Description: filt/remez.c: ensure string format security This patch addresses a compilation failure when building EDFbrowser with -Werror=format-security with gcc: . filt/remez.c: In function ‘init_frequencies’: filt/remez.c:174:27: error: format not a string literal and no format arguments [-Werror=format-security] 174 | fprintf(stderr, spec->err_msg); | ~~~~^~~~~~~~~ filt/remez.c: In function ‘func_b’: filt/remez.c:1024:25: error: format not a string literal and no format arguments [-Werror=format-security] 1024 | fprintf(stderr, spec->err_msg); | ~~~~^~~~~~~~~ . The spec->err_msg should be preformatted already, so any occurrence of a percent format control in the resulting string may result in a crash of the function trying to print out the message to stderr. It should be unlikely, but in doubt… Author: Étienne Mollier Forwarded: https://gitlab.com/Teuniz/EDFbrowser/-/merge_requests/6?commit_id=11bc3f6cb055946c41e7384720f8c46c57282df7 Last-Update: 2023-01-30 --- This patch header follows DEP-3: http://dep.debian.net/deps/dep3/ --- edfbrowser.orig/filt/remez.c +++ edfbrowser/filt/remez.c @@ -171,7 +171,7 @@ { spec->error = -2; snprintf(spec->err_msg, T_RZ_MAX_MSG_LEN, "init_frequencies(): reached max frequencies: %i line: %i file: %s\n", spec->r, __LINE__, __FILE__); - fprintf(stderr, spec->err_msg); + fprintf(stderr, "%s", spec->err_msg); return -2; } @@ -1021,7 +1021,7 @@ { snprintf(spec->err_msg, T_RZ_MAX_MSG_LEN, "func_b() error: %i line: %i file: %s\n", err, __LINE__, __FILE__); spec->error = -1; - fprintf(stderr, spec->err_msg); + fprintf(stderr, "%s", spec->err_msg); err = 1; }