[clang-tools-extra] [clang-tidy] New bugprone-unsafe-format-string check (PR #168691)

[Daniel Krupp via cfe-commits]

dkrupp wrote:

I have executed the checker on several open source projects.

There are a few findings.
1) In twin, the destination buffer size is calculated properly (I think), but using snprintf or width specifier would not hurt.
2) Openssl the write length to `sfx` is protected with the if condition. 
3) The sprintf usage in sqlite could be problematic. The source string size is not trivially visible and the write length of the destination buffer is not protected. Using snprintf or width specifier would make the write much safer.

| Project | Reports |
|---------|---------|
| codechecker | [0 reports](https://codechecker-demo.eastus.cloudapp.azure.com/Default/reports?run=codechecker_v6.25.1_ednikru_dkrupp-bugprone-unsafe-format-string-pr_a8d28b5) |
| memcached | [0 reports](https://codechecker-demo.eastus.cloudapp.azure.com/Default/reports?run=memcached_1.6.38_ednikru_dkrupp-bugprone-unsafe-format-string-pr_a8d28b5) |
| tmux | [0 reports](https://codechecker-demo.eastus.cloudapp.azure.com/Default/reports?run=tmux_3.5a_ednikru_dkrupp-bugprone-unsafe-format-string-pr_a8d28b5) |
| curl | [0 reports](https://codechecker-demo.eastus.cloudapp.azure.com/Default/reports?run=curl_curl-8_12_1_ednikru_dkrupp-bugprone-unsafe-format-string-pr_a8d28b5) |
| twin | [3 reports](https://codechecker-demo.eastus.cloudapp.azure.com/Default/reports?run=twin_v0.9.0_ednikru_dkrupp-bugprone-unsafe-format-string-pr_a8d28b5) |
| vim | [0 reports](https://codechecker-demo.eastus.cloudapp.azure.com/Default/reports?run=vim_v9.1.1232_ednikru_dkrupp-bugprone-unsafe-format-string-pr_a8d28b5) |
| openssl | [2 reports](https://codechecker-demo.eastus.cloudapp.azure.com/Default/reports?run=openssl_openssl-3.4.1_ednikru_dkrupp-bugprone-unsafe-format-string-pr_a8d28b5) |
| sqlite | [1 reports](https://codechecker-demo.eastus.cloudapp.azure.com/Default/reports?run=sqlite_version-3.49.1_ednikru_dkrupp-bugprone-unsafe-format-string-pr_a8d28b5) |
| postgres | [0 reports](https://codechecker-demo.eastus.cloudapp.azure.com/Default/reports?run=postgres_REL_17_4_ednikru_dkrupp-bugprone-unsafe-format-string-pr_a8d28b5) |
| tinyxml2 | [0 reports](https://codechecker-demo.eastus.cloudapp.azure.com/Default/reports?run=tinyxml2_11.0.0_ednikru_dkrupp-bugprone-unsafe-format-string-pr_a8d28b5) |
| libwebm | [0 reports](https://codechecker-demo.eastus.cloudapp.azure.com/Default/reports?run=libwebm_libwebm-1.0.0.31_ednikru_dkrupp-bugprone-unsafe-format-string-pr_a8d28b5) |
| xerces | [0 reports](https://codechecker-demo.eastus.cloudapp.azure.com/Default/reports?run=xerces_v3.3.0_ednikru_dkrupp-bugprone-unsafe-format-string-pr_a8d28b5) |



https://github.com/llvm/llvm-project/pull/168691