Package: zoo
Version: 2.10-24
Severity: important
Tags: patch
Please enabled hardened build flags through dpkg-buildflags.
Patch attached. The hardened build flags also exposed several
missing format strings, for which I have attached patches as
well.
Cheers,
Moritz
diff -aur zoo-2.10.orig/makefile zoo-2.10/makefile
--- zoo-2.10.orig/makefile 2012-01-09 06:08:51.000000000 +0100
+++ zoo-2.10/makefile 2012-01-09 06:13:28.000000000 +0100
@@ -23,7 +23,11 @@
MODEL =
EXTRA = -DBIG_MEM -DNDEBUG
LINTFLAGS = -DLINT
-OPTIM = -O -Wall
+OPTIM = `dpkg-buildflags --get CFLAGS`
+OPTIM += -Wall
+OPTIM += `dpkg-buildflags --get CPPFLAGS`
+LDFLAGS = `dpkg-buildflags --get LDFLAGS`
+
DESTDIR = /usr/local/bin
#List of all object files created for Zoo
@@ -98,11 +102,11 @@
# Linux
linux:
- $(MAKE) CC="gcc" CFLAGS="-c $(OPTIM) $(LINTFLAGS) -DLINUX -DANSI_HDRS" $(TARGETS)
+ $(MAKE) CC="gcc" CFLAGS="-c $(OPTIM) $(LINTFLAGS) -DLINUX -DANSI_HDRS" LDFLAGS="$(LDFLAGS)" $(TARGETS)
# Linux64
linux64:
- $(MAKE) CC="gcc" CFLAGS="-c $(OPTIM) $(LINTFLAGS) -DLINUX -DLONG64 -DANSI_HDRS" $(TARGETS)
+ $(MAKE) CC="gcc" CFLAGS="-c $(OPTIM) $(LINTFLAGS) -DLINUX -DLONG64 -DANSI_HDRS" LDFLAGS="$(LDFLAGS)" $(TARGETS)
# ULTRIX 4.1
ultrix:
Nur in zoo-2.10: makefile~.
diff -aur zoo-2.10.orig/zoo.c zoo-2.10/zoo.c
--- zoo-2.10.orig/zoo.c 2012-01-09 06:14:34.000000000 +0100
+++ zoo-2.10/zoo.c 2012-01-09 06:16:28.000000000 +0100
@@ -167,7 +167,7 @@
cmd == UPDATE || cmd == DELETE) && argc < 4) ||
((cmd == EXTRACT || cmd == TEST || cmd == LIST ||
cmd == PRINT || cmd == COMMENT) && argc < 3)) {
- fprintf (stderr, incorrect_args);
+ fprintf (stderr, "%s", incorrect_args);
goto show_usage;
}
} else {
@@ -191,7 +191,7 @@
)
)
) {
- fprintf (stderr, incorrect_args);
+ fprintf (stderr, "%s", incorrect_args);
goto show_usage;
}
}
@@ -282,25 +282,25 @@
/* brief usage list */
give_list:
- fprintf (stderr, usage); zooexit (1);
+ fprintf (stderr, "%s", usage); zooexit (1);
/* help screen */
bigusage:
printf ("Zoo archiver, %s\n", version);
printf("(C) Copyright 1991 Rahul Dhesi -- Noncommercial use permitted\n");
-printf (usage);
+printf ("%s", usage);
printf ("\nChoose a command from within {} and zero or more modifiers from within [].\n");
printf ("E.g.: `zoo a save /bin/*' will archive all files in /bin into save.zoo.\n");
printf ("(Please see the user manual for a complete description of commands.)\n");
-printf (nov_usage);
-printf (nov_cmds);
+printf ("%s", nov_usage);
+printf ("%s", nov_cmds);
printf ("\n");
wait_return(); /* print msg & wait for RETURN */
printf ("\n");
-printf (usage);
+printf ("%s", usage);
printf (" Commands in {} mean: |Modifiers in [] mean:\n");
Nur in zoo-2.10: zoo.c~.
--- zoo-2.10.orig/zooadd.c 2012-01-09 06:14:34.000000000 +0100
+++ zoo-2.10/zooadd.c 2012-01-09 06:19:07.000000000 +0100
@@ -542,7 +542,7 @@
status = getfile (this_file, zoo_file, -1L, 1);
if (status != 0) { /* if III */
success = 0;
- printf (disk_full);
+ printf ("%s", disk_full);
exit_status++;
} else {
success = 1;
diff -aur zoo-2.10.orig/zoolist.c zoo-2.10/zoolist.c
--- zoo-2.10.orig/zoolist.c 2012-01-09 06:14:34.000000000 +0100
+++ zoo-2.10/zoolist.c 2012-01-11 18:53:32.000000000 +0100
@@ -373,7 +373,7 @@
} else {
if (talking && first_time && !show_name) {/*print archive header */
printf ("Length CF Size Now Date Time\n");
- printf (tot_line);
+ printf ("%s", tot_line);
}
printf ("%8lu %3u%% %8lu %2d %-.3s %02d %02d:%02d:%02d",
direntry.org_size,
@@ -476,7 +476,7 @@
if (talking && !show_name) {
if (!fast && file_count) {
tot_sf = cfactor (tot_org_siz, tot_siz_now);
- printf (tot_line);
+ printf ("%s", tot_line);
printf (tot_fmt, tot_org_siz, tot_sf, tot_siz_now, file_count);
if (file_count > 1)
@@ -486,7 +486,7 @@
if (del_count || expl_ver || expl_deleted || expl_comment ||
expl_star || (show_gen && (zoo_header.type > 0)))
- printf (dashes);
+ printf ("%s", dashes);
}
if (!fast) {
@@ -528,7 +528,7 @@
if (talking && show_name) {
if (file_count) {
tot_sf = cfactor (tot_org_siz, tot_siz_now);
- printf (tot_line);
+ printf ("%s", tot_line);
printf (tot_fmt, tot_org_siz, tot_sf, tot_siz_now, file_count);
if (file_count > 1)
printf ("s\n");
Nur in zoo-2.10: zoolist.c~.
