Source: dnprogs Version: 2.57 Severity: minor User: [email protected] Usertags: hardening-format-security hardening
the package dnprogs fails to compile with the new hardened compiler flags dpkg-buildflag outputs [0]. The problematic flag is: -Werror=format-security See the attached buildlog. Snippet: g++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -fno-rtti -fno-exceptions -pipe -fdollars-in-identifiers -fsigned-char -Wall -Wno-unused -Wno-uninitialized -I../libdap -I../include -DVERSION=\"2.56\" -D_XOPEN_SOURCE -D_BSD_SOURCE -D_GNU_SOURCE -D_SVID_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -DSHADOW_PWD -O2 -fno-rtti -fno-exceptions -pipe -fdollars-in-identifiers -fsigned-char -Wall -Wno-unused -Wno-uninitialized -I../libdap -I../include -DVERSION=\"2.56\" -D_XOPEN_SOURCE -D_BSD_SOURCE -D_GNU_SOURCE -D_SVID_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -DSHADOW_PWD -O2 -D_FORTIFY_SOURCE=2 -c -o dndir.o dndir.cc dndir.cc: In function 'void print_long(dap_name_message*, dap_attrib_message*, dap_date_message*, dap_protect_message*)': dndir.cc:775:17: error: format not a string literal and no format arguments [-Werror=format-security] The buildflags are not exported in debian, but can be enabled e.g. by adding this to debian/rules: DPKG_EXPORT_BUILDFLAGS = 1 include /usr/share/dpkg/buildflags.mk or by setting dh compat to level 9 Please fix the issues and maybe also enable the hardened build in debian. [0] http://lists.debian.org/debian-devel-announce/2011/09/msg00001.html
dnprogs.log.gz
Description: GNU Zip compressed data
signature.asc
Description: OpenPGP digital signature
