Debian Bug report logs - #680935
jbigkit: several compiler warnings on amd64

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Colin Watson <cjwatson@ubuntu.com>

To: submit@bugs.debian.org

Subject: jbigkit: several compiler warnings on amd64

Date: Mon, 9 Jul 2012 12:08:25 +0100

Package: jbigkit
Version: 2.0-2
Severity: normal
Tags: patch
User: ubuntu-devel@lists.ubuntu.com
Usertags: origin-ubuntu ubuntu-patch quantal

I got the Ubuntu security team to review jbigkit
(https://bugs.launchpad.net/ubuntu/+source/jbigkit/+bug/993304), since
image processing libraries often end up being attack vectors one way or
another.  Jamie commented on some compiler warnings that show up.
Here's a patch to fix them.

Note that I've used some C99 printf length modifiers (z and t), since
those are the most precise way to specify the types.  This is fine for
Debian, but I don't know whether upstream is happy to rely on C99; if
not, they might have to use casts or something instead.

  * Fix a number of compiler warnings per feedback from Ubuntu security team
    (LP: #993304).

diff -Nru jbigkit-2.0/debian/patches/series jbigkit-2.0/debian/patches/series
--- jbigkit-2.0/debian/patches/series	2012-04-09 10:25:02.000000000 +0100
+++ jbigkit-2.0/debian/patches/series	2012-07-09 11:11:28.000000000 +0100
@@ -1,3 +1,4 @@
 allNewMainMakefile.diff
 pbmtoolsMakefile.diff
 useLibtool.diff
+warnings.diff
diff -Nru jbigkit-2.0/debian/patches/warnings.diff jbigkit-2.0/debian/patches/warnings.diff
--- jbigkit-2.0/debian/patches/warnings.diff	1970-01-01 01:00:00.000000000 +0100
+++ jbigkit-2.0/debian/patches/warnings.diff	2012-07-09 11:57:52.000000000 +0100
@@ -0,0 +1,263 @@
+Subject: Fix several compiler warnings
+Author: Colin Watson <cjwatson@ubuntu.com>
+Forwarded: no
+
+Index: b/libjbig/tstcodec.c
+===================================================================
+--- a/libjbig/tstcodec.c
++++ b/libjbig/tstcodec.c
+@@ -399,7 +399,7 @@
+   for (i = 0; i < 16 * 16 && !trouble; i++) {
+     pix = arith_decode(sd, (t82cx[i >> 4] >> ((15 - i) & 15)) & 1);
+     if (pix < 0) {
+-      printf("Problem at pixel %ld, byte %d.\n\n",
++      printf("Problem at pixel %ld, byte %td.\n\n",
+ 	     i+1, sd->pscd_ptr - sd->pscd_end);
+       trouble++;
+       break;
+@@ -411,7 +411,7 @@
+     }
+   }
+   if (!trouble && sd->pscd_ptr != sd->pscd_end - 2) {
+-    printf("%d bytes left after decoder finished.\n\n",
++    printf("%td bytes left after decoder finished.\n\n",
+ 	   sd->pscd_end - sd->pscd_ptr - 2);
+     trouble++;
+   }
+@@ -439,7 +439,7 @@
+       pix = arith_decode(sd, (t82cx[i >> 4] >> ((15 - i) & 15)) & 1);
+     }
+     if (pix < 0) {
+-      printf("Problem at pixel %ld, byte %d.\n\n",
++      printf("Problem at pixel %ld, byte %td.\n\n",
+ 	     i+1, sd->pscd_ptr - sd->pscd_end);
+       trouble++;
+       break;
+@@ -451,7 +451,7 @@
+     }
+   }
+   if (!trouble && sd->pscd_ptr != sd->pscd_end - 2) {
+-    printf("%d bytes left after decoder finished.\n\n",
++    printf("%td bytes left after decoder finished.\n\n",
+ 	   sd->pscd_end - sd->pscd_ptr - 2);
+     trouble++;
+   }
+Index: b/libjbig/tstcodec85.c
+===================================================================
+--- a/libjbig/tstcodec85.c
++++ b/libjbig/tstcodec85.c
+@@ -334,7 +334,7 @@
+   for (i = 0; i < 16 * 16 && !trouble; i++) {
+     pix = arith_decode(sd, (t82cx[i >> 4] >> ((15 - i) & 15)) & 1);
+     if (pix < 0) {
+-      printf("Problem at pixel %ld, byte %d.\n\n",
++      printf("Problem at pixel %ld, byte %td.\n\n",
+ 	     i+1, sd->pscd_ptr - sd->pscd_end);
+       trouble++;
+       break;
+@@ -346,7 +346,7 @@
+     }
+   }
+   if (!trouble && sd->pscd_ptr != sd->pscd_end - 2) {
+-    printf("%d bytes left after decoder finished.\n\n",
++    printf("%td bytes left after decoder finished.\n\n",
+ 	   sd->pscd_end - sd->pscd_ptr - 2);
+     trouble++;
+   }
+@@ -374,7 +374,7 @@
+       pix = arith_decode(sd, (t82cx[i >> 4] >> ((15 - i) & 15)) & 1);
+     }
+     if (pix < 0) {
+-      printf("Problem at pixel %ld, byte %d.\n\n",
++      printf("Problem at pixel %ld, byte %td.\n\n",
+ 	     i+1, sd->pscd_ptr - sd->pscd_end);
+       trouble++;
+       break;
+@@ -386,7 +386,7 @@
+     }
+   }
+   if (!trouble && sd->pscd_ptr != sd->pscd_end - 2) {
+-    printf("%d bytes left after decoder finished.\n\n",
++    printf("%td bytes left after decoder finished.\n\n",
+ 	   sd->pscd_end - sd->pscd_ptr - 2);
+     trouble++;
+   }
+Index: b/pbmtools/jbgtopbm.c
+===================================================================
+--- a/pbmtools/jbgtopbm.c
++++ b/pbmtools/jbgtopbm.c
+@@ -110,7 +110,7 @@
+   for (i = 0; i < len && i < max; i++)
+     fprintf(f, "%02x ", p[i]);
+   if (len > i)
+-    fprintf(f, "... %d bytes total", len);
++    fprintf(f, "... %zd bytes total", len);
+   fprintf(f, "\n");
+ }
+ 
+@@ -134,7 +134,7 @@
+   /* read BIH */
+   read_file(&bie, &buflen, &len, fin);
+   if (len < 20) {
+-    fprintf(f, "Error: Input file is %d < 20 bytes long and therefore "
++    fprintf(f, "Error: Input file is %zd < 20 bytes long and therefore "
+ 	    "does not contain an intact BIE header!\n", len);
+     return;
+   }
+@@ -188,18 +188,18 @@
