Re: some warnings on mac

[Allin C. <cot...@wf...>]

On Thu, 20 Jan 2011, Werner Smekal wrote:

> >>> ../term/post.trm:1819: warning: format not a string literal and no
> >>> format arguments
> >>>
> >>> This comes from
> >>>       static char GPFAR psg1[] = "0 setgray\nnewpath\n";
> >>>       fprintf(gppsfile, psg1);
> >> [\me scratches head] Sure looks like a string literal to me.
> >
> > It's not.  It's s string-valued variable.
> >
> > The complaint is a bit vague, but what I'm pretty sure the compiler is
> > trying to tell us here is that it's kinda pointless to use *printf() if
> > you're not going to format any data into the output.  It wants us to
> > replace the above fprintf() by either
> >
> >           fprintf(gppsfile, "%s", psg1);
> >
> > or
> >
> > 	fputs(psg1, gppsfile);
> It's a security problem, e.g.
> http://bobthegnome.blogspot.com/2009/07/format-not-string-literal-and-no-format.html,
> which might be exploited.
>
> Hans' first version would be IMO the correct one (the second one would
> add an extra \n).

No it wouldn't. Perhaps you're thinking of puts(), which does add
'\n'.

Allin Cottrell