Package: eggdrop
Version: 1.6.20-1
Severity: important
Tags: patch
Please enable hardened build flags through dpkg-buildflags.See
http://lists.debian.org/debian-devel-announce/2012/02/msg00016.html
for details.
Patch attached. relro isn't handled yet, since the upstream
buildsystem doesn't properly propagate LDFLAGS yet.
The patch eggdrop-format.patch fixes missing format strings exposed
by -Werror=format-security.
Cheers,
Moritz
--- eggdrop-1.6.20.harden/debian/rules 2011-07-24 09:12:53.000000000 +0200
+++ eggdrop-1.6.20/debian/rules 2012-04-08 20:35:17.000000000 +0200
@@ -1,6 +1,9 @@
#!/usr/bin/make -f
# -*- mode: makefile; coding: utf-8 -*-
+DPKG_EXPORT_BUILDFLAGS = 1
+include /usr/share/dpkg/buildflags.mk
+
include /usr/share/cdbs/1/rules/debhelper.mk
include /usr/share/cdbs/1/class/autotools.mk
diff -aur eggdrop-1.6.20.orig/src/main.c eggdrop-1.6.20/src/main.c
--- eggdrop-1.6.20.orig/src/main.c 2010-07-12 17:40:52.000000000 +0200
+++ eggdrop-1.6.20/src/main.c 2012-04-08 20:37:43.000000000 +0200
@@ -489,7 +489,7 @@
break; /* this should never be reached */
case 'h':
printf("\n%s\n\n", version);
- printf(EGG_USAGE);
+ printf("%s", EGG_USAGE);
printf("\n");
bg_send_quit(BG_ABORT);
exit(0);
@@ -1042,7 +1042,7 @@
putlog(LOG_ALL, "*", "--- Loading %s (%s)", ver, s);
chanprog();
if (!encrypt_pass) {
- printf(MOD_NOCRYPT);
+ printf("%s", MOD_NOCRYPT);
bg_send_quit(BG_ABORT);
exit(1);
}
Nur in eggdrop-1.6.20/src: main.c~.
diff -aur eggdrop-1.6.20.orig/src/misc.c eggdrop-1.6.20/src/misc.c
--- eggdrop-1.6.20.orig/src/misc.c 2010-06-29 17:52:24.000000000 +0200
+++ eggdrop-1.6.20/src/misc.c 2012-04-08 20:48:12.000000000 +0200
@@ -601,8 +601,8 @@
* then reset repeats. We want the current time here,
* so put that in the file first.
*/
- fprintf(logs[i].f, stamp);
- fprintf(logs[i].f, MISC_LOGREPEAT, logs[i].repeats);
+ fprintf(logs[i].f, "%s", stamp);
+ fprintf(logs[i].f, "%s%s", MISC_LOGREPEAT, logs[i].repeats);
logs[i].repeats = 0;
/* No need to reset logs[i].szlast here
* because we update it later on...
Nur in eggdrop-1.6.20/src: misc.c~.
diff -aur eggdrop-1.6.20.orig/src/mod/transfer.mod/transfer.c eggdrop-1.6.20/src/mod/transfer.mod/transfer.c
--- eggdrop-1.6.20.orig/src/mod/transfer.mod/transfer.c 2010-01-03 14:27:55.000000000 +0100
+++ eggdrop-1.6.20/src/mod/transfer.mod/transfer.c 2012-04-08 20:51:02.000000000 +0200
@@ -786,7 +786,7 @@
static void display_dcc_fork_send(int idx, char *buf)
{
- sprintf(buf, TRANSFER_CONN_SEND);
+ sprintf(buf, "%s", TRANSFER_CONN_SEND);
}
static int expmem_dcc_xfer(void *x)
Nur in eggdrop-1.6.20/src/mod/transfer.mod: transfer.c~.
