Potential fix for code scanning alert no. 48: Wrong type of arguments to formatting function

[bgotowal]

Potential fix for https://github.com/intel/confidential-computing.tee.dcap/security/code-scanning/48

Use a correctly typed precision argument for "%.*s" by converting numbytes (size_t) to int only after bounding it to INT_MAX. This keeps behavior the same (log up to full header line) while removing undefined behavior from varargs mismatch.

Best fix in this file/region:

• Edit tools/SGXPlatformRegistration/src/network/src/MPSynchronicSender.cpp in responseHeaderCallBack around line 83.
• Add <climits> include (for INT_MAX).
• Replace the direct use of numbytes in the log call with a bounded int local variable, e.g.:
  • int logLen = (numbytes > static_cast<size_t>(INT_MAX)) ? INT_MAX : static_cast<int>(numbytes);
  • then call network_log_message_aux(..., "%.*s", logLen, b);

No functional behavior change beyond making the formatting call type-safe in all builds.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

This PR addresses code-scanning alert #48 by making the printf-style precision argument for "%.*s" type-correct in the libcurl response header callback, avoiding varargs undefined behavior while preserving existing logging behavior.

Changes:

• Added <climits> to access INT_MAX.
• Introduced a bounded int (logLen) derived from numbytes (a size_t) and used it as the "%.*s" precision argument in network_log_message_aux.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.