AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 20 Bitcoin

fmt: fix and prevent future use of unsupported format spec "zu"

Public commit record

What the developer wrote

Authored by Jon Griffiths

65/100 · Adequate
fmt: fix and prevent future use of unsupported format spec "zu"

Reported-by: oroderico <oroderico@users.noreply.github.com>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
The short version

What changed, and why it matters

This commit fixes the use of the "%zu" printf format specifier, which is not supported by the ESP32 toolchain used in this project. The unsupported format could cause log messages and user-facing strings to display incorrect or garbage values. The commit also adds a CI check to prevent future use of "%zu". There is no direct evidence in the commit that this caused a security vulnerability such as information disclosure or memory corruption, but it is a code-quality fix that removes undefined/unsupported formatting behavior.

Recommended action

Treat as a low-risk maintainability/portability fix. Review whether any %zu usage elsewhere in the codebase (outside main/ and libjade/) remains unsupported. No urgent security response is indicated by the diff alone.

Security signals we found

01

Use of unsupported printf format specifier %zu on embedded target

02

Potential for malformed log/UI output due to undefined format behavior

03

Addition of CI guard to prevent recurrence

04

No direct evidence of memory corruption, buffer overflow, or information leak in diff

Risk score

Why this scored 20/100

Our methodology →
Potential impact 3/30
Exploitability 2/25
Stealth signal 2/15
Affected reach 3/15
Confidence 7/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.