Index: runtime/DebugRuntime/FormatStrings.cpp
===================================================================
--- runtime/DebugRuntime/FormatStrings.cpp	(revision 141271)
+++ runtime/DebugRuntime/FormatStrings.cpp	(working copy)
@@ -606,7 +606,7 @@
   // Print the resulting string if there was no error making it.
   //
   if (result < 0)
-    err(eval, message_error);
+    err(eval, "%s", message_error);
   else
     // This call exits the program; we can't free the allocated string.
     err(eval, "%.*s", result, p.output.alloced_string.string);
@@ -646,7 +646,7 @@
   // Print the resulting string if there was no error making it.
   //
   if (result < 0)
-    errx(eval, message_error);
+    errx(eval, "%s", message_error);
   else
     // This call exits the program; we can't free the allocated string.
     errx(eval, "%.*s", result, p.output.alloced_string.string);
@@ -689,7 +689,7 @@
   // Print and free the resulting string if there was no error making it.
   //
   if (result < 0)
-    warn(message_error);
+    warn("%s", message_error);
   else
   {
     warn("%.*s", result, p.output.alloced_string.string);
@@ -735,7 +735,7 @@
   // Print and free the resulting string if there was no error making it.
   //
   if (result < 0)
-    warnx(message_error);
+    warnx("%s", message_error);
   else
   {
     warnx("%.*s", result, p.output.alloced_string.string);
@@ -773,7 +773,7 @@
   // Print and free the resulting string if there was no error making it.
   //
   if (result < 0)
-    syslog(priority, message_error);
+    syslog(priority, "%s", message_error);
   else
   {
     syslog(priority, "%.*s", result, p.output.alloced_string.string);