Bug#643371: dasher: FTBFS: game_mode_helper.cpp:327:15: error: format not a string literal and no format arguments [-Werror=format-security]

[Didier Raboud]

Source: dasher
Version: 4.11-1
Severity: serious
Tags: wheezy sid
User: debian-qa at lists.debian.org
Usertags: qa-ftbfs-20110923 qa-ftbfs hardening-format-security hardening
Justification: FTBFS on amd64

Hi,

During a rebuild of all packages in sid, your package failed to build on
amd64.

Relevant part:
> /bin/bash ../../libtool --tag=CXX   --mode=compile g++ -DHAVE_CONFIG_H -I. -I../..    -I./../DasherCore -DPROGDATA=\"/usr/share/dasher\" -I../../intl -I../../intl -pthread -I/usr/include/gtk-2.0 -I/usr/lib/x86_64-linux-gnu/gtk-2.0/include -I/usr/include/atk-1.0 -I/usr/include/gdk-pixbuf-2.0 -I/usr/include/pango-1.0 -I/usr/include/pixman-1 -I/usr/include/freetype2 -I/usr/include/libpng12 -I/usr/include/cairo -I/usr/include/gio-unix-2.0/ -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include   -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include   -DORBIT2=1 -pthread -I/usr/include/gconf/2 -I/usr/include/orbit-2.0 -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include   -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include   -pthread -DORBIT2=1 -I/usr/include/gnome-speech-1.0 -I/usr/include/libbonobo-2.0 -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/orbit-2.0 -I/usr/include/bonobo-activation-2.0   -pthread -DORBIT2=1 -D_REENTRANT -I/usr/include/gtk-2.0 -I/usr/include/gdk-pixbuf-2.0 -I/usr/include/pango-1.0 -I/usr/include/gail-1.0 -I/usr/include/freetype2 -I/usr/include/atk-1.0 -I/usr/lib/x86_64-linux-gnu/gtk-2.0/include -I/usr/include/pixman-1 -I/usr/include/libpng12 -I/usr/include/bonobo-activation-2.0 -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/orbit-2.0 -I/usr/include/libbonobo-2.0 -I/usr/include/libgnomeui-2.0 -I/usr/include/libart-2.0 -I/usr/include/gconf/2 -I/usr/include/gnome-keyring-1 -I/usr/include/libgnome-2.0 -I/usr/include/libbonoboui-2.0 -I/usr/include/libgnomecanvas-2.0 -I/usr/include/gnome-vfs-2.0 -I/usr/lib/gnome-vfs-2.0/include -I/usr/include/libxml2 -I/usr/include/cairo -I/usr/include/gio-unix-2.0/ -I/usr/include/at-spi-1.0      -g -O2 -fstack-protector --param=ssp-buffer-size=4 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security -Wall -c -o game_mode_helper.lo game_mode_helper.cpp
> libtool: compile:  g++ -DHAVE_CONFIG_H -I. -I../.. -I./../DasherCore -DPROGDATA=\"/usr/share/dasher\" -I../../intl -I../../intl -pthread -I/usr/include/gtk-2.0 -I/usr/lib/x86_64-linux-gnu/gtk-2.0/include -I/usr/include/atk-1.0 -I/usr/include/gdk-pixbuf-2.0 -I/usr/include/pango-1.0 -I/usr/include/pixman-1 -I/usr/include/freetype2 -I/usr/include/libpng12 -I/usr/include/cairo -I/usr/include/gio-unix-2.0/ -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -DORBIT2=1 -pthread -I/usr/include/gconf/2 -I/usr/include/orbit-2.0 -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -pthread -DORBIT2=1 -I/usr/include/gnome-speech-1.0 -I/usr/include/libbonobo-2.0 -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/orbit-2.0 -I/usr/include/bonobo-activation-2.0 -pthread -DORBIT2=1 -D_REENTRANT -I/usr/include/gtk-2.0 -I/usr/include/gdk-pixbuf-2.0 -I/usr/include/pango-1.0 -I/usr/include/gail-1.0 -I/usr/include/freetype2 -I/usr/include/atk-1.0 -I/usr/lib/x86_64-linux-gnu/gtk-2.0/include -I/usr/include/pixman-1 -I/usr/include/libpng12 -I/usr/include/bonobo-activation-2.0 -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/orbit-2.0 -I/usr/include/libbonobo-2.0 -I/usr/include/libgnomeui-2.0 -I/usr/include/libart-2.0 -I/usr/include/gconf/2 -I/usr/include/gnome-keyring-1 -I/usr/include/libgnome-2.0 -I/usr/include/libbonoboui-2.0 -I/usr/include/libgnomecanvas-2.0 -I/usr/include/gnome-vfs-2.0 -I/usr/lib/gnome-vfs-2.0/include -I/usr/include/libxml2 -I/usr/include/cairo -I/usr/include/gio-unix-2.0/ -I/usr/include/at-spi-1.0 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security -Wall -c game_mode_helper.cpp  -fPIC -DPIC -o .libs/game_mode_helper.o
> In file included from ./../DasherCore/DasherComponent.h:4:0,
>                  from ./../DasherCore/DasherModel.h:34,
>                  from ./../DasherCore/ControlManager.h:24,
>                  from GtkDasherControl.h:8,
>                  from game_mode_helper.h:4,
>                  from game_mode_helper.cpp:1:
> ./../DasherCore/SettingsStore.h:21:15: warning: declaration 'struct Dasher::CEventHandler' does not declare anything [enabled by default]
> ./../DasherCore/SettingsStore.h:22:15: warning: declaration 'struct Dasher::CParameterNotificationEvent' does not declare anything [enabled by default]
> game_mode_helper.cpp: In function 'void game_mode_helper_update_target_label(GameModeHelper*)':
> game_mode_helper.cpp:275:21: warning: variable 'co' set but not used [-Wunused-but-set-variable]
> game_mode_helper.cpp: In function 'void game_mode_helper_dialog_box(GameModeHelper*, const gchar*)':
> game_mode_helper.cpp:327:15: error: format not a string literal and no format arguments [-Werror=format-security]
> cc1plus: some warnings being treated as errors
> 
> make[4]: *** [game_mode_helper.lo] Error 1

The full build log is available from:
   http://people.debian.org/~lucas/logs/2011/09/23/dasher_4.11-1_lsid64.buildlog

This happened because since dpkg 1.16.0 [0], hardening flags are enabled 
under various conditions.

[0] http://lists.debian.org/debian-devel-announce/2011/09/msg00001.html

A list of current common problems and possible solutions is available at 
http://wiki.debian.org/qa.debian.org/FTBFS . You're welcome to contribute!

About the archive rebuild: The rebuild was done on about 50 AMD64 nodes
of the Grid'5000 platform, using a clean chroot.  Internet was not
accessible from the build systems.