+       == (JBG_DPON | JBG_DPPRIV))
+     p += 1728;  /* skip DPTABLE */
+   if (p > bie + len) {
+-    fprintf(f, "Error: Input file is %d < 20+1728 bytes long and therefore "
++    fprintf(f, "Error: Input file is %zd < 20+1728 bytes long and therefore "
+ 	    "does not contain an intact BIE header with DPTABLE!\n", len);
+     return;
+   }
+   while (p != bie + len) {
+     if (p > bie + len - 2) {
+-      fprintf(f, "%06x: Error: single byte 0x%02x left\n", p - bie, *p);
++      fprintf(f, "%06tx: Error: single byte 0x%02x left\n", p - bie, *p);
+       return;
+     }
+     pnext = jbg_next_pscdms(p, len - (p - bie));
+     if (p[0] != MARKER_ESC || p[1] == MARKER_STUFF) {
+-      fprintf(f, "%06x: PSCD: ", p - bie);
++      fprintf(f, "%06tx: PSCD: ", p - bie);
+       fprint_bytes(f, p, pnext ? (size_t) (pnext - p) : len - (p - bie), 60);
+       if (!pnext) {
+ 	fprintf(f, "Error: PSCD not terminated by SDNORM or SDRST marker\n");
+@@ -209,7 +209,7 @@
+       switch (p[1]) {
+       case MARKER_SDNORM:
+       case MARKER_SDRST:
+-	fprintf(f, "%06x: ESC %s, ending SDE #%lu", p - bie,
++	fprintf(f, "%06tx: ESC %s, ending SDE #%lu", p - bie,
+ 		(p[1] == MARKER_SDNORM) ? "SDNORM" : "SDRST", ++sde);
+ 	if (sde == sdes)
+ 	  fprintf(f, " (final SDE)");
+@@ -219,10 +219,10 @@
+ 	fprintf(f, "\n");
+ 	break;
+       case MARKER_ABORT:
+-	fprintf(f, "%06x: ESC ABORT\n", p - bie);
++	fprintf(f, "%06tx: ESC ABORT\n", p - bie);
+ 	break;
+       case MARKER_NEWLEN:
+-	fprintf(f, "%06x: ESC NEWLEN ", p - bie);
++	fprintf(f, "%06tx: ESC NEWLEN ", p - bie);
+ 	if (p + 5 < bie + len) {
+ 	  fprintf(f, "YD = %lu\n",
+ 		  yd = (((long) p[2] << 24) | ((long) p[3] << 16) |
+@@ -242,7 +242,7 @@
+ 	  fprintf(f, "unexpected EOF\n");
+ 	break;
+       case MARKER_ATMOVE:
+-	fprintf(f, "%06x: ESC ATMOVE ", p - bie);
++	fprintf(f, "%06tx: ESC ATMOVE ", p - bie);
+ 	if (p + 7 < bie + len)
+ 	  fprintf(f, "YAT = %lu, tX = %d, tY = %d\n",
+ 		  (((long) p[2] << 24) | ((long) p[3] << 16) |
+@@ -251,7 +251,7 @@
+ 	  fprintf(f, "unexpected EOF\n");
+ 	break;
+       case MARKER_COMMENT:
+-	fprintf(f, "%06x: ESC COMMENT ", p - bie);
++	fprintf(f, "%06tx: ESC COMMENT ", p - bie);
+ 	if (p + 5 < bie + len)
+ 	  fprintf(f, "LC = %lu\n",
+ 		  (((long) p[2] << 24) | ((long) p[3] << 16) |
+@@ -260,7 +260,7 @@
+ 	  fprintf(f, "unexpected EOF\n");
+ 	break;
+       default:
+-	fprintf(f, "%06x: ESC 0x%02x\n", p - bie, p[1]);
++	fprintf(f, "%06tx: ESC 0x%02x\n", p - bie, p[1]);
+       }
+     if (!pnext) {
+       fprintf(f, "Error encountered!\n");
+@@ -372,7 +372,7 @@
+   /* read BIH first to check VLENGTH */
+   len = fread(buffer, 1, 20, fin);
+   if (len < 20) {
+-    fprintf(stderr, "Input file '%s' (%d bytes) must be at least "
++    fprintf(stderr, "Input file '%s' (%zd bytes) must be at least "
+ 	    "20 bytes long\n", fnin, len);
+     if (fout != stdout) {
+       fclose(fout);
+Index: b/pbmtools/pbmtojbg.c
+===================================================================
+--- a/pbmtools/pbmtojbg.c
++++ b/pbmtools/pbmtojbg.c
+@@ -88,7 +88,11 @@
+       while ((c = getc(f)) != EOF && !(c == 13 || c == 10)) ;
+   if (c != EOF) {
+     ungetc(c, f);
+-    fscanf(f, "%lu", &i);
++    if (fscanf(f, "%lu", &i) != 1) {
++      /* should never fail, since c must be a digit */
++      fprintf(stderr, "Unexpected failure reading digit '%c'\n", c);
++      exit(1);
++    }
+   }
+ 
+   return i;
+@@ -302,7 +306,9 @@
+     break;
+   case '4':
+     /* PBM raw binary format */
+-    fread(bitmap[0], bitmap_size, 1, fin);
++    if (fread(bitmap[0], bitmap_size, 1, fin) != 1) {
++      /* silence compiler warnings; ferror/feof checked below */
++    }
+     break;
+   case '2':
+   case '5':
+@@ -314,8 +320,18 @@
+ 	for (j = 0; j < bpp; j++)
+ 	  image[x * bpp + (bpp - 1) - j] = v >> (j * 8);
+       }
+-    } else
+-      fread(image, width * height, bpp, fin);
++    } else {
++      if (fread(image, width * height, bpp, fin) != (size_t) bpp) {
++	if (ferror(fin)) {
++	  fprintf(stderr, "Problem while reading input file '%s", fnin);
++	  perror("'");
++	  exit(1);
++	} else {
++	  fprintf(stderr, "Unexpected end of input file '%s'!\n", fnin);
++	  exit(1);
++	}
++      }
++    }
+     jbg_split_planes(width, height, planes, encode_planes, image, bitmap,
+ 		     use_graycode);
+     free(image);
+Index: b/pbmtools/pbmtojbg85.c
+===================================================================
+--- a/pbmtools/pbmtojbg85.c
++++ b/pbmtools/pbmtojbg85.c
+@@ -72,7 +72,11 @@
+       while ((c = getc(f)) != EOF && !(c == 13 || c == 10)) ;
+   if (c != EOF) {
+     ungetc(c, f);
+-    fscanf(f, "%lu", &i);
++    if (fscanf(f, "%lu", &i) != 1) {
++      /* should never fail, since c must be a digit */
++      fprintf(stderr, "Unexpected failure reading digit '%c'\n", c);
++      exit(1);
++    }
+   }
+ 
+   return i;
+@@ -239,7 +243,9 @@
+       break;
+     case '4':
+       /* PBM raw binary format */
+-      fread(next_line, bpl, 1, fin);
++      if (fread(next_line, bpl, 1, fin) != 1) {
++	/* silence compiler warnings; ferror/feof checked below */
++      }
+       break;
+     default:
+       fprintf(stderr, "Unsupported PBM type P%c!\n", type);

Thanks,

-- 
Colin Watson                                       [cjwatson@ubuntu.com]

Message #10 received at submit@bugs.debian.org (full text, mbox, reply):

From: Michael van der Kolff <mvanderkolff@gmail.com>

To: Colin Watson <cjwatson@ubuntu.com>, 680935@bugs.debian.org

Cc: submit@bugs.debian.org

Subject: Re: Bug#680935: jbigkit: several compiler warnings on amd64

Date: Mon, 9 Jul 2012 22:02:27 +1000

[Message part 1 (text/plain, inline)]

That seems perfectly sensible.  Now to convince my sponsor to make a new
upload :)

I'll try to find my sponsor in the morning.

Warmest regards,

Michael

On Mon, Jul 9, 2012 at 9:08 PM, Colin Watson <cjwatson@ubuntu.com> wrote:

> Package: jbigkit
> Version: 2.0-2
> Severity: normal
> Tags: patch
> User: ubuntu-devel@lists.ubuntu.com
> Usertags: origin-ubuntu ubuntu-patch quantal
>
> I got the Ubuntu security team to review jbigkit
> (https://bugs.launchpad.net/ubuntu/+source/jbigkit/+bug/993304), since
> image processing libraries often end up being attack vectors one way or
> another.  Jamie commented on some compiler warnings that show up.
> Here's a patch to fix them.
>
> Note that I've used some C99 printf length modifiers (z and t), since
> those are the most precise way to specify the types.  This is fine for
> Debian, but I don't know whether upstream is happy to rely on C99; if
> not, they might have to use casts or something instead.
>
>   * Fix a number of compiler warnings per feedback from Ubuntu security
> team
>     (LP: #993304).
>
> diff -Nru jbigkit-2.0/debian/patches/series
> jbigkit-2.0/debian/patches/series
> --- jbigkit-2.0/debian/patches/series   2012-04-09 10:25:02.000000000 +0100
> +++ jbigkit-2.0/debian/patches/series   2012-07-09 11:11:28.000000000 +0100
> @@ -1,3 +1,4 @@
>  allNewMainMakefile.diff
>  pbmtoolsMakefile.diff
>  useLibtool.diff
> +warnings.diff
> diff -Nru jbigkit-2.0/debian/patches/warnings.diff
> jbigkit-2.0/debian/patches/warnings.diff
> --- jbigkit-2.0/debian/patches/warnings.diff    1970-01-01
> 01:00:00.000000000 +0100
> +++ jbigkit-2.0/debian/patches/warnings.diff    2012-07-09
> 11:57:52.000000000 +0100
> @@ -0,0 +1,263 @@
> +Subject: Fix several compiler warnings
> +Author: Colin Watson <cjwatson@ubuntu.com>
> +Forwarded: no
> +
> +Index: b/libjbig/tstcodec.c
> +===================================================================
> +--- a/libjbig/tstcodec.c
> ++++ b/libjbig/tstcodec.c
> +@@ -399,7 +399,7 @@
> +   for (i = 0; i < 16 * 16 && !trouble; i++) {
> +     pix = arith_decode(sd, (t82cx[i >> 4] >> ((15 - i) & 15)) & 1);
> +     if (pix < 0) {
> +-      printf("Problem at pixel %ld, byte %d.\n\n",
> ++      printf("Problem at pixel %ld, byte %td.\n\n",
> +            i+1, sd->pscd_ptr - sd->pscd_end);
> +       trouble++;
> +       break;
> +@@ -411,7 +411,7 @@
> +     }
> +   }
> +   if (!trouble && sd->pscd_ptr != sd->pscd_end - 2) {
> +-    printf("%d bytes left after decoder finished.\n\n",
> ++    printf("%td bytes left after decoder finished.\n\n",
> +          sd->pscd_end - sd->pscd_ptr - 2);
> +     trouble++;
> +   }
> +@@ -439,7 +439,7 @@
> +       pix = arith_decode(sd, (t82cx[i >> 4] >> ((15 - i) & 15)) & 1);
> +     }
> +     if (pix < 0) {
> +-      printf("Problem at pixel %ld, byte %d.\n\n",
> ++      printf("Problem at pixel %ld, byte %td.\n\n",
> +            i+1, sd->pscd_ptr - sd->pscd_end);
> +       trouble++;
> +       break;
> +@@ -451,7 +451,7 @@
> +     }
> +   }
> +   if (!trouble && sd->pscd_ptr != sd->pscd_end - 2) {
> +-    printf("%d bytes left after decoder finished.\n\n",
> ++    printf("%td bytes left after decoder finished.\n\n",
> +          sd->pscd_end - sd->pscd_ptr - 2);
> +     trouble++;
> +   }
> +Index: b/libjbig/tstcodec85.c
> +===================================================================
> +--- a/libjbig/tstcodec85.c
> ++++ b/libjbig/tstcodec85.c
> +@@ -334,7 +334,7 @@
> +   for (i = 0; i < 16 * 16 && !trouble; i++) {
