no more sprintf

NEWS.md

@@ -1,5 +1,7 @@
 # testthat (development version)
 
+* The embedded version of Catch no longer uses `sprintf()`.
+
 # testthat 3.1.5
 
 * Deprecation warnings are no longer captured by `expect_warning(code, NA)`,

inst/include/testthat/vendor/catch.h

@@ -9473,6 +9473,10 @@ Ptr<IStreamingReporter> addReporter( Ptr<IStreamingReporter> const& existingRepo
 // #included from: catch_reporter_bases.hpp
 #define TWOBLUECUBES_CATCH_REPORTER_BASES_HPP_INCLUDED
 
+#include <iomanip>
+#include <iostream>
+#include <sstream>
+
 #include <cstring>
 #include <cfloat>
 #include <cstdio>
@@ -9481,24 +9485,10 @@ Ptr<IStreamingReporter> addReporter( Ptr<IStreamingReporter> const& existingRepo
 namespace Catch {
 
     namespace {
-        // Because formatting using c++ streams is stateful, drop down to C is required
-        // Alternatively we could use stringstream, but its performance is... not good.
         std::string getFormattedDuration( double duration ) {
-            // Max exponent + 1 is required to represent the whole part
-            // + 1 for decimal point
-            // + 3 for the 3 decimal places
-            // + 1 for null terminator
-            const size_t maxDoubleSize = DBL_MAX_10_EXP + 1 + 1 + 3 + 1;
-            char buffer[maxDoubleSize];
-
-            // Save previous errno, to prevent sprintf from overwriting it
-            ErrnoGuard guard;
-#ifdef _MSC_VER
-            sprintf_s(buffer, "%.3f", duration);
-#else
-            sprintf(buffer, "%.3f", duration);
-#endif
-            return std::string(buffer);
+            std::stringstream ss;
+            ss << std::setprecision(4) << duration;
+            return ss.str();
         }
     }