Fix -Wformat-security issues

Ensure that methods with a printf()-like format string
are invoked with a literal string instead of a string
built from possibly untrusted sources.

Fixes issue #1906.

1 files changed, 3 insertions, 3 deletions

diff --git a/TAO/orbsvcs/ImplRepo_Service/ImR_Activator_i.cpp b/TAO/orbsvcs/ImplRepo_Service/ImR_Activator_i.cpp
index ab2e06d5c0f..e605c547c89 100644
--- a/TAO/orbsvcs/ImplRepo_Service/ImR_Activator_i.cpp
+++ b/TAO/orbsvcs/ImplRepo_Service/ImR_Activator_i.cpp
@@ -537,7 +537,7 @@ ImR_Activator_i::start_server(const char* name,
                                  1,
                                  cmdline_buf_len + 1,
                                  this->env_buf_len_, this->max_env_vars_);
-  proc_opts.command_line (ACE_TEXT_CHAR_TO_TCHAR(cmdline));
+  proc_opts.command_line (ACE_TEXT("%s"), ACE_TEXT_CHAR_TO_TCHAR(cmdline));
   proc_opts.working_directory (dir);
   // Win32 does not support the CLOSE_ON_EXEC semantics for sockets
   // the way unix does, so in order to avoid having the child process
@@ -564,13 +564,13 @@ ImR_Activator_i::start_server(const char* name,
     {
       CORBA::String_var ior = orb_->object_to_string (locator_.in ());
       proc_opts.setenv (ACE_TEXT ("ImplRepoServiceIOR"),
-                        ACE_TEXT_CHAR_TO_TCHAR (ior.in ()));
+                        ACE_TEXT ("%s"), ACE_TEXT_CHAR_TO_TCHAR (ior.in ()));
     }
 
   for (CORBA::ULong i = 0; i < env.length (); ++i)
     {
       proc_opts.setenv (ACE_TEXT_CHAR_TO_TCHAR (env[i].name.in ()),
-                        ACE_TEXT_CHAR_TO_TCHAR (env[i].value.in ()));
+                        ACE_TEXT ("%s"), ACE_TEXT_CHAR_TO_TCHAR (env[i].value.in ()));
     }
 
   pid = this->process_mgr_.spawn (proc_opts, this);