Package: src:medusa; Maintainer for src:medusa is Debian Security Tools <[email protected]>;
Reported by: Matthias Klose <[email protected]>
Date: Mon, 17 Feb 2025 17:38:20 UTC
Severity: important
Tags: fixed-upstream, forky, sid
Found in version medusa/2.3~rc1-2
Forwarded to https://github.com/jmk-foofus/medusa/pull/72
Reply or subscribe to this bug.
View this report as an mbox folder, status mbox, maintainer mbox
Report forwarded
to Debian Security Tools <[email protected]>:
Bug#1097379; Package src:medusa.
(Mon, 17 Feb 2025 17:38:21 GMT) (full text, mbox, link).
Acknowledgement sent
to Matthias Klose <[email protected]>:
New Bug report received and forwarded. Copy sent to Debian Security Tools <[email protected]>.
(Mon, 17 Feb 2025 17:38:21 GMT) (full text, mbox, link).
Message #5 received at [email protected] (full text, mbox, reply):
Package: src:medusa
Version: 2.3~rc1-2
Severity: important
Tags: sid forky
User: [email protected]
Usertags: ftbfs-gcc-15
[This bug is NOT targeted to the upcoming trixie release]
Please keep this issue open in the bug tracker for the package it
was filed for. If a fix in another package is required, please
file a bug for the other package (or clone), and add a block in this
package. Please keep the issue open until the package can be built in
a follow-up test rebuild.
The package fails to build in a test rebuild on at least amd64 with
gcc-15/g++-15, but succeeds to build with gcc-14/g++-14. The
severity of this report will be raised before the forky release.
The full build log can be found at:
http://qa-logs.debian.net/2025/02/16/amd64exp/medusa_2.3~rc1-2_unstable_gccexp.log.gz
The last lines of the build log are at the end of this report.
To build with GCC 15, either set CC=gcc-15 CXX=g++-15 explicitly,
or install the gcc, g++, gfortran, ... packages from experimental.
apt-get -t=experimental install g++
GCC 15 now defaults to the C23/C++23 standards, exposing many FTBFS.
Other Common build failures are new warnings resulting in build failures
with -Werror turned on, or new/dropped symbols in Debian symbols files.
For other C/C++ related build failures see the porting guide at
http://gcc.gnu.org/gcc-15/porting_to.html
[...]
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
31 | __glibc_objsize (__s), __fmt,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
32 | __va_arg_pack ());
| ~~~~~~~~~~~~~~~~~
gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src -Wdate-time -D_FORTIFY_SOURCE=2 -g -DDEBUG -fPIC -I/usr/include -I/usr/local/include -I/usr/include/postgresql -I/usr/include/pgsql -I/usr/include/afpfs-ng -I/usr//include -I/usr/include/freerdp2 -I/usr/include/winpr2 -I/usr/include/smb2 -I/usr/include/apr-1.0 -DLINUX -D_REENTRANT -D_GNU_SOURCE -D_GNU_SOURCE -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/medusa-2.3~rc1=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -c -o postgres.o postgres.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src -Wdate-time -D_FORTIFY_SOURCE=2 -g -DDEBUG -fPIC -I/usr/include -I/usr/local/include -I/usr/include/postgresql -I/usr/include/pgsql -I/usr/include/afpfs-ng -I/usr//include -I/usr/include/freerdp2 -I/usr/include/winpr2 -I/usr/include/smb2 -I/usr/include/apr-1.0 -DLINUX -D_REENTRANT -D_GNU_SOURCE -D_GNU_SOURCE -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/medusa-2.3~rc1=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -c -o rexec.o rexec.