Bug#643376: epiphany-browser: FTBFS: ephy-window.c:531:7: error: format not a string literal and no format arguments [-Werror=format-security]

[Didier Raboud]

Source: epiphany-browser
Version: 3.0.4-1
Severity: serious
Tags: wheezy sid
User: debian-qa at lists.debian.org
Usertags: qa-ftbfs-20110923 qa-ftbfs hardening-format-security hardening
Justification: FTBFS on amd64

Hi,

During a rebuild of all packages in sid, your package failed to build on
amd64.

Relevant part:
> /bin/bash ../libtool  --tag=CC   --mode=compile gcc -DHAVE_CONFIG_H -I. -I..  -I../lib -I../lib/egg -I../embed -I../embed -I../lib -I../lib/egg -I../lib/widgets -I../src/bookmarks -DEXTENSIONS_DIR=\""/usr/lib/epiphany-browser/3.0/extensions"\" -DLOADER_DIR=\""/usr/lib/epiphany-browser/3.0/loaders"\" -DDATADIR=\""/usr/share/epiphany-browser"\" -DGNOMELOCALEDIR=\"/usr/share/locale\"   -pthread -DGSEAL_ENABLE -I/usr/include/atk-1.0 -I/usr/include/gdk-pixbuf-2.0 -I/usr/include/pango-1.0 -I/usr/include/pixman-1 -I/usr/include/freetype2 -I/usr/include/libpng12 -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/gio-unix-2.0/ -I/usr/include/gtk-3.0 -I/usr/include/cairo -I/usr/include/gtk-3.0/unix-print -I/usr/include/libxml2 -I/usr/include/startup-notification-1.0 -I/usr/include/webkit-3.0 -I/usr/include/libsoup-2.4 -I/usr/include/libsoup-gnome-2.4 -I/usr/include/gnome-keyring-1 -I/usr/include/gsettings-desktop-schemas   -pthread -I/usr/include/dbus-1.0 -I/usr/lib/x86_64-linux-gnu/dbus-1.0/include -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include    -Wall -Wmissing-prototypes -Wnested-externs -Wpointer-arith -Wno-sign-compare   -I/usr/include/NetworkManager   -pthread -DGSEAL_ENABLE -I/usr/include/atk-1.0 -I/usr/include/gdk-pixbuf-2.0 -I/usr/include/pango-1.0 -I/usr/include/pixman-1 -I/usr/include/freetype2 -I/usr/include/libpng12 -I/usr/include/seed-gtk3 -I/usr/include/webkit-3.0 -I/usr/include/gobject-introspection-1.0 -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/gtk-3.0 -I/usr/include/libsoup-2.4 -I/usr/include/cairo -I/usr/include/gio-unix-2.0/ -I/usr/include/libxml2   -g -O2 -fstack-protector --param=ssp-buffer-size=4 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security -Wall -c -o libephymain_la-ephy-window.lo `test -f 'ephy-window.c' || echo './'`ephy-window.c
> libtool: compile:  gcc -DHAVE_CONFIG_H -I. -I.. -I../lib -I../lib/egg -I../embed -I../embed -I../lib -I../lib/egg -I../lib/widgets -I../src/bookmarks -DEXTENSIONS_DIR=\"/usr/lib/epiphany-browser/3.0/extensions\" -DLOADER_DIR=\"/usr/lib/epiphany-browser/3.0/loaders\" -DDATADIR=\"/usr/share/epiphany-browser\" -DGNOMELOCALEDIR=\"/usr/share/locale\" -pthread -DGSEAL_ENABLE -I/usr/include/atk-1.0 -I/usr/include/gdk-pixbuf-2.0 -I/usr/include/pango-1.0 -I/usr/include/pixman-1 -I/usr/include/freetype2 -I/usr/include/libpng12 -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/gio-unix-2.0/ -I/usr/include/gtk-3.0 -I/usr/include/cairo -I/usr/include/gtk-3.0/unix-print -I/usr/include/libxml2 -I/usr/include/startup-notification-1.0 -I/usr/include/webkit-3.0 -I/usr/include/libsoup-2.4 -I/usr/include/libsoup-gnome-2.4 -I/usr/include/gnome-keyring-1 -I/usr/include/gsettings-desktop-schemas -pthread -I/usr/include/dbus-1.0 -I/usr/lib/x86_64-linux-gnu/dbus-1.0/include -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -Wall -Wmissing-prototypes -Wnested-externs -Wpointer-arith -Wno-sign-compare -I/usr/include/NetworkManager -pthread -DGSEAL_ENABLE -I/usr/include/atk-1.0 -I/usr/include/gdk-pixbuf-2.0 -I/usr/include/pango-1.0 -I/usr/include/pixman-1 -I/usr/include/freetype2 -I/usr/include/libpng12 -I/usr/include/seed-gtk3 -I/usr/include/webkit-3.0 -I/usr/include/gobject-introspection-1.0 -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/gtk-3.0 -I/usr/include/libsoup-2.4 -I/usr/include/cairo -I/usr/include/gio-unix-2.0/ -I/usr/include/libxml2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security -Wall -c ephy-window.c  -fPIC -DPIC -o .libs/libephymain_la-ephy-window.o
> ephy-window.c: In function 'construct_confirm_close_dialog':
> ephy-window.c:531:7: error: format not a string literal and no format arguments [-Werror=format-security]
> ephy-window.c:534:3: error: format not a string literal and no format arguments [-Werror=format-security]
> cc1: some warnings being treated as errors
> 
> make[5]: *** [libephymain_la-ephy-window.lo] Error 1

The full build log is available from:
   http://people.debian.org/~lucas/logs/2011/09/23/epiphany-browser_3.0.4-1_lsid64.buildlog

This happened because since dpkg 1.16.0 [0], hardening flags are enabled 
under various conditions.

[0] http://lists.debian.org/debian-devel-announce/2011/09/msg00001.html

A list of current common problems and possible solutions is available at 
http://wiki.debian.org/qa.debian.org/FTBFS . You're welcome to contribute!

About the archive rebuild: The rebuild was done on about 50 AMD64 nodes
of the Grid'5000 platform, using a clean chroot.  Internet was not
accessible from the build systems.