Author: Andreas Tille <tille@debian.org>
Last-Update: Fri, 26 Oct 2018 20:34:34 +0200
Description: Ensure format security

--- a/src/compute_qv/Btk_qv_io.c
+++ b/src/compute_qv/Btk_qv_io.c
@@ -1426,13 +1426,13 @@
     /* Set alignment parameters globally. */
     if (set_alignment_parameters(&align_pars, Match, MisMatch, Insertion,
             Deletion, &message ) == ERROR) {
-        fprintf(stderr, message.text);
+        fprintf(stderr, "%s", message.text);
         goto error;
     }
 
     if (set_alignment_parameters_IUB(&align_pars_IUB, Match, MisMatch,
             Insertion, Deletion, &message ) == ERROR ) {
-        fprintf(stderr, message.text);
+        fprintf(stderr, "%s", message.text);
         goto error;
     }	
 
@@ -1451,7 +1451,7 @@
     /* Create reverse complement of consensus. */
     if (contig_get_reverse_comp(&consensusrc, &consensus, 
              &message)==ERROR ) {
-        fprintf(stderr, message.text);
+        fprintf(stderr, "%s", message.text);
         goto error;
     }
     FREE(qv); 
--- a/src/mktrain/train.c
+++ b/src/mktrain/train.c
@@ -1600,7 +1600,7 @@
     /* Set parameters for alignment with consensus */
     if (set_alignment_parameters( &align_pars, Match, MisMatch, GapInit,
 	GapExt  , &message ) ==ERROR ) {
-    	fprintf(stderr, message.text);
+    	fprintf(stderr, "%s", message.text);
     	exit (ERROR);
     }
 
@@ -1608,7 +1608,7 @@
     if (set_alignment_parameters_IUB( &align_pars_IUB, 
         Match * VECTOR_MATCH_MULTIPLIER, MisMatch, GapInit, GapExt, 
         &message ) ==ERROR ) {
-    	fprintf(stderr, message.text);
+    	fprintf(stderr, "%s", message.text);
     	exit (ERROR);
     }
 
@@ -1636,7 +1636,7 @@
     	fprintf(fout, "# Site = %s\n",   SiteName);
     	if (readVector( VectorName, PrimerName, SiteName, &vector, 
 	    &align_pars_IUB, &message) ==ERROR ) {
-      	    fprintf(stderr, message.text);
+      	    fprintf(stderr, "%s", message.text);
       	    exit (ERROR);
     	}
     	vecP=&vector;
@@ -1644,7 +1644,7 @@
 	      && (! PrimerSpecified) && (!SiteSpecified) ) {
     	fprintf(fout, "# Short Vector = %s\n", VectorName);
     	if (readShortVector( VectorName, &vector, &message) == ERROR ) {
-      	    fprintf(stderr, message.text);
+      	    fprintf(stderr, "%s", message.text);
      	    exit (ERROR);
     	}
     	vecP=&vector;
@@ -1669,14 +1669,14 @@
        	    /* Read consensus file. */
     	    if (local_read_fasta( ConsensusName, &consensus, &message)
                 == ERROR) {
-      	        fprintf(stderr, message.text);
+      	        fprintf(stderr, "%s", message.text);
    	        exit (ERROR);
             }
 
    	    /* Create reverse complement of consensus. */
     	    if (contig_get_reverse_comp( &consensusrc, &consensus, &message)
                 == ERROR) {
-  	        fprintf(stderr, message.text);
+  	        fprintf(stderr, "%s", message.text);
  	        exit (ERROR);
             }
     	}
--- a/src/mktrain/trainphd.c
+++ b/src/mktrain/trainphd.c
@@ -928,7 +928,7 @@
         if (set_alignment_parameters( &align_pars, Match, MisMatch, GapInit,
             GapExt, &message ) != SUCCESS) 
         {
-           fprintf(stderr, message.text);
+           fprintf(stderr, "%s", message.text);
            exit (ERROR);
         }
    
@@ -937,7 +937,7 @@
             Match * VECTOR_MATCH_MULTIPLIER, MisMatch, 
             GapInit, GapExt, &message ) != SUCCESS)
         {
-           fprintf(stderr, message.text);
+           fprintf(stderr, "%s", message.text);
            exit (ERROR);
         }
 
@@ -956,7 +956,7 @@
         	fprintf(fout, "# Site = %s\n",   SiteName);
         	if (readVector( VectorName, PrimerName, SiteName, &vector, 
     	        &align_pars_IUB, &message) ==ERROR ) {
-      	        fprintf(stderr, message.text);
+      	        fprintf(stderr, "%s", message.text);
       	        exit (ERROR);
     	    }
     	    vecP=&vector;
@@ -964,7 +964,7 @@
     	      && (! PrimerSpecified) && (!SiteSpecified) ) {
         	fprintf(fout, "# Short Vector = %s\n", VectorName);
         	if (readShortVector( VectorName, &vector, &message) == ERROR ) {
-          	    fprintf(stderr, message.text);
+          	    fprintf(stderr, "%s", message.text);
      	        exit (ERROR);
     	    }
     	    vecP=&vector;
@@ -1008,14 +1008,14 @@
 	    /* Read consensus file. */
 	    if (local_read_fasta( ConsensusName, &consensus, &message ) != SUCCESS)
             {
-	        fprintf(stderr, message.text);
+	        fprintf(stderr, "%s", message.text);
 	        exit (ERROR);
 	    }
 	    /* Create reverse complement of consensus. */
             if (contig_get_reverse_comp( &rev_comp, &consensus, &message ) 
                 != SUCCESS) 
             {
-	        fprintf(stderr, message.text);
+	        fprintf(stderr, "%s", message.text);
 	        exit (ERROR);
 	    }
 
@@ -1081,14 +1081,14 @@
             fprintf( fout, "#\n");
 	    /* Read consensus file. */
 	    if (local_read_fasta( ConsensusName, &consensus, &message ) != SUCCESS) {
-	        fprintf(stderr, message.text);
+	        fprintf(stderr, "%s", message.text);
 	        exit (ERROR);
 	    }
 	    /* Create reverse complement of consensus. */
 	    if (contig_get_reverse_comp( &rev_comp, &consensus, &message )
                 != SUCCESS) 
             {
-	        fprintf(stderr, message.text);
+	        fprintf(stderr, "%s", message.text);
 	        exit (ERROR);
 	    }
 
@@ -1120,23 +1120,23 @@
     if (!hist)
     { 
         if (alignment_parameters_release( &align_pars, &message ) != SUCCESS) {
-           fprintf(stderr, message.text);
+           fprintf(stderr, "%s", message.text);
            exit (ERROR);
         }
 
         if (alignment_parameters_release( &align_pars_IUB, &message ) != SUCCESS) {
-           fprintf(stderr, message.text);
+           fprintf(stderr, "%s", message.text);
            exit (ERROR);
         }
 
         if ( ( InputType == NAME_FILES ) || ( InputType == NAME_DIR ) ) {
     	    if (contig_release( &consensus, &message ) != SUCCESS) {
-	        fprintf(stderr, message.text);
+	        fprintf(stderr, "%s", message.text);
 	        exit (ERROR);
 	    }
 
             if (contig_release( &rev_comp, &message ) != SUCCESS) {
-	        fprintf(stderr, message.text);
+	        fprintf(stderr, "%s", message.text);
 	        exit (ERROR);
             }
         }