Hi!
The patch calls snprintf() to get the resulting formatted string length,
but does not check for error values. It then uses the unchecked returned
length for a VLA, which tends to be a controversial usage, as that
allocates a potentially arbitrary size from the stack (with no easy way
to check for errors), and where I'm not sure the dillo project might have
policies against its use. I'd tend to default to allocating on the heap
on these cases. The second snprintf() also is not being checked for errors
(which would be unlikely if the first one succeeded, but personally I'd
check them anyway out of defensive programming).
The patch is also attributed to the package maintainer which seems
suspect, and the boilerplate patch metadata seems in need of an update.
Thanks,
Guillem