> +     pix = arith_decode(sd, (t82cx[i >> 4] >> ((15 - i) & 15)) & 1);
> +     if (pix < 0) {
> +-      printf("Problem at pixel %ld, byte %d.\n\n",
> ++      printf("Problem at pixel %ld, byte %td.\n\n",
> +            i+1, sd->pscd_ptr - sd->pscd_end);
> +       trouble++;
> +       break;
> +@@ -346,7 +346,7 @@
> +     }
> +   }
> +   if (!trouble && sd->pscd_ptr != sd->pscd_end - 2) {
> +-    printf("%d bytes left after decoder finished.\n\n",
> ++    printf("%td bytes left after decoder finished.\n\n",
> +          sd->pscd_end - sd->pscd_ptr - 2);
> +     trouble++;
> +   }
> +@@ -374,7 +374,7 @@
> +       pix = arith_decode(sd, (t82cx[i >> 4] >> ((15 - i) & 15)) & 1);
> +     }
> +     if (pix < 0) {
> +-      printf("Problem at pixel %ld, byte %d.\n\n",
> ++      printf("Problem at pixel %ld, byte %td.\n\n",
> +            i+1, sd->pscd_ptr - sd->pscd_end);
> +       trouble++;
> +       break;
> +@@ -386,7 +386,7 @@
> +     }
> +   }
> +   if (!trouble && sd->pscd_ptr != sd->pscd_end - 2) {
> +-    printf("%d bytes left after decoder finished.\n\n",
> ++    printf("%td bytes left after decoder finished.\n\n",
> +          sd->pscd_end - sd->pscd_ptr - 2);
> +     trouble++;
> +   }
> +Index: b/pbmtools/jbgtopbm.c
> +===================================================================
> +--- a/pbmtools/jbgtopbm.c
> ++++ b/pbmtools/jbgtopbm.c
> +@@ -110,7 +110,7 @@
> +   for (i = 0; i < len && i < max; i++)
> +     fprintf(f, "%02x ", p[i]);
> +   if (len > i)
> +-    fprintf(f, "... %d bytes total", len);
> ++    fprintf(f, "... %zd bytes total", len);
> +   fprintf(f, "\n");
> + }
> +
> +@@ -134,7 +134,7 @@
> +   /* read BIH */
> +   read_file(&bie, &buflen, &len, fin);
> +   if (len < 20) {
> +-    fprintf(f, "Error: Input file is %d < 20 bytes long and therefore "
> ++    fprintf(f, "Error: Input file is %zd < 20 bytes long and therefore "
> +           "does not contain an intact BIE header!\n", len);
> +     return;
> +   }
> +@@ -188,18 +188,18 @@
> +       == (JBG_DPON | JBG_DPPRIV))
> +     p += 1728;  /* skip DPTABLE */
> +   if (p > bie + len) {
> +-    fprintf(f, "Error: Input file is %d < 20+1728 bytes long and
> therefore "
> ++    fprintf(f, "Error: Input file is %zd < 20+1728 bytes long and
> therefore "
> +           "does not contain an intact BIE header with DPTABLE!\n", len);
> +     return;
> +   }
> +   while (p != bie + len) {
> +     if (p > bie + len - 2) {
> +-      fprintf(f, "%06x: Error: single byte 0x%02x left\n", p - bie, *p);
> ++      fprintf(f, "%06tx: Error: single byte 0x%02x left\n", p - bie, *p);
> +       return;
> +     }
> +     pnext = jbg_next_pscdms(p, len - (p - bie));
> +     if (p[0] != MARKER_ESC || p[1] == MARKER_STUFF) {
> +-      fprintf(f, "%06x: PSCD: ", p - bie);
> ++      fprintf(f, "%06tx: PSCD: ", p - bie);
> +       fprint_bytes(f, p, pnext ? (size_t) (pnext - p) : len - (p - bie),
> 60);
> +       if (!pnext) {
> +       fprintf(f, "Error: PSCD not terminated by SDNORM or SDRST
> marker\n");
> +@@ -209,7 +209,7 @@
> +       switch (p[1]) {
> +       case MARKER_SDNORM:
> +       case MARKER_SDRST:
> +-      fprintf(f, "%06x: ESC %s, ending SDE #%lu", p - bie,
> ++      fprintf(f, "%06tx: ESC %s, ending SDE #%lu", p - bie,
> +               (p[1] == MARKER_SDNORM) ? "SDNORM" : "SDRST", ++sde);
> +       if (sde == sdes)
> +         fprintf(f, " (final SDE)");
> +@@ -219,10 +219,10 @@
> +       fprintf(f, "\n");
> +       break;
> +       case MARKER_ABORT:
> +-      fprintf(f, "%06x: ESC ABORT\n", p - bie);
> ++      fprintf(f, "%06tx: ESC ABORT\n", p - bie);
> +       break;
> +       case MARKER_NEWLEN:
> +-      fprintf(f, "%06x: ESC NEWLEN ", p - bie);
> ++      fprintf(f, "%06tx: ESC NEWLEN ", p - bie);
> +       if (p + 5 < bie + len) {
> +         fprintf(f, "YD = %lu\n",
> +                 yd = (((long) p[2] << 24) | ((long) p[3] << 16) |
> +@@ -242,7 +242,7 @@
> +         fprintf(f, "unexpected EOF\n");
