Skip to content
  • Daniel P. Berrangé's avatar
    88a0ef00
    enforce use of G_GNUC_PRINTF attributes · 88a0ef00
    Daniel P. Berrangé authored
    
    
    We've been very gradually adding G_GNUC_PRINTF annotations
    to functions over years. This has been useful in detecting
    certain malformed printf strings, or cases where we pass
    user data as the printf format which is a potential security
    flaw.
    
    Given the inherant memory corruption danger in use of format
    strings vs mis-matched variadic arguments, it is worth applying
    G_GNUC_PRINTF to all functions using printf, even if we know
    they are safe.
    
    The compilers can reasonably reliably identify such places
    with the -Wsuggest-attribute=format / -Wmissing-format-attribute
    flags.
    
    Signed-off-by: default avatarDaniel P. Berrangé <berrange@redhat.com>
    Message-Id: <20221219130205.687815-7-berrange@redhat.com>
    [-Wsuggest-attribute=format and -Wmissing-format-attribute are
     synonyms, only include one; disable it for testfloat. - Paolo]
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    88a0ef00
    enforce use of G_GNUC_PRINTF attributes
    Daniel P. Berrangé authored
    
    
    We've been very gradually adding G_GNUC_PRINTF annotations
    to functions over years. This has been useful in detecting
    certain malformed printf strings, or cases where we pass
    user data as the printf format which is a potential security
    flaw.
    
    Given the inherant memory corruption danger in use of format
    strings vs mis-matched variadic arguments, it is worth applying
    G_GNUC_PRINTF to all functions using printf, even if we know
    they are safe.
    
    The compilers can reasonably reliably identify such places
    with the -Wsuggest-attribute=format / -Wmissing-format-attribute
    flags.
    
    Signed-off-by: default avatarDaniel P. Berrangé <berrange@redhat.com>
    Message-Id: <20221219130205.687815-7-berrange@redhat.com>
    [-Wsuggest-attribute=format and -Wmissing-format-attribute are
     synonyms, only include one; disable it for testfloat. - Paolo]
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Loading