0 | |
From: Tim Dengel <tim.dengel.debian@gmail.com>
|
1 | |
Date: Thu, 15 Sep 2016 01:10:38 +0200
|
2 | |
Subject: Replace unsafe format string by safe alternative
|
3 | |
|
4 | |
Compiling with -Werror=format-security fails because a printf-like function was used in an unsafe way.
|
5 | |
Format strings for functions like this should be string literals, to avoid injection of
|
6 | |
format specifiers, which can lead to undefined behavior if they are not filled in with arguments.
|
7 | |
|
8 | |
If one wants to pass a normal string to one of those functions without formatting, the format string
|
9 | |
"%s" should be used, with the desired string passed as an argument for it.
|
10 | |
|
11 | |
See also:
|
12 | |
https://stackoverflow.com/questions/17260409/fprintf-error-format-not-a-string-literal-and-no-format-arguments-werror-for
|
13 | |
https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html
|
14 | |
---
|
15 | |
src/gt-twitch.c | 6 +++---
|
16 | |
1 file changed, 3 insertions(+), 3 deletions(-)
|
17 | |
|
18 | |
diff --git a/src/gt-twitch.c b/src/gt-twitch.c
|
19 | |
index 3fd7a93..e890be7 100644
|
20 | |
--- a/src/gt-twitch.c
|
21 | |
+++ b/src/gt-twitch.c
|
22 | |
@@ -1720,7 +1720,7 @@ gt_twitch_follows_all(GtTwitch* self, const gchar* user_name, GError** error)
|
23 | |
_("Twitch replied with error code '%d', message '%s' and body '%s'"),
|
24 | |
msg->status_code, msg->reason_phrase, msg->response_body->data);
|
25 | |
|
26 | |
- g_set_error(error, GT_TWITCH_ERROR, GT_TWITCH_ERROR_FOLLOWS_ALL, msg_str);
|
27 | |
+ g_set_error(error, GT_TWITCH_ERROR, GT_TWITCH_ERROR_FOLLOWS_ALL, "%s", msg_str);
|
28 | |
|
29 | |
g_free(msg_str);
|
30 | |
|
31 | |
@@ -1864,7 +1864,7 @@ gt_twitch_follow_channel(GtTwitch* self,
|
32 | |
_("Twitch replied with error code '%d', message '%s' and body '%s'"),
|
33 | |
msg->status_code, msg->reason_phrase, msg->response_body->data);
|
34 | |
|
35 | |
- g_set_error(error, GT_TWITCH_ERROR, GT_TWITCH_ERROR_FOLLOW_CHANNEL, msg_str);
|
36 | |
+ g_set_error(error, GT_TWITCH_ERROR, GT_TWITCH_ERROR_FOLLOW_CHANNEL, "%s", msg_str);
|
37 | |
|
38 | |
g_free(msg_str);
|
39 | |
|
40 | |
@@ -1942,7 +1942,7 @@ gt_twitch_unfollow_channel(GtTwitch* self,
|
41 | |
_("Twitch replied with error code '%d', message '%s' and body '%s'"),
|
42 | |
msg->status_code, msg->reason_phrase, msg->response_body->data);
|
43 | |
|
44 | |
- g_set_error(error, GT_TWITCH_ERROR, GT_TWITCH_ERROR_FOLLOW_CHANNEL, msg_str);
|
45 | |
+ g_set_error(error, GT_TWITCH_ERROR, GT_TWITCH_ERROR_FOLLOW_CHANNEL, "%s", msg_str);
|
46 | |
|
47 | |
g_free(msg_str);
|
48 | |
|