<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On Oct 24, 2013, at 21:33, C. Bergström <<a href="mailto:cbergstrom@pathscale.com">cbergstrom@pathscale.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">On 10/25/13 10:49 AM, Sean Bruno wrote:<br><blockquote type="cite">libnvpair.c has some macros and preprocessor directives that make<br>clang's -Wformat-security very unhappy.<br><br>/home/sbruno/bsd/head/cddl/lib/libnvpair/../../../cddl/contrib/opensolaris/lib/libnvpair/libnvpair.c:245:1: warning: format string is not a string literal (po<br>tentially insecure) [-Wformat-security]<br>NVLIST_ARRPRTFUNC(byte_array, uchar_t, uchar_t, "0x%2.2x")<br>^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>/home/sbruno/bsd/head/cddl/lib/libnvpair/../../../cddl/contrib/opensolaris/lib/libnvpair/libnvpair.c:238:23: note: expanded from macro 'NVLIST_ARRPRTFUNC'<br> (void) fprintf(fp, pctl->nvprt_btwnarrfmt); \<br><br><br>I don't see a real graceful way out of this. Also, this is totally<br>"legit" C, so I don't see any reason to generate these warnings. Can<br>someone educate me on either:<br> 1. fixing these warnings the right way<br> 2. how to disable the warning flags/makefile magic<br></blockquote>One of our friends working on FBSD is having the above issue. Cross posting in case anyone here is familiar with this issue.<br></blockquote></div><br><div>The warning is saying that pctl->nvprt_btwnarrfmt could be anything, which is locally correct. If a stray percent ever makes it into that string, there'll be a crash at best. I imagine nvprt_btwnarrfmt is pretty well controlled, so it's probably not an example in practice, but local analysis can't prove that.</div><div><br></div><div>If they don't like the warning, they can disable it locally with <a href="http://clang.llvm.org/docs/UsersManual.html#controlling-diagnostics-via-pragmas">pragmas</a> (_Pragma around that line, perhaps), or just add -Wno-format-security to their warning flags.</div><div><br></div><div>Jordan</div></body></html>