Re: [Qemu-devel] [PATCH 8/9] Add more format string warning flags

[Peter Maydell]

On 2 April 2012 15:22, Daniel P. Berrange <address@hidden> wrote:
> The -Wformat-security option can only catch problems if the format
> string is a literal. eg so it'd miss this:
>
>  void foo(void) {
>     int notastring = 1;
>     const char *format = "String is %s";
>
>     sprintf(format, notastring);
>  }
>
> There are a handful of places in QEMU which do that with non-trivial
> format strings & were easy to fix in this patch, which I think is a
> worthwhile improvement. The cases in the *-user/strace.c file though
> are not practical to fix, without significant re-design of the code
> in question.

To be honest I couldn't tell from your patch whether you'd actually
fixed any bugs or if you were just moving things around to turn non
literals into literals.

(Some of the cleanup looks like a good idea anyway, eg the vnc bits.)

-- PMM