Content-Type: multipart/mixed;
 boundary=189a9c9780bf4b81bbc4a1e17f83b738ac1f94911c17c5d61d415e1c41cc
Mime-Version: 1.0
Date: Thu, 07 Mar 2024 23:39:39 -0600
Message-Id: <CZO4L8L0KP7K.1RWJWEAGL8UMN@neon.tech>
From: "Tristan Partin" <tristan@neon.tech>
Cc: <pgsql-hackers@postgresql.org>
Subject: Re: meson: Specify -Wformat as a common warning flag for extensions
To: "Sutou Kouhei" <kou@clear-code.com>
References: <20240122.141139.931086145628347157.kou@clear-code.com>
In-Reply-To: <20240122.141139.931086145628347157.kou@clear-code.com>
Archived-At: <https://www.postgresql.org/message-id/CZO4L8L0KP7K.1RWJWEAGL8UMN%40neon.tech>
Precedence: bulk

--189a9c9780bf4b81bbc4a1e17f83b738ac1f94911c17c5d61d415e1c41cc
Content-Type: multipart/alternative;
 boundary=46f309535e5c317004afdf38d596f3b75c3ed0fe2aca18f24c6d0562b6b2

--46f309535e5c317004afdf38d596f3b75c3ed0fe2aca18f24c6d0562b6b2
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Type: text/plain; charset=UTF-8; format=Flowed

On Sun Jan 21, 2024 at 11:11 PM CST, Sutou Kouhei wrote:
> Hi,
>
> I'm an extension developer. If I use PostgreSQL built with
> Meson, I get the following warning:
>
>     cc1: warning: '-Wformat-security' ignored without '-Wformat' [-Wforma=
t-security]
>
> Because "pg_config --cflags" includes -Wformat-security but
> doesn't include -Wformat.
>
> Can we specify -Wformat as a common warning flag too? If we
> do it, "pg_config --cflags" includes both of
> -Wformat-security and -Wformat. So I don't get the warning.

The GCC documentation[0] says the following:

> If -Wformat is specified, also warn about uses of format functions=20
> that represent possible security problems. At present, this warns=20
> about calls to printf and scanf functions where the format string is=20
> not a string literal and there are no format arguments, as in printf=20
> (foo);. This may be a security hole if the format string came from=20
> untrusted input and contains =E2=80=98%n=E2=80=99. (This is currently a s=
ubset of what=20
> -Wformat-nonliteral warns about, but in future warnings may be added=20
> to -Wformat-security that are not included in -Wformat-nonliteral.)

It sounds like a legitimate issue. I have confirmed the issue exists=20
with a pg_config compiled with Meson. I can also confirm that this issue=20
exists in the autotools build.

Here is a v2 of your patch which includes the fix for autotools. I will=20
mark this "Ready for Committer" in the commitfest. Thanks!

[0]: https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html

--=20
Tristan Partin
Neon (https://neon.tech)

--46f309535e5c317004afdf38d596f3b75c3ed0fe2aca18f24c6d0562b6b2--

--189a9c9780bf4b81bbc4a1e17f83b738ac1f94911c17c5d61d415e1c41cc
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
 filename=v2-0001-Add-Wformat-to-common-warning-flags.patch
Content-Type: text/x-patch; charset=utf-8;
 name=v2-0001-Add-Wformat-to-common-warning-flags.patch

