File inkscape-buffer-overrun.patch of Package inkscape

File inkscape-buffer-overrun.patch of Package inkscape (Revision e2190d7bfa8451b3be5b5dddd3e1e140)

Currently displaying revision e2190d7bfa8451b3be5b5dddd3e1e140, show latest

Index: inkscape-0.43/src/interface.cpp
===================================================================
--- inkscape-0.43.orig/src/interface.cpp
+++ inkscape-0.43/src/interface.cpp
@@ -1149,7 +1149,7 @@ sp_ui_error_dialog(gchar const *message)
     gchar *safeMsg = Inkscape::IO::sanitizeString(message);
 
     dlg = gtk_message_dialog_new(NULL, GTK_DIALOG_DESTROY_WITH_PARENT, GTK_MESSAGE_ERROR,
-                                 GTK_BUTTONS_CLOSE, safeMsg);
+                                 GTK_BUTTONS_CLOSE, "%s", safeMsg);
     sp_transientize(dlg);
     gtk_window_set_resizable(GTK_WINDOW(dlg), FALSE);
     gtk_dialog_run(GTK_DIALOG(dlg));
Index: inkscape-0.43/src/file.cpp
===================================================================
--- inkscape-0.43.orig/src/file.cpp
+++ inkscape-0.43/src/file.cpp
@@ -239,7 +239,7 @@ sp_file_revert_dialog()
                 GTK_DIALOG_DESTROY_WITH_PARENT,
                 GTK_MESSAGE_WARNING,
                 GTK_BUTTONS_YES_NO,
-                text);
+                "%s", text);
         gint response = gtk_dialog_run(GTK_DIALOG(dialog));
         gtk_widget_destroy(dialog);
         g_free(text);
@@ -278,7 +278,7 @@ void dump_str(gchar const *str, gchar co
     }
 
     tmp += "]";
-    g_message(tmp.c_str());
+    g_message("%s", tmp.c_str());
 }
 
 void dump_ustr(Glib::ustring const &ustr)
@@ -339,7 +339,7 @@ void dump_ustr(Glib::ustring const &ustr
                 tmp += "            ";
             }
 
-            g_message( tmp.c_str() );
+            g_message("%s", tmp.c_str());
         }
     } catch (...) {
         g_message("XXXXXXXXXXXXXXXXXX Exception" );
Index: inkscape-0.43/src/message-context.h
===================================================================
--- inkscape-0.43.orig/src/message-context.h
+++ inkscape-0.43/src/message-context.h
@@ -16,6 +16,7 @@
 
 #include <stdarg.h>
 #include <glib/gtypes.h>
+#include <glib.h>
 #include "message.h"
 
 namespace Inkscape {
@@ -56,7 +57,7 @@ public:
       * @param type the message type
       * @param format a printf-style formatting string
       */
-    void setF(MessageType type, gchar const *format, ...);
+    void setF(MessageType type, gchar const *format, ...) G_GNUC_PRINTF(3, 4);
 
     /** @brief pushes a message on the stack using printf-style formatting,
       *        and a stdarg argument list
@@ -82,7 +83,7 @@ public:
       * @param type the message type
       * @param format a printf-style formatting string
       */
-    void flashF(MessageType type, gchar const *format, ...);
+    void flashF(MessageType type, gchar const *format, ...) G_GNUC_PRINTF(3, 4);
 
     /** @brief pushes a message onto the stack for a brief period of time
       *        using printf-style formatting and a stdarg argument list;
Index: inkscape-0.43/src/message-stack.h
===================================================================
--- inkscape-0.43.orig/src/message-stack.h
+++ inkscape-0.43/src/message-stack.h
@@ -16,6 +16,7 @@
 
 #include <sigc++/sigc++.h>
 #include <glib/gtypes.h>
+#include <glib.h>
 #include <stdarg.h>
 #include "gc-managed.h"
 #include "gc-finalized.h"
@@ -85,7 +86,7 @@ public:
       *
       * @return the id of the pushed message
       */
-    MessageId pushF(MessageType type, gchar const *format, ...);
+    MessageId pushF(MessageType type, gchar const *format, ...) G_GNUC_PRINTF(3, 4);
 
     /** @brief pushes a message onto the stack using printf-like formatting,
       *        using a stdarg argument list
@@ -124,7 +125,7 @@ public:
       *
       * @return the id of the pushed message
       */
-    MessageId flashF(MessageType type, gchar const *format, ...);
+    MessageId flashF(MessageType type, gchar const *format, ...) G_GNUC_PRINTF(3, 4);
 
     /** @brief temporarily pushes a message onto the stack using
       *        printf-like formatting, using a stdarg argument list
Index: inkscape-0.43/src/io/inkscapestream.h
===================================================================
--- inkscape-0.43.orig/src/io/inkscapestream.h
+++ inkscape-0.43/src/io/inkscapestream.h
@@ -13,6 +13,7 @@
 
