[Pkg-mpd-maintainers] Bug#646261: gimmix: FTBFS with -Werror=format-security

[Julian Taylor]

Source: gimmix
Version: 0.5.7.1-3
Severity: normal
User: debian-qa at lists.debian.org
Usertags: hardening-format-security hardening

the package gimmix fails to compile with the new hardened compiler flags
dpkg-buildflag outputs [0].
The problematic flag is: -Werror=format-security
See the ubuntu buildlog:
https://launchpadlibrarian.net/83134274/buildlog_ubuntu-precise-i386.gimmix_0.5.7.1-3_FAILEDTOBUILD.txt.gz
Snippet:
gcc -DHAVE_CONFIG_H -I. -I.. -pthread -I/usr/include/gtk-2.0
-I/usr/lib/x86_64-linux-gnu/gtk-2.0/include -I/usr/include/atk-1.0
-I/usr/include/gdk-pixbuf-2.0 -I/usr/include/pango-1.0
-I/usr/include/pixman-1 -I/usr/include/freetype2 -I/usr/include/libpng12
-I/usr/include/taglib -I/usr/include/cairo -I/usr/include/gio-unix-2.0/
-I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include
-I/usr/include/libmpd-1.0/ -I/usr/include/libglade-2.0
-I/usr/include/libxml2 -DPREFIX=\"/usr\" -fPIC  -D_FORTIFY_SOURCE=2  -g
-O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat
-Wformat-security -Werror=format-security -DHAVE_TAGEDITOR -DHAVE_LYRICS
-DHAVE_COVER_PLUGIN -pipe -Wall -c gimmix-config.c
gimmix-config.c: In function 'gimmix_config_get_bool':
gimmix-config.c:96:3: warning: zero-length gnu_printf format string
[-Wformat-zero-length]
gimmix-config.c: In function 'gimmix_config_get_proxy_string':
gimmix-config.c:149:4: error: format not a string literal and no format
arguments [-Werror=format-security]

The buildflags are not exported in debian, but can be enabled e.g. by
adding this to debian/rules:

 DPKG_EXPORT_BUILDFLAGS = 1
 include /usr/share/dpkg/buildflags.mk

Please fix the issues and maybe also enable the hardened build in debian.

[0] http://lists.debian.org/debian-devel-announce/2011/09/msg00001.html



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: OpenPGP digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-mpd-maintainers/attachments/20111022/3e613f14/attachment.pgp>