<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
I'm great with this being an error. "printf(fmt, x, y, z);" is
suspicious, and can remain a warning, but "printf(fmt);" should just
default to being an error. Just be sure there is a way to turn it
back into a warning, or squelched entirely.<br>
<br>
You should strongly consider adding a fix-it for this situation.
That should make it slightly more palatable to turn the warning into
an error.<br>
<br>
<div class="moz-cite-prefix">On 2/16/2016 1:01 PM, David Blaikie via
cfe-dev wrote:<br>
</div>
<blockquote
cite="mid:CAENS6Estf1Qc_7CEvrSKKXnTB=bmKd06Sy=9WasPaQm77QG+6g@mail.gmail.com"
type="cite">
<div dir="ltr">What other warnings do we default to error? Do we
seem to have any (defacto or explicit) guideline for deciding?</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Mon, Feb 15, 2016 at 6:04 PM, Bob
Wilson via cfe-dev <span dir="ltr"><<a
moz-do-not-send="true"
href="mailto:cfe-dev@lists.llvm.org" target="_blank"><a class="moz-txt-link-abbreviated" href="mailto:cfe-dev@lists.llvm.org">cfe-dev@lists.llvm.org</a></a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">We’ve had
a number of requests to make the format-security warning
default to an error. This warning complains about a
printf-like format string that is not a literal string and
is used without any arguments. E.G.:<br>
<br>
format-security.c:4:10: warning: format string is not a
string literal (potentially insecure) [-Wformat-security]<br>
printf(fmt);<br>
^~~<br>
1 warning generated.<br>
<br>
For background, if the format string can be controlled by
external input, the security risk is that it could contain
“%” characters and be used to clobber memory. The
alternative is to use a fixed “%s” format, e.g.,
printf(“%s”, fmt).<br>
<br>
This catches real-world security holes, but sometimes people
don’t pay attention to warnings. Promoting this warning to
an error by default would get people’s attention and help
motivate them to fix their code. But, the obvious downside
is that it could be disruptive. Existing code might fail to
build and would either require source code fixes or build
changes to specify -Wno-error=format-security.<br>
<br>
Opinions?<br>
_______________________________________________<br>
cfe-dev mailing list<br>
<a moz-do-not-send="true"
href="mailto:cfe-dev@lists.llvm.org">cfe-dev@lists.llvm.org</a><br>
<a moz-do-not-send="true"
href="http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev"
rel="noreferrer" target="_blank">http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev</a><br>
</blockquote>
</div>
<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
cfe-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:cfe-dev@lists.llvm.org">cfe-dev@lists.llvm.org</a>
<a class="moz-txt-link-freetext" href="http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev">http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Employee of Qualcomm Innovation Center, Inc.
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, a Linux Foundation Collaborative Project
</pre>
</body>
</html>