Bug#649018: bist: FTBFS when building with -Werror=format-security

2011-12-16 Thread Felix Geyer
Please update the patch to the version from message #10
which fixes the possible format string vulnerabilities instead
of working around the gcc error.




-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#649018: bist: FTBFS when building with -Werror=format-security

2011-12-03 Thread Aurelien Jarno
severity 649018 serious
thanks

On Wed, Nov 16, 2011 at 06:11:33PM -0500, Mathieu Trudel-Lapierre wrote:
 Package: bist
 Version: 0.5.1-3
 Severity: important
 Tags: patch
 User: ubuntu-de...@lists.ubuntu.com
 Usertags: origin-ubuntu oneiric ubuntu-patch
 
 Dear Maintainer,
 
 bist appears to FTBFS on Ubuntu precise when build with the
 -Werror=format-security parameter passed to GCC 4.6. [1]
 

This bug now affects sid, upgrading the severity.


-- 
Aurelien Jarno  GPG: 1024D/F1BCDB73
aurel...@aurel32.net http://www.aurel32.net



-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#649018: bist: FTBFS when building with -Werror=format-security

2011-11-16 Thread Mathieu Trudel-Lapierre
Package: bist
Version: 0.5.1-3
Severity: important
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu oneiric ubuntu-patch

Dear Maintainer,

bist appears to FTBFS on Ubuntu precise when build with the
-Werror=format-security parameter passed to GCC 4.6. [1]

This is because some fltk functions such as fl_warn, fl_choice, and others
expect a format string as first argument. However, in the case where the
format string stands by itself, -Werror=format-security will still require
one to pass format parameters to be interpolated: in this case, something
like NULL is sufficient.

The attached patch resolve this issue by adding NULLs as a final parameter
to the relevant fltk functions.

[1] 
https://launchpadlibrarian.net/85118405/buildlog_ubuntu-precise-amd64.bist_0.5.1-3_FAILEDTOBUILD.txt.gz

Regards,


-- System Information:
Debian Release: wheezy/sid
  APT prefers precise-updates
  APT policy: (500, 'precise-updates'), (500, 'precise-security'), (500, 
'precise'), (100, 'precise-backports')
Architecture: amd64 (x86_64)

Kernel: Linux 3.1.0-2-generic (SMP w/4 CPU cores)
Locale: LANG=fr_CA.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages bist depends on:
ii  libc6  2.13-20ubuntu5  
ii  libcairo2  1.10.2-6ubuntu3 
ii  libexpat1  2.0.1-7.2   
ii  libfltk1.1 1.1.10-8
ii  libgcc11:4.6.2-2ubuntu1
ii  libglib2.0-0   2.30.1-2ubuntu1 
ii  libncurses55.9-2   
ii  libpango1.0-0  1.29.4-2ubuntu1 
ii  libstdc++6 4.6.2-2ubuntu1  
ii  libtinfo5  5.9-2   
ii  libx11-6   2:1.4.4-4   
ii  libxpm41:3.5.9-4   

bist recommends no packages.

bist suggests no packages.

-- no debconf information
From: Mathieu Trudel-Lapierre mathieu.trudel-lapie...@canonical.com
Subject: pass terminating NULLs to fl_ functions expecting formats.
Last-Update: 2011-11-16

Index: bist/src/util.cpp
===
--- bist.orig/src/util.cpp	2011-11-16 17:32:52.216281000 -0500
+++ bist/src/util.cpp	2011-11-16 17:36:32.684441611 -0500
@@ -1566,7 +1566,7 @@
   string the_choice=string(_(File with name)) + 
 string(_( )) + string(the_file) + string(_( )) +
 string(_(already exist.\nDo you want to overwrite it?));
-  return fl_choice(the_choice.c_str(),_(No),_(Yes),NULL);
+  return fl_choice(the_choice.c_str(),_(No),_(Yes),NULL,NULL);
 
 }
 
Index: bist/src/immagine.cpp
===
--- bist.orig/src/immagine.cpp	2011-11-16 17:24:46.086009000 -0500
+++ bist/src/immagine.cpp	2011-11-16 17:39:48.280432894 -0500
@@ -2788,7 +2788,7 @@
   warn +=  _warning[i] + \n;
 }
 if(warn!=){
-  fl_alert(warn.c_str());
+  fl_alert(warn.c_str(),NULL);
 }
   }
   void immagine::print_errors(){
@@ -2797,7 +2797,7 @@
   errori+= _error[i] +\n;
 }
 if(errori!=){
-  fl_alert(errori.c_str());
+  fl_alert(errori.c_str(),NULL);
 }
 
   }
@@ -6276,7 +6276,7 @@
 can_write=1;
   }else{
 if(graphics){
-  fl_message(strerror(errno));
+  fl_message(strerror(errno),NULL);
 }else{
   perror(NULL);
 }
Index: bist/src/editor.cpp
===
--- bist.orig/src/editor.cpp	2011-11-16 17:24:46.086009000 -0500
+++ bist/src/editor.cpp	2011-11-16 17:41:08.872429299 -0500
@@ -394,7 +394,7 @@
 void edit_nowar_cb(Fl_Widget* w, void* v){
   const static char* man=Copyright (C)  2005  Valerio Benfante.\nThis  is  free software; see the file COPYING for copying conditions.\nThere is NO warranty; not even for MERCHANTABILITY or  FITNESS FOR A PARTICULAR PURPOSE.\nThe logo is copyright (C) 2005 Luisa Russo and is released under GNU GPL;
 
-  fl_message(man);
+  fl_message(man, NULL);
 }