Searching for a gcc option

Searching for a gcc option

[Pierre Wieser]

Hi

I'am the maintainer of Nautilus-Actions, a Gnome application.

I'm afraid that my code may sometimes embed some sentences such as
    printf( "blah blah" );
instead of
    printf( "%s", "blah blah" );

For the second time, a Gentoo user complains about a syntax error
in the first form, probably due to a particular configuration option
of the Gentoo gcc.

Might someone be kind enough to point out which gcc option I should
use in order to be warned on this type of error, please ?
This may give better quality to my releases...

My current compilation options are:
-Wall -Wmissing-prototypes -Wnested-externs -Wpointer-arith -Wno-sign-compare -Werror -ansi -fstack-protector -Wno-overlength-strings -g -O2 -MT


Thanks in advance for your help
Regards
Pierre

Re: Searching for a gcc option

[Kevin P. Fleming]

Pierre Wieser wrote:

> I'm afraid that my code may sometimes embed some sentences such as
>     printf( "blah blah" );
> instead of
>     printf( "%s", "blah blah" );
> 
> For the second time, a Gentoo user complains about a syntax error
> in the first form, probably due to a particular configuration option
> of the Gentoo gcc.
> 
> Might someone be kind enough to point out which gcc option I should
> use in order to be warned on this type of error, please ?
> This may give better quality to my releases...

This is -Wformat.

-- 
Kevin P. Fleming
Digium, Inc. | Director of Software Technologies
445 Jan Davis Drive NW - Huntsville, AL 35806 - USA
skype: kpfleming | jabber: kpfleming@digium.com
Check us out at www.digium.com & www.asterisk.org

Re: Searching for a gcc option

[Frank Mehnert]

[-- Attachment #1: Type: text/plain, Size: 991 bytes --]

On Monday 04 January 2010, Pierre Wieser wrote:
> I'am the maintainer of Nautilus-Actions, a Gnome application.
>
> I'm afraid that my code may sometimes embed some sentences such as
>     printf( "blah blah" );
> instead of
>     printf( "%s", "blah blah" );
>
> For the second time, a Gentoo user complains about a syntax error
> in the first form, probably due to a particular configuration option
> of the Gentoo gcc.

the first form is dangerous if "blah blah" is a string which can
contain format specifiers, for instance

  void foo(const char *str)
  {
    ...
    printf(str);
  }

where str is passed from somewhere else. Maybe Gentoo hardenend does
not allow such use of printf. The correct switch for this warning is

  -Wformat-security

which will make gcc produce

  ``warning: format not a string literal and no format arguments''

in such a case.

Kind regards,

Frank
-- 
Dr.-Ing. Frank Mehnert    Sun Microsystems, Inc.    www.sun.com

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 197 bytes --]