Re: [Debian-med-packaging] Trying to disable error=format-security for clapack
Hi again,
after the build issues in clapack[1] were solved and I was even able to
create shared libraries I wonder how I can properly set a sensible
SONAME. I tried to do this via SET_TARGET_PROPERTIES but failed.
Another question is how I could link against the Debian packaged f2c
rather than building the one that comes with clapack upstream.
Any help would be welcome
Andreas.
[1] https://anonscm.debian.org/git/debian-science/packages/clapack.git
On Mon, May 16, 2016 at 12:21:06PM +0200, Gert Wollny wrote:
> Am Montag, den 16.05.2016, 10:16 +0000 schrieb Gianfranco Costamagna:
> > Hi Gert!
> >
> > >
> > > I think, since in this case the (empty) format string passed to the
> > > printf call is not user generated there is no security problem to
> > > be exploited.
> >
> > yes, sure, but disabling this flag has a nasty side-effect, it is
> > disabled in the *whole* build, possibly
> > hiding more serious issues somewhere else.
>
> Of course, that's why I gave the #pragma based disabling that can be
> fitted tightly to the offending code.
>
> Best,
> Gert
>
>
>
--
http://fam-tille.de
Reply to: