@@ -16,6 +16,11 @@ # implementation (slower).
 #
 # Define NEEDS_LIBICONV if linking with libc is not enough (eg. Darwin).
 #
+# Define NO_C99_FORMAT if your formatted IO functions (printf/scanf et.al.)
+# do not support the 'size specifiers' introduced by C99, namely ll, hh,
+# j, z, t. (representing long long int, char, intmax_t, size_t, ptrdiff_t).
+# some C compilers supported these specifiers prior to C99 as an extension.
+#
 
 #-include config.mak
 
@@ -126,6 +131,9 @@ CFLAGS += -DNO_ICONV
 endif
 ifdef NO_STRCASESTR
 	CFLAGS += -DNO_STRCASESTR
+endif
+ifdef NO_C99_FORMAT
+	CFLAGS += -DNO_C99_FORMAT
 endif
 ifdef NO_OPENSSL
 	CFLAGS += -DNO_OPENSSL

@@ -30,6 +30,7 @@ /* List info about all cache entries on stdout */
 extern int cache_ls(const char *path);
 
 /* Print a message to stdout */
+__attribute__((format (printf,1,2)))
 extern void cache_log(const char *format, ...);
 
 extern unsigned long hash_str(const char *str);

@@ -610,7 +610,7 @@
 	hash = hash_str(path);
 	if (ctx.cfg.project_list)
 		hash += hash_str(ctx.cfg.project_list);
-	cached_rc = xstrdup(fmt("%s/rc-%8x", ctx.cfg.cache_root, hash));
+	cached_rc = xstrdup(fmt("%s/rc-%8lx", ctx.cfg.cache_root, hash));
 
 	if (stat(cached_rc, &st)) {
 		/* Nothing is cached, we need to scan without forking. And

@@ -295,6 +295,7 @@ filepair_fn fn, const char *prefix, int ignorews);
 
 extern void cgit_diff_commit(struct commit *commit, filepair_fn fn);
 
+__attribute__((format (printf,1,2)))
 extern char *fmt(const char *format,...);
 
 extern struct commitinfo *cgit_parse_commit(struct commit *commit);

@@ -95,7 +95,7 @@ const char *t = txt;
 	while(t && *t){
 		int c = *t;
 		if (c=='<' || c=='>' || c=='&') {
-			write(htmlfd, txt, t - txt);
+			html_raw(txt, t - txt);
 			if (c=='>')
 				html("&gt;");
 			else if (c=='<')
@@ -116,7 +116,7 @@ const char *t = txt;
 	while(t && *t && len--){
 		int c = *t;
 		if (c=='<' || c=='>' || c=='&') {
-			write(htmlfd, txt, t - txt);
+			html_raw(txt, t - txt);
 			if (c=='>')
 				html("&gt;");
 			else if (c=='<')
@@ -128,7 +128,7 @@ }
 		t++;
 	}
 	if (t!=txt)
-		write(htmlfd, txt, t - txt);
+		html_raw(txt, t - txt);
 	if (len<0)
 		html("...");
 }
@@ -139,7 +139,7 @@ const char *t = txt;
 	while(t && *t){
 		int c = *t;
 		if (c=='<' || c=='>' || c=='\'' || c=='\"') {
-			write(htmlfd, txt, t - txt);
+			html_raw(txt, t - txt);
 			if (c=='>')
 				html("&gt;");
 			else if (c=='<')
@@ -163,8 +163,8 @@ while(t && *t){
 		int c = *t;
 		const char *e = url_escape_table[c];
 		if (e && c!='+' && c!='&' && c!='+') {
-			write(htmlfd, txt, t - txt);
-			write(htmlfd, e, 3);
+			html_raw(txt, t - txt);
+			html_raw(e, 3);
 			txt = t+1;
 		}
 		t++;
@@ -180,8 +180,8 @@ while(t && *t){
 		int c = *t;
 		const char *e = url_escape_table[c];
 		if (e) {
-			write(htmlfd, txt, t - txt);
-			write(htmlfd, e, 3);
+			html_raw(txt, t - txt);
+			html_raw(e, 3);
 			txt = t+1;
 		}
 		t++;
@@ -249,7 +249,7 @@ filename, strerror(errno), errno);
 		return -1;
 	}
 	while((len = fread(buf, 1, 4096, f)) > 0)
-		write(htmlfd, buf, len);
+		html_raw(buf, len);
 	fclose(f);
 	return 0;
 }

@@ -5,7 +5,10 @@ extern int htmlfd;
 
 extern void html_raw(const char *txt, size_t size);
 extern void html(const char *txt);
+
+__attribute__((format (printf,1,2)))
 extern void htmlf(const char *format,...);
+
 extern void html_status(int code, const char *msg, int more_headers);
 extern void html_txt(const char *txt);
 extern void html_ntxt(int len, const char *txt);

@@ -52,7 +52,7 @@ buf = read_sha1_file(sha1, &type, &size);
 	if (!buf)
 		return -1;
 	buf[size] = '\0';
-	write(htmlfd, buf, size);
+	html_raw(buf, size);
 	return 0;
 }
 