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src -Wdate-time -D_FORTIFY_SOURCE=2 -g -DDEBUG -fPIC -I/usr/include -I/usr/local/include -I/usr/include/postgresql -I/usr/include/pgsql -I/usr/include/afpfs-ng -I/usr//include -I/usr/include/freerdp2 -I/usr/include/winpr2 -I/usr/include/smb2 -I/usr/include/apr-1.0 -DLINUX -D_REENTRANT -D_GNU_SOURCE -D_GNU_SOURCE -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/medusa-2.3~rc1=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -c -o rlogin.o rlogin.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src -Wdate-time -D_FORTIFY_SOURCE=2 -g -DDEBUG -fPIC -I/usr/include -I/usr/local/include -I/usr/include/postgresql -I/usr/include/pgsql -I/usr/include/afpfs-ng -I/usr//include -I/usr/include/freerdp2 -I/usr/include/winpr2 -I/usr/include/smb2 -I/usr/include/apr-1.0 -DLINUX -D_REENTRANT -D_GNU_SOURCE -D_GNU_SOURCE -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/medusa-2.3~rc1=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -c -o rsh.o rsh.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src -Wdate-time -D_FORTIFY_SOURCE=2 -g -DDEBUG -fPIC -I/usr/include -I/usr/local/include -I/usr/include/postgresql -I/usr/include/pgsql -I/usr/include/afpfs-ng -I/usr//include -I/usr/include/freerdp2 -I/usr/include/winpr2 -I/usr/include/smb2 -I/usr/include/apr-1.0 -DLINUX -D_REENTRANT -D_GNU_SOURCE -D_GNU_SOURCE -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/medusa-2.3~rc1=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -c -o smbnt.o smbnt.c
pop3.c: In function ‘sendAuthPLAIN’:
pop3.c:550:39: warning: ‘%s’ directive output between 0 and 2147483646 bytes may cause result to exceed ‘INT_MAX’ [-Wformat-overflow=]
550 | sprintf((char*)bufSend, "AUTH PLAIN %s\r\n", szTmpBuf64);
| ^~
gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src -Wdate-time -D_FORTIFY_SOURCE=2 -g -DDEBUG -fPIC -I/usr/include -I/usr/local/include -I/usr/include/postgresql -I/usr/include/pgsql -I/usr/include/afpfs-ng -I/usr//include -I/usr/include/freerdp2 -I/usr/include/winpr2 -I/usr/include/smb2 -I/usr/include/apr-1.0 -DLINUX -D_REENTRANT -D_GNU_SOURCE -D_GNU_SOURCE -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/medusa-2.3~rc1=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -c -o smbnt-smb1.o smbnt-smb1.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src -Wdate-time -D_FORTIFY_SOURCE=2 -g -DDEBUG -fPIC -I/usr/include -I/usr/local/include -I/usr/include/postgresql -I/usr/include/pgsql -I/usr/include/afpfs-ng -I/usr//include -I/usr/include/freerdp2 -I/usr/include/winpr2 -I/usr/include/smb2 -I/usr/include/apr-1.0 -DLINUX -D_REENTRANT -D_GNU_SOURCE -D_GNU_SOURCE -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/medusa-2.3~rc1=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -c -o smbnt-smb2.o smbnt-smb2.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src -Wdate-time -D_FORTIFY_SOURCE=2 -g -DDEBUG -fPIC -I/usr/include -I/usr/local/include -I/usr/include/postgresql -I/usr/include/pgsql -I/usr/include/afpfs-ng -I/usr//include -I/usr/include/freerdp2 -I/usr/include/winpr2 -I/usr/include/smb2 -I/usr/include/apr-1.0 -DLINUX -D_REENTRANT -D_GNU_SOURCE -D_GNU_SOURCE -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/medusa-2.3~rc1=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -c -o hmacmd5.o hmacmd5.