Fix buffer overflow in plot.cc: replace sprintf with snprintf

[Copilot]

CodeQL alert #370 (cpp/overrunning-write, critical): two sprintf calls in src/plot.cc write into a 30-byte stack buffer with no size bound, risking overflow.

Change

• src/plot.cc — replace unbounded sprintf with snprintf(label, sizeof(label), ...) for both the Pango and fallback label formatting paths.

// Before
sprintf(label, "%d×10<sup>%d</sup>", lead, omag);

// After
snprintf(label, sizeof(label), "%d×10<sup>%d</sup>", lead, omag);

The format string "%d×10<sup>%d</sup>" can produce up to ~38 bytes (multi-byte UTF-8 ×, HTML tags, large integers) against a 30-byte buffer — snprintf caps the write at sizeof(label).

---

This change is 

[highperformancecoder]

Prefer to increase the buffer size to be large enough.

[highperformancecoder]

Please just increase the buffer size to be sufficiently large

[Copilot]

Prefer to increase the buffer size to be large enough.

Done — increased label from 30 to 64 bytes and reverted to sprintf (commit Increase label buffer from 30 to 64 bytes). The longest format string ("%d×10<sup>%d</sup>") can produce at most ~31 bytes, so 64 is well clear. CodeQL confirms 0 alerts.

[Copilot]

Pull request overview

This PR aims to address a critical CodeQL buffer-overrun finding in src/plot.cc related to formatting log-axis labels into a fixed-size stack buffer.

Changes:

• Increased the stack buffer used by logAxisLabel() from 30 bytes to 64 bytes in src/plot.cc.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.