Add a snprinf wrapper which checks that the buffer was big enough

If we scale our buffer to be wide enough for the format string, we
should expect that the calculation was correct.

char_array_0() invocations are removed, since snprintf nul-terminates
the output in any case.

A similar wrapper is used for strftime calls, but only in timedatectl.c.

1 files changed, 2 insertions, 3 deletions

diff --git a/src/fsck/fsck.c b/src/fsck/fsck.c
index 20b7940948..78ceeb6fab 100644
--- a/src/fsck/fsck.c
+++ b/src/fsck/fsck.c
@@ -222,7 +222,7 @@ int main(int argc, char *argv[]) {
         const char *device, *type;
         bool root_directory;
         int progress_pipe[2] = { -1, -1 };
-        char dash_c[2+10+1];
+        char dash_c[sizeof("-C")-1 + DECIMAL_STR_MAX(int) + 1];
         struct stat st;
 
         if (argc > 2) {
@@ -336,8 +336,7 @@ int main(int argc, char *argv[]) {
                 cmdline[i++] = "-f";
 
         if (progress_pipe[1] >= 0) {
-                snprintf(dash_c, sizeof(dash_c), "-C%i", progress_pipe[1]);
-                char_array_0(dash_c);
+                xsprintf(dash_c, "-C%i", progress_pipe[1]);
                 cmdline[i++] = dash_c;
         }