-Werror=format-security breaks the build

[belegdol+mplayer@…]

Summary of the bug:
How to reproduce:

build svn r36573 with -Werror=format-security

-Werror=format-security will be enabled in Fedora 21 by default. This breaks the mplayer build:

cc -MMD -MP -Wundef -Wall -Wno-switch -Wno-parentheses -Wpointer-arith -Wredundant-decls -Wstrict-prototypes -Wmissing-prototypes -Wdisabled-optimization -Wno-pointer-sign -Wdeclaration-after-statement -std=gnu99 -Werror-implicit-function-declaration -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ISOC99_SOURCE -I. -Iffmpeg -O4 -march=x86-64 -mtune=generic -pipe -ffast-math -fomit-frame-pointer -fno-tree-vectorize -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE64_SOURCE -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fpie -DPIC -D_REENTRANT -I/usr/include/   -D_REENTRANT   -I/usr/include/freetype2 -I/usr/include/bs2b  -I/usr/include/ffmpeg  -pthread -I/usr/include/gtk-2.0 -I/usr/lib64/gtk-2.0/include -I/usr/include/pango-1.0 -I/usr/include/atk-1.0 -I/usr/include/cairo -I/usr/include/pixman-1 -I/usr/include/libdrm -I/usr/include/libpng16 -I/usr/include/gdk-pixbuf-2.0 -I/usr/include/libpng16 -I/usr/include/pango-1.0 -I/usr/include/harfbuzz -I/usr/include/pango-1.0 -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/include/freetype2   -Wno-strict-prototypes -c -o gui/interface.o gui/interface.c
gui/interface.c: In function 'guiInit':
gui/interface.c:203:26: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
         guiInfo.Tracks = (int)listMgr(PLAYLIST_ITEM_GET_POS, 0);
                          ^
gui/interface.c: In function 'gui':
gui/interface.c:325:17: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
         switch ((int)data) {
                 ^
gui/interface.c:330:31: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
             guiInfo.Playing = (int)data;
                               ^
gui/interface.c:352:59: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
         mp_msg(MSGT_GPLAYER, MSGL_DBG2, "[interface] GUI_RUN_COMMAND: %d\n", (int)data);
                                                           ^
gui/interface.c:354:17: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
         switch ((int)data) {
                 ^
gui/interface.c:613:30: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
             guiInfo.Tracks = (int)listMgr(PLAYLIST_ITEM_GET_POS, 0);
                              ^
gui/interface.c:806:29: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
             guiInfo.Track   = (int)listMgr(PLAYLIST_ITEM_GET_POS, next);
                             ^
gui/interface.c: In function 'gmp_msg':
gui/interface.c:1186:5: error: format not a string literal and no format arguments [-Werror=format-security]
     mp_msg(mod, lev, msg);
     ^
cc1: some warnings being treated as errors
make: *** [gui/interface.o] Error 1

Full build log is available on the RPM Fusion build system:
​http://buildsys.rpmfusion.org/logs/fedora-development-rpmfusion_free/19477-mplayer-1.1-18.20140111svn.fc21/x86_64/build.log
Thank you for looking into this in advance.

[beastd]

Patch: Do not pass a non-literal as fmt to a printf-like function

[beastd]

How far does it go with the attached patch​?

[belegdol+mplayer@…]

It gets to here:

stream/stream_radio.c: In function 'open_s':
stream/stream_radio.c:1141:9: error: format not a string literal and no format arguments [-Werror=format-security]
         mp_msg(MSGT_RADIO, MSGL_INFO, priv->driver->info);
         ^
cc1: some warnings being treated as errors

[belegdol+mplayer@…]

The attached file makes the build go all the way, but please keep in mind I have no idea what I am doing.

[beastd]

Replying to belegdol+mplayer@…:

The attached file makes the build go all the way, but please keep in mind I have no idea what I am doing.

Seems OK. Will try checking myself locally.

Thank you for going on with this.

[beastd]

OK, I built locally with -Werror=format-security and everything works now.

I attempted to find more places where this particular pattern occurs, but I did an easy way to check for it. So I did not find any more occurrences besides the 2nd you pointed out.

I committed the combined patch as r36740 in SVN trunk.

Thanks for the report!