From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 4017 invoked by alias); 17 Jan 2006 19:46:32 -0000 Received: (qmail 3999 invoked by uid 22791); 17 Jan 2006 19:46:29 -0000 X-Spam-Check-By: sourceware.org Received: from nevyn.them.org (HELO nevyn.them.org) (66.93.172.17) by sourceware.org (qpsmtpd/0.31.1) with ESMTP; Tue, 17 Jan 2006 19:46:27 +0000 Received: from drow by nevyn.them.org with local (Exim 4.54) id 1Eywme-0002iE-VA for gdb-patches@sourceware.org; Tue, 17 Jan 2006 14:46:25 -0500 Date: Tue, 17 Jan 2006 19:46:00 -0000 From: Daniel Jacobowitz To: gdb-patches@sourceware.org Subject: Re: [ob] More warnings; Call for assistance Message-ID: <20060117194624.GA10188@nevyn.them.org> Mail-Followup-To: gdb-patches@sourceware.org References: <20060117151730.GA2420@nevyn.them.org> <20060117152156.GA3115@nevyn.them.org> <8f2776cb0601171137yffbcd4exefdefe7c8a79bbf3@mail.gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <8f2776cb0601171137yffbcd4exefdefe7c8a79bbf3@mail.gmail.com> User-Agent: Mutt/1.5.8i X-IsSubscribed: yes Mailing-List: contact gdb-patches-help@sourceware.org; run by ezmlm Precedence: bulk List-Subscribe: List-Archive: List-Post: List-Help: , Sender: gdb-patches-owner@sourceware.org X-SW-Source: 2006-01/txt/msg00221.txt.bz2 On Tue, Jan 17, 2006 at 11:37:29AM -0800, Jim Blandy wrote: > Looking at the printcmd.c warnings, there's the following note in Makefile.in: > > # FIXME: cagney/2003-08-10: Do not try to build "printcmd.c" with > # -Wformat-nonliteral. It needs to be overhauled so that it doesn't > # pass user input strings as the format parameter to host printf > # function calls. > printcmd.o: $(srcdir)/printcmd.c > $(CC) -c $(INTERNAL_WARN_CFLAGS) $(NO_WERROR_CFLAGS) $(srcdir)/printcmd.c > > I gather what this is suggesting is that we have a big switch > selecting an appropriate call to printf that uses a fixed format > string. > > There will be dozens of cases there, due to the modifiers (h, l, ll, > precision, leading sign, alternative form). The precisions will need > to be parsed when present; sometimes they are minimum values, > sometimes they are maximum values. Since we check the number and type > of the arguments, I think -Wformat-nonliteral is the right answer > here. I don't see a benefit to making this change that justifies the > risk of mistakes. > > What do folks think? I disagree, because (IIRC) Debian users have filed at least two bugs where failures in this code have led to user input crashing GDB: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=186037 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=231162 The advantages of static format checking, in the face of that, are pretty large. If we can simplify this or else avoid the use of standard printf, we won't have these kinds of bugs. However, I'd strongly prefer to address the pointer problems first before returning to worry around the edges of this one :-) -- Daniel Jacobowitz CodeSourcery