Werror=format-security issue from gprofng/src/Print.cc

Yichao Yu via Gdb <[email protected]>
Newsgroups gmane.comp.gdb.devel
Message-ID <CAMvDr+St65VrE2-_boON-m_Ph0A4MhPWFUGqWd9xZ1HQ-z+oxg@mail.gmail.com>
I got a format-security werror on gprofng/src/Print.cc when trying to
build the master version of gdb (the compiler flag is added by the
archlinuxcn build machine).

While I could disable the flag, I think there might be a real issue
looking at the code.

The line that causes the issue is
https://github.com/bminor/binutils-gdb/blob/master/gprofng/src/Print.cc#L2616,
which uses a "dynamic" format string without any argument. AFAICT, the
fmt3 is only ever initialized in
`er_print_experiment::overview_summary` and if I read it correctly,
it's initialized to a string with no actual formatting inputs other
than a `%%`. It is used, however, twice in
`er_print_experiment::overview_value`, one given two zeros as the
arguments and one given no arguments so it looks a bit suspicious.

The git log shows now history of this file so I'm not sure what's the
intention but my best guess is

1. the `fprintf (out_file, fmt3, 0., 0.);` was meant to be using
`fmt4`. (I assume this is to avoid nan from total_value = 0), or
2. since fmt3 is actually a string that's more or less "0.0 (0.0)"
with padding, the two `0.`s passed to fmt3 are probably bogus and it
should be the same as the `fprintf (out_file, fmt3);` below

if my understanding is correct, I think in either case one can simply
avoid using fmt3 with fprintf by just removing the extra % from it and
directly write it to the output instead. (i.e.
https://gist.github.com/yuyichao/7e7cc2f240a1a6e92a1b2a9da8eb3905)
Did I miss anything?

Yichao
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.