Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/btcheck-2.1/src/check.h
Examining data/btcheck-2.1/src/hash.h
Examining data/btcheck-2.1/src/btcheck.h
Examining data/btcheck-2.1/src/hash.c
Examining data/btcheck-2.1/src/btree.h
Examining data/btcheck-2.1/src/info.c
Examining data/btcheck-2.1/src/btree.c
Examining data/btcheck-2.1/src/bencode.c
Examining data/btcheck-2.1/src/file.c
Examining data/btcheck-2.1/src/check.c
Examining data/btcheck-2.1/src/kernelcryptoapi.c
Examining data/btcheck-2.1/src/bdecode.c
Examining data/btcheck-2.1/src/bencode.h
Examining data/btcheck-2.1/src/list.c
Examining data/btcheck-2.1/src/kernelcryptoapi.h
Examining data/btcheck-2.1/src/meta.h
Examining data/btcheck-2.1/src/meta.c
Examining data/btcheck-2.1/src/btcheck.c
Examining data/btcheck-2.1/src/list.h
Examining data/btcheck-2.1/src/file.h
Examining data/btcheck-2.1/src/info.h
Examining data/btcheck-2.1/src/usage.h
Examining data/btcheck-2.1/src/bdecode.h
Examining data/btcheck-2.1/src/config.h
Examining data/btcheck-2.1/src/usage.c
FINAL RESULTS:
data/btcheck-2.1/src/file.c:209:6: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(stderr, ZeroFill ? "\rError file size too short, continue filling with zeros...\n" : "\rError file size too short, continue anyway...\n");
data/btcheck-2.1/src/file.c:214:6: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(stderr, ZeroFill ? "\rRead btfile error, continue filling with zeros...\n" : "\rRead btfile error, continue anyway...\n");
data/btcheck-2.1/src/info.c:159:2: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
printf(isprivate ? "Announce URL : %s (private)\n" : "Announce URL : %s\n", (char *)torrentannounce);
data/btcheck-2.1/src/info.c:164:2: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
printf(issinglefile ? "File Name : %s\n" : "Dir. Name : %s\n", (char *)torrentinfoname);
data/btcheck-2.1/src/info.c:165:2: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
printf(issinglefile ? "File Length : " LLD_FMT "\n" : "Total Length : " LLD_FMT "\n", (long long)torrentinfolength);
data/btcheck-2.1/src/meta.c:55:4: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(file, i == 0 ? "%s" : DIRSEP "%s", (char *)string);
data/btcheck-2.1/src/meta.c:95:8: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
ret = printf(format, (char *)string);
data/btcheck-2.1/src/btcheck.c:48:14: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while ((c = getopt(argc, argv, "hVvqnizl")) != EOF) {
data/btcheck-2.1/src/bencode.c:47:29: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
func(ctx, (int)((unsigned char *)string)[i]);
data/btcheck-2.1/src/btcheck.c:72:12: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
torrent = fopen(filename, "rb");
data/btcheck-2.1/src/btree.c:175:45: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
if (strlen((char *)attribute) == strlen((char *)info[0]) && strncmp((char *)attribute, (char *)info[0], strlen((char *)info[0])) == 0) {
data/btcheck-2.1/src/btree.c:175:73: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
if (strlen((char *)attribute) == strlen((char *)info[0]) && strncmp((char *)attribute, (char *)info[0], strlen((char *)info[0])) == 0) {
data/btcheck-2.1/src/btree.c:175:92: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
if (strlen((char *)attribute) == strlen((char *)info[0]) && strncmp((char *)attribute, (char *)info[0], strlen((char *)info[0])) == 0) {
data/btcheck-2.1/src/btree.c:175:116: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
if (strlen((char *)attribute) == strlen((char *)info[0]) && strncmp((char *)attribute, (char *)info[0], strlen((char *)info[0])) == 0) {
data/btcheck-2.1/src/check.c:34:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char digest[HASH_LENGTH];
data/btcheck-2.1/src/file.c:110:20: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
btfile->file = fopen(string, "rb");
data/btcheck-2.1/src/file.c:149:18: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
btfile->file = fopen(TorrentInfoName, "rb");
data/btcheck-2.1/src/file.c:166:19: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
btfile->dirfd = open(".", O_RDONLY);
data/btcheck-2.1/src/file.h:49:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char dirname[PATH_MAX];
data/btcheck-2.1/src/hash.c:111:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char pad[1] = { 0x80 };
data/btcheck-2.1/src/hash.c:112:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char null[1] = { 0x00 };
data/btcheck-2.1/src/hash.c:113:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char len[8];
data/btcheck-2.1/src/hash.c:358:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char data[1];
data/btcheck-2.1/src/hash.h:81:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char buffer[64]; \
data/btcheck-2.1/src/info.c:102:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char torrentdigest[HASH_LENGTH*2+1];
data/btcheck-2.1/src/kernelcryptoapi.c:31:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->sa.salg_type, "hash", sizeof("hash"));
data/btcheck-2.1/src/kernelcryptoapi.c:32:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->sa.salg_name, "sha1", sizeof("sha1"));
data/btcheck-2.1/src/meta.c:141:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char digest[HASH_LENGTH];
data/btcheck-2.1/src/bdecode.c:26:6: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c = fgetc(torrent);
data/btcheck-2.1/src/bencode.c:77:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
bencode_string(string, strlen((char *)string), func, ctx);
data/btcheck-2.1/src/btree.c:175:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen((char *)attribute) == strlen((char *)info[0]) && strncmp((char *)attribute, (char *)info[0], strlen((char *)info[0])) == 0) {
data/btcheck-2.1/src/btree.c:175:37: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen((char *)attribute) == strlen((char *)info[0]) && strncmp((char *)attribute, (char *)info[0], strlen((char *)info[0])) == 0) {
data/btcheck-2.1/src/btree.c:175:108: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen((char *)attribute) == strlen((char *)info[0]) && strncmp((char *)attribute, (char *)info[0], strlen((char *)info[0])) == 0) {
data/btcheck-2.1/src/file.c:49:9: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ret = fgetc(btfile->file);
data/btcheck-2.1/src/file.c:101:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(string) != 0)
data/btcheck-2.1/src/file.c:238:9: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ret = fgetc(btfile->file);
data/btcheck-2.1/src/info.c:53:44: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (ret == 0 && torrentcomment != NULL && strlen(torrentcomment) != 0)
data/btcheck-2.1/src/info.c:78:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int ret, strlen;
data/btcheck-2.1/src/info.c:82:53: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ret = get_btree_string(torrenturllist, &webseed, &strlen);
data/btcheck-2.1/src/info.c:84:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen > 0)
ANALYSIS SUMMARY:
Hits = 40
Lines analyzed = 2585 in approximately 0.12 seconds (21816 lines/second)
Physical Source Lines of Code (SLOC) = 1812
Hits@level = [0] 94 [1] 12 [2] 20 [3] 1 [4] 7 [5] 0
Hits@level+ = [0+] 134 [1+] 40 [2+] 28 [3+] 8 [4+] 7 [5+] 0
Hits/KSLOC@level+ = [0+] 73.9514 [1+] 22.0751 [2+] 15.4525 [3+] 4.41501 [4+] 3.86313 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.