Bugzilla Bug 130801

There are more format string bugs than those reported by 'c0ntex':

Index: src/xitk/main.c
===================================================================
RCS file: /cvsroot/xine/xine-ui/src/xitk/main.c,v
retrieving revision 1.308
retrieving revision 1.309
diff -u -p -r1.308 -r1.309
--- src/xitk/main.c

There are more format string bugs than those reported by 'c0ntex':

Index: src/xitk/main.c
===================================================================
RCS file: /cvsroot/xine/xine-ui/src/xitk/main.c,v
retrieving revision 1.308
retrieving revision 1.309
diff -u -p -r1.308 -r1.309
--- src/xitk/main.c     24 Jul 2005 02:40:37 -0000      1.308
+++ src/xitk/main.c     1 Aug 2005 23:49:53 -0000       1.309
@@ -456,7 +456,7 @@ static void print_formatted(char *title,
   int          len;
   char        *blanks = "     ";
 
-  printf(title);
+  printf("%s", title);
   
   sprintf(buffer, "%s", blanks);
   plugin = *plugins++;
@@ -469,7 +469,7 @@ static void print_formatted(char *title,
       sprintf(buffer, "%s%s%s", buffer, (strlen(buffer) == strlen(blanks))
? "" : ", ", plugin);
     }
     else {
-      printf(buffer);
+      printf("%s", buffer);
       printf(",\n");
       snprintf(buffer, sizeof(buffer), "%s%s", blanks, plugin);
     }
@@ -478,7 +478,7 @@ static void print_formatted(char *title,
   }
   
   if(strlen(buffer))
-    printf(buffer);
+    printf("%s", buffer);
   
   printf(".\n\n");
 }
Index: src/xitk/xine-toolkit/xitk.c
--- src/xitk/xine-toolkit/xitk.c    2005-05-21 00:02:05.000000000 +0200
+++ src/xitk/xine-toolkit/xitk.c        2006-02-20 12:10:58.000000000 +0100
@@ -1877,7 +1896,7 @@
   sprintf(buffer, "%s%s", buffer, " ]-");

   if(verbosity)
-    printf(buffer);
+    printf("%s", buffer);

   gXitk->wm_type = xitk_check_wm(display);

Index: src/xitk/main.c
===================================================================
RCS file: /cvsroot/xine/xine-ui/src/xitk/main.c,v
retrieving revision 1.311
diff -u -p -r1.311 main.c
--- src/xitk/main.c     24 Dec 2005 09:56:24 -0000      1.311
+++ src/xitk/main.c     20 Apr 2006 15:04:04 -0000
@@ -1219,7 +1219,7 @@ static void event_listener(void *user_da
       }
       
       if(strlen(buffer))
-       report(buffer);
+       report("%s", buffer);
       
     }
     break;

-- 
 (o_   Ludwig Nussel
 //\   SUSE LINUX Products GmbH, Development
 V_/_  http://www.suse.de/

Any pointer to "those by C0ntex" ?

Only the last one is missing from our patchset, the rest, coming out of 1.309,
is my own patch.

I'll provide a bumped revision immediately.

Thx Diego.

xine-ui-0.99.4-r5 with patchset 10 is out with the last format fixed. It also
fixes a few warnings that I was working on trying to fix something else.

Arches please test and mark stable.

stable on ppc64

stable on alpha.

stable on amd64

ppc stable

SPARC, it does an ebuild good

Looks ok to mark this stable on x86 to me - it compiles, runs and plays
something with the several USE flag combinations I tried, and I tested it a lot
with
+X +aalib +curl +libcaca -lirc +ncurses +nls +readline -vdr -xinerama

(DVDs, CDs, various videos, mp3s, several video drivers, subtitles fiddled
about with settings and did various things using the UI and keyboard shortcuts.
aaxine and xine-check work ok. I don't have the hardware to test lirc, vdr or
xinerama)

So, looks good to me...

(sorry tsunam ;-))
emerge --info:
Portage 2203-svn (default-linux/x86/2006.0, gcc-3.4.5, glibc-2.3.5-r3,
2.6.16-gentoo-r3 i686)
=================================================================
System uname: 2.6.16-gentoo-r3 i686 Intel(R) Pentium(R) M processor 1.86GHz
Gentoo Base System version 1.6.14
dev-lang/python:     2.4.2
sys-apps/sandbox:    1.2.12
sys-devel/autoconf:  2.13, 2.59-r7
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1
sys-devel/binutils:  2.16.1
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=pentium3 -pipe"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3/share/config
/usr/share/X11/xkb /usr/share/config /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/eselect/compiler /etc/gconf /etc/revdep-rebuild
/etc/terminfo /etc/texmf/web2c /etc/env.d"
CXXFLAGS="-O2 -march=pentium3 -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig collision-protect distlocks sandbox sfperms strict"
GENTOO_MIRRORS="ftp://www.mirrorservice.org/sites/www.ibiblio.org/gentoo/
http://ftp.mirrorservice.org/sites/www.ibiblio.org/gentoo/
ftp://gentoo.blueyonder.co.uk http://mirrors.blueyonder.co.uk/mirrors/gentoo"
LC_ALL="en_GB.utf8"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="x86 X a52 aac aalib acpi alsa asf audiofile avi bash-completion berkdb
bitmap-fonts bzip2 cdda cddb cdparanoia cdr cjk cli crypt cscope cups curl daap
dbus dlloader dri dvd dvdr emboss encode exif expat fbcon ffmpeg firefox flac
foomaticdb fortran ftp gd gdbm gif glut graphviz gstreamer gtk2 hal imagemagick
imap isdnlog jack jpeg lcms libcaca libg++ libwww live lua mad maildir matroska
mbox mikmod mmx mng motif mp3 mp4 mpeg ncurses nls nptl ogg opengl pam pcre pdf
pdflib perl png pppd python quicktime readline real reflection ruby samba sdl
session spell spl sse sse2 ssl svg svga tcpd theora tiff truetype
truetype-fonts type1-fonts udev unicode usb userlocales vcd vidix vorbis
win32codecs x264 xine xorg xv xvid xvmc zlib video_cards_radeon
video_cards_fglrx video_cards_vesa video_cards_ati input_devices_keyboard
input_devices_mouse userland_GNU kernel_linux elibc_glibc"
Unset:  ASFLAGS, CTARGET, INSTALL_MASK, LANG, LDFLAGS, LINGUAS

x86 done, sorry about the delay.

GLSA 200604-15