Fix buffer overflow vulnerability in format()

[faratech]

Summary

Fix a buffer overflow vulnerability in the format() function where user-controlled format strings (via +format argument) could overflow the fixed 391-byte output buffer.

Vulnerability Details

• Type: Stack buffer overflow (CWE-120)
• Attack Vector: Command line argument +format
• Impact: Stack smashing / potential code execution

Proof of Concept

# Before fix - crashes with stack smashing
./ddate +"%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%."
*** stack smashing detected ***: terminated

Changes

• Add bufsize parameter to format() function
• Add bounds checking before all buffer writes
• Replace strcpy with length-limited memcpy
• Replace sprintf with snprintf
• Check remaining buffer space in main loop condition

Output is now safely truncated if it would exceed buffer size.

[danwdart]

That sounds reasonable enough to me. Anyone against?