Bug#997142: bastet: FTBFS: Ui.cpp:184:14: error: format not a string literal and no format arguments [-Werror=format-security]

[Lucas Nussbaum]

Source: bastet
Version: 0.43-6
Severity: serious
Justification: FTBFS
Tags: bookworm sid ftbfs

Hi,

During a rebuild of all packages in sid, your package failed to build
on amd64.


Relevant part (hopefully):
> g++ -g -O2 -ffile-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -Wformat -Werror=format-security -DNDEBUG -Wall -Wdate-time -D_FORTIFY_SOURCE=2  -c -o BlockChooser.o BlockChooser.cpp
> Ui.cpp: In member function ‘int Bastet::BorderedWindow::GetMinX()’:
> Ui.cpp:82:9: warning: variable ‘y’ set but not used [-Wunused-but-set-variable]
>    82 |     int y,x;
>       |         ^
> Ui.cpp: In member function ‘int Bastet::BorderedWindow::GetMaxX()’:
> Ui.cpp:94:9: warning: variable ‘y’ set but not used [-Wunused-but-set-variable]
>    94 |     int y,x;
>       |         ^
> Ui.cpp: In function ‘Bastet::Dot Bastet::BoundingRect(const string&)’:
> Ui.cpp:174:24: warning: narrowing conversion of ‘(maxlen + 1)’ from ‘size_t’ {aka ‘long unsigned int’} to ‘int’ [-Wnarrowing]
>   174 |     return (Dot){maxlen+1,splits.size()};
>       |                  ~~~~~~^~
> Ui.cpp:174:38: warning: narrowing conversion of ‘splits.std::vector<std::__cxx11::basic_string<char> >::size()’ from ‘std::vector<std::__cxx11::basic_string<char> >::size_type’ {aka ‘long unsigned int’} to ‘int’ [-Wnarrowing]
>   174 |     return (Dot){maxlen+1,splits.size()};
>       |                           ~~~~~~~~~~~^~
> Ui.cpp: In member function ‘void Bastet::Ui::MessageDialog(const string&)’:
> Ui.cpp:184:14: error: format not a string literal and no format arguments [-Werror=format-security]
>   184 |     mvwprintw(w,0,0,message.c_str());
>       |     ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~
> Ui.cpp: In member function ‘std::string Bastet::Ui::InputDialog(const string&)’:
> Ui.cpp:201:14: error: format not a string literal and no format arguments [-Werror=format-security]
>   201 |     mvwprintw(w,0,0,message.c_str());
>       |     ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~
> Ui.cpp: In member function ‘int Bastet::Ui::KeyDialog(const string&)’:
> Ui.cpp:222:14: error: format not a string literal and no format arguments [-Werror=format-security]
>   222 |     mvwprintw(w,0,0,message.c_str());
>       |     ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~
> Ui.cpp: In member function ‘int Bastet::Ui::MenuDialog(const std::vector<std::__cxx11::basic_string<char> >&)’:
> Ui.cpp:236:17: warning: narrowing conversion of ‘(width + 5)’ from ‘size_t’ {aka ‘long unsigned int’} to ‘int’ [-Wnarrowing]
>   236 |     Dot d={width+5,choices.size()};
>       |            ~~~~~^~
> Ui.cpp:236:32: warning: narrowing conversion of ‘(& choices)->std::vector<std::__cxx11::basic_string<char> >::size()’ from ‘std::vector<std::__cxx11::basic_string<char> >::size_type’ {aka ‘long unsigned int’} to ‘int’ [-Wnarrowing]
>   236 |     Dot d={width+5,choices.size()};
>       |                    ~~~~~~~~~~~~^~
> Ui.cpp:240:16: error: format not a string literal and no format arguments [-Werror=format-security]
>   240 |       mvwprintw(w,i,4,choices[i].c_str());
>       |       ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~
> Ui.cpp: In member function ‘void Bastet::Ui::ChooseLevel()’:
> Ui.cpp:291:16: error: format not a string literal and no format arguments [-Werror=format-security]
>   291 |       mvwprintw(w,0,0,msg.c_str());
>       |       ~~~~~~~~~^~~~~~~~~~~~~~~~~~~
> g++ -g -O2 -ffile-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -Wformat -Werror=format-security -DNDEBUG -Wall -Wdate-time -D_FORTIFY_SOURCE=2  -c -o BastetBlockChooser.o BastetBlockChooser.cpp
> cc1plus: some warnings being treated as errors
> make[1]: *** [<builtin>: Ui.o] Error 1


The full build log is available from:
http://qa-logs.debian.net/2021/10/23/bastet_0.43-6_unstable.log

A list of current common problems and possible solutions is available at
http://wiki.debian.org/qa.debian.org/FTBFS . You're welcome to contribute!

If you reassign this bug to another package, please marking it as 'affects'-ing
this package. See https://www.debian.org/Bugs/server-control#affects

If you fail to reproduce this, please provide a build log and diff it with mine
so that we can identify if something relevant changed in the meantime.