> +       break;
> +       case MARKER_ATMOVE:
> +-      fprintf(f, "%06x: ESC ATMOVE ", p - bie);
> ++      fprintf(f, "%06tx: ESC ATMOVE ", p - bie);
> +       if (p + 7 < bie + len)
> +         fprintf(f, "YAT = %lu, tX = %d, tY = %d\n",
> +                 (((long) p[2] << 24) | ((long) p[3] << 16) |
> +@@ -251,7 +251,7 @@
> +         fprintf(f, "unexpected EOF\n");
> +       break;
> +       case MARKER_COMMENT:
> +-      fprintf(f, "%06x: ESC COMMENT ", p - bie);
> ++      fprintf(f, "%06tx: ESC COMMENT ", p - bie);
> +       if (p + 5 < bie + len)
> +         fprintf(f, "LC = %lu\n",
> +                 (((long) p[2] << 24) | ((long) p[3] << 16) |
> +@@ -260,7 +260,7 @@
> +         fprintf(f, "unexpected EOF\n");
> +       break;
> +       default:
> +-      fprintf(f, "%06x: ESC 0x%02x\n", p - bie, p[1]);
> ++      fprintf(f, "%06tx: ESC 0x%02x\n", p - bie, p[1]);
> +       }
> +     if (!pnext) {
> +       fprintf(f, "Error encountered!\n");
> +@@ -372,7 +372,7 @@
> +   /* read BIH first to check VLENGTH */
> +   len = fread(buffer, 1, 20, fin);
> +   if (len < 20) {
> +-    fprintf(stderr, "Input file '%s' (%d bytes) must be at least "
> ++    fprintf(stderr, "Input file '%s' (%zd bytes) must be at least "
> +           "20 bytes long\n", fnin, len);
> +     if (fout != stdout) {
> +       fclose(fout);
> +Index: b/pbmtools/pbmtojbg.c
> +===================================================================
> +--- a/pbmtools/pbmtojbg.c
> ++++ b/pbmtools/pbmtojbg.c
> +@@ -88,7 +88,11 @@
> +       while ((c = getc(f)) != EOF && !(c == 13 || c == 10)) ;
> +   if (c != EOF) {
> +     ungetc(c, f);
> +-    fscanf(f, "%lu", &i);
> ++    if (fscanf(f, "%lu", &i) != 1) {
> ++      /* should never fail, since c must be a digit */
> ++      fprintf(stderr, "Unexpected failure reading digit '%c'\n", c);
> ++      exit(1);
> ++    }
> +   }
> +
> +   return i;
> +@@ -302,7 +306,9 @@
> +     break;
> +   case '4':
> +     /* PBM raw binary format */
> +-    fread(bitmap[0], bitmap_size, 1, fin);
> ++    if (fread(bitmap[0], bitmap_size, 1, fin) != 1) {
> ++      /* silence compiler warnings; ferror/feof checked below */
> ++    }
> +     break;
> +   case '2':
> +   case '5':
> +@@ -314,8 +320,18 @@
> +       for (j = 0; j < bpp; j++)
> +         image[x * bpp + (bpp - 1) - j] = v >> (j * 8);
> +       }
> +-    } else
> +-      fread(image, width * height, bpp, fin);
> ++    } else {
> ++      if (fread(image, width * height, bpp, fin) != (size_t) bpp) {
> ++      if (ferror(fin)) {
> ++        fprintf(stderr, "Problem while reading input file '%s", fnin);
> ++        perror("'");
> ++        exit(1);
> ++      } else {
> ++        fprintf(stderr, "Unexpected end of input file '%s'!\n", fnin);
> ++        exit(1);
> ++      }
> ++      }
> ++    }
> +     jbg_split_planes(width, height, planes, encode_planes, image, bitmap,
> +                    use_graycode);
> +     free(image);
> +Index: b/pbmtools/pbmtojbg85.c
> +===================================================================
> +--- a/pbmtools/pbmtojbg85.c
> ++++ b/pbmtools/pbmtojbg85.c
> +@@ -72,7 +72,11 @@
> +       while ((c = getc(f)) != EOF && !(c == 13 || c == 10)) ;
> +   if (c != EOF) {
> +     ungetc(c, f);
> +-    fscanf(f, "%lu", &i);
> ++    if (fscanf(f, "%lu", &i) != 1) {
> ++      /* should never fail, since c must be a digit */
> ++      fprintf(stderr, "Unexpected failure reading digit '%c'\n", c);
> ++      exit(1);
> ++    }
> +   }
> +
> +   return i;
> +@@ -239,7 +243,9 @@
> +       break;
> +     case '4':
> +       /* PBM raw binary format */
> +-      fread(next_line, bpl, 1, fin);
> ++      if (fread(next_line, bpl, 1, fin) != 1) {
> ++      /* silence compiler warnings; ferror/feof checked below */
> ++      }
> +       break;
> +     default:
> +       fprintf(stderr, "Unsupported PBM type P%c!\n", type);
>
> Thanks,
>
> --
> Colin Watson                                       [cjwatson@ubuntu.com]
>
>
>

