printf() arguments shouldn't be passed straight from user supplied data.

(Security thingy.)

diff --git a/coreutils/ln.c b/coreutils/ln.c
index 6751e909384c0e447c50e00c023112480a995397..dcb70d40f6fb2dae6e119952eae4dfe0231b5d4b 100644 (file)
--- a/coreutils/ln.c
+++ b/coreutils/ln.c
@@ -106,7 +106,7 @@ extern int ln_main(int argc, char **argv)
                }
 
                if (link_func(*argv, src) != 0) {
-                       bb_perror_msg(src);
+                       bb_perror_msg("%s", src);
                        status = EXIT_FAILURE;
                }