Subject: Bug#423: Still present in3.5.0.23

From: Orion Poplawski <[email-masked]>
Date: Tue, 06 May 2014 11:45:56 -0600

I'm still seeing this in 3.5.0.23:

In file included from x11trans.c:80:0:
../../lib/xtrans/Xtranssock.c: In function '_NXGetUnixDir':
../../lib/xtrans/Xtranssock.c:377:5: error: format not a string literal and no 
format arguments [-Werror=format-security]
      PRMSG (3, "_NXGetUnixDir(%s)\n", dir, 0, 0);
      ^
../../lib/xtrans/Xtranssock.c: In function '_NXGetUnixPath':
../../lib/xtrans/Xtranssock.c:446:5: error: format not a string literal and no 
format arguments [-Werror=format-security]
      PRMSG (3, "_NXGetUnixPath(%s)\n", path, 0, 0);
      ^
I don't see that this patch is actually applied.

-- 
Orion Poplawski
Technical Manager                     303-415-9701 x222
NWRA, Boulder/CoRA Office             FAX: 303-415-9702
3380 Mitchell Lane                       [email-masked]
Boulder, CO 80301                   http://www.nwra.com
diff -up nx-libs-3.5.0.22/nx-X11/lib/xtrans/Xtransint.h.format nx-libs-3.5.0.22/nx-X11/lib/xtrans/Xtransint.h
--- nx-libs-3.5.0.22/nx-X11/lib/xtrans/Xtransint.h.format	2014-01-04 13:39:35.000000000 -0700
+++ nx-libs-3.5.0.22/nx-X11/lib/xtrans/Xtransint.h	2014-01-24 20:29:37.678919812 -0700
@@ -443,7 +443,7 @@ static int trans_mkdir (
 			int hack= 0, saveerrno=errno; \
                         struct timeval tp;\
                         gettimeofday(&tp,0); \
-			ErrorF(__xtransname); \
+			ErrorF("%s",__xtransname); \
 			ErrorF(x+hack,a,b,c); \
                         ErrorF("timestamp (ms): %d\n",tp.tv_sec*1000+tp.tv_usec/1000); \
 			errno=saveerrno; \
@@ -453,7 +453,7 @@ static int trans_mkdir (
 			int hack= 0, saveerrno=errno; \
                         struct timeval tp;\
                         gettimeofday(&tp,0); \
-			fprintf(stderr, __xtransname); fflush(stderr); \
+			fprintf(stderr, "%s",__xtransname); fflush(stderr); \
 			fprintf(stderr, x+hack,a,b,c); fflush(stderr); \
                         fprintf(stderr, "timestamp (ms): %d\n",tp.tv_sec*1000+tp.tv_usec/1000); \
                         fflush(stderr); \
@@ -465,14 +465,14 @@ static int trans_mkdir (
 /* Use ErrorF() for the X server */
 #define PRMSG(lvl,x,a,b,c)	if (lvl <= XTRANSDEBUG){ \
 			int hack= 0, saveerrno=errno; \
-			ErrorF(__xtransname); \
+			ErrorF("%s",__xtransname); \
 			ErrorF(x+hack,a,b,c); \
 			errno=saveerrno; \
 			} else ((void)0)
 #else
 #define PRMSG(lvl,x,a,b,c)	if (lvl <= XTRANSDEBUG){ \
 			int hack= 0, saveerrno=errno; \
-			fprintf(stderr, __xtransname); fflush(stderr); \
+			fprintf(stderr, "%s",__xtransname); fflush(stderr); \
 			fprintf(stderr, x+hack,a,b,c); fflush(stderr); \
 			errno=saveerrno; \
 			} else ((void)0)
diff -up nx-libs-3.5.0.22/nx-X11/programs/nxauth/process.c.format nx-libs-3.5.0.22/nx-X11/programs/nxauth/process.c
--- nx-libs-3.5.0.22/nx-X11/programs/nxauth/process.c.format	2014-01-04 13:39:35.000000000 -0700
+++ nx-libs-3.5.0.22/nx-X11/programs/nxauth/process.c	2014-01-28 22:52:26.100107437 -0700
@@ -974,7 +974,7 @@ fprintfhex(register FILE *fp, int len, c
     char *hex;
 
     hex = bintohex(len, cp);
-    fprintf(fp, hex);
+    fprintf(fp, "%s", hex);
     free(hex);
 }
 