[Message part 2 (text/html, inline)]

Message #24 received at 680935@bugs.debian.org (full text, mbox, reply):

From: Mathieu Malaterre <malat@debian.org>

To: 680935@bugs.debian.org

Subject: jbigkit: several compiler warnings on amd64

Date: Fri, 14 Jun 2013 13:25:54 +0200

> That seems perfectly sensible.  Now to convince my sponsor to make a new
> upload :)

Any update on #680935 ?

Thanks,

Message #29 received at 680935@bugs.debian.org (full text, mbox, reply):

From: Mathieu Malaterre <malat@debian.org>

To: mgk25@cl.cam.ac.uk, 680935@bugs.debian.org

Subject: Patch for jbigkit

Date: Tue, 14 Jan 2014 17:50:28 +0100

Dear Markus,

  Would it be possible for you to import the following patch directly
into jbigkit source:

http://bugs.debian.org/680935#5

  We are planning to apply this patch on jbigkit source as distributed
within debian distribution.

Thanks for your inputs,

Message #34 received at 680935@bugs.debian.org (full text, mbox, reply):

From: Mathieu Malaterre <malat@debian.org>

To: 680935@bugs.debian.org

Subject: Fwd: Patch for jbigkit

Date: Tue, 14 Jan 2014 18:07:29 +0100

For reference


---------- Forwarded message ----------
From: Markus Kuhn <Markus.Kuhn@cl.cam.ac.uk>
Date: Tue, Jan 14, 2014 at 6:04 PM
Subject: Re: Patch for jbigkit
To: Mathieu Malaterre <malat@debian.org>


On 14/01/14 16:50, Mathieu Malaterre wrote:
>
> Dear Markus,
>
>    Would it be possible for you to import the following patch directly
> into jbigkit source:
>
> http://bugs.debian.org/680935#5
>
>    We are planning to apply this patch on jbigkit source as distributed
> within debian distribution.


Thanks, I'll have a look at these shortly, as I expect to have a new
jbigkit-2.1 security-fix release coming up soon.

Note that at present JBIG-KIT is implemented in portable C89, not in C99,
because this software is also widely used in embedded systems and
on Microsoft platforms for which C89 compilers are more easily
available than C99 compilers. So your patch looks at first
glance like a change of programming language ...

Markus

--
Markus Kuhn, Computer Laboratory, University of Cambridge
http://www.cl.cam.ac.uk/~mgk25/ || CB3 0FD, Great Britain

Message #39 received at 680935@bugs.debian.org (full text, mbox, reply):

From: Markus Kuhn <Markus.Kuhn@cl.cam.ac.uk>

To: Mathieu Malaterre <malat@debian.org>, 680935@bugs.debian.org

Subject: Re: Patch for jbigkit

Date: Fri, 28 Mar 2014 17:36:31 +0000

FYI: JBIG-KIT 2.1, which fixes the printf 64-bit type problems
noted here, in addition to more serious security vulnerabilities,
will be released on 8 April 2014.

Markus

-- 
Markus Kuhn, Computer Laboratory, University of Cambridge
http://www.cl.cam.ac.uk/~mgk25/ || CB3 0FD, Great Britain

Message #44 received at 680935@bugs.debian.org (full text, mbox, reply):

From: Mathieu Malaterre <malat@debian.org>

To: Markus Kuhn <Markus.Kuhn@cl.cam.ac.uk>

Cc: 743960@bugs.debian.org, 680935@bugs.debian.org

Subject: Re: Patch for jbigkit

Date: Mon, 14 Apr 2014 09:11:05 +0200

On Fri, Mar 28, 2014 at 6:36 PM, Markus Kuhn <Markus.Kuhn@cl.cam.ac.uk> wrote:
> FYI: JBIG-KIT 2.1, which fixes the printf 64-bit type problems
> noted here, in addition to more serious security vulnerabilities,
> will be released on 8 April 2014.

Are you planning on updating the debian package ?

Thanks

Message #47 received at 680935-submitter@bugs.debian.org (full text, mbox, reply):

From: Mathieu Malaterre <malat@debian.org>

To: 680935-submitter@bugs.debian.org

Date: Mon, 21 Jul 2014 13:55:29 +0200

Current packager is working on uploading new upstream: 2.1. Hopefully
upstream did integrate most of your diffs, otherwise we'll just close
it.

Thanks for your patch anyway.

Message #52 received at 680935@bugs.debian.org (full text, mbox, reply):

From: Colin Watson <cjwatson@debian.org>

To: Mathieu Malaterre <malat@debian.org>, 680935@bugs.debian.org

Cc: 680935-submitter@bugs.debian.org

Subject: Re: Bug#680935:

Date: Mon, 21 Jul 2014 14:49:49 +0100

On Mon, Jul 21, 2014 at 01:55:29PM +0200, Mathieu Malaterre wrote:
> Current packager is working on uploading new upstream: 2.1. Hopefully
> upstream did integrate most of your diffs, otherwise we'll just close
> it.

This implies that you will close this bug if upstream did not integrate
all my diffs.  Rather, if upstream did not integrate my diffs or the
equivalent (e.g. casts so that the code is correct within C89), then
please leave this bug open.

-- 
Colin Watson                                       [cjwatson@debian.org]

Message #58 received at 680935-submitter@bugs.debian.org (full text, mbox, reply):

From: Mathieu Malaterre <malat@debian.org>

Cc: 680935-submitter <680935-submitter@bugs.debian.org>

Subject: Re: Bug#680935:

Date: Mon, 21 Jul 2014 16:06:27 +0200

On Mon, Jul 21, 2014 at 3:49 PM, Colin Watson <cjwatson@debian.org> wrote:
> On Mon, Jul 21, 2014 at 01:55:29PM +0200, Mathieu Malaterre wrote:
>> Current packager is working on uploading new upstream: 2.1. Hopefully
>> upstream did integrate most of your diffs, otherwise we'll just close
>> it.
>
> This implies that you will close this bug if upstream did not integrate
> all my diffs.  Rather, if upstream did not integrate my diffs or the
> equivalent (e.g. casts so that the code is correct within C89), then
> please leave this bug open.

Ok.

Just for reference, the current upload is missing the full hardening
flags (partial):

https://github.com/mvanderkolff/jbigkit-packaging/commit/284a99968fd10d3e0e9d39ed23cdfb2812c4c045

I'll leave this bug open, unless of course every single warnings
disapear once I apply commit 284a99968f

Message #61 received at 680935-submitter@bugs.debian.org (full text, mbox, reply):

From: Mathieu Malaterre <malat@debian.org>

Cc: 680935-submitter <680935-submitter@bugs.debian.org>

Subject: Re: Bug#680935:

Date: Mon, 21 Jul 2014 16:09:04 +0200

On Mon, Jul 21, 2014 at 4:06 PM, Mathieu Malaterre <malat@debian.org> wrote:
> On Mon, Jul 21, 2014 at 3:49 PM, Colin Watson <cjwatson@debian.org> wrote:
>> On Mon, Jul 21, 2014 at 01:55:29PM +0200, Mathieu Malaterre wrote:
>>> Current packager is working on uploading new upstream: 2.1. Hopefully
>>> upstream did integrate most of your diffs, otherwise we'll just close
>>> it.
>>
>> This implies that you will close this bug if upstream did not integrate
>> all my diffs.  Rather, if upstream did not integrate my diffs or the
>> equivalent (e.g. casts so that the code is correct within C89), then
>> please leave this bug open.
>
> Ok.
>
> Just for reference, the current upload is missing the full hardening
> flags (partial):
>
> https://github.com/mvanderkolff/jbigkit-packaging/commit/284a99968fd10d3e0e9d39ed23cdfb2812c4c045
>
> I'll leave this bug open, unless of course every single warnings
> disapear once I apply commit 284a99968f

Looks like ubuntu is catching more warnings that what I initially
thought. Sorry got confused with your C89 vs hardening flags.

