Hi! On Sun, 2026-08-30 at 22:02:34 +0100, João wrote: > Package: dillo > Version: 3.3.0-3 > Severity: normal > Tags: ftbfs patch > X-Debbugs-Cc: [email protected], [email protected] > User: [email protected] > Usertags: hurd-i386
> Version 3.3.0 of Dillo does not currently build on > GNU/hurd due to the macro PATH_MAX not being defined > on that platform. The attached patch addresses the > problem. The patch calls snprintf() to get the resulting formatted string length, but does not check for error values. It then uses the unchecked returned length for a VLA, which tends to be a controversial usage, as that allocates a potentially arbitrary size from the stack (with no easy way to check for errors), and where I'm not sure the dillo project might have policies against its use. I'd tend to default to allocating on the heap on these cases. The second snprintf() also is not being checked for errors (which would be unlikely if the first one succeeded, but personally I'd check them anyway out of defensive programming). The patch is also attributed to the package maintainer which seems suspect, and the boilerplate patch metadata seems in need of an update. Thanks, Guillem
