bugGNU FreeIPMI - Bugs: bug #36591, error: format not a string literal...

 
 

bug #36591: error: format not a string literal and no format arguments [-Werror=format-security]

Submitted by:  Yaroslav Halchenko <yoh>
Submitted on:  Tue 05 Jun 2012 01:00:00 AM UTC  
 
Category: NoneSeverity: 3 - Normal
Priority: 5 - NormalItem Group: None
Status: NonePrivacy: Public
Assigned to: NoneOpen/Closed: Closed
Operating System: GNU/Linux

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 05 Jun 2012 09:06:19 PM UTC, comment #2:

Fixed, it'll be in the next release of FreeIPMI

Albert Chu <chu11>
Project Administrator
Tue 05 Jun 2012 05:56:41 PM UTC, comment #1:

(As discussed on mailing list)

A lot of those functions have snprintf-like return values, which is why I call snprintf the way I do. I'm not 100% sure how to deal with this cleanly. strncpy + strlen I don't think handle the end '\0' character the same. I will research this a bit.

Is there a suggested way to handle this from the Debian folks.

Albert Chu <chu11>
Project Administrator
Tue 05 Jun 2012 01:00:00 AM UTC, original submission:

There is an ongoing effort
http://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
to provide "hardened" builds of the software for Debian. so I have tried to
build freeipmi with suggested flags and ran into:

/bin/sh ../../libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -I../../config -D_GNU_SOURCE -D_REENTRANT -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security
-Werror=format-security -c -o libmiscutil_la-conffile.lo `test -f 'conffile.c' || echo './'`conffile.c
libtool: compile: gcc -DHAVE_CONFIG_H -I. -I../../config -D_GNU_SOURCE -D_REENTRANT -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -c conffile.c
-fPIC -DPIC -o .libs/libmiscutil_la-conffile.o
conffile.c: In function ‘conffile_errmsg’:
conffile.c:152:23: error: format not a string literal and no format arguments [-Werror=format-security]
conffile.c:152:23: error: format not a string literal and no format arguments [-Werror=format-security]
conffile.c:155:23: error: format not a string literal and no format arguments [-Werror=format-security]
conffile.c:155:23: error: format not a string literal and no format arguments [-Werror=format-security]
conffile.c:159:23: error: format not a string literal and no format arguments [-Werror=format-security]
conffile.c:159:23: error: format not a string literal and no format arguments [-Werror=format-security]
conffile.c:179:23: error: format not a string literal and no format arguments [-Werror=format-security]
conffile.c:179:23: error: format not a string literal and no format arguments [-Werror=format-security]
cc1: some warnings being treated as errors
make[3]: *** [libmiscutil_la-conffile.lo] Error 1
...

which are due to the use of snprintf in the scenario where format string is not actually especting any format options.

Here is few other locations of similar uses:

util/ipmi-device-types-util.c:58:3: error: format not a string literal and no format arguments [-Werror=format-security]
util/ipmi-sensor-and-event-code-tables-util.c:1111:3: error: format not a string literal and no format arguments [-Werror=format-security]
util/ipmi-sensor-util.c:67:3: error: format not a string literal and no format arguments [-Werror=format-security]

Yaroslav Halchenko <yoh>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by chu11 (Posted a comment)
  • -unavailable- added by yoh (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follows 1 latest change.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 05 Jun 2012 09:06:19 PM UTCchu11Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1