I'll keep this bug open in all cases.

Regards.

Message #66 received at 680935@bugs.debian.org (full text, mbox, reply):

From: Michael van der Kolff <mvanderkolff@gmail.com>

To: Colin Watson <cjwatson@debian.org>, 680935@bugs.debian.org

Cc: Mathieu Malaterre <malat@debian.org>, 680935-submitter@bugs.debian.org

Subject: Re: Bug#680935:

Date: Tue, 22 Jul 2014 00:30:27 +1000

[Message part 1 (text/plain, inline)]

AFAICT, upstream has incorporated those into pbmtojbg*.c & jbgtopbm*.c.
 Additionally, I have tested the current version with -Wall, and it builds
clean.

Cheers,


Michael


On Mon, Jul 21, 2014 at 11:49 PM, Colin Watson <cjwatson@debian.org> wrote:

> On Mon, Jul 21, 2014 at 01:55:29PM +0200, Mathieu Malaterre wrote:
> > Current packager is working on uploading new upstream: 2.1. Hopefully
> > upstream did integrate most of your diffs, otherwise we'll just close
> > it.
>
> This implies that you will close this bug if upstream did not integrate
> all my diffs.  Rather, if upstream did not integrate my diffs or the
> equivalent (e.g. casts so that the code is correct within C89), then
> please leave this bug open.
>
> --
> Colin Watson                                       [cjwatson@debian.org]
>

[Message part 2 (text/html, inline)]

Message #74 received at 680935@bugs.debian.org (full text, mbox, reply):

From: Michael van der Kolff <mvanderkolff@gmail.com>

To: Colin Watson <cjwatson@debian.org>, 680935@bugs.debian.org

Cc: Mathieu Malaterre <malat@debian.org>, 680935-submitter@bugs.debian.org

Subject: Re: Bug#680935:

Date: Tue, 22 Jul 2014 00:36:49 +1000

[Message part 1 (text/plain, inline)]

On closer inspection, not quite; we can incorporate the fscanf pedantry -
we probably should upstream that...

Cheers,

Michael


On Tue, Jul 22, 2014 at 12:30 AM, Michael van der Kolff <
mvanderkolff@gmail.com> wrote:

> AFAICT, upstream has incorporated those into pbmtojbg*.c & jbgtopbm*.c.
>  Additionally, I have tested the current version with -Wall, and it builds
> clean.
>
> Cheers,
>
>
> Michael
>
>
> On Mon, Jul 21, 2014 at 11:49 PM, Colin Watson <cjwatson@debian.org>
> wrote:
>
>> On Mon, Jul 21, 2014 at 01:55:29PM +0200, Mathieu Malaterre wrote:
>> > Current packager is working on uploading new upstream: 2.1. Hopefully
>> > upstream did integrate most of your diffs, otherwise we'll just close
>> > it.
>>
>> This implies that you will close this bug if upstream did not integrate
>> all my diffs.  Rather, if upstream did not integrate my diffs or the
>> equivalent (e.g. casts so that the code is correct within C89), then
>> please leave this bug open.
>>
>> --
>> Colin Watson                                       [cjwatson@debian.org]
>>
>
>

[Message part 2 (text/html, inline)]

Message #82 received at 680935@bugs.debian.org (full text, mbox, reply):

From: Michael van der Kolff <mvanderkolff@gmail.com>

To: Colin Watson <cjwatson@debian.org>, 680935@bugs.debian.org

Cc: Mathieu Malaterre <malat@debian.org>, 680935-submitter@bugs.debian.org

Subject: Re: Bug#680935:

Date: Tue, 22 Jul 2014 00:46:02 +1000

[Message part 1 (text/plain, inline)]

Yeah, there's still the -Wunused-result stuff. OK, we can incorporate
that...

So just the pbmtojbg* changes need to be incorporated.

Cheers,

Michael


On Tue, Jul 22, 2014 at 12:36 AM, Michael van der Kolff <
mvanderkolff@gmail.com> wrote:

> On closer inspection, not quite; we can incorporate the fscanf pedantry -
> we probably should upstream that...
>
> Cheers,
>
> Michael
>
>
> On Tue, Jul 22, 2014 at 12:30 AM, Michael van der Kolff <
> mvanderkolff@gmail.com> wrote:
>
>> AFAICT, upstream has incorporated those into pbmtojbg*.c & jbgtopbm*.c.
>>  Additionally, I have tested the current version with -Wall, and it builds
>> clean.
>>
>> Cheers,
>>
>>
>> Michael
>>
>>
>> On Mon, Jul 21, 2014 at 11:49 PM, Colin Watson <cjwatson@debian.org>
>> wrote:
>>
>>> On Mon, Jul 21, 2014 at 01:55:29PM +0200, Mathieu Malaterre wrote:
>>> > Current packager is working on uploading new upstream: 2.1. Hopefully
>>> > upstream did integrate most of your diffs, otherwise we'll just close
>>> > it.
>>>
>>> This implies that you will close this bug if upstream did not integrate
>>> all my diffs.  Rather, if upstream did not integrate my diffs or the
>>> equivalent (e.g. casts so that the code is correct within C89), then
>>> please leave this bug open.
>>>
>>> --
>>> Colin Watson                                       [cjwatson@debian.org]
>>>
>>
>>
>

[Message part 2 (text/html, inline)]

Message #90 received at 680935@bugs.debian.org (full text, mbox, reply):

From: Michael van der Kolff <mvanderkolff@gmail.com>

To: Markus Kuhn <mgk25@cl.cam.ac.uk>

Cc: Mathieu Malaterre <mathieu.malaterre@gmail.com>, 680935@bugs.debian.org

Subject: Re: jbigkit: Removing the last -Wunused-result compile warnings, and some error checking in pbmtojbg

Date: Tue, 22 Jul 2014 09:46:40 +1000

[Message part 1 (text/plain, inline)]

Forgot to include the bug on the email.


