frame.origin.x);
-		sprintf(dimension_buffer[3], "%d",
-			(int32_t)screen.frame.origin.y);
-
-		sprintf(name_buffer, "%.200s: %.12sx%.12s @ %.12s,%.12s",
-			screen.localizedName.UTF8String, dimension_buffer[0],
-			dimension_buffer[1], dimension_buffer[2],
-			dimension_buffer[3]);
+		snprintf(dimension_buffer[0], sizeof(dimension_buffer[0]), "%u",
+			 (uint32_t)screen.frame.size.width);
+		snprintf(dimension_buffer[1], sizeof(dimension_buffer[0]), "%u",
+			 (uint32_t)screen.frame.size.height);
+		snprintf(dimension_buffer[2], sizeof(dimension_buffer[0]), "%d",
+			 (int32_t)screen.frame.origin.x);
+		snprintf(dimension_buffer[3], sizeof(dimension_buffer[0]), "%d",
+			 (int32_t)screen.frame.origin.y);
+
+		snprintf(name_buffer, sizeof(name_buffer),
+			 "%.200s: %.12sx%.12s @ %.12s,%.12s",
+			 screen.localizedName.UTF8String, dimension_buffer[0],
+			 dimension_buffer[1], dimension_buffer[2],
+			 dimension_buffer[3]);
 
 		obs_property_list_add_int(display_list, name_buffer,
 					  display.displayID);

plugins/obs-ffmpeg/obs-ffmpeg-vaapi.c

@@ -629,12 +629,17 @@ static obs_properties_t *vaapi_properties(void *unused)
 		os_closedir(by_path_dir);
 	}
 	if (obs_property_list_item_count(list) == 0) {
-		char path[32] = "/dev/dri/renderD1";
+		char path[32];
 		for (int i = 28;; i++) {
-			sprintf(path, "/dev/dri/renderD1%d", i);
+			snprintf(path, sizeof(path), "/dev/dri/renderD1%d", i);
 			if (access(path, F_OK) == 0) {
-				char card[128] = "Card: ";
-				sprintf(card, "Card%d: %s", i - 28, path);
+				char card[128];
+				int ret = snprintf(card, sizeof(card),
+						   "Card%d: %s", i - 28, path);
+				if (ret >= sizeof(card))
+					blog(LOG_DEBUG,
+					     "obs-ffmpeg-vaapi: A format truncation may have occurred."
+					     " This can be ignored since it is quite improbable.");
 				obs_property_list_add_string(list, card, path);
 			} else {
 				break;

plugins/obs-filters/scale-filter.c

@@ -540,7 +540,8 @@ static obs_properties_t *scale_filter_properties(void *data)
 
 	for (size_t i = 0; i < NUM_DOWNSCALES; i++) {
 		char str[32];
-		snprintf(str, 32, "%dx%d", downscales[i].cx, downscales[i].cy);
+		snprintf(str, sizeof(str), "%dx%d", downscales[i].cx,
+			 downscales[i].cy);
 		obs_property_list_add_string(p, str, str);
 	}
 

plugins/obs-outputs/librtmp/amf.c

@@ -831,7 +831,7 @@ AMFProp_Dump(AMFObjectProperty *prop)
     if (name.av_len > 18)
         name.av_len = 18;
 
-    snprintf(strRes, 255, "Name: %18.*s, ", name.av_len, name.av_val);
+    snprintf(strRes, sizeof(strRes), "Name: %18.*s, ", name.av_len, name.av_val);
 
     if (prop->p_type == AMF_OBJECT)
     {
@@ -855,22 +855,22 @@ AMFProp_Dump(AMFObjectProperty *prop)
     switch (prop->p_type)
     {
     case AMF_NUMBER:
-        snprintf(str, 255, "NUMBER:\t%.2f", prop->p_vu.p_number);
+        snprintf(str, sizeof(str), "NUMBER:\t%.2f", prop->p_vu.p_number);
         break;
     case AMF_BOOLEAN:
-        snprintf(str, 255, "BOOLEAN:\t%s",
+        snprintf(str, sizeof(str), "BOOLEAN:\t%s",
                  prop->p_vu.p_number != 0.0 ? "TRUE" : "FALSE");
         break;
     case AMF_STRING:
-        snprintf(str, 255, "STRING:\t%.*s", prop->p_vu.p_aval.av_len,
+        snprintf(str, sizeof(str), "STRING:\t%.*s", prop->p_vu.p_aval.av_len,
                  prop->p_vu.p_aval.av_val);
         break;
     case AMF_DATE:
-        snprintf(str, 255, "DATE:\ttimestamp: %.2f, UTC offset: %d",
+        snprintf(str, sizeof(str), "DATE:\ttimestamp: %.2f, UTC offset: %d",
                  prop->p_vu.p_number, prop->p_UTCoffset);
         break;
     default:
-        snprintf(str, 255, "INVALID TYPE 0x%02x", (unsigned char)prop->p_type);
+        snprintf(str, sizeof(str), "INVALID TYPE 0x%02x", (unsigned char)prop->p_type);
     }
 