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src -Wdate-time -D_FORTIFY_SOURCE=2 -g -DDEBUG -fPIC -I/usr/include -I/usr/local/include -I/usr/include/postgresql -I/usr/include/pgsql -I/usr/include/afpfs-ng -I/usr//include -I/usr/include/freerdp2 -I/usr/include/winpr2 -I/usr/include/smb2 -I/usr/include/apr-1.0 -DLINUX -D_REENTRANT -D_GNU_SOURCE -D_GNU_SOURCE -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/medusa-2.3~rc1=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -c -o smtp.o smtp.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src -Wdate-time -D_FORTIFY_SOURCE=2 -g -DDEBUG -fPIC -I/usr/include -I/usr/local/include -I/usr/include/postgresql -I/usr/include/pgsql -I/usr/include/afpfs-ng -I/usr//include -I/usr/include/freerdp2 -I/usr/include/winpr2 -I/usr/include/smb2 -I/usr/include/apr-1.0 -DLINUX -D_REENTRANT -D_GNU_SOURCE -D_GNU_SOURCE -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/medusa-2.3~rc1=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -c -o smtp-vrfy.o smtp-vrfy.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src -Wdate-time -D_FORTIFY_SOURCE=2 -g -DDEBUG -fPIC -I/usr/include -I/usr/local/include -I/usr/include/postgresql -I/usr/include/pgsql -I/usr/include/afpfs-ng -I/usr//include -I/usr/include/freerdp2 -I/usr/include/winpr2 -I/usr/include/smb2 -I/usr/include/apr-1.0 -DLINUX -D_REENTRANT -D_GNU_SOURCE -D_GNU_SOURCE -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/medusa-2.3~rc1=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -c -o snmp.o snmp.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src -Wdate-time -D_FORTIFY_SOURCE=2 -g -DDEBUG -fPIC -I/usr/include -I/usr/local/include -I/usr/include/postgresql -I/usr/include/pgsql -I/usr/include/afpfs-ng -I/usr//include -I/usr/include/freerdp2 -I/usr/include/winpr2 -I/usr/include/smb2 -I/usr/include/apr-1.0 -DLINUX -D_REENTRANT -D_GNU_SOURCE -D_GNU_SOURCE -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/medusa-2.3~rc1=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -c -o ssh.o ssh.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src -Wdate-time -D_FORTIFY_SOURCE=2 -g -DDEBUG -fPIC -I/usr/include -I/usr/local/include -I/usr/include/postgresql -I/usr/include/pgsql -I/usr/include/afpfs-ng -I/usr//include -I/usr/include/freerdp2 -I/usr/include/winpr2 -I/usr/include/smb2 -I/usr/include/apr-1.0 -DLINUX -D_REENTRANT -D_GNU_SOURCE -D_GNU_SOURCE -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/medusa-2.3~rc1=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -c -o svn.o svn.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src -Wdate-time -D_FORTIFY_SOURCE=2 -g -DDEBUG -fPIC -I/usr/include -I/usr/local/include -I/usr/include/postgresql -I/usr/include/pgsql -I/usr/include/afpfs-ng -I/usr//include -I/usr/include/freerdp2 -I/usr/include/winpr2 -I/usr/include/smb2 -I/usr/include/apr-1.0 -DLINUX -D_REENTRANT -D_GNU_SOURCE -D_GNU_SOURCE -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/medusa-2.3~rc1=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -c -o telnet.o telnet.c
smtp.c: In function ‘sendAuthPLAIN’:
smtp.c:535:31: warning: ‘
’ directive output between 2 and 2 bytes may cause result to exceed ‘INT_MAX’ [-Wformat-overflow=]
535 | sprintf((char *)bufSend, "%s\r\n", szTmpBuf64);
| ^~~~
ssh.c: In function ‘initModule’:
ssh.c:261:9: warning: ‘libssh2_banner_set’ is deprecated: since libssh2 1.4.0. Use libssh2_session_banner_set() [-Wdeprecated-declarations]
261 | if ( libssh2_banner_set(session, _psSessionData->szBannerMsg) ) {
| ^~
In file included from ssh.c:46:
/usr/include/libssh2.h:666:17: note: declared here