On Tue, Jul 22, 2014 at 9:37 AM, Michael van der Kolff <
mvanderkolff@gmail.com> wrote:

> Dear Markus,
>
> I attach the following patch to jbig-kit 2.1.  This is a reworked one
> against 2.0, and (atm) is slated for inclusion in Debian.
>
> Warmest regards,
>
>
> Michael
>

[Message part 2 (text/html, inline)]

Message #95 received at 680935-close@bugs.debian.org (full text, mbox, reply):

From: Michael van der Kolff <mvanderkolff@gmail.com>

To: 680935-close@bugs.debian.org

Subject: Bug#680935: fixed in jbigkit 2.1-2

Date: Wed, 23 Jul 2014 09:35:53 +0000

Source: jbigkit
Source-Version: 2.1-2

We believe that the bug you reported is fixed in the latest version of
jbigkit, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 680935@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Michael van der Kolff <mvanderkolff@gmail.com> (supplier of updated jbigkit package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Wed, 23 Jul 2014 18:25:12 +1000
Source: jbigkit
Binary: jbigkit-bin libjbig-dev libjbig0
Architecture: source amd64
Version: 2.1-2
Distribution: unstable
Urgency: medium
Maintainer: Michael van der Kolff <mvanderkolff@gmail.com>
Changed-By: Michael van der Kolff <mvanderkolff@gmail.com>
Description:
 jbigkit-bin - JBIGkit binaries
 libjbig-dev - JBIGkit development files
 libjbig0   - JBIGkit libraries
Closes: 680935 741379
Changes:
 jbigkit (2.1-2) unstable; urgency=medium
 .
   * Don't override passed CFLAGS in Makefile (so it now hardens properly)
   * Use -Wall, remove -Wno-unused-result (papering over #680935)
   * Fix remaining unused result warnings (Thanks Colin) (Closes: #680935)
   * Add static library to dev package (Closes: #741379)
Checksums-Sha1:
 a2979442c7efd6a27fcf9912171cd51b4fcb25fc 1955 jbigkit_2.1-2.dsc
 94f7fc4bb896b38ea6db33ae00da43a2935240ce 6432 jbigkit_2.1-2.debian.tar.xz
 4680c380d1ffec639d1904c22d6699a9eec7a50a 28494 jbigkit-bin_2.1-2_amd64.deb
 faf9700f75bd3af5934174c584c97c21b67254e9 34162 libjbig-dev_2.1-2_amd64.deb
 424ef364e9169e8811ed93638c98ff3e3326c4b8 30336 libjbig0_2.1-2_amd64.deb
Checksums-Sha256:
 a8cd3c1a722af7ce1a5d8f046fac34cb653280aed2bb590114f34012251a26a6 1955 jbigkit_2.1-2.dsc
 d005650a9e005b6d01b2dbda892623e0003822f5a771e656a72090a9ea8920b5 6432 jbigkit_2.1-2.debian.tar.xz
 1fe4c330bd7f823611e24e35802bbccf680d10c6704e5b3a5f195a33eda41e02 28494 jbigkit-bin_2.1-2_amd64.deb
 1a5260376393111049f846649ab3fa0fbee8c6a9c0c7387e7243e78774fe27c1 34162 libjbig-dev_2.1-2_amd64.deb
 89042d85ed6dd0466f91397a9ab3ae12ef5e8b1f6ce03f6312be2c1e044b4868 30336 libjbig0_2.1-2_amd64.deb
Files:
 1265b871a3e60848b32f50dba09b05d9 28494 graphics optional jbigkit-bin_2.1-2_amd64.deb
 e62243cec70fef4f2c098d81183351cf 34162 libdevel optional libjbig-dev_2.1-2_amd64.deb
 0f2e4f809314e8d11517578f1c755e3a 30336 libs optional libjbig0_2.1-2_amd64.deb
 901af17200545484f2d85bb192dbe1e8 1955 libs optional jbigkit_2.1-2.dsc
 622b563dffcbc01ea002252fc7bbe94a 6432 libs optional jbigkit_2.1-2.debian.tar.xz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBAgAGBQJTz3OkAAoJEAFx4YKK4JNFjHwP/2yd1Zvd9Lfpj8lbfGgjELb2
ExDWEHK9vSxkxeflYqX0Jsxi2koNw3JOIjAo6Thyf3/pljDp/aA1DkH1Jx07i3Qp
ucsvq9V+dsnZh6AbOpTqtj3DKg1L9E+0soXOR792otT1qeNxkfO74OP1HaiPJBxc
0uYn76yMJEZkRB0mWZI771HnBtSR2qDQ/1og7A7rvkJGdRKZGwgYW2GeQKV7rZjC
fRKtzr7aJxAjeyFG8TZ1lwg4LM1VzYe/ekcHZ4Lh1VENFAYSNI6k0SwOgeG3wWab
jdZWZDt35vLV0DfLv9NVB9WV1Z0GPylFm43jsnyTsBSO/aHnAZKtrpRREXOjBu7/
BmewEDMekliKXZCf3rOAWnKScJGN0R3X5RZxbp+urLMPZJpf8sUaZO8/3uLkLyhE
gAWO03r6au2KTpt46UHHBhxOtoKbuxJo+qiOC4di2X/HmXNbxVMddwV2KHguPMfm
JtlbqZU7ckKcijQIxm5rJJgxHg791XW3x6OfcJ/p/RYZLuo4zmo0M9J6sOAggSNA
qpcdbswtfXT8HgKvrDeRp2cd8Fbv8hGU/ud0c9FL6S4koozk55/kxeXY5+CaXdQy
vVRuJlYLkOu+lAU4G2gQ22UCiLfWtPNuP/uXxqMjBVg0R0HdQSwqMhX2MFHD5jsh
QseFgpoKAfBSX8k10LBa
=bCqE
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.