https://sources.debian.org/data/main/a/a2ps/1:4.14-2/debian/patches/fix-format-security.diff

Index: b/lib/psgen.c
===================================================================
--- a/lib/psgen.c
+++ b/lib/psgen.c
@@ -232,7 +232,7 @@
     default:
       *buf = '\0';
       ps_escape_char (job, cp[i], buf);
-      output (jdiv, (char *) buf);
+      output (jdiv, "%s", (char *) buf);
       break;
     }
   }
Index: b/lib/output.c
===================================================================
--- a/lib/output.c
+++ b/lib/output.c
@@ -525,7 +525,7 @@
 		     expand_user_string (job, FIRST_FILE (job),
 					 (const uchar *) "Expand: requirement",
 					 (const uchar *) token));
-	output (dest, expansion);
+	output (dest, "%s", expansion);
 	continue;
       }
 
Index: b/lib/parseppd.y
===================================================================
--- a/lib/parseppd.y
+++ b/lib/parseppd.y
@@ -154,7 +154,7 @@
 void
 yyerror (const char *msg)
 {
-  error_at_line (1, 0, ppdfilename, ppdlineno, msg);
+  error_at_line (1, 0, ppdfilename, ppdlineno, "%s", msg);
 }
 
 /*
Index: b/src/parsessh.y
===================================================================
--- a/src/parsessh.y
+++ b/src/parsessh.y
@@ -740,7 +740,7 @@
 void
 yyerror (const char *msg)
 {
-  error_at_line (1, 0, sshfilename, sshlineno, msg);
+  error_at_line (1, 0, sshfilename, sshlineno, "%s", msg);
 }
 
 /*
Index: b/lib/parseppd.c
===================================================================
--- a/lib/parseppd.c
+++ b/lib/parseppd.c
@@ -1707,7 +1707,7 @@
 void
 yyerror (const char *msg)
 {
-  error_at_line (1, 0, ppdfilename, ppdlineno, msg);
+  error_at_line (1, 0, ppdfilename, ppdlineno, "%s", msg);
 }
 
 /*
Index: b/src/parsessh.c
===================================================================
--- a/src/parsessh.c
+++ b/src/parsessh.c
@@ -2639,7 +2639,7 @@
 void
 yyerror (const char *msg)
 {
-  error_at_line (1, 0, sshfilename, sshlineno, msg);
+  error_at_line (1, 0, sshfilename, sshlineno, "%s", msg);
 }
 
 /*
r></table>
<div class='path'>path: <a href='/guix/log/?id=5de603e13aebc588fd2ecaa9bf0fc86055d54e08'>root</a>/<a href='/guix/log/gnu?id=5de603e13aebc588fd2ecaa9bf0fc86055d54e08'>gnu</a>/<a href='/guix/log/gnu/build?id=5de603e13aebc588fd2ecaa9bf0fc86055d54e08'>build</a>/<a href='/guix/log/gnu/build/linux-initrd.scm?id=5de603e13aebc588fd2ecaa9bf0fc86055d54e08'>linux-initrd.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/gnu/build/linux-initrd.scm?id=5de603e13aebc588fd2ecaa9bf0fc86055d54e08&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2020-12-15 17:32:10 +0100'>2020-12-15</span></td><td><a href='/guix/commit/gnu/build/linux-initrd.scm?id=6a060ff27ff68384d7c90076baa36c349fff689d'>store-copy: 'populate-store' can optionally deduplicate files.</a><span class='msg-avail'>...<span class='msg-tooltip'>Until now deduplication was performed as an additional pass after
copying files, which involve re-traversing all the files that had just
been copied.

* guix/store/deduplication.scm (copy-file/deduplicate): New procedure.
* tests/store-deduplication.scm ("copy-file/deduplicate"): New test.
* guix/build/store-copy.scm (populate-store): Add #:deduplicate?
parameter and honor it.
* tests/gexp.scm ("gexp-&gt;derivation, store copy"): Pass #:deduplicate? #f
to 'populate-store'.
* gnu/build/image.scm (initialize-root-partition): Pass #:deduplicate?
to 'populate-store'.  Pass #:deduplicate? #f to 'register-closure'.
* gnu/build/vm.scm (root-partition-initializer): Likewise.
* gnu/build/install.scm (populate-single-profile-directory): Pass
 #:deduplicate? #f to 'populate-store'.
* gnu/build/linux-initrd.scm (build-initrd): Likewise.
* guix/scripts/pack.scm (self-contained-tarball)[import-module?]: New
procedure.
[build]: Pass it as an argument to 'source-module-closure'.
* guix/scripts/pack.scm (squashfs-image)[build]: Wrap in
'with-extensions'.
* gnu/system/linux-initrd.scm (expression-&gt;initrd)[import-module?]: New
procedure.
[builder]: Pass it to 'source-module-closure'.
* gnu/system/install.scm (cow-store-service-type)[import-module?]: New
procedure.  Pass it to 'source-module-closure'.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2020-11-21 12:39:14 +0100'>2020-11-21</span></td><td><a href='/guix/commit/gnu/build/linux-initrd.scm?id=2200bb214690ebc78b9fa42887ac9dfb8035bd4f'>linux-initrd: Remove unnecessary timestamp reset phase.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/build/linux-initrd.scm (write-cpio-archive): Mention timestamps in
docstring.
(build-initrd): Remove unnecessary timestamp reset phase.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2019-09-25 12:18:25 +0900'>2019-09-25</span></td><td><a href='/guix/commit/gnu/build/linux-initrd.scm?id=91e633f0430c8c26e6915f79365a49d8a4327c96'>build: initrd: Fix "write-cpio-archive" return value.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/build/linux-initrd.scm (write-cpio-archive): Really return OUTPUT on
success, even when compression is disabled.
</span></span></td><td>Maxim Cournoyer</td></tr>