u-a: Fix possible segfault if master_file contains a format specifier

The input does not get sanitized, and as such the user could end up
registering a file containing format string specifiers, which would
make the pr() call most probably segfault trying to access an invalid
pointer.

Reported-by: Sandro Cazzaniga <cazzaniga.sandro@gmail.com>

debian/changelog

@@ -11,6 +11,9 @@ dpkg (1.15.8.5) UNRELEASED; urgency=low
     Thanks to The Fungi <fungi@yuggoth.org>. Closes: #593628
   * Add gettext plurals infrastructure support.
   * Add gettext messages for plural forms. Closes: #594218
+  * Fix possible but improbable segfault in update-alternatives in case
+    the master file name contains a format string specifier. Reported by
+    Sandro Cazzaniga.
 
   [ Raphaël Hertzog ]
   * Fix dpkg-genchanges to not split the short description in the middle of a

utils/update-alternatives.c

@@ -1412,7 +1412,7 @@ alternative_display_list(struct alternative *a)
 	struct fileset *fs;
 
 	for (fs = a->choices; fs; fs = fs->next)
-		pr(fs->master_file);
+		pr("%s", fs->master_file);
 }
 
 static const char *