Bug#643406: hydrogen: FTBFS: libs/hydrogen/src/object.cpp:242:30: error: format not a string literal and no format arguments [-Werror=format-security]

[Didier Raboud]

Source: hydrogen
Version: 0.9.5-3
Severity: serious
Tags: wheezy sid
User: debian-qa at lists.debian.org
Usertags: qa-ftbfs-20110923 qa-ftbfs hardening-format-security hardening
Justification: FTBFS on amd64

Hi,

During a rebuild of all packages in sid, your package failed to build on
amd64.

Relevant part:
> g++ -o libs/hydrogen/src/object.o -c -O3 -fomit-frame-pointer -funroll-loops -g -O2 -fstack-protector --param=ssp-buffer-size=4 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security -Wall -DOSS_SUPPORT -DALSA_SUPPORT -DJACK_SUPPORT -DLRDF_SUPPORT -DPORTAUDIO_SUPPORT -DPORTMIDI_SUPPORT -DLADSPA_SUPPORT -DLIBARCHIVE_SUPPORT -DQT_CORE_LIB -DQT_GUI_LIB -DQT_XML_LIB -DQT_SHARED -I. -Igui/src -I3rdparty/install/include -Ilibs/hydrogen/include -I/usr/include/qt4 -I/usr/include/qt4/QtCore -I/usr/include/qt4/QtGui -I/usr/include/qt4/QtXml libs/hydrogen/src/object.cpp
> libs/hydrogen/src/object.cpp: In function 'void* loggerThread_func(void*)':
> libs/hydrogen/src/object.cpp:242:30: error: format not a string literal and no format arguments [-Werror=format-security]
> libs/hydrogen/src/object.cpp:244:42: error: format not a string literal and no format arguments [-Werror=format-security]
> cc1plus: some warnings being treated as errors
> 
> scons: *** [libs/hydrogen/src/object.o] Error 1
> scons: building terminated because of errors.
> make: *** [debian/stamp-scons-build] Error 2

The full build log is available from:
   http://people.debian.org/~lucas/logs/2011/09/23/hydrogen_0.9.5-3_lsid64.buildlog

This happened because since dpkg 1.16.0 [0], hardening flags are enabled 
under various conditions.

[0] http://lists.debian.org/debian-devel-announce/2011/09/msg00001.html

A list of current common problems and possible solutions is available at 
http://wiki.debian.org/qa.debian.org/FTBFS . You're welcome to contribute!

About the archive rebuild: The rebuild was done on about 50 AMD64 nodes
of the Grid'5000 platform, using a clean chroot.  Internet was not
accessible from the build systems.