Source: blimps Followup-For: Bug #1114069 X-Debbugs-Cc: [email protected] Control: tags -1 ftbfs
Control: tags -1 + patch Control: user [email protected] Control: usertags -1 + origin-ubuntu stonking ubuntu-patch Hi, We hit this in Ubuntu (gcc-15 15.3) and fixed it as below; the attached changes build fine, and sift builds against the result. There are two parts to it: 1. The K&R code doesn't build in C23 mode (gcc-15's default), so build with -std=gnu17 (debian-rules.diff): -export DEB_CFLAGS_MAINT_APPEND=-Wno-error=implicit-int +export DEB_CFLAGS_MAINT_APPEND=-Wno-error=implicit-int -std=gnu17 2. That alone isn't enough, because protomat/Makefile.Linux hardcodes "CFLAGS = -Wall -O2 -c" and ignores the DEBCFLAGS/DEBLDFLAGS that the top-level Makefile passes (so the protomat tools were also built without the hardening flags). protomat-honour-build-flags.patch makes it use them. With the hardening flags, -Werror=format-security then catches a real issue: extract_seqs() writes sequence data with fprintf(fout, line), i.e. the data is used as a format string. protomat-format-security.patch switches that (and the same pattern in universa.c) to fputs(). The binary packages' contents are unchanged (the protomat tools are only built, not shipped). Ubuntu upload: blimps 3.9+ds-4ubuntu1. Thanks, Sebastien Bacher -- System Information: Debian Release: forky/sid APT prefers resolute-updates APT policy: (500, 'resolute-updates'), (500, 'resolute-security'), (500, 'resolute'), (100, 'resolute-backports') Architecture: amd64 (x86_64) Kernel: Linux 7.0.0-38-generic (SMP w/16 CPU threads; PREEMPT) Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_WARN, TAINT_OOT_MODULE Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled
--- a/debian/rules +++ b/debian/rules @@ -4,8 +4,8 @@ # export DH_VERBOSE=1 export DEB_BUILD_MAINT_OPTIONS=hardening=+all -# Workaround build failures with gcc-14. -export DEB_CFLAGS_MAINT_APPEND=-Wno-error=implicit-int +# Workaround build failures with gcc-14 and gcc-15 (C23 default, K&R code). +export DEB_CFLAGS_MAINT_APPEND=-Wno-error=implicit-int -std=gnu17 include /usr/share/dpkg/default.mk
Description: Build protomat tools with the build flags passed from the top Makefile protomat/Makefile.Linux hardcodes "CFLAGS = -Wall -O2 -c", so the tools (blksort, getblock, ...) were built without dpkg-buildflags (hardening, -std=gnu17 to cope with gcc-15's C23 default, ...). Use DEBCFLAGS and DEBLDFLAGS, which the top-level Makefile already passes, as is done for the blimps directory. Author: Sebastien Bacher <[email protected]> Forwarded: https://bugs.debian.org/1114069 Last-Update: 2026-10-09 --- a/protomat/Makefile.Linux +++ b/protomat/Makefile.Linux @@ -2,8 +2,8 @@ # Type "make install" to compile all programs and move them to ../bin # Type "make blksort" to compile blksort program CC = gcc -CFLAGS = -Wall -O2 -c -LDFLAGS = -lm -o +CFLAGS = $(DEBCFLAGS) -Wall -O2 -c +LDFLAGS = $(DEBLDFLAGS) -lm -o RM = /bin/rm -f MV = /bin/mv -f CP = cp -af
Description: Don't use sequence data as a printf format string extract_seqs() wrote sequence lines with fprintf(fout, line), which misbehaves if the data contains '%' and fails to build with -Werror=format-security once protomat honours the build flags. Use fputs(). Author: Sebastien Bacher <[email protected]> Forwarded: https://bugs.debian.org/1114069 Last-Update: 2026-10-09 --- a/protomat/motmisc.c +++ b/protomat/motmisc.c @@ -835,7 +835,7 @@ char *pros; if (strpbrk(&line[dbs[db]->seq_offset], "ARNDCQEGHILKMFPSTWYVBZXactg") != NULL) { - if (out) fprintf(fout, &line[dbs[db]->seq_offset]); + if (out) fputs(&line[dbs[db]->seq_offset], fout); for (i=dbs[db]->seq_offset; i<strlen(line); i++) if (isalpha(line[i])) id->len = id->len + 1; } --- a/protomat/universa.c +++ b/protomat/universa.c @@ -204,7 +204,7 @@ int short_title; { for (i=0; i<strlen(line); i++) /* change CR to space */ if (line[i] == CR) line[i] = ' '; - fprintf(fout, &line[dbs[db]->seq_offset]); + fputs(&line[dbs[db]->seq_offset], fout); } /* end of sequence */ /* if (!short_title) fprintf(fout, "\n"); was "*\n" */ } /* end of start of entry */
