Tue Nov 6 19:54:00 CET 2007 Jim Meyering <meyering@redhat.com>

        Avoid risk of format string abuse (also avoids gcc warnings).
        * src/util.c (ReportError): Use a literal "%s" format string.
        * src/remote_internal.c (server_error): Likewise.
        * src/qemu_conf.c (qemudReportError): Likewise.
        * acinclude.m4: Add -Wformat -Wformat-security to default
          list of warning flags, to warn about errors such as the
          above.

ChangeLog

+Tue Nov 6 19:54:00 CET 2007 Jim Meyering  <meyering@redhat.com>
+
+	Avoid risk of format string abuse (also avoids gcc warnings).
+	* src/util.c (ReportError): Use a literal "%s" format string.
+	* src/remote_internal.c (server_error): Likewise.
+	* src/qemu_conf.c (qemudReportError): Likewise.
+	* acinclude.m4: Add -Wformat -Wformat-security to default
+	  list of warning flags, to warn about errors such as the
+	  above.
+
 Tue Nov  6 17:24:16 CET 2007 Daniel Veillard <veillard@redhat.com>
 
 	* src/xs_internals.c: patch from Chris Lalancette, forgot to

acinclude.m4

@@ -26,13 +26,13 @@ AC_DEFUN([LIBVIRT_COMPILE_WARNINGS],[
         try_compiler_flags=""
 	;;
     minimum)
-	try_compiler_flags="-Wall $common_flags"
+	try_compiler_flags="-Wall -Wformat -Wformat-security $common_flags"
 	;;
     yes)
-	try_compiler_flags="-Wall -Wmissing-prototypes $common_flags"
+	try_compiler_flags="-Wall -Wformat -Wformat-security -Wmissing-prototypes $common_flags"
 	;;
     maximum|error)
-	try_compiler_flags="-Wall -Wmissing-prototypes -Wnested-externs -Wpointer-arith"
+	try_compiler_flags="-Wall -Wformat -Wformat-security -Wmissing-prototypes -Wnested-externs -Wpointer-arith"
 	try_compiler_flags="$try_compiler_flags -Wextra -Wshadow -Wcast-align -Wwrite-strings -Waggregate-return"
 	try_compiler_flags="$try_compiler_flags -Wstrict-prototypes -Winline -Wredundant-decls -Wno-sign-compare"
 	try_compiler_flags="$try_compiler_flags $common_flags"

src/qemu_conf.c

@@ -64,7 +64,7 @@ void qemudReportError(virConnectPtr conn,
         errorMessage[0] = '\0';
     }
     __virRaiseError(conn, dom, net, VIR_FROM_QEMU, code, VIR_ERR_ERROR,
-                    NULL, NULL, NULL, -1, -1, errorMessage);
+                    NULL, NULL, NULL, -1, -1, "%s", errorMessage);
 }
 
 int qemudLoadDriverConfig(struct qemud_driver *driver,

src/remote_internal.c

@@ -3073,7 +3073,7 @@ server_error (virConnectPtr conn, remote_error *err)
                      err->domain, err->code, err->level,
                      str1, str2, str3,
                      err->int1, err->int2,
-                     message);
+                     "%s", message);
 }
 
 /* get_nonnull_domain and get_nonnull_network turn an on-wire

src/util.c

@@ -53,7 +53,7 @@ ReportError(virConnectPtr conn,
         errorMessage[0] = '\0';
     }
     __virRaiseError(conn, dom, net, VIR_FROM_NONE, code, VIR_ERR_ERROR,
-                    NULL, NULL, NULL, -1, -1, errorMessage);
+                    NULL, NULL, NULL, -1, -1, "%s", errorMessage);
 }
 
 static int virSetCloseExec(int fd) {