osd: replace common tfp_sprintf patterns with direct formatting helpers

[sensei-hacker]

Summary

Replace 81 tfp_sprintf calls in osd.c with lightweight formatting helpers that skip format-string parsing, va_list marshaling, and per-character function-pointer dispatch. For example, we had 21 calls of the form:

tfp_sprintf(buff, "%c", c);

Which just writes a single known character into the buffer.

It is about 97% faster to do:

    buff[0] = c;
    buff[1] = '\0';

Changes

Five new static helper functions added near the top of osd.c:

• osdFormatIntUnit(buff, width, value, unit) — replaces "%Nd" and "%Nd%c" patterns (47 calls). Uses existing i2a() from typeconversion.c.
• osdWriteChar(buff, c) — replaces tfp_sprintf(buff, "%c", c) with direct assignment (21 calls)
• osdWriteChar2(buff, c1, c2) — replaces tfp_sprintf(buff, "%c%c", c1, c2) (12 calls)
• osdFormatTime_MMSS(buff, m, s) — replaces "%02d:%02d" with direct digit writes (2 calls)
• i2a_len(num, bf) — thin wrapper around i2a() that returns string length

Calls that use the return value of tfp_sprintf, zero-padded formats (%02d, %07d), or dynamic format strings were intentionally left unchanged.

Testing

• Built SITL — compiles clean
• Built SDMODELH7V2 (STM32H7 hardware target) — compiles clean, 35.8% flash usage
• Correctness checked via standalone benchmark harness: all five patterns produce output identical to tfp_sprintf across a range of values including negative numbers, zero, boundary values, and values wider than the field width
• Not tested on physical hardware — OSD display verification on a real FC would be appreciated

[qodo-code-review]

ⓘ You are approaching your monthly quota for Qodo. Upgrade your plan

Review Summary by Qodo

Replace common tfp_sprintf patterns with direct formatting helpers in OSD

✨ Enhancement

Walkthroughs

Description

• Replace 81 tfp_sprintf calls with lightweight formatting helpers
• Add five new static helper functions for common OSD formatting patterns
• Reduce code size and CPU overhead by skipping format-string parsing
• Simplify redundant RSSI_DBM display logic with unified formatting

Diagram

flowchart LR
  A["tfp_sprintf calls<br/>81 instances"] -->|"osdFormatIntUnit<br/>47 calls"| B["Integer with unit<br/>formatting"]
  A -->|"osdWriteChar<br/>21 calls"| C["Single char<br/>formatting"]
  A -->|"osdWriteChar2<br/>12 calls"| D["Two char<br/>formatting"]
  A -->|"osdFormatTime_MMSS<br/>2 calls"| E["MM:SS time<br/>formatting"]
  B --> F["Reduced code size<br/>and CPU overhead"]
  C --> F
  D --> F
  E --> F

Loading

File Changes

1. src/main/io/osd.c ✨ Enhancement +127/-85

Replace tfp_sprintf patterns with direct formatting helpers

• Added five new static helper functions (i2a_len, osdFormatIntUnit, osdWriteChar,
 osdWriteChar2, osdFormatTime_MMSS) near line 231 to replace common tfp_sprintf patterns
• Replaced 47 calls to tfp_sprintf with "%Nd" and "%Nd%c" patterns using osdFormatIntUnit
• Replaced 33 calls to tfp_sprintf with "%c" and "%c%c" patterns using osdWriteChar and
 osdWriteChar2
• Replaced 2 calls to tfp_sprintf with "%02d:%02d" pattern using osdFormatTime_MMSS
• Removed dead null-terminator write in drawStat_AverageEfficiency function
• Collapsed redundant if/else branches in RSSI_DBM display case where both branches became identical
 after conversion

src/main/io/osd.c

---

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (2) 📎 Requirement gaps (0)

1. osdFormatTime_MMSS uses modulo wrap 📘 Rule violation ✓ Correctness

Description

The new time formatter wraps minutes/seconds with % 100 instead of validating/clamping or using an
explicit sentinel for out-of-range values. This can turn invalid/overflowed time inputs into
plausible-looking values, making bad data indistinguishable from valid measurements.

Code

src/main/io/osd.c[R266-275]

+static void osdFormatTime_MMSS(char *buff, int m, int s)
+{
+    m %= 100; // clamp to two digits to prevent writing non-ASCII to display
+    s %= 100;
+    buff[0] = '0' + m / 10;
+    buff[1] = '0' + m % 10;
+    buff[2] = ':';
+    buff[3] = '0' + s / 10;
+    buff[4] = '0' + s % 10;
+    buff[5] = '\0';

Evidence

PR Compliance ID 1 requires validating externally sourced/variable inputs and using deterministic
fallback/sentinel behavior when values are invalid; the new helper silently wraps m/s via modulo
and then renders digits, which is ambiguous for out-of-range inputs.

src/main/io/osd.c[266-275]
Best Practice: Learned patterns

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`osdFormatTime_MMSS()` currently uses `% 100` to force two digits, which wraps out-of-range values into plausible-looking times instead of using deterministic validation/fallback behavior.
## Issue Context
Compliance requires validating variable inputs and using explicit deterministic fallback/sentinels when values are invalid, so bad inputs are not displayed as realistic values.
## Fix Focus Areas
- src/main/io/osd.c[266-275]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. i2a_len lacks INT_MIN guard ☑ 📘 Rule violation ⛯ Reliability

Description

The new i2a_len() passes signed ints to i2a(), which negates negative values and can
overflow/trigger undefined behavior for INT_MIN. This violates the requirement to validate numeric
ranges before use to avoid invalid computations.

Code

src/main/io/osd.c[R234-244]

+static int i2a_len(int num, char *bf)
+{
+    i2a(num, bf);
+    return (int)strlen(bf);
+}
+
+static void osdFormatIntUnit(char *buff, int width, int value, char unit)
+{
+    char tmp[12];
+    int len = i2a_len(value, tmp);
+    int pad = width - len;

Evidence

PR Compliance ID 1 requires preventing invalid computations via range validation; the new helper
relies on i2a() which performs num = -num for negatives, a known overflow case for INT_MIN in
C, and the new code does not guard against it.

src/main/io/osd.c[234-244]
src/main/common/typeconversion.c[74-81]
Best Practice: Learned patterns

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`i2a_len()` calls `i2a()` with signed ints without validating edge cases like `INT_MIN`, which can overflow when negated.
## Issue Context
Compliance requires range validation to avoid undefined/nondeterministic behavior when formatting values for OSD.
## Fix Focus Areas
- src/main/io/osd.c[234-250]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

ⓘ The new review experience is currently in Beta. Learn more

[github-actions]

Test firmware build ready — commit b72ae26

Download firmware for PR #11405

234 targets built. Find your board's .hex file by name on that page (e.g. MATEKF405SE.hex). Files are individually downloadable — no GitHub login required.

Development build for testing only. Use Full Chip Erase when flashing.