diff -up flightgear-2.6.0/src/Cockpit/panel.cxx.checkforn flightgear-2.6.0/src/Cockpit/panel.cxx
--- flightgear-2.6.0/src/Cockpit/panel.cxx.checkforn 2012-02-17 17:41:14.704313333 -0500
+++ flightgear-2.6.0/src/Cockpit/panel.cxx 2012-05-29 21:01:31.264831372 -0400
@@ -1209,8 +1209,18 @@ FGTextLayer::Chunk::Chunk (const string
: _type(FGTextLayer::TEXT), _fmt(fmt)
{
_text = text;
- if (_fmt.empty())
- _fmt = "%s";
+ if (_fmt.empty()) {
+ _fmt = "%s";
+ } else {
+ // It is never safe for _fmt.c_str to be %n.
+ string unsafe ("%n");
+ size_t found;
+ found=_fmt.find(unsafe);
+ if (found!=string::npos) {
+ SG_LOG(SG_COCKPIT, SG_WARN, "format type contained %n, but this is unsafe, reverting to %s");
+ _fmt = "%s";
+ }
+ }
}
FGTextLayer::Chunk::Chunk (ChunkType type, const SGPropertyNode * node,
@@ -1223,6 +1233,20 @@ FGTextLayer::Chunk::Chunk (ChunkType typ
_fmt = "%s";
else
_fmt = "%.2f";
+ } else {
+ // It is never safe for _fmt.c_str to be %n.
+ string unsafe ("%n");
+ size_t found;
+ found=_fmt.find(unsafe);
+ if (found!=string::npos) {
+ if (type == TEXT_VALUE) {
+ SG_LOG(SG_COCKPIT, SG_WARN, "format type contained %n, but this is unsafe, reverting to %s");
+ _fmt = "%s";
+ } else {
+ SG_LOG(SG_COCKPIT, SG_WARN, "format type contained %n, but this is unsafe, reverting to %.2f");
+ _fmt = "%.2f";
+ }
+ }
}
_node = node;
}
diff -up flightgear-2.6.0/src/Network/generic.cxx.checkforn flightgear-2.6.0/src/Network/generic.cxx
--- flightgear-2.6.0/src/Network/generic.cxx.checkforn 2012-02-17 17:41:16.428329558 -0500
+++ flightgear-2.6.0/src/Network/generic.cxx 2012-05-29 20:50:37.212255822 -0400
@@ -205,6 +205,8 @@ bool FGGeneric::gen_message_binary() {
bool FGGeneric::gen_message_ascii() {
string generic_sentence;
+ string unsafe ("%n");
+ size_t found;
char tmp[255];
length = 0;
@@ -215,6 +217,13 @@ bool FGGeneric::gen_message_ascii() {
generic_sentence += var_separator;
}
+ // It is never safe for _out_message[i].format.c_str to be %n.
+ found=_out_message[i].format.find(unsafe);
+ if (found!=string::npos) {
+ SG_LOG(SG_COCKPIT, SG_WARN, "format type contained %n, but this is unsafe, reverting to %s");
+ _out_message[i].format = "%s";
+ }
+
switch (_out_message[i].type) {
case FG_INT:
val = _out_message[i].offset +