Re: Fwd: [PATCH] fix format security

Collin Funk wrote:
> > More details here:
> > https://lists.gnu.org/archive/html/bug-gnulib/2025-05/msg00266.html
> > https://lists.gnu.org/archive/html/bug-gnulib/2025-06/msg00327.html
> > https://lists.gnu.org/archive/html/bug-gnulib/2026-01/msg00088.html
> 
> It is a bit unfortunate that this warning comes up almost monthly
> because clang doesn't special case gettext, misleading well-meaning bug
> reporters...
> 
> I'll check if there is an existing clang report or file one later.

Thanks for taking a bit off of my workload.

The three important points to mention in the clang bug report are:
  - The test case produces no warning with gcc, but it does with clang.
  - The clang warning occurs only for format strings without format
    directives. But a format string with format directives is not more
    secure than a format string without format directives.
  - The security of the translations is guaranteed through the workflow
    (xgettext marks the string with '#, c-format', then 'msgfmt -c' verifies
    the compatibility of the format string directives in the translation).

Bruno