Bug#1066811: cyrus-sasl2: assumes time_t fits into long for printf and scanf(!), will break on big endian

2024-03-19 Thread Bastian Germann

Control: forwarded -1 https://github.com/cyrusimap/cyrus-sasl/issues/484



Bug#1066811: cyrus-sasl2: assumes time_t fits into long for printf and scanf(!), will break on big endian

2024-03-13 Thread Thorsten Glaser
Source: cyrus-sasl2
Version: 2.1.28+dfsg1-4
Severity: serious
Justification: breaks
X-Debbugs-Cc: t...@mirbsd.de

cyrus-sasl2, before aborting the build due to #1066214, spews
several warnings like the following:

[…]
otp.c:648:43: warning: format '%ld' expects argument of type 'long int', but 
argument 7 has type 'time_t' {aka 'long long int'} [-Wformat=]
  648 | sprintf(data, "%s\t%04d\t%s\t%s\t%020ld",
  |  ~^
  |   |
  |   long int
  |  %020lld
  649 | alg, seq, seed, buf, timeout);
  |  ~~~
  |  |
  |  time_t {aka long long int}
otp.c:709:48: warning: format '%ld' expects argument of type 'long int *', but 
argument 7 has type 'time_t *' {aka 'long long int *'} [-Wformat=]
  709 | sscanf(secret, "%s\t%04d\t%s\t%s\t%020ld",
  |   ~^
  ||
  |long int *
  |   %020lld
  710 |alg, seq, seed, buf, timeout);
  | ~~~
  | |
  | time_t * {aka long long int *}
[…]

These are actual problems that not only result in bad data
being printed or read but, if the time_t argument is not
(like here) the last one, also wrong arguments being used
for subsequent positional parameters.

Please fix *all* -Wformat mismatches involving time_t, for
example:

-   sprintf(data, "%s\t%04d\t%s\t%s\t%020ld",
+   sprintf(data, "%s\t%04d\t%s\t%s\t%020lld",
-   alg, seq, seed, buf, timeout);
+   alg, seq, seed, buf, (long long)timeout);

+   long long tmptimeout;
-   sscanf(secret, "%s\t%04d\t%s\t%s\t%020ld",
+   sscanf(secret, "%s\t%04d\t%s\t%s\t%020lld",
-   alg, seq, seed, buf, timeout);
+   alg, seq, seed, buf, tmptimeout);
+   timeout = tmptimeout;

Justification: I’ve been fixing bugs like these on MirBSD
since its i386 port switched to 64-bit time_t in 2004…

Thanks,
//mirabilos
-- 
16:47⎜«mika:#grml» .oO(mira ist einfach gut)  23:22⎜«mikap:#grml»
mirabilos: und dein bootloader ist geil :)23:29⎜«mikap:#grml» und ich
finds saugeil dass ich ein bsd zum booten mit grml hab, das muss ich dann
gleich mal auf usb-stick installieren   -- Michael Prokop über MirOS bsd4grml