Question

Possible Duplicate:
Calling NSLog from C++: “Format string is not a string literal (potentially insecure)”
Why is my string potentially unsecure in my iOS application?

I have this code to log the number of elements in my NSMutableDictionary called “myDictionary” in objective-c.

NSLog([NSString stringWithFormat:@"%d", [myDictionary count]]);

XCode warns me that “Format string is not a string literal. Potentially insecure.”

Why? Aren’t I using a secure formatted string as opposed to directly casting the count?

Answer 1

The string you pass to NSLog is interpreted like a format string, so the appropriate way to do this is NSLog(@"%d", myDictionary.count);.

The reason it’s “unsafe” is that it’s possible to crash the program in cases like this:

NSString *someString = @"The integer format specifier is %d";
NSLog([NSString stringWithFormat:@"%@", someString]);

The input to NSLog is treated like a format string, but there’s no corresponding value for the %d at the end. In your case it’s not a problem, but the compiler isn’t smart enough to figure that out.