php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #46887 -Werror=format-security - compile failure with ext/xmlwriter/php_xmlwriter.c
Submitted: 2008-12-17 10:47 UTC Modified: 2008-12-18 20:08 UTC
From: oeriksson at mandriva dot com Assigned:
Status: Closed Package: XML Writer
PHP Version: 5.2.8 OS: Mandriva Cooker
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: oeriksson at mandriva dot com
New email:
PHP Version: OS:

 

 [2008-12-17 10:47 UTC] oeriksson at mandriva dot com 
Description:
------------
I get a build error when using -Werror=format-security with php_xmlwriter.c

Reproduce code:
---------------
Proposed fix:

[oden@oe BUILD]$ cat php-5.2.8-format_not_a_string_literal_and_no_format_arguments.diff
--- ext/xmlwriter/php_xmlwriter.c       2008-12-16 17:31:11.000000000 +0100
+++ ext/xmlwriter/php_xmlwriter.c.oden  2008-12-16 17:31:54.000000000 +0100
@@ -168,7 +168,7 @@ static zend_object_value xmlwriter_objec

 #define XMLW_NAME_CHK(__err) \
        if (xmlValidateName((xmlChar *) name, 0) != 0) {        \
-               php_error_docref(NULL TSRMLS_CC, E_WARNING, __err);     \
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "%s", __err);       \
                RETURN_FALSE;   \
        }       \



Expected result:
----------------
It should build?

Actual result:
--------------
/home/oden/RPM/BUILD/php-5.2.8/ext/xmlwriter/php_xmlwriter.c: In function 'php_xmlwriter_string_arg':
/home/oden/RPM/BUILD/php-5.2.8/ext/xmlwriter/php_xmlwriter.c:441: error: format not a string literal and no format arguments

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-12-17 21:20 UTC] crrodriguez at opensuse dot org 
Yeah, and there is another one in 5_3

Index: ext/mysqli/mysqli.c
===================================================================
RCS file: /repository/php-src/ext/mysqli/mysqli.c,v
retrieving revision 1.72.2.16.2.17.2.33
diff -u -p -r1.72.2.16.2.17.2.33 mysqli.c
--- ext/mysqli/mysqli.c 27 Nov 2008 19:01:22 -0000      1.72.2.16.2.17.2.33
+++ ext/mysqli/mysqli.c 17 Dec 2008 21:18:33 -0000
@@ -1352,7 +1352,7 @@ if (a) {\
 #define LOCAL_INFILE_ERROR_MSG(source,dest)\
        memset(source, 0, LOCAL_INFILE_ERROR_LEN);\
        memcpy(source, dest, MIN(strlen(dest), LOCAL_INFILE_ERROR_LEN-1));\
-       php_error_docref(NULL TSRMLS_CC, E_WARNING, dest);
+       php_error_docref(NULL TSRMLS_CC, E_WARNING,"%s", dest);


 /* {{{ php_local_infile_init
 [2008-12-18 20:08 UTC] iliaa@php.net 
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Thu Apr 17 03:01:25 2025 UTC