     RTMP_Log(RTMP_LOGDEBUG, "Property: <%s%s>", strRes, str);

plugins/obs-outputs/librtmp/hashswf.c

@@ -152,12 +152,12 @@ HTTP_get(struct HTTP_ctx *http, const char *url, HTTP_read_callback *cb)
     if (sb.sb_socket == INVALID_SOCKET)
         return HTTPRES_LOST_CONNECTION;
     i =
-        sprintf(sb.sb_buf,
+        snprintf(sb.sb_buf, RTMP_BUFFER_CACHE_SIZE,
                 "GET %s HTTP/1.0\r\nUser-Agent: %s\r\nHost: %s\r\nReferer: %.*s\r\n",
                 path, AGENT, host, (int)(path - url + 1), url);
     if (http->date[0])
-        i += sprintf(sb.sb_buf + i, "If-Modified-Since: %s\r\n", http->date);
-    i += sprintf(sb.sb_buf + i, "\r\n");
+        i += snprintf(sb.sb_buf + i, RTMP_BUFFER_CACHE_SIZE, "If-Modified-Since: %s\r\n", http->date);
+    i += snprintf(sb.sb_buf + i, RTMP_BUFFER_CACHE_SIZE, "\r\n");
 
     if (connect
             (sb.sb_socket, (struct sockaddr *)&sa, sizeof(struct sockaddr)) < 0)
@@ -455,12 +455,12 @@ make_unix_time(char *s)
  * Weekday, DD-MMM-YYYY HH:MM:SS GMT
  */
 static void
-strtime(time_t * t, char *s)
+strtime(time_t * t, char *s, size_t size)
 {
     struct tm *tm;
 
     tm = gmtime((time_t *) t);
-    sprintf(s, "%s, %02d %s %d %02d:%02d:%02d GMT",
+    snprintf(s, size, "%s, %02d %s %d %02d:%02d:%02d GMT",
             days[tm->tm_wday], tm->tm_mday, monthtab[tm->tm_mon],
             tm->tm_year + 1900, tm->tm_hour, tm->tm_min, tm->tm_sec);
 }
@@ -516,8 +516,9 @@ RTMP_HashSWF(const char *url, unsigned int *size, unsigned char *hash,
      * These fields must be present in this order. All fields
      * besides URL are fixed size.
      */
-    path = malloc(hpre.av_len + home.av_len + sizeof(DIRSEP ".swfinfo"));
-    sprintf(path, "%s%s" DIRSEP ".swfinfo", hpre.av_val, home.av_val);
+    size_t path_size = hpre.av_len + home.av_len + sizeof(DIRSEP ".swfinfo");
+    path = malloc(path_size);
+    snprintf(path, path_size, "%s%s" DIRSEP ".swfinfo", hpre.av_val, home.av_val);
 
     f = fopen(path, "r+");
     while (f)
@@ -651,7 +652,7 @@ RTMP_HashSWF(const char *url, unsigned int *size, unsigned char *hash,
 
             fprintf(f, "url: %.*s\n", i, url);
         }
-        strtime(&cnow, cctim);
+        strtime(&cnow, cctim, sizeof(cctim));
         fprintf(f, "ctim: %s\n", cctim);
 
         if (!in.first)

plugins/obs-outputs/librtmp/rtmp.c

@@ -781,7 +781,7 @@ add_addr_info(struct sockaddr_storage *service, socklen_t *addrlen, AVal *host,
 
     char portStr[8];
 
-    sprintf(portStr, "%d", port);
+    snprintf(portStr, sizeof(portStr), "%d", port);
 
     int err = getaddrinfo(hostname, portStr, &hints, &result);
 
@@ -2623,12 +2623,12 @@ typedef struct md5_ctx	MD5_CTX;
 static const AVal av_authmod_adobe = AVC("authmod=adobe");
 static const AVal av_authmod_llnw  = AVC("authmod=llnw");
 
