build: drop global suppression of -Wformat-nonliteral, fix fallouts

Extend two existing local suppressions to GCC, and add another
GCC-specific one as a replacement.

Before this patch suppressing this warning was odd with clang, because
after this option, `-Wformat=2` is used, which re-enables it.

Also:
- mprintf: minimize scope of a warning suppression.
- tests/server: suppress this warning for a system `vsnprintf()` call
  where it could trigger in C89 builds or with
  `CFLAGS=-DCURL_NO_FMT_CHECKS` set. Seen with Apple clang 17:
  ```
  curl/tests/server/util.c:114:37: warning: format string is not a string literal [-Wformat-nonliteral]
    114 |   vsnprintf(buffer, sizeof(buffer), msg, ap);
        |                                     ^~~
  /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/secure/_stdio.h:124:69: note: expanded from macro 'vsnprintf'
    124 | #define vsnprintf(str, len, ...) __vsnprintf_chk_func (str, len, 0, __VA_ARGS__)
        |                                                                     ^~~~~~~~~~~
  /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/secure/_stdio.h:81:65: note: expanded from macro '__vsnprintf_chk_func'
     81 |         __builtin___vsnprintf_chk (str, len, flag, __darwin_obsz(str), format, ap)
        |                                                                        ^~~~~~
  ```

Ref: #20363

Closes #20366
This commit is contained in:
Viktor Szakats 2026-01-20 02:52:53 +01:00
parent c1ef1876ac
commit f07a98ae11
No known key found for this signature in database
GPG key ID: B5ABD165E2AEF201
6 changed files with 27 additions and 19 deletions

View file

@ -812,7 +812,6 @@ AC_DEFUN([CURL_SET_COMPILER_WARNING_OPTS], [
CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [sign-compare])
tmp_CFLAGS="$tmp_CFLAGS -Wno-multichar"
CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [undef])
tmp_CFLAGS="$tmp_CFLAGS -Wno-format-nonliteral"
CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [endif-labels strict-prototypes])
CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [declaration-after-statement])
CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [cast-align])
@ -1028,11 +1027,6 @@ AC_DEFUN([CURL_SET_COMPILER_WARNING_OPTS], [
CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [undef])
fi
#
dnl Only gcc 2.97 or later
if test "$compiler_num" -ge "297"; then
tmp_CFLAGS="$tmp_CFLAGS -Wno-format-nonliteral"
fi
#
dnl Only gcc 3.0 or later
if test "$compiler_num" -ge "300"; then
dnl -Wunreachable-code seems totally unreliable on my gcc 3.3.2 on