9539 2016-04-28 10:34:17 +0000 Resolve string formatting issues in busybox 2018-02-09 23:20:39 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core 2.2 x86 Multiple RESOLVED WONTFIX Medium normal 2.5 1 joshuagloe ross.burton elena.reshetova garbados libertad.gonzalez.de.la.cruz meta.mr.watcher meta.watcher --- --- No (bug/feature does not impact docs) oldest_to_newest 61771 0 joshuagloe 2016-04-28 10:34:17 +0000 Busybox fails to compile with compiler flags which elevate common string formatting issues into an error (-Wformat -Wformat-security -Werror=format-security). 70473 1 joshuagloe 2017-02-07 13:20:21 +0000 Setting assignee to recipe maintainer. Chen Qi, please feel free to update estimate, target, etc. to suit your workload. 70483 2 joshuagloe 2017-02-07 13:24:45 +0000 Note: to observe the failures comment out the recipe's SECURITY_STRINGFORMAT entry in security_cflags.inc and build the recipe with a configuration that utilises security_cflags (i.e. the poky-lsb distro). 74014 3 garbados 2017-06-12 18:52:20 +0000 Unassigned myself after struggling with it for a while :( 79364 4 maxin.john 2018-02-06 13:38:09 +0000 From this commit (ca81a937225714f75157eb596d90255243ae2e29), it seems the mainline is not super interested in fixing these kind of format related bugs in busybox (mainly due to size) --- disable format security warnings We pass strings to printf directly a lot. Some distros enable some flags in their gcc by default like -Wformat-security. With these two things, we end up with a lot of build warnings like so: loginutils/chpasswd.c:42:3: warning: format not a string literal and no format arguments [-Wformat-security] But we don't care. Our focus is first and foremost on size, so adding a lot of dummy calls like: - printf(some_constant_string); + printf("%s", some_constant_string); is pointless bloat. Disable this warning flag if the compiler supports it. Signed-off-by: Mike Frysinger <vapier@gentoo.org> https://git.busybox.net/busybox/commit/?id=ca81a937225714f75157eb596d90255243ae2e29 79365 5 maxin.john 2018-02-06 13:42:59 +0000 Even if we prepare patches for format-security warnings, busybox mainline would treat it as "pointless bloat". Should we still fix those and carry the burden with us ? 79411 6 ross.burton 2018-02-09 23:20:39 +0000 Wow that's impressive logic. If printf(string) is fine but printf("%s", string) is bloat, surely printf(string) is bloat as puts(string) is more efficient? Yes, if upstream refuse to fix these, then I think we just have to sigh. At least their forcing the flag off...