-static void hexenc(unsigned char *inbuf, int len, char *dst)
+static void hexenc(unsigned char *inbuf, int len, char *dst, size_t size)
 {
     char *ptr = dst;
     while(len--)
     {
-        sprintf(ptr, "%02x", *inbuf++);
+        snprintf(ptr, size, "%02x", *inbuf++);
         ptr += 2;
     }
     *ptr = '\0';
@@ -2676,8 +2676,9 @@ PublisherAuth(RTMP *r, AVal *description)
             }
             else if(r->Link.pubUser.av_len && r->Link.pubPasswd.av_len)
             {
-                pubToken.av_val = malloc(r->Link.pubUser.av_len + av_authmod_adobe.av_len + 8);
-                pubToken.av_len = sprintf(pubToken.av_val, "?%s&user=%s",
+                size_t val_size = r->Link.pubUser.av_len + av_authmod_adobe.av_len + 8;
+                pubToken.av_val = malloc(val_size);
+                pubToken.av_len = snprintf(pubToken.av_val, val_size, "?%s&user=%s",
                                           av_authmod_adobe.av_val,
                                           r->Link.pubUser.av_val);
                 RTMP_Log(RTMP_LOGDEBUG, "%s, pubToken1: %s", __FUNCTION__, pubToken.av_val);
@@ -2777,8 +2778,9 @@ PublisherAuth(RTMP *r, AVal *description)
             RTMP_Log(RTMP_LOGDEBUG, "%s, b64(md5_2) = %s", __FUNCTION__, response);
 
             /* have all hashes, create auth token for the end of app */
-            pubToken.av_val = malloc(32 + B64INT_LEN + B64DIGEST_LEN + opaque.av_len);
-            pubToken.av_len = sprintf(pubToken.av_val,
+            size_t val_size = 32 + B64INT_LEN + B64DIGEST_LEN + opaque.av_len;
+            pubToken.av_val = malloc(val_size);
+            pubToken.av_len = snprintf(pubToken.av_val, val_size,
                                       "&challenge=%s&response=%s&opaque=%s",
                                       challenge2,
                                       response,
@@ -2845,8 +2847,9 @@ PublisherAuth(RTMP *r, AVal *description)
             }
             else if(r->Link.pubUser.av_len && r->Link.pubPasswd.av_len)
             {
-                pubToken.av_val = malloc(r->Link.pubUser.av_len + av_authmod_llnw.av_len + 8);
-                pubToken.av_len = sprintf(pubToken.av_val, "?%s&user=%s",
+                size_t val_size = r->Link.pubUser.av_len + av_authmod_llnw.av_len + 8;
+                pubToken.av_val = malloc(val_size);
+                pubToken.av_len = snprintf(pubToken.av_val, val_size, "?%s&user=%s",
                                           av_authmod_llnw.av_val,
                                           r->Link.pubUser.av_val);
                 RTMP_Log(RTMP_LOGDEBUG, "%s, pubToken1: %s", __FUNCTION__, pubToken.av_val);
@@ -2923,8 +2926,8 @@ PublisherAuth(RTMP *r, AVal *description)
 
             /* FIXME: handle case where user==NULL or nonce==NULL */
 
-            sprintf(nchex, "%08x", nc);
-            sprintf(cnonce, "%08x", rand());
+            snprintf(nchex, sizeof(nchex), "%08x", nc);
+            snprintf(cnonce, sizeof(cnonce), "%08x", rand());
 
             /* hash1 = hexenc(md5(user + ":" + realm + ":" + password)) */
             MD5_Init(&md5ctx);
@@ -2937,7 +2940,7 @@ PublisherAuth(RTMP *r, AVal *description)
             RTMP_Log(RTMP_LOGDEBUG, "%s, md5(%s:%s:%s) =>", __FUNCTION__,
                      user.av_val, realm, r->Link.pubPasswd.av_val);
             RTMP_LogHexString(RTMP_LOGDEBUG, md5sum_val, MD5_DIGEST_LENGTH);
-            hexenc(md5sum_val, MD5_DIGEST_LENGTH, hash1);
+            hexenc(md5sum_val, MD5_DIGEST_LENGTH, hash1, sizeof(hash1));
 
             /* hash2 = hexenc(md5(method + ":/" + app + "/" + appInstance)) */
             /* Extract appname + appinstance without query parameters */
@@ -2956,7 +2959,7 @@ PublisherAuth(RTMP *r, AVal *description)
             RTMP_Log(RTMP_LOGDEBUG, "%s, md5(%s:/%.*s) =>", __FUNCTION__,
                      method, apptmp.av_len, apptmp.av_val);
             RTMP_LogHexString(RTMP_LOGDEBUG, md5sum_val, MD5_DIGEST_LENGTH);
-            hexenc(md5sum_val, MD5_DIGEST_LENGTH, hash2);
+            hexenc(md5sum_val, MD5_DIGEST_LENGTH, hash2, sizeof(hash2));
 
