Bug#643428: libimage-librsvg-perl: FTBFS: LibRSVG.xs:121:9: error: format not a string literal and no format arguments [-Werror=format-security]

[Didier Raboud]

Source: libimage-librsvg-perl
Version: 0.07-5
Severity: serious
Tags: wheezy sid
User: debian-qa at lists.debian.org
Usertags: qa-ftbfs-20110923 qa-ftbfs hardening-format-security hardening
Justification: FTBFS on amd64

Hi,

During a rebuild of all packages in sid, your package failed to build on
amd64.

Relevant part:
> cc -c  -pthread -I/usr/include/librsvg-2.0 -I/usr/include/gdk-pixbuf-2.0 -I/usr/include/libpng12 -I/usr/include/pixman-1 -I/usr/include/freetype2 -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/cairo   -D_REENTRANT -D_GNU_SOURCE -DDEBIAN -fno-strict-aliasing -pipe -fstack-protector -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security   -DVERSION=\"0.07\" -DXS_VERSION=\"0.07\" -fPIC "-I/usr/lib/perl/5.12/CORE"   LibRSVG.c
> In file included from LibRSVG.xs:15:0:
> ppport.h:227:0: warning: "PERL_UNUSED_DECL" redefined [enabled by default]
> /usr/lib/perl/5.12/CORE/perl.h:308:0: note: this is the location of the previous definition
> LibRSVG.xs: In function 'rsvg_pixbuf_from_file_with_size_data_ex':
> LibRSVG.xs:121:9: error: format not a string literal and no format arguments [-Werror=format-security]
> LibRSVG.xs: In function 'XS_Image__LibRSVG_getSupportedFormats':
> LibRSVG.xs:408:9: warning: passing argument 2 of 'g_slist_foreach' from incompatible pointer type [enabled by default]
> /usr/include/glib-2.0/glib/gslist.h:96:10: note: expected 'GFunc' but argument is of type 'void (*)(struct GdkPixbufFormat *, struct AV *)'
> LibRSVG.xs: In function 'XS_Image__LibRSVG_getKnownFormats':
> LibRSVG.xs:421:9: warning: passing argument 2 of 'g_slist_foreach' from incompatible pointer type [enabled by default]
> /usr/include/glib-2.0/glib/gslist.h:96:10: note: expected 'GFunc' but argument is of type 'void (*)(struct GdkPixbufFormat *, struct AV *)'
> LibRSVG.xs: In function 'XS_Image__LibRSVG_isFormatSupported':
> LibRSVG.xs:437:9: warning: passing argument 2 of 'g_slist_foreach' from incompatible pointer type [enabled by default]
> /usr/include/glib-2.0/glib/gslist.h:96:10: note: expected 'GFunc' but argument is of type 'void (*)(struct GdkPixbufFormat *, struct AV *)'
> cc1: some warnings being treated as errors
> 
> make[2]: *** [LibRSVG.o] Error 1

The full build log is available from:
   http://people.debian.org/~lucas/logs/2011/09/23/libimage-librsvg-perl_0.07-5_lsid64.buildlog

This happened because since dpkg 1.16.0 [0], hardening flags are enabled 
under various conditions.

[0] http://lists.debian.org/debian-devel-announce/2011/09/msg00001.html

A list of current common problems and possible solutions is available at 
http://wiki.debian.org/qa.debian.org/FTBFS . You're welcome to contribute!

About the archive rebuild: The rebuild was done on about 50 AMD64 nodes
of the Grid'5000 platform, using a clean chroot.  Internet was not
accessible from the build systems.