bugGNU FreeIPMI - Bugs: bug #36591, error: format not a string literal...

 
 

bug #36591: error: format not a string literal and no format arguments [-Werror=format-security]

Submitter:  Yaroslav Halchenko <yoh>
Submitted:  Tue 05 Jun 2012 01:00:00 AM UTC
   
 
Category:  None Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  None Privacy:  Public
Assigned to:  None Open/Closed:  Closed
Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 05 Jun 2012 09:06:19 PM UTC, comment #2: 

Fixed, it'll be in the next release of FreeIPMI

Albert Chu <chu11>
Group administrator
Tue 05 Jun 2012 05:56:41 PM UTC, comment #1: 

(As discussed on mailing list)

A lot of those functions have snprintf-like return values, which is why I call snprintf the way I do.  I'm not 100% sure how to deal with this cleanly.  strncpy + strlen I don't think handle the end '\0' character the same. I will research this a bit.

Is there a suggested way to handle this from the Debian folks.

Albert Chu <chu11>
Group administrator
Tue 05 Jun 2012 01:00:00 AM UTC, original submission:  

There is an ongoing effort
http://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
to provide "hardened" builds of the software for Debian.  so I have tried to
build freeipmi with suggested flags and ran into:

/bin/sh ../../libtool  --tag=CC   --mode=compile gcc -DHAVE_CONFIG_H -I. -I../../config  -D_GNU_SOURCE -D_REENTRANT -D_FORTIFY_SOURCE=2  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security
-Werror=format-security -c -o libmiscutil_la-conffile.lo `test -f 'conffile.c' || echo './'`conffile.c
libtool: compile:  gcc -DHAVE_CONFIG_H -I. -I../../config -D_GNU_SOURCE -D_REENTRANT -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -c conffile.c
-fPIC -DPIC -o .libs/libmiscutil_la-conffile.o
conffile.c: In function ‘conffile_errmsg’:
conffile.c:152:23: error: format not a string literal and no format arguments [-Werror=format-security]
conffile.c:152:23: error: format not a string literal and no format arguments [-Werror=format-security]
conffile.c:155:23: error: format not a string literal and no format arguments [-Werror=format-security]
conffile.c:155:23: error: format not a string literal and no format arguments [-Werror=format-security]
conffile.c:159:23: error: format not a string literal and no format arguments [-Werror=format-security]
conffile.c:159:23: error: format not a string literal and no format arguments [-Werror=format-security]
conffile.c:179:23: error: format not a string literal and no format arguments [-Werror=format-security]
conffile.c:179:23: error: format not a string literal and no format arguments [-Werror=format-security]
cc1: some warnings being treated as errors
make[3]: * [libmiscutil_la-conffile.lo] Error 1
...

which are due to the use of snprintf in the scenario where format string is not actually especting any format options.

Here is few other locations of similar uses:

util/ipmi-device-types-util.c:58:3: error: format not a string literal and no format arguments [-Werror=format-security]
util/ipmi-sensor-and-event-code-tables-util.c:1111:3: error: format not a string literal and no format arguments [-Werror=format-security]
util/ipmi-sensor-util.c:67:3: error: format not a string literal and no format arguments [-Werror=format-security]


Yaroslav Halchenko <yoh>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by chu11 (Posted a comment)
  • -email is unavailable- added by yoh (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2012-06-05 chu11 Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code