Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/amavisd-milter-1.7.1/amavisd-milter/amavisd-milter.h Examining data/amavisd-milter-1.7.1/amavisd-milter/amavisd.c Examining data/amavisd-milter-1.7.1/amavisd-milter/log.c Examining data/amavisd-milter-1.7.1/amavisd-milter/mlfi.c Examining data/amavisd-milter-1.7.1/amavisd-milter/main.c Examining data/amavisd-milter-1.7.1/compat/compat.h Examining data/amavisd-milter-1.7.1/compat/daemon.c Examining data/amavisd-milter-1.7.1/compat/fts_compat.h Examining data/amavisd-milter-1.7.1/compat/fts_open.c Examining data/amavisd-milter-1.7.1/compat/mkdtemp.c Examining data/amavisd-milter-1.7.1/compat/read_sock.c Examining data/amavisd-milter-1.7.1/compat/strlcpy.c Examining data/amavisd-milter-1.7.1/compat/write_sock.c FINAL RESULTS: data/amavisd-milter-1.7.1/amavisd-milter/mlfi.c:590:13: [5] (race) chmod: This accepts filename arguments; if an attacker can move those files, a race condition results. (CWE-362). Use fchmod( ) instead. if (chmod(mlfi->mlfi_wrkdir, S_IRWXU|S_IRGRP|S_IXGRP) == -1) { data/amavisd-milter-1.7.1/amavisd-milter/log.c:47:16: [4] (format) vsnprintf: If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134). Use a constant for the format specification. (void) vsnprintf(buf, sizeof(buf), fmt, ap); data/amavisd-milter-1.7.1/amavisd-milter/log.c:73:12: [4] (format) vsnprintf: If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134). Use a constant for the format specification. (void) vsnprintf(buf, sizeof(buf), fmt, ap); data/amavisd-milter-1.7.1/amavisd-milter/main.c:100:12: [4] (format) vsnprintf: If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134). Use a constant for the format specification. (void) vsnprintf(buf, sizeof(buf), fmt, ap); data/amavisd-milter-1.7.1/amavisd-milter/mlfi.c:104:20: [4] (format) vsnprintf: If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134). Use a constant for the format specification. if ((length += vsnprintf(buf + length, size - length, fmt, ap)) >= size) { data/amavisd-milter-1.7.1/amavisd-milter/mlfi.c:637:13: [4] (format) snprintf: If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134). Use a constant for the format specification. if (snprintf(buf, sizeof(buf), data/amavisd-milter-1.7.1/amavisd-milter/main.c:148:17: [3] (buffer) getopt: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. while ((c = getopt(argc, argv, args)) != EOF) { data/amavisd-milter-1.7.1/compat/mkdtemp.c:86:10: [3] (random) random: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. pid = (random() & 0xffff) % (26+26); data/amavisd-milter-1.7.1/amavisd-milter/amavisd-milter.h:50:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char q_paddr[1]; /* recipient */ data/amavisd-milter-1.7.1/amavisd-milter/amavisd-milter.h:66:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char mlfi_wrkdir[MAXPATHLEN];/* working directory */ data/amavisd-milter-1.7.1/amavisd-milter/amavisd-milter.h:67:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char mlfi_fname[MAXPATHLEN]; /* mail file name */ data/amavisd-milter-1.7.1/amavisd-milter/log.c:40:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[MAXLOGBUF]; data/amavisd-milter-1.7.1/amavisd-milter/log.c:67:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[MAXLOGBUF]; data/amavisd-milter-1.7.1/amavisd-milter/main.c:95:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[MAXLOGBUF]; data/amavisd-milter-1.7.1/amavisd-milter/main.c:414:14: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fp = fopen(pid_file, "w"); data/amavisd-milter-1.7.1/amavisd-milter/mlfi.c:510:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[64]; data/amavisd-milter-1.7.1/amavisd-milter/mlfi.c:603:26: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if ((mlfi->mlfi_fp = fopen(mlfi->mlfi_fname, "w+")) == NULL) { data/amavisd-milter-1.7.1/compat/daemon.c:65:24: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if (!noclose && (fd = open(_PATH_DEVNULL, O_RDWR, 0)) != -1) { data/amavisd-milter-1.7.1/compat/fts_compat.h:132:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char fts_name[1]; /* file name */ data/amavisd-milter-1.7.1/compat/fts_open.c:171:22: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if ((sp->fts_rfd = open(".", O_RDONLY, 0)) == -1) data/amavisd-milter-1.7.1/compat/fts_open.c:321:24: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if ((p->fts_symfd = open(".", O_RDONLY, 0)) == -1) { data/amavisd-milter-1.7.1/compat/fts_open.c:415:9: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). open(".", O_RDONLY, 0)) == -1) { data/amavisd-milter-1.7.1/compat/fts_open.c:556:12: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if ((fd = open(".", O_RDONLY, 0)) == -1) data/amavisd-milter-1.7.1/compat/fts_open.c:1136:25: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if (oldfd < 0 && (fd = open(path, O_RDONLY)) == -1) data/amavisd-milter-1.7.1/compat/mkdtemp.c:122:8: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). open(path, O_CREAT|O_EXCL|O_RDWR, 0600)) >= 0) data/amavisd-milter-1.7.1/amavisd-milter/main.c:243:17: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(optarg) >= sizeof(unix_addr.sun_path) - 1) { data/amavisd-milter-1.7.1/amavisd-milter/main.c:281:17: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(optarg) >= sizeof(unix_addr.sun_path) - 1) { data/amavisd-milter-1.7.1/amavisd-milter/main.c:413:22: [1] (access) umask: Ensure that umask is given most restrictive possible setting (e.g., 066 or 077) (CWE-732). save_umask = umask(022); data/amavisd-milter-1.7.1/amavisd-milter/main.c:430:9: [1] (access) umask: Ensure that umask is given most restrictive possible setting (e.g., 066 or 077) (CWE-732). umask(save_umask); data/amavisd-milter-1.7.1/amavisd-milter/mlfi.c:789:15: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). rcptlen = strlen(*envrcpt); data/amavisd-milter-1.7.1/compat/fts_open.c:117:14: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if ((len = strlen(*argv)) == 0) { data/amavisd-milter-1.7.1/compat/fts_open.c:207:9: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). len = strlen(++cp); data/amavisd-milter-1.7.1/compat/fts_open.c:700:13: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). dnamlen = strlen(dp->d_name); data/amavisd-milter-1.7.1/compat/fts_open.c:1117:14: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if ((len = strlen(*argv)) > max) data/amavisd-milter-1.7.1/compat/read_sock.c:87:13: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). m = read(sd, b, nbytes - n); ANALYSIS SUMMARY: Hits = 35 Lines analyzed = 4536 in approximately 0.15 seconds (30469 lines/second) Physical Source Lines of Code (SLOC) = 3109 Hits@level = [0] 34 [1] 10 [2] 17 [3] 2 [4] 5 [5] 1 Hits@level+ = [0+] 69 [1+] 35 [2+] 25 [3+] 8 [4+] 6 [5+] 1 Hits/KSLOC@level+ = [0+] 22.1936 [1+] 11.2576 [2+] 8.04117 [3+] 2.57317 [4+] 1.92988 [5+] 0.321647 Dot directories skipped = 2 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.