Rule 21.6 and snprintf()

[dejanpan]

We are using snprintf() function (https://linux.die.net/man/3/snprintf) in a framework that lets you program autonomous driving cars (our product).
The function is currently being used only for logging of console data on the secondary, non-real time computer.


However, both PCLint and Coverity static code analysis tools mark it as non-compliant:

Rule 21.6
The Standard Library input/output functions shall not be used
C90 [Unspecified 2–5, 16–18; Undefined 77–89; Implementation 53–68]
C99 [Unspecified 3–6, 34–37; Undefined 138–166, 186; Implementation J.3.12(14–32)] [Koenig 74]

Category: Required
Analysis: Decidable, Single Translation Unit
Applies to: C90, C99

Amplification
This rule applies to the functions that are specified as being provided by and, in C99,
their wide-character equivalents specified in Sections 7.24.2 and 7.24.3 of the C99 Standard as being
provided by .

None of these identifiers shall be used and no macro with one of these names shall be expanded.

Rationale
Streams and file I/O have unspecified, undefined and implementation-defined behaviours associated
with them.

See also
Rule 22.1, Rule 22.3, Rule 22.4, Rule 22.5, Rule 22. 6



We have a following rebuttal:
The problem is that if the source and destination string buffers in a snprintf() call are the same, the behavior is undefined.

These buffers are passed as char pointers to

Code:

snprintf()

. Checking that two pointer variables can never be the same in a program (in all possible executions) is called alias analysis. It is a static code analysis that static code analysis tools can do, but it usually is imprecise (can have false positives). So it is easier for them to ban the use of

Code:

snprintf()

altogether.

We claim that we can use snprintf() ONLY IF we ALWAYS check that the source and destination buffers are NOT the same before calling snprintf().

Code:

if source != destination:
  snprintf(...)
else:
  raise error

Pardon pseudo code but if I use actual C code it won't let me post this question.

Additionally, based on the rule's Rationale text it could be argued that the snprintf() call is OK since it's not a stream or file output call.

I would love to hear some thoughts from MISRA members.