diff -up nx-libs-3.5.0.22/nx-X11/programs/Xserver/GL/glx/glximports.c.format nx-libs-3.5.0.22/nx-X11/programs/Xserver/GL/glx/glximports.c
--- nx-libs-3.5.0.22/nx-X11/programs/Xserver/GL/glx/glximports.c.format	2014-01-04 13:39:35.000000000 -0700
+++ nx-libs-3.5.0.22/nx-X11/programs/Xserver/GL/glx/glximports.c	2014-01-27 20:26:27.614602671 -0700
@@ -110,12 +110,12 @@ void *__glXImpRealloc(__GLcontext *gc, v
 
 void __glXImpWarning(__GLcontext *gc, char *msg)
 {
-    ErrorF((char *)msg);
+    ErrorF("%s",(char *)msg);
 }
 
 void __glXImpFatal(__GLcontext *gc, char *msg)
 {
-    ErrorF((char *)msg);
+    ErrorF("%s",(char *)msg);
     __glXAbort();
 }
 
diff -up nx-libs-3.5.0.22/nx-X11/programs/Xserver/hw/nxagent/Error.c.format nx-libs-3.5.0.22/nx-X11/programs/Xserver/hw/nxagent/Error.c
--- nx-libs-3.5.0.22/nx-X11/programs/Xserver/hw/nxagent/Error.c.format	2014-01-04 13:41:35.000000000 -0700
+++ nx-libs-3.5.0.22/nx-X11/programs/Xserver/hw/nxagent/Error.c	2014-01-28 20:35:13.602642690 -0700
@@ -232,7 +232,7 @@ static int nxagentPrintError(dpy, event,
 
 int nxagentExitHandler(const char *message)
 {
-  FatalError(message);
+  FatalError("%s", message);
 
   return 0;
 }
diff -up nx-libs-3.5.0.22/nx-X11/programs/Xserver/hw/nxagent/Init.c.format nx-libs-3.5.0.22/nx-X11/programs/Xserver/hw/nxagent/Init.c
--- nx-libs-3.5.0.22/nx-X11/programs/Xserver/hw/nxagent/Init.c.format	2014-01-04 13:41:35.000000000 -0700
+++ nx-libs-3.5.0.22/nx-X11/programs/Xserver/hw/nxagent/Init.c	2014-01-27 20:53:59.551990127 -0700
@@ -509,7 +509,7 @@ void OsVendorVErrorFFunction(const char
 
     nxagentStartRedirectToClientsLog();
 
-    fprintf(stderr, buffer);
+    fprintf(stderr, "%s", buffer);
 
     nxagentEndRedirectToClientsLog();
   }
diff -up nx-libs-3.5.0.22/nx-X11/programs/Xserver/os/log.c.format nx-libs-3.5.0.22/nx-X11/programs/Xserver/os/log.c
--- nx-libs-3.5.0.22/nx-X11/programs/Xserver/os/log.c.format	2014-01-04 13:39:35.000000000 -0700
+++ nx-libs-3.5.0.22/nx-X11/programs/Xserver/os/log.c	2014-01-27 20:01:29.741979120 -0700
@@ -692,9 +692,9 @@ Error(char *str)
 	    return;
 	sprintf(err, "%s: ", str);
 	strcat(err, strerror(saveErrno));
-	LogWrite(-1, err);
+	LogWrite(-1, "%s", err);
     } else
-	LogWrite(-1, strerror(saveErrno));
+	LogWrite(-1, "%s", strerror(saveErrno));
 }
 
 void

---

From: Mike Gabriel <[email-masked]>
Date: Wed, 07 May 2014 07:11:19 +0000

Hi Orion,

On  Di 06 Mai 2014 19:45:56 CEST, Orion Poplawski wrote:

> ../../lib/xtrans/Xtranssock.c:377:5: error: format not a string  
> literal and no format arguments [-Werror=format-security]
> ../../lib/xtrans/Xtranssock.c:446:5: error: format not a string  
> literal and no format arguments [-Werror=format-security]

Dang... The patch 056 did not make it into the rolled release tarball.

Fixing and re-releasing (as 3.5.0.24)...

Mike

-- 

DAS-NETZWERKTEAM
mike gabriel, herweg 7, 24357 fleckeby
fon: +49 (1520) 1976 148

GnuPG Key ID 0x25771B31
mail: [email-masked], http://das-netzwerkteam.de

freeBusy:
https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb

---

From: Orion Poplawski <[email-masked]>
Date: Wed, 07 May 2014 09:41:30 -0600

On 05/07/2014 01:11 AM, Mike Gabriel wrote:
>> ../../lib/xtrans/Xtranssock.c:377:5: error: format not a string literal and
>> no format arguments [-Werror=format-security]
>> ../../lib/xtrans/Xtranssock.c:446:5: error: format not a string literal and
>> no format arguments [-Werror=format-security]

Looks good now, thanks.