开放源代码软件Apache 成熟度评估报告 - 开源中国社区- 软件镜像下载

Severity: HighIssue: sprintfCheck to be sure that the non-constant format string passed as argument 2to this function call does not come from an untrusted source that couldhave added formatting characters that the code is not prepared to handle.File: httpd-2.2.15//srclib/apr/test/testfmt.c Line:27[5] sprintf(buf, "%"APR_SSIZE_T_FMT, var);File: httpd-2.2.15//srclib/apr/test/testfmt.c Line:38[5]sprintf(buf, "%" APR_SIZE_T_FMT, var);File: httpd-2.2.15//srclib/apr/test/testfmt.c Line:49[5]sprintf(buf, "%" APR_OFF_T_FMT, var);File: httpd-2.2.15//srclib/apr/test/testfmt.c Line:60[5]sprintf(buf, "%" APR_PID_T_FMT, var);File: httpd-2.2.15//srclib/apr/test/testfmt.c Line:71[5]sprintf(buf, "%" APR_INT64_T_FMT, var);File: httpd-2.2.15//srclib/apr/test/testfmt.c Line:82[5]sprintf(buf, "%" APR_UINT64_T_FMT, var);File: httpd-2.2.15//srclib/apr/test/testfmt.c Line:93[5]sprintf(buf, "%" APR_UINT64_T_HEX_FMT, var);File: httpd-2.2.15//modules/dav/main/util_lock.c Line:120[9]sprintf(tmp, "%s" DEBUG_CR,File: httpd-2.2.15//modules/dav/fs/repos.c Line:1868[16](void) sprintf(buf, "%" APR_OFF_T_FMT, resource->info->finfo.size);Severity: HighIssue: vsprintfCheck to be sure that the non-constant format string passed as argument 2to this function call does not come from an untrusted source that couldhave added formatting characters that the code is not prepared to handle.File: httpd-2.2.15//srclib/apr/build/jlibtool.c Line:307[22] res =vsprintf( str, fmt, ap );Severity: HighIssue: vsprintfCheck to be sure that the format string passed as argument 2 to thisfunction call does not come from an untrusted source that could have addedformatting characters that the code is not prepared to handle.