Bug#728333: console-tools: FTBFS due to format string vulnerability

[Thorsten Glaser]

tags 728333 + patch
thanks

Dixi quod…

>This appears to be masked on other architectures because they
>errorneously don’t build with -Wformat -Werror=format-security

Oh, this is fun… when I build it in cowbuilder, it also lacks
these flags. So here is the obvious patch, but I can only test
it once it’s uploaded, either as NMU (which I’ll do in a week,
unless you tell me to do it now or disagree) or maintainer up-
load.

bye,
//mirabilos
-- 
“It is inappropriate to require that a time represented as
 seconds since the Epoch precisely represent the number of
 seconds between the referenced time and the Epoch.”
        -- IEEE Std 1003.1b-1993 (POSIX) Section B.2.2.2
diff -Nru console-tools-0.2.3/debian/changelog 
console-tools-0.2.3/debian/changelog
--- console-tools-0.2.3/debian/changelog        2013-10-26 21:27:53.000000000 
+0000
+++ console-tools-0.2.3/debian/changelog        2013-10-30 19:57:38.000000000 
+0000
@@ -1,3 +1,10 @@
+console-tools (2:0.2.3-72.1) unstable; urgency=low
+
+  * Non-maintainer upload.
+  * Fix FTBFS due to format string problem.
+
+ -- Thorsten Glaser <t...@mirbsd.de>  Wed, 30 Oct 2013 19:57:25 +0000
+
 console-tools (2:0.2.3-72) unstable; urgency=low
 
   * Really remove the dependency on dbs. Closes: #576051.
diff -Nru console-tools-0.2.3/debian/patches/600_formatstring.patch 
console-tools-0.2.3/debian/patches/600_formatstring.patch
--- console-tools-0.2.3/debian/patches/600_formatstring.patch   1970-01-01 
00:00:00.000000000 +0000
+++ console-tools-0.2.3/debian/patches/600_formatstring.patch   2013-10-30 
19:57:20.000000000 +0000
@@ -0,0 +1,11 @@
+--- a/lib/ksyms.c
++++ b/lib/ksyms.c
+@@ -1664,7 +1664,7 @@ list_charsets(FILE *f) {
+                       if(!strncmp(charsets[i].charset, mm[j], lth)) {
+                               if(ct++)
+                                       fprintf(f, ",");
+-                              fprintf(f, charsets[i].charset+lth);
++                              fprintf(f, "%s", charsets[i].charset+lth);
+                       }
+               }
+               fprintf(f, "}");
diff -Nru console-tools-0.2.3/debian/patches/series 
console-tools-0.2.3/debian/patches/series
--- console-tools-0.2.3/debian/patches/series   2013-10-15 18:27:35.000000000 
+0000
+++ console-tools-0.2.3/debian/patches/series   2013-10-30 19:56:57.000000000 
+0000
@@ -54,3 +54,4 @@
 540_KDSKBDIACRUC.patch
 550_fr.patch
 560_unicode_stop.patch
+600_formatstring.patch