[packages/poldek/rpm5] - fix insecure format string usage allowing to build poldek with -Wformat -Werror=format-security
baggins
baggins at pld-linux.org
Mon Sep 10 13:06:34 CEST 2012
commit 4ee7e05390b7190a6ee9ef4d3b18555acf3d2d0a
Author: Jan Rękorajski <baggins at pld-linux.org>
Date: Mon Sep 10 13:05:32 2012 +0200
- fix insecure format string usage allowing to build poldek with
-Wformat -Werror=format-security
poldek-Werror-format-security.patch | 190 ++++++++++++++++++++++++++++++++++++
poldek.spec | 4 +-
2 files changed, 193 insertions(+), 1 deletion(-)
---
diff --git a/poldek.spec b/poldek.spec
index 0524d4a..3f7961d 100644
--- a/poldek.spec
+++ b/poldek.spec
@@ -14,7 +14,7 @@
%define ver_rpm 5.4.10
%define snap rc5
-%define rel 14.1%{?with_snap:.%{SNAP}}
+%define rel 14.2%{?with_snap:.%{SNAP}}
Summary: RPM packages management helper tool
Summary(hu.UTF-8): RPM csomagkezelést segítő eszköz
Summary(pl.UTF-8): Pomocnicze narzędzie do zarządzania pakietami RPM
@@ -50,6 +50,7 @@ Patch7: https://bugs.launchpad.net/pld-linux/+bug/1042200/+attachment/3285885/+
# Patch7-md5: 128afb37934a3f12077fff12fddaa3ec
Patch8: https://bugs.launchpad.net/pld-linux/+bug/1042200/+attachment/3298948/+files/poldek-pkg-recno-type.patch
# Patch8-md5: bdc855d84167592a1adef576eba75de6
+Patch9: %{name}-Werror-format-security.patch
URL: http://poldek.pld-linux.org/
BuildRequires: autoconf
BuildRequires: automake
@@ -216,6 +217,7 @@ Moduły języka Python dla poldka.
%patch6 -p1
%patch7 -p1
%patch8 -p1
+%patch9 -p1
%{__rm} m4/libtool.m4 m4/lt*.m4
diff --git a/poldek-Werror-format-security.patch b/poldek-Werror-format-security.patch
new file mode 100644
index 0000000..1813851
--- /dev/null
+++ b/poldek-Werror-format-security.patch
@@ -0,0 +1,190 @@
+diff -ur poldek-0.30/cli/ls.c poldek-0.30-Werror-format-security/cli/ls.c
+--- poldek-0.30/cli/ls.c 2012-09-10 13:00:43.301558181 +0200
++++ poldek-0.30-Werror-format-security/cli/ls.c 2012-09-10 13:00:07.921559430 +0200
+@@ -98,7 +98,7 @@
+ switch (key) {
+ case 'l':
+ if (cmdctx->_flags & OPT_LS_GROUP) {
+- logn(LOGERR, errmsg_excl);
++ logn(LOGERR, "%s", errmsg_excl);
+ return EINVAL;
+ }
+
+@@ -111,7 +111,7 @@
+
+ case 'G':
+ if (cmdctx->_flags & OPT_LS_LONG || cmdctx->_flags & OPT_LS_SOURCERPM) {
+- logn(LOGERR, errmsg_excl);
++ logn(LOGERR, "%s", errmsg_excl);
+ return EINVAL;
+ }
+
+@@ -120,7 +120,7 @@
+
+ case 's':
+ if (cmdctx->_flags & OPT_LS_LONG || cmdctx->_flags & OPT_LS_GROUP) {
+- logn(LOGERR, errmsg_excl);
++ logn(LOGERR, "%s", errmsg_excl);
+ return EINVAL;
+ }
+
+@@ -426,7 +426,7 @@
+ static
+ int do_ls(const tn_array *ents, struct cmdctx *cmdctx, const tn_array *evrs)
+ {
+- char hdr[256], fmt_hdr[256], fmt_pkg[256];
++ char hdr[256];
+ int i, size, err = 0, npkgs = 0;
+ register int incstep = 0;
+ int term_width, term_width_div2;
+@@ -443,44 +443,32 @@
+ *hdr = '\0';
+
+ if (flags & OPT_LS_GROUP || flags & OPT_LS_SOURCERPM) {