RnJvbSBiY2UwZjcwZjg2NmJiMGUzZjhmYjhlYjE0YzA1YmJiZGQyN2M1MWYyIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBTdXRvdSBLb3VoZWkgPGtvdUBjbGVhci1jb2RlLmNvbT4KRGF0
ZTogTW9uLCAyMiBKYW4gMjAyNCAxMzo1MTo1OCArMDkwMApTdWJqZWN0OiBbUEFUQ0ggdjJdIEFk
ZCAtV2Zvcm1hdCB0byBjb21tb24gd2FybmluZyBmbGFncwoKV2Ugc3BlY2lmeSAtV2Zvcm1hdC1z
ZWN1cml0eSBhcyBhIGNvbW1vbiB3YXJuaW5nIGZsYWcgZXhwbGljaXRseS4gR0NDCnJlcXVpcmVz
IC1XZm9ybWF0IHRvIGJlIGFkZGVkIGZvciAtV2Zvcm1hdC1zZWN1cml0eSB0byB0YWtlIGVmZmVj
dC4gSWYKLVdmb3JtYXQtc2VjdXJpdHkgaXMgdXNlZCB3aXRob3V0IC1XZm9ybWF0LCBHQ0Mgc2hv
d3MgdGhlIGZvbGxvd2luZwp3YXJuaW5nOgoKICAgIGNjMTogd2FybmluZzogJy1XZm9ybWF0LXNl
Y3VyaXR5JyBpZ25vcmVkIHdpdGhvdXQgJy1XZm9ybWF0JyBbLVdmb3JtYXQtc2VjdXJpdHldCgpD
by1hdXRob3JlZC1ieTogU3V0b3UgS291aGVpIDxrb3VAY2xlYXItY29kZS5jb20+Ci0tLQogY29u
ZmlndXJlICAgIHwgOTIgKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysr
KysrKysrKysrKwogY29uZmlndXJlLmFjIHwgIDMgKysKIG1lc29uLmJ1aWxkICB8ICAyICsrCiAz
IGZpbGVzIGNoYW5nZWQsIDk3IGluc2VydGlvbnMoKykKCmRpZmYgLS1naXQgYS9jb25maWd1cmUg
Yi9jb25maWd1cmUKaW5kZXggMzZmZWVhZmJiMjMuLmVhZmFiMjQ3ZTFkIDEwMDc1NQotLS0gYS9j
b25maWd1cmUKKysrIGIvY29uZmlndXJlCkBAIC01OTg1LDYgKzU5ODUsOTggQEAgaWYgdGVzdCB4
IiRwZ2FjX2N2X3Byb2dfQ1hYX2N4eGZsYWdzX19Xc2hhZG93X2NvbXBhdGlibGVfbG9jYWwiID0g
eCJ5ZXMiOyB0aGVuCiBmaQogCiAKKyAgIyAtV2Zvcm1hdC1zZWN1cml0eSByZXF1aXJlcyAtV2Zv
cm1hdCwgc28gY2hlY2sgZm9yIGl0CisKK3sgJGFzX2VjaG8gIiRhc19tZToke2FzX2xpbmVuby0k
TElORU5PfTogY2hlY2tpbmcgd2hldGhlciAke0NDfSBzdXBwb3J0cyAtV2Zvcm1hdCwgZm9yIENG
TEFHUyIgPiY1CiskYXNfZWNob19uICJjaGVja2luZyB3aGV0aGVyICR7Q0N9IHN1cHBvcnRzIC1X
Zm9ybWF0LCBmb3IgQ0ZMQUdTLi4uICIgPiY2OyB9CitpZiAke3BnYWNfY3ZfcHJvZ19DQ19jZmxh
Z3NfX1dmb3JtYXQrOn0gZmFsc2U7IHRoZW4gOgorICAkYXNfZWNob19uICIoY2FjaGVkKSAiID4m
NgorZWxzZQorICBwZ2FjX3NhdmVfQ0ZMQUdTPSRDRkxBR1MKK3BnYWNfc2F2ZV9DQz0kQ0MKK0ND
PSR7Q0N9CitDRkxBR1M9IiR7Q0ZMQUdTfSAtV2Zvcm1hdCIKK2FjX3NhdmVfY193ZXJyb3JfZmxh
Zz0kYWNfY193ZXJyb3JfZmxhZworYWNfY193ZXJyb3JfZmxhZz15ZXMKK2NhdCBjb25mZGVmcy5o
IC0gPDxfQUNFT0YgPmNvbmZ0ZXN0LiRhY19leHQKKy8qIGVuZCBjb25mZGVmcy5oLiAgKi8KKwor
aW50CittYWluICgpCit7CisKKyAgOworICByZXR1cm4gMDsKK30KK19BQ0VPRgoraWYgYWNfZm5f
Y190cnlfY29tcGlsZSAiJExJTkVOTyI7IHRoZW4gOgorICBwZ2FjX2N2X3Byb2dfQ0NfY2ZsYWdz
X19XZm9ybWF0PXllcworZWxzZQorICBwZ2FjX2N2X3Byb2dfQ0NfY2ZsYWdzX19XZm9ybWF0PW5v
