Busybox fails to compile with compiler flags which elevate common string formatting issues into an error (-Wformat -Wformat-security -Werror=format-security).
Setting assignee to recipe maintainer. Chen Qi, please feel free to update estimate, target, etc. to suit your workload.
Note: to observe the failures comment out the recipe's SECURITY_STRINGFORMAT entry in security_cflags.inc and build the recipe with a configuration that utilises security_cflags (i.e. the poky-lsb distro).
Unassigned myself after struggling with it for a while :(
From this commit (ca81a937225714f75157eb596d90255243ae2e29), it seems the mainline is not super interested in fixing these kind of format related bugs in busybox (mainly due to size) --- disable format security warnings We pass strings to printf directly a lot. Some distros enable some flags in their gcc by default like -Wformat-security. With these two things, we end up with a lot of build warnings like so: loginutils/chpasswd.c:42:3: warning: format not a string literal and no format arguments [-Wformat-security] But we don't care. Our focus is first and foremost on size, so adding a lot of dummy calls like: - printf(some_constant_string); + printf("%s", some_constant_string); is pointless bloat. Disable this warning flag if the compiler supports it. Signed-off-by: Mike Frysinger <vapier@gentoo.org> https://git.busybox.net/busybox/commit/?id=ca81a937225714f75157eb596d90255243ae2e29
Even if we prepare patches for format-security warnings, busybox mainline would treat it as "pointless bloat". Should we still fix those and carry the burden with us ?
Wow that's impressive logic. If printf(string) is fine but printf("%s", string) is bloat, surely printf(string) is bloat as puts(string) is more efficient? Yes, if upstream refuse to fix these, then I think we just have to sigh. At least their forcing the flag off...