Bug#643427: libidn2-0: FTBFS: idn2.c:161:5: error: format not a string literal and no format arguments [-Werror=format-security]

[Didier Raboud]

Source: libidn2-0
Version: 0.7-6
Severity: serious
Tags: wheezy sid
User: address@hidden
Usertags: qa-ftbfs-20110923 qa-ftbfs hardening-format-security hardening
Justification: FTBFS on amd64

Hi,

During a rebuild of all packages in sid, your package failed to build on
amd64.

Relevant part:
> gcc -std=gnu99 -DHAVE_CONFIG_H -I.  -I. -I./.. -I./.. -I./../gl -I./../gl 
> -I./gl -I./gl   -g -O2 -fstack-protector --param=ssp-buffer-size=4 
> -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security -Wall 
> -c idn2.c
> idn2.c: In function 'hexdump':
> idn2.c:110:5: warning: pointer targets in passing argument 1 of 'strlen' 
> differ in signedness [-Wpointer-sign]
> /usr/include/string.h:399:15: note: expected 'const char *' but argument is 
> of type 'uint8_t *'
> idn2.c:116:3: warning: pointer targets in passing argument 1 of 
> '__builtin_strlen' differ in signedness [-Wpointer-sign]
> idn2.c:116:3: note: expected 'const char *' but argument is of type 'uint8_t 
> *'
> idn2.c:116:3: warning: pointer targets in passing argument 2 of 
> '__builtin_strcmp' differ in signedness [-Wpointer-sign]
> idn2.c:116:3: note: expected 'const char *' but argument is of type 'uint8_t 
> *'
> idn2.c:116:3: warning: pointer targets in passing argument 2 of 
> '__builtin_strcmp' differ in signedness [-Wpointer-sign]
> idn2.c:116:3: note: expected 'const char *' but argument is of type 'uint8_t 
> *'
> idn2.c:116:3: warning: pointer targets in passing argument 1 of 
> '__builtin_strlen' differ in signedness [-Wpointer-sign]
> idn2.c:116:3: note: expected 'const char *' but argument is of type 'uint8_t 
> *'
> idn2.c:116:3: warning: pointer targets in passing argument 2 of 
> '__builtin_strcmp' differ in signedness [-Wpointer-sign]
> idn2.c:116:3: note: expected 'const char *' but argument is of type 'uint8_t 
> *'
> idn2.c:116:3: warning: pointer targets in passing argument 2 of 
> '__builtin_strcmp' differ in signedness [-Wpointer-sign]
> idn2.c:116:3: note: expected 'const char *' but argument is of type 'uint8_t 
> *'
> idn2.c:117:5: warning: pointer targets in passing argument 1 of 'strlen' 
> differ in signedness [-Wpointer-sign]
> /usr/include/string.h:399:15: note: expected 'const char *' but argument is 
> of type 'uint8_t *'
> idn2.c: In function 'main':
> idn2.c:136:3: warning: statement with no effect [-Wunused-value]
> idn2.c:137:3: warning: statement with no effect [-Wunused-value]
> idn2.c:161:5: error: format not a string literal and no format arguments 
> [-Werror=format-security]
> idn2.c:179:4: error: format not a string literal and no format arguments 
> [-Werror=format-security]
> cc1: some warnings being treated as errors
> 
> make[5]: *** [idn2.o] Error 1

The full build log is available from:
   
http://people.debian.org/~lucas/logs/2011/09/23/libidn2-0_0.7-6_lsid64.buildlog

This happened because since dpkg 1.16.0 [0], hardening flags are enabled 
under various conditions.

[0] http://lists.debian.org/debian-devel-announce/2011/09/msg00001.html

A list of current common problems and possible solutions is available at 
http://wiki.debian.org/qa.debian.org/FTBFS . You're welcome to contribute!

About the archive rebuild: The rebuild was done on about 50 AMD64 nodes
of the Grid'5000 platform, using a clean chroot.  Internet was not
accessible from the build systems.