CitmaQorcm0gLWYgY29yZSBjb25mdGVzdC5lcnIgY29uZnRlc3QuJGFjX29iamV4dCBjb25mdGVz
dC4kYWNfZXh0CithY19jX3dlcnJvcl9mbGFnPSRhY19zYXZlX2Nfd2Vycm9yX2ZsYWcKK0NGTEFH
Uz0iJHBnYWNfc2F2ZV9DRkxBR1MiCitDQz0iJHBnYWNfc2F2ZV9DQyIKK2ZpCit7ICRhc19lY2hv
ICIkYXNfbWU6JHthc19saW5lbm8tJExJTkVOT306IHJlc3VsdDogJHBnYWNfY3ZfcHJvZ19DQ19j
ZmxhZ3NfX1dmb3JtYXQiID4mNQorJGFzX2VjaG8gIiRwZ2FjX2N2X3Byb2dfQ0NfY2ZsYWdzX19X
Zm9ybWF0IiA+JjY7IH0KK2lmIHRlc3QgeCIkcGdhY19jdl9wcm9nX0NDX2NmbGFnc19fV2Zvcm1h
dCIgPSB4InllcyI7IHRoZW4KKyAgQ0ZMQUdTPSIke0NGTEFHU30gLVdmb3JtYXQiCitmaQorCisK
KyAgeyAkYXNfZWNobyAiJGFzX21lOiR7YXNfbGluZW5vLSRMSU5FTk99OiBjaGVja2luZyB3aGV0
aGVyICR7Q1hYfSBzdXBwb3J0cyAtV2Zvcm1hdCwgZm9yIENYWEZMQUdTIiA+JjUKKyRhc19lY2hv
X24gImNoZWNraW5nIHdoZXRoZXIgJHtDWFh9IHN1cHBvcnRzIC1XZm9ybWF0LCBmb3IgQ1hYRkxB
R1MuLi4gIiA+JjY7IH0KK2lmICR7cGdhY19jdl9wcm9nX0NYWF9jeHhmbGFnc19fV2Zvcm1hdCs6
fSBmYWxzZTsgdGhlbiA6CisgICRhc19lY2hvX24gIihjYWNoZWQpICIgPiY2CitlbHNlCisgIHBn
YWNfc2F2ZV9DWFhGTEFHUz0kQ1hYRkxBR1MKK3BnYWNfc2F2ZV9DWFg9JENYWAorQ1hYPSR7Q1hY
fQorQ1hYRkxBR1M9IiR7Q1hYRkxBR1N9IC1XZm9ybWF0IgorYWNfc2F2ZV9jeHhfd2Vycm9yX2Zs
YWc9JGFjX2N4eF93ZXJyb3JfZmxhZworYWNfY3h4X3dlcnJvcl9mbGFnPXllcworYWNfZXh0PWNw
cAorYWNfY3BwPSckQ1hYQ1BQICRDUFBGTEFHUycKK2FjX2NvbXBpbGU9JyRDWFggLWMgJENYWEZM
QUdTICRDUFBGTEFHUyBjb25mdGVzdC4kYWNfZXh0ID4mNScKK2FjX2xpbms9JyRDWFggLW8gY29u
ZnRlc3QkYWNfZXhlZXh0ICRDWFhGTEFHUyAkQ1BQRkxBR1MgJExERkxBR1MgY29uZnRlc3QuJGFj
X2V4dCAkTElCUyA+JjUnCithY19jb21waWxlcl9nbnU9JGFjX2N2X2N4eF9jb21waWxlcl9nbnUK
KworY2F0IGNvbmZkZWZzLmggLSA8PF9BQ0VPRiA+Y29uZnRlc3QuJGFjX2V4dAorLyogZW5kIGNv
bmZkZWZzLmguICAqLworCitpbnQKK21haW4gKCkKK3sKKworICA7CisgIHJldHVybiAwOworfQor
X0FDRU9GCitpZiBhY19mbl9jeHhfdHJ5X2NvbXBpbGUgIiRMSU5FTk8iOyB0aGVuIDoKKyAgcGdh
Y19jdl9wcm9nX0NYWF9jeHhmbGFnc19fV2Zvcm1hdD15ZXMKK2Vsc2UKKyAgcGdhY19jdl9wcm9n
X0NYWF9jeHhmbGFnc19fV2Zvcm1hdD1ubworZmkKK3JtIC1mIGNvcmUgY29uZnRlc3QuZXJyIGNv
bmZ0ZXN0LiRhY19vYmpleHQgY29uZnRlc3QuJGFjX2V4dAorYWNfZXh0PWMKK2FjX2NwcD0nJENQ
UCAkQ1BQRkxBR1MnCithY19jb21waWxlPSckQ0MgLWMgJENGTEFHUyAkQ1BQRkxBR1MgY29uZnRl
c3QuJGFjX2V4dCA+JjUnCithY19saW5rPSckQ0MgLW8gY29uZnRlc3QkYWNfZXhlZXh0ICRDRkxB
R1MgJENQUEZMQUdTICRMREZMQUdTIGNvbmZ0ZXN0LiRhY19leHQgJExJQlMgPiY1JworYWNfY29t
cGlsZXJfZ251PSRhY19jdl9jX2NvbXBpbGVyX2dudQorCithY19jeHhfd2Vycm9yX2ZsYWc9JGFj