 
 #include <glibmm.h>
+#include <glib.h>
 
 namespace Inkscape
 {
@@ -475,7 +476,7 @@ public:
     virtual void put(gunichar ch) = 0;
     
     /* Formatted output */
-    virtual Writer& printf(char *fmt, ...) = 0;
+    virtual Writer& printf(char *fmt, ...) G_GNUC_PRINTF(2, 3) = 0;
 
     virtual Writer& writeChar(char val) = 0;
 
@@ -531,7 +532,7 @@ public:
     
     
     /* Formatted output */
-    virtual Writer &printf(char *fmt, ...);
+    virtual Writer &printf(char *fmt, ...) G_GNUC_PRINTF(2, 3);
 
     virtual Writer& writeChar(char val);
 
Index: inkscape-0.43/configure.ac
===================================================================
--- inkscape-0.43.orig/configure.ac
+++ inkscape-0.43/configure.ac
@@ -27,7 +27,7 @@ if test "$GCC" = "yes"; then
   CFLAGS="-Wno-pointer-sign $CFLAGS"
   AC_COMPILE_IFELSE([int dummy;
 ], , CFLAGS="$ink_svd_CFLAGS",)
-  CFLAGS="-Wall -W $CFLAGS"
+  CFLAGS="-Wall -Wformat-security -W $CFLAGS"
 fi
 
 AC_LANG(C++)
@@ -612,7 +612,7 @@ if test "$GXX" = "yes"; then
   # programmer deliberately has an unused parameter (e.g. because it's used
   # as a callback or similar function pointer use).
 
-  CXXFLAGS="-Wall -W -Wpointer-arith -Wcast-align -Wsign-compare -Woverloaded-virtual -Wswitch  $CXXFLAGS"
+  CXXFLAGS="-Wall -Wformat-security -W -Wpointer-arith -Wcast-align -Wsign-compare -Woverloaded-virtual -Wswitch  $CXXFLAGS"
 
   dnl Test for arch-specific situations.
   case "$host_cpu" in
Index: inkscape-0.43/src/debug/logger.cpp
===================================================================
--- inkscape-0.43.orig/src/debug/logger.cpp
+++ inkscape-0.43/src/debug/logger.cpp
@@ -109,7 +109,8 @@ static void set_category_mask(bool * con
             } else if (equal_range("EXTENSION", start, end)) {
                 mask[Event::EXTENSION] = true;
             } else {
-                g_warning("Unknown debugging category %*s", end - start, start);
+                g_warning("Unknown debugging category %*s",
+                          (int) (end - start), start);
             }
         }
         if (*end) {
Index: inkscape-0.43/src/extension/internal/svg.cpp
===================================================================
--- inkscape-0.43.orig/src/extension/internal/svg.cpp
+++ inkscape-0.43/src/extension/internal/svg.cpp
@@ -126,7 +126,7 @@ _load_uri (const gchar *uri)
     GnomeVFSResult result = gnome_vfs_open (&handle, uri_local, GNOME_VFS_OPEN_READ);
 
     if (result != GNOME_VFS_OK) {
-        g_warning(gnome_vfs_result_to_string(result));
+        g_warning("%s", gnome_vfs_result_to_string(result));
     }
 
     while (result == GNOME_VFS_OK) {
Index: inkscape-0.43/src/libcroco/cr-statement.c
===================================================================
--- inkscape-0.43.orig/src/libcroco/cr-statement.c
+++ inkscape-0.43/src/libcroco/cr-statement.c
@@ -2442,7 +2442,7 @@ cr_statement_dump_ruleset (CRStatement *
         g_return_if_fail (a_fp && a_this);
         str = cr_statement_ruleset_to_string (a_this, a_indent);
         if (str) {
-                fprintf (a_fp, str);
+                fprintf (a_fp, "%s", str);
                 g_free (str);
                 str = NULL;
         }
@@ -2487,7 +2487,7 @@ cr_statement_dump_charset (CRStatement *
         str = cr_statement_charset_to_string (a_this,
                                               a_indent) ;
         if (str) {
-                fprintf (a_fp, str) ;
+                fprintf (a_fp, "%s", str) ;
                 g_free (str) ;
                 str = NULL ;
         }
@@ -2511,7 +2511,7 @@ cr_statement_dump_page (CRStatement * a_
 
         str = cr_statement_at_page_rule_to_string (a_this, a_indent) ;
         if (str) {
-                fprintf (a_fp, str);
+                fprintf (a_fp, "%s", str);
                 g_free (str) ;
                 str = NULL ; 
         }
@@ -2534,7 +2534,7 @@ cr_statement_dump_media_rule (CRStatemen
 
