+++ This bug was initially created as a clone of Bug #585199 +++

Description of problem:

`wn' utilty from wordnet-3.0 package passes user input (executable positional
argument to fprintf(3) as format string without check for format escapes.


Version-Release number of selected component (if applicable):

wordnet-3.0-10.fc14 and lower version in all Fedoras.


How reproducible:

Compile and install wordnet package and invoke `wn' executable with invalid
arguments resulting in application error message:

    $ wn -antsn 'Hello world'
    wn: invalid search option: Hello world

Now try some formating escapes:

    $ wn -antsn '%s'
    Segmentation fault (core dumped)

    $ wn -antsn '%x %x %x %x'
    wn: invalid search option: 1 b 0 1789f60d

    $ wn -antsn '%n'
    *** %n in writable segment detected ***
    Aborted (core dumped)

Additional info:
WordNet-3.0/src/wn.c:346:

    static int error_message(char *msg)
    {
→       fprintf(stderr, msg);
        return(0);
    }

--- Additional comment from ppisar on 2010-04-23 08:19:52 EDT ---

Created an attachment (id=408589)
Fix

Print message as raw string.