666 | LIBSSH2_API int libssh2_banner_set(LIBSSH2_SESSION *session,
| ^~~~~~~~~~~~~~~~~~
ssh.c:287:11: warning: ‘libssh2_session_startup’ is deprecated: since libssh2 1.2.8. Use libssh2_session_handshake() [-Wdeprecated-declarations]
287 | if (libssh2_session_startup(session, hSocket)) {
| ^~
/usr/include/libssh2.h:670:17: note: declared here
670 | LIBSSH2_API int libssh2_session_startup(LIBSSH2_SESSION *session, int sock);
| ^~~~~~~~~~~~~~~~~~~~~~~
ssh.c: In function ‘tryLogin’:
ssh.c:442:21: error: assignment to ‘void (*)(void)’ from incompatible pointer type ‘void (*)(const char *, int, const char *, int, int, const LIBSSH2_USERAUTH_KBDINT_PROMPT *, LIBSSH2_USERAUTH_KBDINT_RESPONSE *, void **)’ [-Wincompatible-pointer-types]
442 | pResponseCallback = response_callback;
| ^
ssh.c:398:6: note: ‘response_callback’ declared here
398 | void response_callback(const char* name, int name_len, const char* instruction, int instruction_len, int num_prompts, const LIBSSH2_USERAUTH_KBDINT_PROMPT* prompts, LIBSSH2_USERAUTH_KBDINT_RESPONSE* responses, void **abstract)
| ^~~~~~~~~~~~~~~~~
ssh.c:495:11: error: passing argument 4 of ‘libssh2_userauth_keyboard_interactive_ex’ from incompatible pointer type [-Wincompatible-pointer-types]
495 | if (libssh2_userauth_keyboard_interactive(session, szLogin, pResponseCallback) )
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| |
| void (*)(void)
/usr/include/libssh2.h:798:42: note: expected ‘void (*)(const char *, int, const char *, int, int, const LIBSSH2_USERAUTH_KBDINT_PROMPT *, LIBSSH2_USERAUTH_KBDINT_RESPONSE *, void **)’ but argument is of type ‘void (*)(void)’
798 | LIBSSH2_USERAUTH_KBDINT_RESPONSE_FUNC
| ^
make[4]: *** [Makefile:785: ssh.o] Error 1
make[4]: *** Waiting for unfinished jobs....
make[4]: Leaving directory '/build/reproducible-path/medusa-2.3~rc1/src/modsrc'
make[3]: *** [Makefile:422: all-recursive] Error 1
make[3]: Leaving directory '/build/reproducible-path/medusa-2.3~rc1/src'
make[2]: *** [Makefile:451: all-recursive] Error 1
make[2]: Leaving directory '/build/reproducible-path/medusa-2.3~rc1'
make[1]: *** [Makefile:349: all] Error 2
make[1]: Leaving directory '/build/reproducible-path/medusa-2.3~rc1'
dh_auto_build: error: make -j8 returned exit code 2
make: *** [debian/rules:8: binary] Error 25
dpkg-buildpackage: error: debian/rules binary subprocess returned exit status 2
Information forwarded
to [email protected], Debian Security Tools <[email protected]>:
Bug#1097379; Package src:medusa.
(Sat, 22 Feb 2025 17:51:01 GMT) (full text, mbox, link).
Acknowledgement sent
to Matheus Polkorny <[email protected]>:
Extra info received and forwarded to list. Copy sent to Debian Security Tools <[email protected]>.
(Sat, 22 Feb 2025 17:51:01 GMT) (full text, mbox, link).
Message #10 received at [email protected] (full text, mbox, reply):
Package: medusa Followup-For: Bug #1097379 A Pull Request is open to fix this https://github.com/jmk-foofus/medusa/pull/72 Thanks, Polkorny
Set Bug forwarded-to-address to 'https://github.com/jmk-foofus/medusa/pull/72'.
Request was from [email protected]
to [email protected].
(Sat, 22 Feb 2025 22:54:01 GMT) (full text, mbox, link).
Added tag(s) fixed-upstream.
Request was from [email protected]
to [email protected].
(Thu, 13 Mar 2025 17:36:05 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debbugs is free software and licensed under the terms of the GNU General Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.