Re: [Bug 1580348] [NEW] mksh 52c bi_errorf(Tbadsubst) format string is not a string literal
Chih-Hung Hsieh dixit: >Lastest mksh/histrap.c (R52c) has a warning from clang/llvm compiler. >It is a tricky use of pointer to the middle of string literals, >which is recognized by gcc but not clang/llvm. Arrgh, stupid compilers, trying to be too smart and utterly failing. I’ve recently had “fun” with newer GCC versions and those string pooling macros, TWICE. I already decided to remove them, but for now I’ve added GCC workarounds… turns out Clang is just as bad. Yes, I’ll tackle this for the next release, thank you for the report. bye, //mirabilos -- 22:20⎜ The crazy that persists in his craziness becomes a master 22:21⎜ And the distance between the craziness and geniality is only measured by the success 18:35⎜ "Psychotics are consistently inconsistent. The essence of sanity is to be inconsistently inconsistent -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1580348 Title: mksh 52c bi_errorf(Tbadsubst) format string is not a string literal To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/mksh/+bug/1580348/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
Re: [Bug 1580348] [NEW] mksh 52c bi_errorf(Tbadsubst) format string is not a string literal
Chih-Hung Hsieh dixit:
>change
> bi_errorf(Tbadsubst);
>to
> bi_errorf0(Tbadsubst);
>where bi_errorf0 is declared as
> void bi_errorf0(const char *); // without format check
>and implemented as a weak alias:
> void bi_errorf0(const char *s) __attribute__((weak, alias("bi_errorf")));
For the record: this is both compiler-specific (there’s no direct
use of __attribute__ in the code, and there must not be any use
that can’t be done with other compilers either) and insecure. DO
NOT DO THAT. Those strings are actually format strings and treated
as such.
bye,
//mirabilos
--
(gnutls can also be used, but if you are compiling lynx for your own use,
there is no reason to consider using that package)
-- Thomas E. Dickey on the Lynx mailing list, about OpenSSL
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1580348
Title:
mksh 52c bi_errorf(Tbadsubst) format string is not a string literal
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/mksh/+bug/1580348/+subscriptions
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1580348] [NEW] mksh 52c bi_errorf(Tbadsubst) format string is not a string literal
Public bug reported:
Lastest mksh/histrap.c (R52c) has a warning from clang/llvm compiler.
It is a tricky use of pointer to the middle of string literals,
which is recognized by gcc but not clang/llvm.
This warning now blocks mksh upgrade in Android open source.
Could you fix the following warning and other places that use
bi_errorf(Tbadsubst) or internal_errorf(Tbadsubst)?
histrap.c:220:15: error: format string is not a string literal (potentially
insecure) [-Werror,-Wformat-security]
bi_errorf(Tbadsubst);
^
sh.h:891:19: note: expanded from macro 'Tbadsubst'
#define Tbadsubst (Tfg_badsubst + 10) /* "bad substitution" */
^~
The warning can be fixed by changing
bi_errorf(Tbadsubst);
to
bi_errorf("%s", Tbadsubst);
If adding a few bytes is not acceptable, could you change
bi_errorf(Tbadsubst);
to
bi_errorf0(Tbadsubst);
where bi_errorf0 is declared as
void bi_errorf0(const char *); // without format check
and implemented as a weak alias:
void bi_errorf0(const char *s) __attribute__((weak, alias("bi_errorf")));
Attached file is a suggested patch to compile with Android.
Thanks.
** Affects: mksh (Ubuntu)
Importance: Undecided
Status: New
** Attachment added: "diff.mksh.bi_errorf0.txt"
https://bugs.launchpad.net/bugs/1580348/+attachment/4660213/+files/diff.mksh.bi_errorf0.txt
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1580348
Title:
mksh 52c bi_errorf(Tbadsubst) format string is not a string literal
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/mksh/+bug/1580348/+subscriptions
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