X3NhdmVfY3h4X3dlcnJvcl9mbGFnCitDWFhGTEFHUz0iJHBnYWNfc2F2ZV9DWFhGTEFHUyIKK0NY
WD0iJHBnYWNfc2F2ZV9DWFgiCitmaQoreyAkYXNfZWNobyAiJGFzX21lOiR7YXNfbGluZW5vLSRM
SU5FTk99OiByZXN1bHQ6ICRwZ2FjX2N2X3Byb2dfQ1hYX2N4eGZsYWdzX19XZm9ybWF0IiA+JjUK
KyRhc19lY2hvICIkcGdhY19jdl9wcm9nX0NYWF9jeHhmbGFnc19fV2Zvcm1hdCIgPiY2OyB9Citp
ZiB0ZXN0IHgiJHBnYWNfY3ZfcHJvZ19DWFhfY3h4ZmxhZ3NfX1dmb3JtYXQiID0geCJ5ZXMiOyB0
aGVuCisgIENYWEZMQUdTPSIke0NYWEZMQUdTfSAtV2Zvcm1hdCIKK2ZpCisKKwogICAjIFRoaXMg
d2FzIGluY2x1ZGVkIGluIC1XYWxsLy1XZm9ybWF0IGluIG9sZGVyIEdDQyB2ZXJzaW9ucwogCiB7
ICRhc19lY2hvICIkYXNfbWU6JHthc19saW5lbm8tJExJTkVOT306IGNoZWNraW5nIHdoZXRoZXIg
JHtDQ30gc3VwcG9ydHMgLVdmb3JtYXQtc2VjdXJpdHksIGZvciBDRkxBR1MiID4mNQpkaWZmIC0t
Z2l0IGEvY29uZmlndXJlLmFjIGIvY29uZmlndXJlLmFjCmluZGV4IDU3ZjczNDg3OWUxLi44N2E4
ODYwZWNjYSAxMDA2NDQKLS0tIGEvY29uZmlndXJlLmFjCisrKyBiL2NvbmZpZ3VyZS5hYwpAQCAt
NTI3LDYgKzUyNyw5IEBAIGlmIHRlc3QgIiRHQ0MiID0geWVzIC1hICIkSUNDIiA9IG5vOyB0aGVu
CiAgIFBHQUNfUFJPR19DWFhfQ0ZMQUdTX09QVChbLVdjYXN0LWZ1bmN0aW9uLXR5cGVdKQogICBQ
R0FDX1BST0dfQ0NfQ0ZMQUdTX09QVChbLVdzaGFkb3c9Y29tcGF0aWJsZS1sb2NhbF0pCiAgIFBH
QUNfUFJPR19DWFhfQ0ZMQUdTX09QVChbLVdzaGFkb3c9Y29tcGF0aWJsZS1sb2NhbF0pCisgICMg
LVdmb3JtYXQtc2VjdXJpdHkgcmVxdWlyZXMgLVdmb3JtYXQsIHNvIGNoZWNrIGZvciBpdAorICBQ
R0FDX1BST0dfQ0NfQ0ZMQUdTX09QVChbLVdmb3JtYXRdKQorICBQR0FDX1BST0dfQ1hYX0NGTEFH
U19PUFQoWy1XZm9ybWF0XSkKICAgIyBUaGlzIHdhcyBpbmNsdWRlZCBpbiAtV2FsbC8tV2Zvcm1h
dCBpbiBvbGRlciBHQ0MgdmVyc2lvbnMKICAgUEdBQ19QUk9HX0NDX0NGTEFHU19PUFQoWy1XZm9y
bWF0LXNlY3VyaXR5XSkKICAgUEdBQ19QUk9HX0NYWF9DRkxBR1NfT1BUKFstV2Zvcm1hdC1zZWN1
cml0eV0pCmRpZmYgLS1naXQgYS9tZXNvbi5idWlsZCBiL21lc29uLmJ1aWxkCmluZGV4IDg1Nzg4
ZjlkZDhmLi43MTdmZGM0NzQ2YiAxMDA2NDQKLS0tIGEvbWVzb24uYnVpbGQKKysrIGIvbWVzb24u
YnVpbGQKQEAgLTE4MjYsNiArMTgyNiw4IEBAIGNvbW1vbl93YXJuaW5nX2ZsYWdzID0gWwogICAn
LVdpbXBsaWNpdC1mYWxsdGhyb3VnaD0zJywKICAgJy1XY2FzdC1mdW5jdGlvbi10eXBlJywKICAg
Jy1Xc2hhZG93PWNvbXBhdGlibGUtbG9jYWwnLAorICAjIC1XZm9ybWF0LXNlY3VyaXR5IHJlcXVp
cmVzIC1XZm9ybWF0LCBzbyBjaGVjayBmb3IgaXQKKyAgJy1XZm9ybWF0JywKICAgIyBUaGlzIHdh
cyBpbmNsdWRlZCBpbiAtV2FsbC8tV2Zvcm1hdCBpbiBvbGRlciBHQ0MgdmVyc2lvbnMKICAgJy1X
Zm9ybWF0LXNlY3VyaXR5JywKIF0KLS0gClRyaXN0YW4gUGFydGluCk5lb24gKGh0dHBzOi8vbmVv
bi50ZWNoKQoK
--189a9c9780bf4b81bbc4a1e17f83b738ac1f94911c17c5d61d415e1c41cc--