https://sources.debian.org/data/main/p/plib/1.8.5-8/debian/patches/05_CVE-2012-4552.diff

diff -up plib-1.8.5/src/ssg/ssgParser.cxx~ plib-1.8.5/src/ssg/ssgParser.cxx
--- plib-1.8.5/src/ssg/ssgParser.cxx~	2008-03-11 03:06:23.000000000 +0100
+++ plib-1.8.5/src/ssg/ssgParser.cxx	2012-11-01 15:33:12.424483374 +0100
@@ -57,18 +57,16 @@ void _ssgParser::error( const char *form
   char msgbuff[ 255 ];
   va_list argp;
 
-  char* msgptr = msgbuff;
-  if (linenum)
-  {
-    msgptr += sprintf ( msgptr,"%s, line %d: ",
-      path, linenum );
-  }
-
   va_start( argp, format );
-  vsprintf( msgptr, format, argp );
+  vsnprintf( msgbuff, sizeof(msgbuff), format, argp );
   va_end( argp );
 
-  ulSetError ( UL_WARNING, "%s", msgbuff ) ;
+  if (linenum)
+  {
+    ulSetError ( UL_WARNING, "%s, line %d: %s", path, linenum, msgbuff ) ;
+  } else {
+    ulSetError ( UL_WARNING, "%s", msgbuff ) ;
+  }
 }
 
 
@@ -78,18 +76,16 @@ void _ssgParser::message( const char *fo
   char msgbuff[ 255 ];
   va_list argp;
 
-  char* msgptr = msgbuff;
-  if (linenum)
-  {
-    msgptr += sprintf ( msgptr,"%s, line %d: ",
-      path, linenum );
-  }
-
   va_start( argp, format );
-  vsprintf( msgptr, format, argp );
+  vsnprintf( msgbuff, sizeof(msgbuff), format, argp );
   va_end( argp );
 
-  ulSetError ( UL_DEBUG, "%s", msgbuff ) ;
+  if (linenum)
+  {
+    ulSetError ( UL_DEBUG, "%s, line %d: %s", path, linenum, msgbuff ) ;
+  } else {
+    ulSetError ( UL_DEBUG, "%s", msgbuff ) ;
+  }
 }
 
 // Opens the file and does a few internal calculations based on the spec.
method='get' action='/guix/log/gnu/packages/mate.scm'>
<input type='hidden' name='id' value='76fc8a53b21bc50017784d76ad06a449b832ab56'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=76fc8a53b21bc50017784d76ad06a449b832ab56'>root</a>/<a href='/guix/log/gnu?id=76fc8a53b21bc50017784d76ad06a449b832ab56'>gnu</a>/<a href='/guix/log/gnu/packages?id=76fc8a53b21bc50017784d76ad06a449b832ab56'>packages</a>/<a href='/guix/log/gnu/packages/mate.scm?id=76fc8a53b21bc50017784d76ad06a449b832ab56'>mate.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/gnu/packages/mate.scm?id=76fc8a53b21bc50017784d76ad06a449b832ab56&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2021-04-25 23:35:04 +0200'>2021-04-25</span></td><td><a href='/guix/commit/gnu/packages/mate.scm?id=c09e331b25e35dc435af67765a9bdb2e8f4aa296'>gnu: xfce, mate: Propagate 'font-dejavu'.</a><span class='msg-avail'>...<span class='msg-tooltip'>Fixes &lt;https://bugs.gnu.org/47713&gt;.
Reported by bo0od &lt;bo0od@riseup.net&gt;.

This ensures applications such as IceCat can properly text (numbers in
the case of IceCat).

* gnu/packages/enlightenment.scm (enlightenment)[propagated-inputs]: Add
FONT-DEJAVU.
* gnu/packages/mate.scm (mate)[propagated-inputs]: New field.
* gnu/packages/xfce.scm (xfce)[propagated-inputs]: New field.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2021-03-22 15:45:33 +0100'>2021-03-22</span></td><td><a href='/guix/commit/gnu/packages/mate.scm?id=ce995d520694c4898028415b9118d711f5bcf125'>gnu: mate-panel: Add missing inputs for Wayland support.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/packages/mate.scm (mate-panel)[inputs]: Add gtk-layer-shell and
wayland.
</span></span></td><td>Léo Le Bouter</td></tr>
<tr><td><span title='2021-03-17 23:10:19 +0100'>2021-03-17</span></td><td><a href='/guix/commit/gnu/packages/mate.scm?id=ce10e2b3e93476a89cf85838fa21bb8b54268b1f'>gnu: Use autoconf instead of autoconf-wrapper when possible.</a><span class='msg-avail'>...<span class='msg-tooltip'>This should reduce confusion on when to use the "autoconf"
package and when to use "autoconf-wrapper" instead in
package definitions.

Fixes &lt;https://bugs.gnu.org/46564&gt;.

* gnu/packages/autotools.scm (autoconf-wrapper):
  advise to use the "autoconf" package instead where
  possible.
* gnu/packages/game-development.scm (tsukundere)[native-inputs]:
  use "autoconf" instead of "autoconf-wrapper".
* gnu/packages/gimp.scm
  (glimpse)[native-inputs]: likewise.
  (gimp-resynthesizer)[native-inputs]: add comment on why
  "autoconf-wrapper" is used.
* gnu/packages/gnunet.scm (gnunet)[native-inputs]:
  use "autoconf" instead of "autoconf-wrapper".
* gnu/packages/gnupg.scm (signing-party)[native-inputs]:
  add comment on why "autoconf-wrapper" is used.
* gnu/packages/guile-xyz.scm
  (guile-bash,guile-filesystem,guile-ics,guile-udev)[native-inputs]:
  use "autoconf" instead of "autoconf-wrapper".
* gnu/packages/libevent.scm (libuv)[native-inputs]: indicates
  "autoconf-wrapper" needs to be replaced with "autoconf"
  on core-updates.
* gnu/packages/logging.scm (glog)[native-inputs]: use "autoconf"
  instead of "autoconf-wrapper".
* gnu/packages/mail.scm (libetpan)[native-inputs]: likewise.
* gnu/packages/mate.scm
  (mate-icon-theme-faenza)[native-inputs]: add comment on why
  "autoconf-wrapper" is used.
  (mate-screensaver)[native-inputs]: use "autoconf" instead of
  "autoconf-wrapper".
* gnu/packages/package-management.scm (guix)[native-inputs]: likewise.
* gnu/packages/sawfish.scm (librep)[native-inputs]: likewise.
* gnu/packages/video.scm (motion)[native-inputs]: likewise.
* gnu/packages/zile.scm (zile)[native-inputs]: likewise.

Signed-off-by: Ludovic Courtès &lt;ludo@gnu.org&gt;
</span></span></td><td>Maxime Devos</td></tr>
<tr><td><span title='2020-11-11 21:37:12 +0100'>2020-11-11</span></td><td><a href='/guix/commit/gnu/packages/mate.scm?id=3645716c56f6f3665a22c959438992aca0ea2e84'>gnu: caja-extensions: Remove unused input.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/packages/mate.scm (caja-extensions)[inputs]: Remove IMAGEMAGICK.
</span></span></td><td>Marius Bakke</td></tr>