php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #46887 -Werror=format-security - compile failure with ext/xmlwriter/php_xmlwriter.c
Submitted: 2008-12-17 10:47 UTC Modified: 2008-12-18 20:08 UTC
From: oeriksson at mandriva dot com Assigned:
Status: Closed Package: XML Writer
PHP Version: 5.2.8 OS: Mandriva Cooker
Private report: No CVE-ID: None
View Developer Edit
 [2008-12-17 10:47 UTC] oeriksson at mandriva dot com 
Description:
------------
I get a build error when using -Werror=format-security with php_xmlwriter.c

Reproduce code:
---------------
Proposed fix:

[oden@oe BUILD]$ cat php-5.2.8-format_not_a_string_literal_and_no_format_arguments.diff
--- ext/xmlwriter/php_xmlwriter.c       2008-12-16 17:31:11.000000000 +0100
+++ ext/xmlwriter/php_xmlwriter.c.oden  2008-12-16 17:31:54.000000000 +0100
@@ -168,7 +168,7 @@ static zend_object_value xmlwriter_objec

 #define XMLW_NAME_CHK(__err) \
        if (xmlValidateName((xmlChar *) name, 0) != 0) {        \
-               php_error_docref(NULL TSRMLS_CC, E_WARNING, __err);     \
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "%s", __err);       \
                RETURN_FALSE;   \
        }       \



Expected result:
----------------
It should build?

Actual result:
--------------
/home/oden/RPM/BUILD/php-5.2.8/ext/xmlwriter/php_xmlwriter.c: In function 'php_xmlwriter_string_arg':
/home/oden/RPM/BUILD/php-5.2.8/ext/xmlwriter/php_xmlwriter.c:441: error: format not a string literal and no format arguments

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-12-17 21:20 UTC] crrodriguez at opensuse dot org 
Yeah, and there is another one in 5_3

Index: ext/mysqli/mysqli.c
===================================================================
RCS file: /repository/php-src/ext/mysqli/mysqli.c,v
retrieving revision 1.72.2.16.2.17.2.33
diff -u -p -r1.72.2.16.2.17.2.33 mysqli.c
--- ext/mysqli/mysqli.c 27 Nov 2008 19:01:22 -0000      1.72.2.16.2.17.2.33
+++ ext/mysqli/mysqli.c 17 Dec 2008 21:18:33 -0000
@@ -1352,7 +1352,7 @@ if (a) {\
 #define LOCAL_INFILE_ERROR_MSG(source,dest)\
        memset(source, 0, LOCAL_INFILE_ERROR_LEN);\
        memcpy(source, dest, MIN(strlen(dest), LOCAL_INFILE_ERROR_LEN-1));\
-       php_error_docref(NULL TSRMLS_CC, E_WARNING, dest);
+       php_error_docref(NULL TSRMLS_CC, E_WARNING,"%s", dest);


 /* {{{ php_local_infile_init
 [2008-12-18 20:08 UTC] iliaa@php.net 
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Thu Nov 21 09:01:32 2024 UTC