开放源代码软件Apache 成熟度评估报告 - 开源中国社区- 软件镜像下载

Severity: High Issue:getpassTruncate all input strings to a reasonable length before passing them tothis functionFile: httpd-2.2.15//srclib/apr/passwd/apr_getpass.c Line:232[20]char *pw_got = getpass(prompt);Severity: HighIssue: EnterCriticalSectionThis function can throw exceptions in low memory conditions. UseInitialCriticalSectionAndSpinCount instead.File: httpd-2.2.15//srclib/apr/threadproc/win32/proc.c Line:791[9]EnterCriticalSection(&proc_lock);File: httpd-2.2.15//srclib/apr/locks/win32/thread_mutex.c Line:85[9]EnterCriticalSection(&mutex->section);File: httpd-2.2.15//srclib/apr/locks/win32/thread_cond.c Line:73[5]EnterCriticalSection(&cond->csection);File: httpd-2.2.15//srclib/apr/locks/win32/thread_cond.c Line:83[9]EnterCriticalSection(&cond->csection);File: httpd-2.2.15//srclib/apr/locks/win32/thread_cond.c Line:134[5]EnterCriticalSection(&cond->csection);File: httpd-2.2.15//srclib/apr/locks/win32/thread_cond.c Line:153[5]EnterCriticalSection(&cond->csection);File: httpd-2.2.15//support/win32/ApacheMonitor.c Line:1550[13]EnterCriticalSection(&g_stcSection);File: httpd-2.2.15//support/win32/ApacheMonitor.c Line:1577[13]EnterCriticalSection(&g_stcSection);Severity: HighIssue: gethostbyaddrDNS results can easily be forged by an attacker (or arbitrarily set tolarge values, etc), and should not be trusted.File: httpd-2.2.15//srclib/apr/network_io/unix/sockaddr.cLine:690[12]hptr = gethostbyaddr((char *)&sockaddr->sa.sin.sin_addr, File:httpd-2.2.15//support/logresolve.c Line:175[20] hostdata =gethostbyaddr((const char *) &ipnum, sizeof(struct in_addr),