Bug#643417: libccscript3: FTBFS: compiler.cpp:1147:38: error: format not a string literal and no format arguments [-Werror=format-security]

[Didier Raboud]

Source: libccscript3
Version: 1.1.7-1.1
Severity: serious
Tags: wheezy sid
User: debian-qa at lists.debian.org
Usertags: qa-ftbfs-20110923 qa-ftbfs hardening-format-security hardening
Justification: FTBFS on amd64

Hi,

During a rebuild of all packages in sid, your package failed to build on
amd64.

Relevant part:
>  g++ -DHAVE_CONFIG_H -I. -g -O2 -fstack-protector --param=ssp-buffer-size=4 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security -Wall -D_GNU_SOURCE -c compiler.cpp  -fPIC -DPIC -o .libs/compiler.o
> compiler.cpp: In member function 'char* ost::ScriptCompiler::getToken(char**)':
> compiler.cpp:198:11: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:289:11: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:319:11: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:321:11: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:323:11: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:325:11: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:327:11: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:329:11: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:331:11: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:333:11: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp: In member function 'int ost::ScriptCompiler::compileDefinitions(const char*)':
> compiler.cpp:499:62: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp: In member function 'int ost::ScriptCompiler::compile(std::istream*, char*, const char*)':
> compiler.cpp:819:15: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:934:15: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:935:14: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:956:13: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:961:14: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:962:13: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:968:14: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:969:13: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:974:14: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:975:13: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:980:13: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:985:14: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:997:13: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:998:13: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:1004:14: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:1006:14: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:1012:13: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:1020:13: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:1033:13: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:1094:12: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:1133:11: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:1147:38: error: format not a string literal and no format arguments [-Werror=format-security]
> compiler.cpp:1147:38: error: format not a string literal and no format arguments [-Werror=format-security]
> compiler.cpp:1169:15: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:1206:12: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:1211:12: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:1216:12: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:1221:12: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:1226:12: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:1243:13: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:1288:14: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> compiler.cpp:1466:12: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
> cc1plus: some warnings being treated as errors
> 
> make[3]: *** [compiler.lo] Error 1

The full build log is available from:
   http://people.debian.org/~lucas/logs/2011/09/23/libccscript3_1.1.7-1.1_lsid64.buildlog

This happened because since dpkg 1.16.0 [0], hardening flags are enabled 
under various conditions.

[0] http://lists.debian.org/debian-devel-announce/2011/09/msg00001.html

A list of current common problems and possible solutions is available at 
http://wiki.debian.org/qa.debian.org/FTBFS . You're welcome to contribute!

About the archive rebuild: The rebuild was done on about 50 AMD64 nodes
of the Grid'5000 platform, using a clean chroot.  Internet was not
accessible from the build systems.