The following LOCs have format/snprintf in version 3.9, (note: these LOCs are not existent in 3.12):
(std::snprintf)(string_buffer.data() + bytes, 13, "\u%04x\u%04x", LOC 15900
(std::snprintf)(&sn[0], sn.size(), "%.2X", byte); LOC 15938
(std::snprintf)(cr.data(), cr.size(), "%.2hhX", static_cast(element_type));, LOC 7956
(std::snprintf)(&sn[0], sn.size(), "%.2X", static_caststd::uint8_t(s.back()));, LOC 16032
std::ptrdiff_t len = (std::snprintf)(number_buffer.data(), number_buffer.size(), "%.*g", d, x);, LOC 16234
(std::snprintf)(string_buffer.data() + bytes, 7, "\u%04x", LOC 15894
*These have hardcoded string literals, an attacker cannot manipulate the format specifiers. However, the JSON header is outdated.
The following LOCs have format/snprintf in version 3.9, (note: these LOCs are not existent in 3.12):
(std::snprintf)(string_buffer.data() + bytes, 13, "\u%04x\u%04x", LOC 15900
(std::snprintf)(&sn[0], sn.size(), "%.2X", byte); LOC 15938
(std::snprintf)(cr.data(), cr.size(), "%.2hhX", static_cast(element_type));, LOC 7956
(std::snprintf)(&sn[0], sn.size(), "%.2X", static_caststd::uint8_t(s.back()));, LOC 16032
std::ptrdiff_t len = (std::snprintf)(number_buffer.data(), number_buffer.size(), "%.*g", d, x);, LOC 16234
(std::snprintf)(string_buffer.data() + bytes, 7, "\u%04x", LOC 15894
*These have hardcoded string literals, an attacker cannot manipulate the format specifiers. However, the JSON header is outdated.