+- snprintf(fmt_hdr, sizeof(fmt_hdr), "%%-%ds%%-%ds\n",
+- term_width_div2 + term_width_div2/10, (term_width/7));
+-
+- snprintf(fmt_pkg, sizeof(fmt_pkg), "%%-%ds %%-%ds\n",
+- term_width_div2 + term_width_div2/10 - 1, (term_width/7));
+-
+ if (flags & OPT_LS_GROUP)
+- snprintf(hdr, sizeof(hdr), fmt_hdr, _("package"), _("group"));
++ snprintf(hdr, sizeof(hdr), "%-*s%-*s\n",
++ term_width_div2 + term_width_div2/10, _("package"), (term_width/7), _("group"));
+ else
+- snprintf(hdr, sizeof(hdr), fmt_hdr, _("package"), _("source rpm"));
++ snprintf(hdr, sizeof(hdr), "%-*s%-*s\n",
++ term_width_div2 + term_width_div2/10, _("package"), (term_width/7), _("source rpm"));
+ } else if (flags & OPT_LS_LONG) {
+ if ((flags & OPT_LS_UPGRADEABLE) == 0) {
+- snprintf(fmt_hdr, sizeof(fmt_hdr), "%%-%ds %%-%ds%%%ds\n",
+- term_width_div2 + term_width_div2/10, (term_width/7),
+- (term_width/8) + 2);
+-
+- snprintf(fmt_pkg, sizeof(fmt_pkg), "%%-%ds %%%ds %%%ds\n",
+- term_width_div2 + term_width_div2/10, (term_width/7),
+- (term_width/8));
+- snprintf(hdr, sizeof(hdr), fmt_hdr,
+- _("package"), _("build date"), _("size"));
+-
++ snprintf(hdr, sizeof(hdr), "%-*s %-*s%*s\n",
++ term_width_div2 + term_width_div2/10, _("package"),
++ (term_width/7), _("build date"),
++ (term_width/8) + 2, _("size"));
+
+ } else {
+- snprintf(fmt_hdr, sizeof(fmt_hdr), "%%-%ds%%-%ds %%-%ds%%%ds\n",
+- (term_width/2) - 1, (term_width/6) - 1,
+- (term_width/6) - 1, (term_width/6) - 1);
+-
+- snprintf(fmt_pkg, sizeof(fmt_pkg), "%%-%ds%%-%ds %%-%ds %%%ds\n",
+- (term_width/2) - 1, (term_width/6) - 1,
+- (term_width/6) - 1, (term_width/6) - 1);
+-
+ if (flags & OPT_LS_INSTALLED)
+- snprintf(hdr, sizeof(hdr), fmt_hdr, _("installed"),
+- _("available"), _("build date"), _("size"));
++ snprintf(hdr, sizeof(hdr), "%-*s%-*s %-*s%*s\n",
++ (term_width/2) - 1, _("installed"),
++ (term_width/6) - 1, _("available"),
++ (term_width/6) - 1, _("build date"),
++ (term_width/6) - 1, _("size"));
+ else
+- snprintf(hdr, sizeof(hdr), fmt_hdr, _("available"),
+- _("installed"), _("build date"), _("size"));
++ snprintf(hdr, sizeof(hdr), "%-*s%-*s %-*s%*s\n",
++ (term_width/2) - 1, _("available"),
++ (term_width/6) - 1, _("installed"),
++ (term_width/6) - 1, _("build date"),
++ (term_width/6) - 1, _("size"));
+ }
+ }
+
+@@ -520,11 +508,15 @@
+
+ if (flags & OPT_LS_GROUP) {
+ const char *group = pkg_group(pkg);
+- cmdctx_printf(cmdctx, fmt_pkg, pkg_name, group ? group : "(unset)");
++ cmdctx_printf(cmdctx, "%-*s %-*s\n",
++ term_width_div2 + term_width_div2/10 - 1, pkg_name,
++ (term_width/7), group ? group : "(unset)");
+ }
+ else if (flags & OPT_LS_SOURCERPM) {
+ const char *srcrpm = pkg_srcfilename_s(pkg);
+- cmdctx_printf(cmdctx, fmt_pkg, pkg_name, srcrpm ? srcrpm : "(unset)");
++ cmdctx_printf(cmdctx, "%-*s %-*s\n",
++ term_width_div2 + term_width_div2/10 - 1, pkg_name,
++ (term_width/7), srcrpm ? srcrpm : "(unset)");
+
+ } else if (flags & OPT_LS_QUERYFMT) {
