Hi,

Here's a patch that inserts "%s", into a number of printf-format calls to
avoid:

        error: format not a string literal and no format arguments
        [-Werror=format-security]

and to avoid reads on uninitialised data should a string with one or more "%"
in it be processed.

David

--- gcc/tree-sra.c.orig 2015-02-12 15:06:20.555985277 +0000
+++ gcc/tree-sra.c      2015-02-12 15:06:39.089074566 +0000
@@ -3987,7 +3987,7 @@ dump_dereferences_table (FILE *f,
 {
   basic_block bb;
 
-  fprintf (dump_file, str);
+  fprintf (dump_file, "%s", str);
   FOR_BB_BETWEEN (bb, ENTRY_BLOCK_PTR_FOR_FN (cfun),
                  EXIT_BLOCK_PTR_FOR_FN (cfun), next_bb)
     {
--- gcc/tree-ssa-uninit.c.orig  2015-02-12 15:11:39.439546383 +0000
+++ gcc/tree-ssa-uninit.c       2015-02-12 15:11:52.101611150 +0000
@@ -820,7 +820,7 @@ dump_predicates (gimple usestmt,
 {
   size_t i, j;
   pred_chain one_pred_chain = vNULL;
-  fprintf (dump_file, msg);
+  fprintf (dump_file, "%s", msg);
   print_gimple_stmt (dump_file, usestmt, 0, 0);
   fprintf (dump_file, "is guarded by :\n\n");
   size_t num_preds = preds.length ();
--- gcc/opts.c.orig     2015-02-12 15:18:23.444612881 +0000
+++ gcc/opts.c  2015-02-12 15:22:24.464845706 +0000
@@ -1106,7 +1106,7 @@ print_filtered_help (unsigned int include_flags,
                      if (* (const char **) flag_var != NULL)
                        snprintf (new_help + strlen (new_help),
                                  sizeof (new_help) - strlen (new_help),
-                                 * (const char **) flag_var);
+                                 "%s", * (const char **) flag_var);
                    }
                  else if (option->var_type == CLVC_ENUM)
                    {
@@ -1120,7 +1120,7 @@ print_filtered_help (unsigned int include_flags,
                        arg = _("[default]");
                      snprintf (new_help + strlen (new_help),
                                sizeof (new_help) - strlen (new_help),
-                               arg);
+                               "%s", arg);
                    }
                  else
                    sprintf (new_help + strlen (new_help),

Reply via email to