@@ -108,5 +108,5 @@ ctx.page.mimetype = "text/plain";
 	}
 	ctx.page.filename = path;
 	cgit_print_http_headers(&ctx);
-	write(htmlfd, buf, size);
+	html_raw(buf, size);
 }

@@ -92,7 +92,7 @@ info->status == DIFF_STATUS_COPIED ? "copied" : "renamed",
 		      info->old_path);
 	html("</td><td class='right'>");
 	if (info->binary) {
-		htmlf("bin</td><td class='graph'>%d -> %d bytes",
+		htmlf("bin</td><td class='graph'>%ld -> %ld bytes",
 		      info->old_size, info->new_size);
 		return;
 	}

@@ -228,8 +228,7 @@ free_commit_list(commit->parents);
 		commit->parents = NULL;
 	}
 	if (pager) {
-		htmlf("</table><div class='pager'>",
-		     columns);
+		html("</table><div class='pager'>");
 		if (ofs > 0) {
 			cgit_log_link("[prev]", NULL, NULL, ctx.qry.head,
 				      ctx.qry.sha1, ctx.qry.vpath,

@@ -6,12 +6,6 @@ * Licensed under GNU General Public License v2
  *   (see COPYING for full license text)
  */
 
-/* This is needed for strcasestr to be defined by <string.h> */
-#define _GNU_SOURCE 1
-#include <string.h>
-
-#include <time.h>
-
 #include "cgit.h"
 #include "html.h"
 #include "ui-shared.h"

@@ -5,6 +5,12 @@ #include "html.h"
 #include "ui-shared.h"
 #include "ui-stats.h"
 
+#ifdef NO_C99_FORMAT
+#define SZ_FMT "%u"
+#else
+#define SZ_FMT "%zu"
+#endif
+
 #define MONTHS 6
 
 struct authorstat {
@@ -283,10 +289,10 @@ date = string_list_lookup(items, tmp);
 			if (date)
 				subtotal += (size_t)date->util;
 		}
-		htmlf("<td class='%s'>%d</td>", centerclass, subtotal);
+		htmlf("<td class='%s'>%ld</td>", centerclass, subtotal);
 		total += subtotal;
 	}
-	htmlf("<td class='%s'>%d</td></tr>", rightclass, total);
+	htmlf("<td class='%s'>%ld</td></tr>", rightclass, total);
 }
 
 void print_authors(struct string_list *authors, int top,
@@ -335,16 +341,16 @@ date = string_list_lookup(items, tmp);
 			if (!date)
 				html("<td>0</td>");
 			else {
-				htmlf("<td>%d</td>", date->util);
+				htmlf("<td>"SZ_FMT"</td>", (size_t)date->util);
 				total += (size_t)date->util;
 			}
 		}
-		htmlf("<td class='sum'>%d</td></tr>", total);
+		htmlf("<td class='sum'>%ld</td></tr>", total);
 	}
 
 	if (top < authors->nr)
 		print_combined_authorrow(authors, top, authors->nr - 1,
-			"Others (%d)", "left", "", "sum", period);
+			"Others (%ld)", "left", "", "sum", period);
 
 	print_combined_authorrow(authors, 0, authors->nr - 1, "Total",
 		"total", "sum", "sum", period);
@@ -367,7 +373,7 @@ code = ctx->qry.period;
 
 	i = cgit_find_stats_period(code, &period);
 	if (!i) {
-		cgit_print_error(fmt("Unknown statistics type: %c", code));
+		cgit_print_error(fmt("Unknown statistics type: %c", code[0]));
 		return;
 	}
 	if (i > ctx->repo->max_stats) {

@@ -46,7 +46,7 @@ if (ctx.repo->source_filter) {
 		html("<td class='lines'><pre><code>");
 		ctx.repo->source_filter->argv[1] = xstrdup(name);
 		cgit_open_filter(ctx.repo->source_filter);
-		write(STDOUT_FILENO, buf, size);
+		html_raw(buf, size);
 		cgit_close_filter(ctx.repo->source_filter);
 		html("</code></pre></td></tr></table>\n");
 		return;
@@ -67,7 +67,7 @@
 	html("<table summary='blob content' class='bin-blob'>\n");
 	html("<tr><th>ofs</th><th>hex dump</th><th>ascii</th></tr>");
 	for (ofs = 0; ofs < size; ofs += ROWLEN, buf += ROWLEN) {
-		htmlf("<tr><td class='right'>%04x</td><td class='hex'>", ofs);
+		htmlf("<tr><td class='right'>%04lx</td><td class='hex'>", ofs);
 		for (idx = 0; idx < ROWLEN && ofs + idx < size; idx++)
 			htmlf("%*s%02x",
 			      idx == 16 ? 4 : 1, "",
@@ -108,7 +108,7 @@ curr_rev, path);
 	html(")\n");
 
 	if (ctx.cfg.max_blob_size && size / 1024 > ctx.cfg.max_blob_size) {
-		htmlf("<div class='error'>blob size (%dKB) exceeds display size limit (%dKB).</div>",
+		htmlf("<div class='error'>blob size (%ldKB) exceeds display size limit (%dKB).</div>",
 				size / 1024, ctx.cfg.max_blob_size);
 		return;
 	}