NagiosEnterprises / ndoutils

NDOUtils - Database Output for Nagios Core
GNU General Public License v2.0
48 stars 21 forks source link

src/queue.c: fix format-security warnings with explicit "%s" format string #42

Closed orlitzky closed 6 years ago

orlitzky commented 7 years ago

The syslog function takes as its second argument a format string (a la printf), but if the third parameter is a string, then the format string can be omitted. This has led to security vulnerabilities in the past, and compilers can now warn about it. In particular, GCC has the -Wformat-security option, which can be made an error with -Werror=format-security.

A few such two-argument calls were present in src/queue.c, where constant strings were being logged to syslog. This commit adds the second format string parameter (simply %s in this case) to avoid the compiler warnings.

More information about format-security can be found in Fedora's FAQ:

https://fedoraproject.org/wiki/Format-Security-FAQ

hedenface commented 7 years ago

I'm working on a good "Contributors" document for all of the Nagios Open Source projects - one of those steps will include adding yourself to the Thanks document.

Are you able to adjust your PR to include yourself in the THANKS file?

Thanks!

orlitzky commented 7 years ago

Sure thing, done.