How to properly write asnprintf without format string compiler warnings?

Question

I'd like to write a asnprintf function -- which is a wrapper around snprintf, but it mallocs the string according to its output size. Unfortunately when I compile I get a warning (promoted to error on my system) format string is not a string literal [-Werror,-Wformat-nonliteral].

I looked up the warning and apparently there are security concerns with passing a non-literal to printf functions, but in my case, I need to take in a format pointer, and pass that on.

Is there a good way around this that does not expose the same security vulnerability?

My function as is is as follows:

int
asnprintf(char **strp, int max_len, const char *fmt, ...)
{
    int len;
    va_list ap,ap2;

    va_start(ap, fmt);
    va_copy(ap2, ap);
    len = vsnprintf(NULL, 0, fmt, ap);
    if ( len > max_len)
        len = max_len;
    *strp = malloc(len+1);
    if (*strp == NULL)
        return -1;
    len = vsnprintf(*strp, len+1, fmt, ap2);
    va_end(ap2);
    va_end(ap);

    return len;
}

Answer 1

From my top comments ...

Just add __attribute__((__format__(__printf__,3,4))) to your asnprintf declaration and/or definition.

This will cue the compiler to not complain.

And, the further benefit is that it will check the variadic arguments passed to asnprintf against the format string.

So:

#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>

// put this in a .h file!?
int __attribute__((__format__(__printf__,3,4)))
asnprintf(char **strp, int max_len, const char *fmt, ...);

int
asnprintf(char **strp, int max_len, const char *fmt, ...)
{
    int len;
    va_list ap, ap2;

    va_start(ap, fmt);
    va_copy(ap2, ap);

    len = vsnprintf(NULL, 0, fmt, ap);
    if (len > max_len)
        len = max_len;
    *strp = malloc(len + 1);
    if (*strp == NULL)
        return -1;
    len = vsnprintf(*strp, len + 1, fmt, ap2);

    va_end(ap2);
    va_end(ap);

    return len;
}