gh-112301: Add -Wformat=2 compiler option to NODIST

.github/workflows/reusable-ubuntu.yml

@@ -80,7 +80,7 @@ jobs:
       working-directory: ${{ env.CPYTHON_BUILDDIR }}
       run: make pythoninfo
     - name: Check compiler warnings
-      run: python Tools/build/check_warnings.py --compiler-output-file-path=${{ env.CPYTHON_BUILDDIR }}/compiler_output.txt --warning-ignore-file-path ${GITHUB_WORKSPACE}/Tools/build/.warningignore_ubuntu
+      run: python Tools/build/check_warnings.py --compiler-output-file-path=${{ env.CPYTHON_BUILDDIR }}/compiler_output.txt --warning-ignore-file-path ${GITHUB_WORKSPACE}/Tools/build/.warningignore_ubuntu --fail-on-regression
     - name: Remount sources writable for tests
       # some tests write to srcdir, lack of pyc files slows down testing
       run: sudo mount $CPYTHON_RO_SRCDIR -oremount,rw

Misc/NEWS.d/next/Security/2024-07-30-17-34-47.gh-issue-112301.8J8WhZ.rst

@@ -0,0 +1 @@
+Add -Wformat=2 to NODIST build flags to warn about potential vulnerabilities related to format strings.

Objects/unicodeobject.c

@@ -2851,6 +2851,14 @@ unicode_fromformat_arg(_PyUnicodeWriter *writer,
             default: fmt = formats[sizemod]; break;
         }
         int issigned = (*f == 'd' || *f == 'i');
+        // Format strings for sprintf are selected from constant arrays of
+        // constant strings, and the variable used to index into the arrays
+        // is only assigned known constant values. Ignore warnings related
+        // to the format string not being a string literal.
+        #if defined(__GNUC__) || defined(__clang__)
+        #pragma GCC diagnostic push
+        #pragma GCC diagnostic ignored "-Wformat-nonliteral"
+        #endif
         switch (sizemod) {
             case F_LONG:
                 len = issigned ?
@@ -2881,6 +2889,9 @@ unicode_fromformat_arg(_PyUnicodeWriter *writer,
                     sprintf(buffer, fmt, va_arg(*vargs, unsigned int));
                 break;
         }
+        #if defined(__GNUC__) || defined(__clang__)
+        #pragma GCC diagnostic pop
+        #endif
         assert(len >= 0);
 
         int sign = (buffer[0] == '-');

Python/getversion.c

@@ -19,8 +19,17 @@ void _Py_InitVersion(void)
 #else
     const char *buildinfo_format = "%.80s (%.80s) %.80s";
 #endif
+    // The format string is defined above and is observably safe.
+    // Ignore warnings related to non-literal format strings.
+    #if defined(__GNUC__) && !defined(__clang__)
+    #pragma GCC diagnostic push
+    #pragma GCC diagnostic ignored "-Wformat-nonliteral"
+    #endif
     PyOS_snprintf(version, sizeof(version), buildinfo_format,
                   PY_VERSION, Py_GetBuildInfo(), Py_GetCompiler());
+    #if defined(__GNUC__) && !defined(__clang__)
+    #pragma GCC diagnostic pop
+    #endif
 }
 
 const char *

configure.ac

@@ -2510,6 +2510,7 @@ if test "$disable_safety" = "no"
 then
   AX_CHECK_COMPILE_FLAG([-fstack-protector-strong], [CFLAGS_NODIST="$CFLAGS_NODIST -fstack-protector-strong"], [AC_MSG_WARN([-fstack-protector-strong not supported])], [-Werror])
   AX_CHECK_COMPILE_FLAG([-Wtrampolines], [CFLAGS_NODIST="$CFLAGS_NODIST -Wtrampolines"], [AC_MSG_WARN([-Wtrampolines not supported])], [-Werror])
+  AX_CHECK_COMPILE_FLAG([-Wformat -Wformat=2], [CFLAGS_NODIST="$CFLAGS_NODIST -Wformat -Wformat=2"], [AC_MSG_WARN([-Wformat and -Wformat=2 not supported])], [-Werror])
 fi
 
 AC_MSG_CHECKING([for --enable-slower-safety])