>Number: 3355
>Category: apache-api
>Synopsis: ap_vformatter barfs on %n in log message
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: apache
>State: open
>Class: sw-bug
>Submitter-Id: apache
>Arrival-Date: Fri Nov 6 10:10:01 PST 1998
>Last-Modified:
>Originator: [EMAIL PROTECTED]
>Organization:
apache
>Release: 1.3.2
>Environment:
FreeBSD internal.accentonline.com 3.0-RELEASE FreeBSD 3.0-RELEASE #2: Thu Nov
5 19:26:38 EST 1998 [EMAIL PROTECTED]:/usr/src/sys/compile/CUSTOM i386
GCC 2.7.2.1
>Description:
I didn't actually do this.... call me lazy
>How-To-Repeat:
I encountered this using PHP and the log_error function, which eventually calls
ap_vsnprintf which calls ap_vformatter(). It doesn't croak too bad on other
escape sequences - just segfaults on %n.
>Fix:
My guess is a small check in the ap_vformatter() code around line 843 in
ap_snprintf.c would fix it:
case 'n':
*(va_arg(ap, int *)) = cc;
break;
I haven't spent enough time in this code to determine what the actual fix is,
but I imagine it's not too difficult.
This might be related to previous bug: 2941
>Audit-Trail:
>Unformatted:
[In order for any reply to be added to the PR database, ]
[you need to include <[EMAIL PROTECTED]> in the Cc line ]
[and leave the subject line UNCHANGED. This is not done]
[automatically because of the potential for mail loops. ]
[If you do not include this Cc, your reply may be ig- ]
[nored unless you are responding to an explicit request ]
[from a developer. ]
[Reply only with text; DO NOT SEND ATTACHMENTS! ]
