Package: jabberd14 Version: 1.6.1.1-5.1 Severity: normal Tags: upstream patch User: [email protected] Usertags: hardening-format-security
jabberd14 fails to build with -Werror=format-security compiler option. Build log in Ubuntu: https://launchpad.net/ubuntu/+source/jabberd14/1.6.1.1-5.1build1/+build/2949505/+files/buildlog_ubuntu-precise-i386.jabberd14_1.6.1.1-5.1build1_FAILEDTOBUILD.txt.gz See also: http://wiki.debian.org/Hardening http://lists.debian.org/debian-devel-announce/2011/09/msg00001.html Patch from Ubuntu attached. https://launchpad.net/ubuntu/+source/jabberd14/1.6.1.1-5.1ubuntu1 -- System Information: Debian Release: wheezy/sid APT prefers oneiric-updates APT policy: (500, 'oneiric-updates'), (500, 'oneiric-security'), (500, 'oneiric-proposed'), (500, 'oneiric'), (100, 'oneiric-backports') Architecture: i386 (i686) Kernel: Linux 3.0.0-14-generic (SMP w/2 CPU cores) Locale: LANG=ru_RU.UTF-8, LC_CTYPE=ru_RU.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash
#! /bin/sh /usr/share/dpatch/dpatch-run ## format-security.dpatch by Ilya Barygin <[email protected]> ## ## All lines beginning with `## DP:' are a description of the patch. ## DP: Fix FTBFS with -Werror=format-security @DPATCH@ diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' jabberd14-1.6.1.1~/dialback/dialback.cc jabberd14-1.6.1.1/dialback/dialback.cc --- jabberd14-1.6.1.1~/dialback/dialback.cc 2007-04-07 23:43:18.000000000 +0400 +++ jabberd14-1.6.1.1/dialback/dialback.cc 2011-11-26 16:50:26.000000000 +0400 @@ -543,7 +543,7 @@ messages_get(lang, N_("tls")), dc->m->ssl == NULL ? messages_get(lang, N_("no")) : messages_get(lang, N_("yes"))); } else { - snprintf(ip_str, sizeof(ip_str), messages_get(lang, N_("IP/port: no current connection"))); + snprintf(ip_str, sizeof(ip_str), "%s", messages_get(lang, N_("IP/port: no current connection"))); } x = xmlnode_insert_tag_ns(result, "identity", NULL, NS_DISCO_INFO); @@ -749,7 +749,7 @@ messages_get(lang, N_("tls")), c->m->ssl == NULL ? messages_get(lang, N_("no")) : messages_get(lang, N_("yes"))); } else { - snprintf(ip_str, sizeof(ip_str), messages_get(lang, N_("IP/port: no current connection"))); + snprintf(ip_str, sizeof(ip_str), "%s", messages_get(lang, N_("IP/port: no current connection"))); } x = xmlnode_insert_tag_ns(result, "identity", NULL, NS_DISCO_INFO); diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' jabberd14-1.6.1.1~/jsm/modules/mod_register.cc jabberd14-1.6.1.1/jsm/modules/mod_register.cc --- jabberd14-1.6.1.1~/jsm/modules/mod_register.cc 2007-04-07 23:43:18.000000000 +0400 +++ jabberd14-1.6.1.1/jsm/modules/mod_register.cc 2011-11-26 16:50:52.000000000 +0400 @@ -311,7 +311,7 @@ item = xmlnode_get_tags(register_config, "xoob:x/xoob:url", m->si->std_namespace_prefixes); xterror err = {400, "", "modify", "bad-request"}; if (item == NULL) { - snprintf(err.msg, sizeof(err.msg), messages_get(xmlnode_get_lang(m->packet->x), N_("Registration not allowed."))); + snprintf(err.msg, sizeof(err.msg), "%s", messages_get(xmlnode_get_lang(m->packet->x), N_("Registration not allowed."))); } else { snprintf(err.msg, sizeof(err.msg), "%s %s", messages_get(xmlnode_get_lang(m->packet->x), N_("Registration not allowed. See")), xmlnode_get_data(item->node)); }