         str = cr_statement_media_rule_to_string (a_this, a_indent) ;
         if (str) {
-                fprintf (a_fp, str) ;
+                fprintf (a_fp, "%s", str) ;
                 g_free (str) ;
                 str = NULL ;
         }
@@ -2557,7 +2557,7 @@ cr_statement_dump_import_rule (CRStateme
 
         str = cr_statement_import_rule_to_string (a_this, a_indent) ;
         if (str) {
-                fprintf (a_fp, str) ;
+                fprintf (a_fp, "%s", str) ;
                 g_free (str) ;
                 str = NULL ;
         }
Index: inkscape-0.43/src/xml/repr-css.cpp
===================================================================
--- inkscape-0.43.orig/src/xml/repr-css.cpp
+++ inkscape-0.43/src/xml/repr-css.cpp
@@ -158,10 +158,9 @@ sp_repr_css_print(SPCSSAttr *css)
     for ( List<AttributeRecord const> iter = css->attributeList() ;
           iter ; ++iter )
     {
-        g_print(g_quark_to_string(iter->key));
-        g_print(":\t");
-        g_print(iter->value);
-        g_print("\n");
+        gchar const * key = g_quark_to_string(iter->key);
+        gchar const * val = iter->value;
+        g_print("%s:\t%s\n",key,val);
     }
 }
 
Index: inkscape-0.43/src/dom/cssparser.h
===================================================================
--- inkscape-0.43.orig/src/dom/cssparser.h
+++ inkscape-0.43/src/dom/cssparser.h
@@ -29,6 +29,7 @@
  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
+#include <glib.h>
 
 #include "dom.h"
 
@@ -81,7 +82,7 @@ protected:
     /**
      *
      */
-    void error(char *fmt, ...);
+    void error(char *fmt, ...) G_GNUC_PRINTF(2, 3);
 
     /**
      * Get the character at the given location in the buffer.
Index: inkscape-0.43/src/dom/lsimpl.h
===================================================================
--- inkscape-0.43.orig/src/dom/lsimpl.h
+++ inkscape-0.43/src/dom/lsimpl.h
@@ -33,6 +33,7 @@
 #include "events.h"
 #include "traversal.h"
 #include "ls.h"
+#include <glib.h>
 
 
 #include "xmlreader.h"
@@ -236,7 +237,7 @@ private:
 
     void spaces();
 
-    void po(char *fmt, ...);
+    void po(char *fmt, ...) G_GNUC_PRINTF(2, 3);
 
     void pos(const DOMString &str);
 
Index: inkscape-0.43/src/dom/svgparser.h
===================================================================
--- inkscape-0.43.orig/src/dom/svgparser.h
+++ inkscape-0.43/src/dom/svgparser.h
@@ -30,6 +30,7 @@
  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
+#include <glib.h>
 
 #include "svgimpl.h"
 
@@ -121,7 +122,7 @@ protected:
     /**
      *
      */
-    void error(char *format, ...);
+    void error(char *format, ...) G_GNUC_PRINTF(2, 3);
 
 
 
Index: inkscape-0.43/src/dom/uri.h
===================================================================
--- inkscape-0.43.orig/src/dom/uri.h
+++ inkscape-0.43/src/dom/uri.h
@@ -30,6 +30,7 @@
  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
+#include <glib.h>
 
 #include "dom.h"
 
@@ -149,9 +150,9 @@ private:
 
     DOMString fragment;
 
-    void error(const char *fmt, ...);
+    void error(const char *fmt, ...) G_GNUC_PRINTF(2, 3);
 
-    void trace(const char *fmt, ...);
+    void trace(const char *fmt, ...) G_GNUC_PRINTF(2, 3);
 
 
     int peek(int p);
Index: inkscape-0.43/src/dom/xmlreader.h
===================================================================
--- inkscape-0.43.orig/src/dom/xmlreader.h
+++ inkscape-0.43/src/dom/xmlreader.h
@@ -30,6 +30,7 @@
  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
+#include <glib.h>
 
 #include "dom.h"
 
@@ -80,7 +81,7 @@ public:
 
 protected:
 
-    void error(char *format, ...);
+    void error(char *format, ...) G_GNUC_PRINTF(2, 3);
 
     int  get(int ch);
     int  peek(int ch);
Index: inkscape-0.43/src/jabber_whiteboard/message-handler.cpp
===================================================================
--- inkscape-0.43.orig/src/jabber_whiteboard/message-handler.cpp
+++ inkscape-0.43/src/jabber_whiteboard/message-handler.cpp
@@ -362,7 +362,7 @@ MessageHandler::_error(LmMessage* messag
 		msubtype = lm_message_get_sub_type(message);
 		if (msubtype == LM_MESSAGE_SUB_TYPE_ERROR) {
 			gchar* error = g_strdup(lm_message_node_get_value(root));
-			g_warning(error);
+			g_warning("%s", error);
 
 			// TODO: more robust error handling code
 			this->_sm->disconnectFromDocument();