+ char *queryfmt = NULL;
+@@ -553,11 +545,19 @@
+ *timbuf = '\0';
+
+ if ((flags & OPT_LS_UPGRADEABLE) == 0) {
+- cmdctx_printf(cmdctx, fmt_pkg, pkg_name, timbuf, sizbuf);
++ cmdctx_printf(cmdctx, "%-*s %*s %*s\n",
++ term_width_div2 + term_width_div2/10, pkg_name,
++ (term_width/7), timbuf,
++ (term_width/8), sizbuf);
+
+ } else if (evrs) {
+ const char *evr = n_array_nth(evrs, i);
+- cmdctx_printf(cmdctx, fmt_pkg, pkg_name, evr, timbuf, sizbuf);
++ cmdctx_printf(cmdctx, "%-*s%-*s %-*s %*s\n",
++ (term_width/2) - 1, pkg_name,
++ (term_width/6) - 1, evr,
++ (term_width/6) - 1, timbuf,
++ (term_width/6) - 1, sizbuf);
++
+ }
+ size += pkg->size/1024;
+
+diff -ur poldek-0.30/misc.c poldek-0.30-Werror-format-security/misc.c
+--- poldek-0.30/misc.c 2012-03-20 21:41:46.000000000 +0100
++++ poldek-0.30-Werror-format-security/misc.c 2012-09-10 12:40:04.314935221 +0200
+@@ -421,7 +421,7 @@
+ }
+
+ if (strcmp(name, "HOME") == 0 && (pw = getpwuid(getuid()))) {
+- snprintf(dest, size, pw->pw_dir);
++ snprintf(dest, size, "%s", pw->pw_dir);
+ val = dest;
+ }
+
+diff -ur poldek-0.30/vfile/vfetch.c poldek-0.30-Werror-format-security/vfile/vfetch.c
+--- poldek-0.30/vfile/vfetch.c 2012-03-20 21:41:46.000000000 +0100
++++ poldek-0.30-Werror-format-security/vfile/vfetch.c 2012-09-10 12:39:17.968270190 +0200
+@@ -323,7 +323,7 @@
+ } else { /* redirected */
+ char url[PATH_MAX];
+
+- snprintf(url, sizeof(url), req->url);
++ snprintf(url, sizeof(url), "%s", req->url);
+ vf_request_free(req);
+ req = NULL;
+ rc = vf_fetch(url, destdir, flags, NULL, NULL);
+diff -ur poldek-0.30/vfile/vfff/http.c poldek-0.30-Werror-format-security/vfile/vfff/http.c
+--- poldek-0.30/vfile/vfff/http.c 2012-09-10 13:00:43.288224848 +0200
++++ poldek-0.30-Werror-format-security/vfile/vfff/http.c 2012-09-10 12:38:24.014938759 +0200
+@@ -846,7 +846,7 @@
+ if (HTTP_STATUS_IS_REDIR(resp->code)) {
+ const char *redirto = http_resp_get_hdr(resp, "location");
+ if (redirto && *redirto != '\0')
+- snprintf(rreq->redirected_to, sizeof(rreq->redirected_to), redirto);
++ snprintf(rreq->redirected_to, sizeof(rreq->redirected_to), "%s", redirto);
+ else
+ vfff_set_err(ENOENT, "wrong or empty redirect location");
+
+diff -ur poldek-0.30/vfile/vfile.c poldek-0.30-Werror-format-security/vfile/vfile.c
+--- poldek-0.30/vfile/vfile.c 2012-03-20 21:41:46.000000000 +0100
++++ poldek-0.30-Werror-format-security/vfile/vfile.c 2012-09-10 12:38:47.601604593 +0200
+@@ -561,7 +561,7 @@
+ n_assert(vf_url_type(vf->vf_path) & VFURL_LOCAL);
+ if (vf_decompressable(vf->vf_path, NULL, 0)) {
+ char src[PATH_MAX], *p;
+- snprintf(src, sizeof(src), vf->vf_path);
++ snprintf(src, sizeof(src), "%s", vf->vf_path);
+ p = strrchr(src, '.');
+ n_assert(p);
+ *p = '\0';
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/poldek.git/commitdiff/4ee7e05390b7190a6ee9ef4d3b18555acf3d2d0a
More information about the pld-cvs-commit
mailing list