Bug 838050

Description of problem:
Huzaifa S. Sidhpurwala of SRT noticed that some functions using formatted printing (e.g. "warn()", "err()", and "warnx()") are not protected by the fortify source format string protection. The relevant functions were never meant to be protected by fortify source, so from a security point of view, this is an enhancement only. Since fixing this would break the ABI, we need to work with upstream to see if a protection for these functions can be included in future versions.

Description from the original bug #836931:
While looking into some format string issue, i found that the warn() function does not seem to be protected by the glibc FORTIFY_SOURCE Format string protection mechanism.

Here is a simple example to prove my point:

[huzaifas@babylon ~]$ cat warn1.c 
#include <stdio.h>
#include <err.h>

void main(int argc, char *argv[])
{
warn(argv[1]);
//printf(argv[1]);
}

[huzaifas@babylon ~]$ gcc -O -g -D_FORTIFY_SOURCE=2 -o warn warn1.c
[huzaifas@babylon ~]$ cat print.c 
#include <stdio.h>
#include <err.h>

void main(int argc, char *argv[])
{
//warn(argv[1]);
printf(argv[1]);
}
[huzaifas@babylon ~]$ gcc -O -g -D_FORTIFY_SOURCE=2 -o print print.c

[huzaifas@babylon ~]$ ./warn "%100s%n"
warn:                                                                                               ?&#9646;&#65533;: Segmentation fault
[huzaifas@babylon ~]$ ./print "%100s%n"
*** %n in writable segment detected ***
                                                                                              L&#65533;|&#65533;Aborted
[huzaifas@babylon ~]$