Description: use a string literal for the format argument in mvwprintw calls
Author: Andreas Beckmann <anbe@debian.org>
Bug: http://bugs.debian.org/997186
Forwarded: no
Last-Update: 2021-10-30

--- a/ncurses/n_nast.c
+++ b/ncurses/n_nast.c
@@ -683,7 +683,7 @@ void title(void)
    title = subwin(stdscr,3,COLS,0,0);
    wbkgd(title,COLOR_PAIR(1));
    box(title,0,0);
-   mvwprintw(title,1,(COLS-sizeof(TITLE))/2, TITLE);
+   mvwprintw(title,1,(COLS-sizeof(TITLE))/2, "%s", TITLE);
    wrefresh(title);
 }
 
@@ -790,7 +790,7 @@ void pop_up_win(void)
    pop_up = newwin(17,55,(LINES-17)/2,(COLS-55)/2);
    wbkgd(pop_up,COLOR_PAIR(4));
    box(pop_up,0,0);
-   mvwprintw(pop_up,0,(55 -strlen(message))/2, message);
+   mvwprintw(pop_up,0,(55 -strlen(message))/2, "%s", message);
    wrefresh(pop_up);
 }
 
@@ -801,7 +801,7 @@ void help_win(void)
    help = newwin(23,67,(LINES-23)/2,(COLS-67)/2);
    wbkgd(help,COLOR_PAIR(4));
    box(help,0,0);
-   mvwprintw(help,0,(67 -strlen(message))/2, message);
+   mvwprintw(help,0,(67 -strlen(message))/2, "%s", message);
    wrefresh(help);
 }
 
