Macros are frequently used in the remediation of existing code to globally replace one identifier with another, for example, when an existing API changes. While there is always some risk involved, this practice becomes particularly dangerous if a function name is replaced with the function name of a deprecated or obsolescent functions. Deprecated functions are defined by the C99 standard and Technical Corrigenda. Obsolescent functions are defined by rule MSC34-C. Do not use deprecated or obsolescent obsolete functions.
While compliance with rule MSC34-C. Do not use deprecated or obsolescent obsolete functions guarantees compliance with this recommendation, the emphasis of this recommendation is the extremely risky and deceptive practice of replacing functions with less secure alternatives.
...
The Internet Systems Consortium's (ISC) Dynamic Host Configuration Protocol (DHCP) contained a vulnerability that introduced several potential buffer overflow conditions VU#654390. ISC DHCP makes use of the vsnprintf() function for writing various log file strings, which is defined in the Open Group Base Specifications Issue 6 [Open Group 2004] as well as C99 [ISO/IEC 9899:1999]. For systems that do not support vsnprintf(), a C include file was created that defines the vsnprintf() function to vsprintf(), as shown in this noncompliant code example:
...
CERT C++ Secure Coding Standard: PRE09-CPP. Do not replace secure functions with less secure functions
ISO/IEC 9899:1999 Section 7.19.6.12, "The vsnprintf function"
ISO/IEC TR 24772 "XYS Executing or Loading Untrusted Code"
MITRE CWE: CWE-684, "Failure to Provide Specified Functionality"
Bibliography
[Open Group 2004] vsnprintf()
[Seacord 2005a] Chapter 6, "Formatted Output"
[VU#654390]
...
PRE08-C. Guarantee that header file names are unique 01. Preprocessor (PRE) PRE10-C. Wrap multi-statement macros in a do-while loop