[Debian-med-packaging] Bug#626761: fastx-toolkit: fgets called with bigger size than length of destination buffer

[Charles Plessy]

Package: fastx-toolkit
Version: 0.0.13-1
Severity: normal

(Report recorded on the Debian bug tracking system).

Dear Gordon,

while trying to build fastx-toolkit on Ubuntu, I encountered the following
warning, treated as error:

Making all in libfastx
make[4]: Entering directory `/build/buildd/fastx-toolkit-0.0.13/src/libfastx'
gcc -DHAVE_CONFIG_H -I. -I../..     -g -O2 -g -O2 -Wall -Wextra -Wformat-nonliteral -Wformat-security -Wswitch-default -Wswitch-enum -Wunused-parameter -Wfloat-equal -Werror -DDEBUG -g -O1 -c chomp.c
gcc -DHAVE_CONFIG_H -I. -I../..     -g -O2 -g -O2 -Wall -Wextra -Wformat-nonliteral -Wformat-security -Wswitch-default -Wswitch-enum -Wunused-parameter -Wfloat-equal -Werror -DDEBUG -g -O1 -c fastx.c
cc1: warnings being treated as errors
In file included from /usr/include/stdio.h:930:0,
                 from fastx.c:18:
In function 'fgets',
    inlined from 'fastx_read_next_record' at fastx.c:323:11:
/usr/include/bits/stdio2.h:253:2: error: call to '__fgets_chk_warn' declared with attribute warning: fgets called with bigger size than length of destination buffer
In function 'fgets',
    inlined from 'fastx_read_next_record' at fastx.c:365:12:
/usr/include/bits/stdio2.h:253:2: error: call to '__fgets_chk_warn' declared with attribute warning: fgets called with bigger size than length of destination buffer
make[4]: *** [fastx.o] Error 1

The full log is available here:
https://launchpadlibrarian.net/71709349/buildlog_ubuntu-natty-amd64.fastx-toolkit_0.0.13-1~natty1_FAILEDTOBUILD.txt.gz

I am not sure I understand, but it seems related to “hardening” and the
prevention of buffer overflows.  I looked at the two following URLs,
but did not find more information.

https://wiki.ubuntu.com/Security/Features
http://wiki.debian.org/Hardening

Cheers,

-- 
Charles