search

ros-drivers / openni_camera

A ROS driver for OpenNI depth (+ RGB) cameras.
49 stars 60 forks source link

Broken with `-Werror=format-security` #32

Closed cottsay closed 9 years ago

cottsay commented 9 years ago

There are some places in openni_camera where supposedly "untrusted" format strings are used for IO. When -Werror=format-security is used, this yields errors in compilation.

This flag has been introduced to the default compilation flags for Fedora [1], and is preventing openni_camera from building on Fedora 21 [2].

For more info on -Werror=format-security, see [3]. I think there will be a straightforward fix for this, but I haven't had time to try anything. If someone has a sec to take a look, I'd appreciate it. Otherwise, I'll try to take a look in the next couple of weeks.

To the best of my knowledge, this is the only ROS package that is failing builds due to this flag. For a list of the locations in openni_camera where the errors occur, see the aforementioned build log in Jenkins.

Thanks,

--scott

[1] https://fedorahosted.org/fesco/ticket/1185 [2] http://csc.mcs.sdsmt.edu/jenkins/job/ros-indigo-openni-camera_binaryrpm_21_i386/13/consoleFull [3] http://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html

cottsay commented 9 years ago

I've attached a suggested fix for this issue, which is fairly straightforward.

Commit message explains: Don't pass unsafe strings as format strings for printing. Doing so causes build errors under -Werror=format-security. If there were to be a % (percent symbol) in the exception string (whether intentional, malicious or otherwise), the print function could expose memory or cause segfaults.

I believe this is the last major blocker bug for ROS Indigo on Fedora 21.

jack-oquin commented 9 years ago

+1 Thanks for the fix, Scott. LGTM.