801fa63a90 ("config.mak.dev: add -Wformat-security", 2018-09-08)
added the "-Wformat-security" to the flags set in config.mak.dev.
In the gcc man page this is documented as:
If -Wformat is specified, also warn about uses of format
functions that represent possible security problems. [...]
The commit did however not add the "-Wformat" flag, but instead
relied on the fact that "-Wall" is set in the Makefile by default
and that "-Wformat" is part of "-Wall".
Unfortunately, those who use config.mak.autogen generated with the
autoconf to configure toolchain do *not* get "-Wall" in their CFLAGS
and the added -Wformat-security had no effect. Worse yet, newer
versions of gcc (gcc 8.2.1 in this particular case) warn about the
lack of "-Wformat" and thus compilation fails only with this option
set.
We could fix it by adding "-Wformat", but in general we do want all
checks included in "-Wall", so let's add it to config.mak.dev to
cover more cases.
Signed-off-by: Thomas Gummerer <t.gummerer@gmail.com>
Helped-by: Jeff King <peff@peff.net>
Helped-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>