Your message dated Sun, 27 Apr 2014 15:27:24 -0500
with message-id <21341.26668.490050.91...@max.nulle.part>
has caused the   report #746067,
regarding rgtk2: FTBFS: gioManuals.c:197:39: error: format not a string literal 
and no format arguments [-Werror=format-security]
to be marked as having been forwarded to the upstream software
author(s) Michael Lawrence <micha...@gene.com>

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
746067: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746067
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Hi Michael,

Fresh bug report 'dubbed' security:

On 27 April 2014 at 14:12, David Suárez wrote:
| Source: rgtk2
| Version: 2.20.27-1
| Severity: serious
| Tags: jessie sid
| User: debian...@lists.debian.org
| Usertags: qa-ftbfs-20140426 qa-ftbfs
| Justification: FTBFS on amd64
| 
| Hi,
| 
| During a rebuild of all packages in sid, your package failed to build on
| amd64.
| 
| Relevant part (hopefully):
| > gcc -std=gnu99 -I/usr/share/R/include -DNDEBUG -g -D_R_=1 -pthread 
-I/usr/include/gtk-2.0 -I/usr/lib/x86_64-linux-gnu/gtk-2.0/include 
-I/usr/include/gio-unix-2.0/ -I/usr/include/cairo -I/usr/include/pango-1.0 
-I/usr/include/atk-1.0 -I/usr/include/cairo -I/usr/include/pixman-1 
-I/usr/include/libdrm -I/usr/include/libpng12 -I/usr/include/gdk-pixbuf-2.0 
-I/usr/include/libpng12 -I/usr/include/pango-1.0 -I/usr/include/harfbuzz 
-I/usr/include/pango-1.0 -I/usr/include/glib-2.0 
-I/usr/lib/x86_64-linux-gnu/glib-2.0/include -I/usr/include/freetype2  -I.  
-DHAVE_UINTPTR_T      -fpic  -g -O2 -fstack-protector --param=ssp-buffer-size=4 
-Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -g  -c gioManuals.c -o 
gioManuals.o
| > gioManuals.c: In function 'S_g_simple_async_report_error_in_idle':
| > gioManuals.c:197:39: error: format not a string literal and no format 
arguments [-Werror=format-security]
| >                                        format);
| >                                        ^
| > cc1: some warnings being treated as errors
| > make[1]: *** [gioManuals.o] Error 1

I would suspect this may be a false positive. The code in question is

USER_OBJECT_
S_g_simple_async_report_error_in_idle(USER_OBJECT_ s_object,
                                      USER_OBJECT_ s_callback,
                                      USER_OBJECT_ s_user_data,
                                      USER_OBJECT_ s_domain,
                                      USER_OBJECT_ s_code,
                                      USER_OBJECT_ s_format)
{
  USER_OBJECT_ _result = NULL_USER_OBJECT;
#if GIO_CHECK_VERSION(2, 16, 0)
  GAsyncReadyCallback callback = ((GAsyncReadyCallback)S_GAsyncReadyCallback);
  R_CallbackData* user_data = R_createCBData(s_callback, s_user_data);
  GObject* object = G_OBJECT(getPtrValue(s_object));
  GQuark domain = ((GQuark)asCNumeric(s_domain));
  gint code = ((gint)asCInteger(s_code));
  const char* format = ((const char*)asCString(s_format));


  g_simple_async_report_error_in_idle(object, callback, user_data, domain, code,
                                      format);

#else
  error("g_simple_async_report_error_in_idle exists only in gio >= 2.16.0");
#endif

  return(_result);
}


Could we tame the compiler message with some proper casts?  Do you want to
look what Gtk2 itself does there?

Thanks in advance for looking into this!

Cheers, Dirk


| 
| The full build log is available from:
|    
http://aws-logs.debian.net/ftbfs-logs/2014/04/26/rgtk2_2.20.27-1_unstable.log
| 
| A list of current common problems and possible solutions is available at
| http://wiki.debian.org/qa.debian.org/FTBFS . You're welcome to contribute!
| 
| About the archive rebuild: The rebuild was done on EC2 VM instances from
| Amazon Web Services, using a clean, minimal and up-to-date chroot. Every
| failed build was retried once to eliminate random failures.

-- 
Dirk Eddelbuettel | e...@debian.org | http://dirk.eddelbuettel.com

--- End Message ---

Reply via email to