search

tomac / yersinia

A framework for layer 2 attacks
GNU General Public License v2.0
702 stars 119 forks source link

ncurses: always use "%s"-style format for printf()-style functions #68

Closed vdot0x23 closed 2 years ago

vdot0x23 commented 2 years ago

ncuses-6.3 added printf-style function attributes and now makes it easier to catch cases when user input is used in place of format string when built with CFLAGS=-Werror=format-security.

In yersinia a typical build failure looks like:

ncurses-interface.c: In function 'ncurses_i_error_window':
ncurses-interface.c:1190:10: error: format not a string literal and no format arguments [8;;https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wformat-security-Werror=format-security8;;]
 1190 |          mvwprintw(my_window, i, 2, m_split);
      |          ^~~~~~~~~

Let's wrap all the missing places with "%s" format.

Thanks to @trofi for writing https://discourse.nixos.org/t/uncoming-ncurses-6-2-6-3-update/16169 motivating this PR as I'm working on packaging yersinia for NixOS :)