https://sources.debian.org/data/main/p/plib/1.8.5-8/debian/patches/05_CVE-2012-4552.diff

diff -up plib-1.8.5/src/ssg/ssgParser.cxx~ plib-1.8.5/src/ssg/ssgParser.cxx
--- plib-1.8.5/src/ssg/ssgParser.cxx~	2008-03-11 03:06:23.000000000 +0100
+++ plib-1.8.5/src/ssg/ssgParser.cxx	2012-11-01 15:33:12.424483374 +0100
@@ -57,18 +57,16 @@ void _ssgParser::error( const char *form
   char msgbuff[ 255 ];
   va_list argp;
 
-  char* msgptr = msgbuff;
-  if (linenum)
-  {
-    msgptr += sprintf ( msgptr,"%s, line %d: ",
-      path, linenum );
-  }
-
   va_start( argp, format );
-  vsprintf( msgptr, format, argp );
+  vsnprintf( msgbuff, sizeof(msgbuff), format, argp );
   va_end( argp );
 
-  ulSetError ( UL_WARNING, "%s", msgbuff ) ;
+  if (linenum)
+  {
+    ulSetError ( UL_WARNING, "%s, line %d: %s", path, linenum, msgbuff ) ;
+  } else {
+    ulSetError ( UL_WARNING, "%s", msgbuff ) ;
+  }
 }
 
 
@@ -78,18 +76,16 @@ void _ssgParser::message( const char *fo
   char msgbuff[ 255 ];
   va_list argp;
 
-  char* msgptr = msgbuff;
-  if (linenum)
-  {
-    msgptr += sprintf ( msgptr,"%s, line %d: ",
-      path, linenum );
-  }
-
   va_start( argp, format );
-  vsprintf( msgptr, format, argp );
+  vsnprintf( msgbuff, sizeof(msgbuff), format, argp );
   va_end( argp );
 
-  ulSetError ( UL_DEBUG, "%s", msgbuff ) ;
+  if (linenum)
+  {
+    ulSetError ( UL_DEBUG, "%s, line %d: %s", path, linenum, msgbuff ) ;
+  } else {
+    ulSetError ( UL_DEBUG, "%s", msgbuff ) ;
+  }
 }
 
 // Opens the file and does a few internal calculations based on the spec.
 action='/guix/log/tests/guix-graph.sh'>
<input type='hidden' name='id' value='0b666b56247724d6beff696ee342e8bf00b76cb8'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=0b666b56247724d6beff696ee342e8bf00b76cb8'>root</a>/<a href='/guix/log/tests?id=0b666b56247724d6beff696ee342e8bf00b76cb8'>tests</a>/<a href='/guix/log/tests/guix-graph.sh?id=0b666b56247724d6beff696ee342e8bf00b76cb8'>guix-graph.sh</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/tests/guix-graph.sh?id=0b666b56247724d6beff696ee342e8bf00b76cb8&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2022-01-16 23:56:56 +0100'>2022-01-16</span></td><td><a href='/guix/commit/tests/guix-graph.sh?id=a1037aa87b39d4c774fe398fc97a58bafeb063d1'>tests: Clean up after 'tests/guix-graph.sh'.</a><span class='msg-avail'>...<span class='msg-tooltip'>Fixes a regression introduced in
a773c3142dd168e1c4480614d3f5fd9d003954cd, which would lead the first
'trap' to be ignored, thereby leaving 't-guix-graph-*' directories
behind it.

* tests/guix-graph.sh: Remove first 'trap' line that had no effect;
replace second 'trap' line.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2020-09-28 21:06:36 -0500'>2020-09-28</span></td><td><a href='/guix/commit/tests/guix-graph.sh?id=d8934360d2453a403b5433e71d09188e4ed23b57'>tests: Simplify shell exit status negation;</a><span class='msg-avail'>...<span class='msg-tooltip'>* tests/guix-archive.sh, tests/guix-build-branch.sh, tests/guix-build.sh,
tests/guix-daemon.sh, tests/guix-download.sh, tests/guix-environment.sh,
tests/guix-gc.sh, tests/guix-git-authenticate.sh, tests/guix-graph.sh,
tests/guix-hash.sh, tests/guix-lint.sh, tests/guix-pack-relocatable.sh,
tests/guix-pack.sh, tests/guix-package-aliases.sh, tests/guix-package-net.sh,
tests/guix-package.sh: Use the shell '!' keyword to negate command exit status
in place of 'if ...; then false; else true; fi'
</span></span></td><td>Eric Bavier</td></tr>
<tr><td><span title='2020-05-11 23:30:55 +0200'>2020-05-11</span></td><td><a href='/guix/commit/tests/guix-graph.sh?id=88a96c568c47c97d05d883ada5afbc4e1200b10f'>guix graph: Add '--path'.</a><span class='msg-avail'>...<span class='msg-tooltip'>* guix/scripts/graph.scm (display-path): New procedure.
(%options, show-help): Add '--path'.
(guix-graph): Handle it.
* tests/guix-graph.sh: Add tests.
* doc/guix.texi (Invoking guix graph): Document it.
(Invoking guix size): Mention it.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2020-01-16 15:27:20 +0100'>2020-01-16</span></td><td><a href='/guix/commit/tests/guix-graph.sh?id=ee9a735bc8f544cf8eedc6c6a7e4ed2962663013'>graph: Add '--load-path' option.</a><span class='msg-avail'>...<span class='msg-tooltip'>* guix/scripts/graph.scm (%option): Add '--load-path' option.
* doc/guix.texi: Document it.
* tests/guix-graph.sh: Test it.
</span></span></td><td>Pierre Neidhardt</td></tr>
<tr><td><span title='2019-11-07 18:39:55 +0100'>2019-11-07</span></td><td><a href='/guix/commit/tests/guix-graph.sh?id=3e962e59d849e4300e447d94487684102d9d412e'>graph: Support package transformation options.</a><span class='msg-avail'>...<span class='msg-tooltip'>* guix/scripts/graph.scm (%options): Append %TRANSFORMATION-OPTIONS.
(show-help): Call 'show-transformation-options-help'.
(guix-graph): Call 'options-&gt;transformation' and use it.
* tests/guix-graph.sh: Add test.
* doc/guix.texi (Invoking guix graph): Document it.
</span></span></td><td>Ludovic Courtès</td></tr>