             /* hash3 = hexenc(md5(hash1 + ":" + nonce + ":" + nchex + ":" + cnonce + ":" + qop + ":" + hash2)) */
             MD5_Init(&md5ctx);
@@ -2975,13 +2978,14 @@ PublisherAuth(RTMP *r, AVal *description)
             RTMP_Log(RTMP_LOGDEBUG, "%s, md5(%s:%s:%s:%s:%s:%s) =>", __FUNCTION__,
                      hash1, nonce.av_val, nchex, cnonce, qop, hash2);
             RTMP_LogHexString(RTMP_LOGDEBUG, md5sum_val, MD5_DIGEST_LENGTH);
-            hexenc(md5sum_val, MD5_DIGEST_LENGTH, hash3);
+            hexenc(md5sum_val, MD5_DIGEST_LENGTH, hash3, sizeof(hash3));
 
             /* pubToken = &authmod=<authmod>&user=<username>&nonce=<nonce>&cnonce=<cnonce>&nc=<nchex>&response=<hash3> */
             /* Append nonces and response to query string which already contains
              * user + authmod */
-            pubToken.av_val = malloc(64 + sizeof(authmod)-1 + user.av_len + nonce.av_len + sizeof(cnonce)-1 + sizeof(nchex)-1 + HEXHASH_LEN);
-            sprintf(pubToken.av_val,
+            size_t token_size = 64 + sizeof(authmod)-1 + user.av_len + nonce.av_len + sizeof(cnonce)-1 + sizeof(nchex)-1 + HEXHASH_LEN;
+            pubToken.av_val = malloc(token_size);
+            snprintf(pubToken.av_val, token_size,
                     "&nonce=%s&cnonce=%s&nc=%s&response=%s",
                     nonce.av_val, cnonce, nchex, hash3);
             pubToken.av_len = (int)strlen(pubToken.av_val);
@@ -3487,23 +3491,23 @@ DumpMetaData(AMFObject *obj)
             DumpMetaData(&prop->p_vu.p_object);
             break;
         case AMF_NUMBER:
-            snprintf(str, 255, "%.2f", prop->p_vu.p_number);
+            snprintf(str, sizeof(str), "%.2f", prop->p_vu.p_number);
             break;
         case AMF_BOOLEAN:
-            snprintf(str, 255, "%s",
+            snprintf(str, sizeof(str), "%s",
                      prop->p_vu.p_number != 0. ? "TRUE" : "FALSE");
             break;
         case AMF_STRING:
-            len = snprintf(str, 255, "%.*s", prop->p_vu.p_aval.av_len,
+            len = snprintf(str, sizeof(str), "%.*s", prop->p_vu.p_aval.av_len,
                            prop->p_vu.p_aval.av_val);
             if (len >= 1 && str[len-1] == '\n')
                 str[len-1] = '\0';
             break;
         case AMF_DATE:
-            snprintf(str, 255, "timestamp:%.2f", prop->p_vu.p_number);
+            snprintf(str, sizeof(str), "timestamp:%.2f", prop->p_vu.p_number);
             break;
         default:
-            snprintf(str, 255, "INVALID TYPE 0x%02x",
+            snprintf(str, sizeof(str), "INVALID TYPE 0x%02x",
                      (unsigned char)prop->p_type);
         }
         if (str[0] && prop->p_name.av_len)

plugins/obs-x264/obs-x264.c

@@ -361,7 +361,7 @@ static void log_x264(void *param, int level, const char *format, va_list args)
 	struct obs_x264 *obsx264 = param;
 	char str[1024];
 
-	vsnprintf(str, 1024, format, args);
+	vsnprintf(str, sizeof(str), format, args);
 	info("%s", str);
 
 	UNUSED_PARAMETER(level);

plugins/win-capture/game-capture.c

@@ -823,7 +823,7 @@ static void pipe_log(void *param, uint8_t *data, size_t size)
 static inline bool init_pipe(struct game_capture *gc)
 {
 	char name[64];
-	sprintf(name, "%s%lu", PIPE_NAME, gc->process_id);
+	snprintf(name, sizeof(name), "%s%lu", PIPE_NAME, gc->process_id);
 
 	if (!ipc_pipe_server_start(&gc->pipe, name, pipe_log, gc)) {
 		warn("init_pipe: failed to start pipe");

plugins/win-capture/graphics-hook/graphics-hook.c

@@ -65,7 +65,8 @@ static inline void wait_for_dll_main_finish(HANDLE thread_handle)
 bool init_pipe(void)
 {
 	char new_name[64];
-	sprintf(new_name, "%s%lu", PIPE_NAME, GetCurrentProcessId());
+	snprintf(new_name, sizeof(new_name), "%s%lu", PIPE_NAME,
+		 GetCurrentProcessId());
 
 	const bool success = ipc_pipe_client_open(&pipe, new_name);
 	if (!success) {