Re: Bug#680484: closed by Andreas Tille <tille@debian.org> (Bug#680484: fixed in scotch 5.1.12b.dfsg-2)
Hi,
On Fri, Apr 05, 2013 at 09:12:31PM +0100, Jonathan Wiltshire wrote:
> > Well, my rationale is this: I assume that the input to those function calls
> > could be untrustworty, and there is no substitution going on anyway, so
> > changing them to fputs prevents naive future arguments being added opening
> > the way to an abuse of %n in the format string. That's essentially what
> > -Wformat-security is about in any case.
I created the patch *because* I enabled hardening and thus it was
needed. I guess it does not harm to leave it in (the patch, not the
hardening as it was said by Julian).
> > Though it could also be argued that once released Wheezy isn't going to
> > change anyway, but... personally I'd play it safe.
> >
> > I don't know Medhi's rationale, he may have a persuasive counter-argument :)
>
> We had a quick discussion on IRC and it makes little difference one way or
> the other, so feel free to go ahead.
OK, I'll upload to testing including the patch.
Thanks for the advise
Andreas.
--
http://fam-tille.de
Reply to: