Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/civetweb-1.13+dfsg/conan/test_package/test_package.cpp
Examining data/civetweb-1.13+dfsg/examples/embedded_c/embedded_c.c
Examining data/civetweb-1.13+dfsg/examples/embedded_cpp/embedded_cpp.cpp
Examining data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c
Examining data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.h
Examining data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON_Utils.c
Examining data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON_Utils.h
Examining data/civetweb-1.13+dfsg/examples/rest/rest.c
Examining data/civetweb-1.13+dfsg/examples/ws_client/ws_client.c
Examining data/civetweb-1.13+dfsg/fuzztest/fuzzmain.c
Examining data/civetweb-1.13+dfsg/include/CivetServer.h
Examining data/civetweb-1.13+dfsg/include/civetweb.h
Examining data/civetweb-1.13+dfsg/src/CivetServer.cpp
Examining data/civetweb-1.13+dfsg/src/civetweb_private_lua.h
Examining data/civetweb-1.13+dfsg/src/main.c
Examining data/civetweb-1.13+dfsg/src/civetweb.c
Examining data/civetweb-1.13+dfsg/unittest/cgi_test.c
Examining data/civetweb-1.13+dfsg/unittest/civetweb_check.h
Examining data/civetweb-1.13+dfsg/unittest/main.c
Examining data/civetweb-1.13+dfsg/unittest/private.c
Examining data/civetweb-1.13+dfsg/unittest/private.h
Examining data/civetweb-1.13+dfsg/unittest/private_exe.c
Examining data/civetweb-1.13+dfsg/unittest/private_exe.h
Examining data/civetweb-1.13+dfsg/unittest/public_func.c
Examining data/civetweb-1.13+dfsg/unittest/public_func.h
Examining data/civetweb-1.13+dfsg/unittest/public_server.c
Examining data/civetweb-1.13+dfsg/unittest/public_server.h
Examining data/civetweb-1.13+dfsg/unittest/shared.c
Examining data/civetweb-1.13+dfsg/unittest/shared.h
Examining data/civetweb-1.13+dfsg/unittest/testclient.c
Examining data/civetweb-1.13+dfsg/unittest/timertest.c
Examining data/civetweb-1.13+dfsg/unittest/timertest.h
FINAL RESULTS:
data/civetweb-1.13+dfsg/examples/embedded_c/embedded_c.c:773:4: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(stderr, \
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON_Utils.c:214:17: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf((char*)full_pointer, "/%lu%s", (unsigned long)child_index, target_pointer); /* /<array_index><path> */
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON_Utils.c:225:17: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat((char*)full_pointer, (char*)target_pointer);
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON_Utils.c:1095:9: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf((char*)full_path, "%s/", (const char*)path);
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON_Utils.c:1161:17: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf((char*)new_path, "%s/%lu", path, (unsigned long)index); /* path of the current array element */
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON_Utils.c:1221:21: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf((char*)new_path, "%s/", path);
data/civetweb-1.13+dfsg/examples/ws_client/ws_client.c:257:4: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(txt,
data/civetweb-1.13+dfsg/examples/ws_client/ws_client.c:277:5: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(txt,
data/civetweb-1.13+dfsg/examples/ws_client/ws_client.c:312:3: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(txt,
data/civetweb-1.13+dfsg/include/civetweb.h:891:49: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
#define PRINTF_ARGS(x, y) __attribute__((format(printf, x, y)))
data/civetweb-1.13+dfsg/src/civetweb.c:274:33: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
if ((void *)this_fn != (void *)printf) {
data/civetweb-1.13+dfsg/src/civetweb.c:282:33: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
if ((void *)this_fn != (void *)printf) {
data/civetweb-1.13+dfsg/src/civetweb.c:629:9: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
#define access _access
data/civetweb-1.13+dfsg/src/civetweb.c:633:14: [4] (shell) popen:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
#if !defined(popen)
data/civetweb-1.13+dfsg/src/civetweb.c:634:9: [4] (shell) popen:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
#define popen(x, y) (_popen(x, y))
data/civetweb-1.13+dfsg/src/civetweb.c:878:24: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
#define vsnprintf_impl vsnprintf
data/civetweb-1.13+dfsg/src/civetweb.c:1214:9: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
#define access(x, a) 1 /* not required anyway */
data/civetweb-1.13+dfsg/src/civetweb.c:1472:2: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(mallocStr,
data/civetweb-1.13+dfsg/src/civetweb.c:1522:3: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(mallocStr,
data/civetweb-1.13+dfsg/src/civetweb.c:1567:5: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(mallocStr,
data/civetweb-1.13+dfsg/src/civetweb.c:1580:5: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(mallocStr,
data/civetweb-1.13+dfsg/src/civetweb.c:1685:13: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
#if defined(snprintf)
data/civetweb-1.13+dfsg/src/civetweb.c:1686:8: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
#undef snprintf
data/civetweb-1.13+dfsg/src/civetweb.c:1688:13: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
#if defined(vsnprintf)
data/civetweb-1.13+dfsg/src/civetweb.c:1689:8: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
#undef vsnprintf
data/civetweb-1.13+dfsg/src/civetweb.c:1695:9: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
#define snprintf DO_NOT_USE_THIS_FUNCTION__USE_mg_snprintf
data/civetweb-1.13+dfsg/src/civetweb.c:1699:9: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
#define vsnprintf DO_NOT_USE_THIS_FUNCTION__USE_mg_vsnprintf
data/civetweb-1.13+dfsg/src/civetweb.c:1855:2: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
vfprintf(DEBUG_TRACE_STREAM, fmt, args);
data/civetweb-1.13+dfsg/src/civetweb.c:2512:24: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
struct mg_file_access access;
data/civetweb-1.13+dfsg/src/civetweb.c:3484:9: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
filep->access.fp = NULL;
data/civetweb-1.13+dfsg/src/civetweb.c:3505:11: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
filep->access.fp = _wfopen(wbuf, L"rb");
data/civetweb-1.13+dfsg/src/civetweb.c:3508:11: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
filep->access.fp = _wfopen(wbuf, L"wb");
data/civetweb-1.13+dfsg/src/civetweb.c:3511:11: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
filep->access.fp = _wfopen(wbuf, L"ab");
data/civetweb-1.13+dfsg/src/civetweb.c:3519:10: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
filep->access.fp = fopen(path, "r");
data/civetweb-1.13+dfsg/src/civetweb.c:3522:10: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
filep->access.fp = fopen(path, "w");
data/civetweb-1.13+dfsg/src/civetweb.c:3525:10: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
filep->access.fp = fopen(path, "a");
data/civetweb-1.13+dfsg/src/civetweb.c:3539:17: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
return (filep->access.fp != NULL);
data/civetweb-1.13+dfsg/src/civetweb.c:3983:8: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fi.access.fp = NULL;
data/civetweb-1.13+dfsg/src/civetweb.c:3986:7: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fi.access.fp = NULL;
data/civetweb-1.13+dfsg/src/civetweb.c:3989:10: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (fi.access.fp != NULL) {
data/civetweb-1.13+dfsg/src/civetweb.c:3990:17: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
flockfile(fi.access.fp);
data/civetweb-1.13+dfsg/src/civetweb.c:3994:15: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fprintf(fi.access.fp,
data/civetweb-1.13+dfsg/src/civetweb.c:4000:16: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fprintf(fi.access.fp,
data/civetweb-1.13+dfsg/src/civetweb.c:4008:15: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fprintf(fi.access.fp, "%s", buf);
data/civetweb-1.13+dfsg/src/civetweb.c:4009:19: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fputc('\n', fi.access.fp);
data/civetweb-1.13+dfsg/src/civetweb.c:4010:14: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fflush(fi.access.fp);
data/civetweb-1.13+dfsg/src/civetweb.c:4011:19: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
funlockfile(fi.access.fp);
data/civetweb-1.13+dfsg/src/civetweb.c:4012:24: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
(void)mg_fclose(&fi.access); /* Ignore errors. We can't call
data/civetweb-1.13+dfsg/src/civetweb.c:6067:26: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
(void)mg_fclose(&file.access); /* ignore error on read only file */
data/civetweb-1.13+dfsg/src/civetweb.c:6362:11: [4] (shell) execle:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
(void)execle(prog, prog, NULL, envp);
data/civetweb-1.13+dfsg/src/civetweb.c:6374:12: [4] (shell) execle:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
(void)execle(interp, interp, interp_args, prog, NULL, envp);
data/civetweb-1.13+dfsg/src/civetweb.c:6376:12: [4] (shell) execle:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
(void)execle(interp, interp, prog, NULL, envp);
data/civetweb-1.13+dfsg/src/civetweb.c:8890:13: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (filep->access.fp != NULL) {
data/civetweb-1.13+dfsg/src/civetweb.c:8891:39: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
return fgets(buf, (int)size, filep->access.fp);
data/civetweb-1.13+dfsg/src/civetweb.c:8964:14: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
&fp.access); /* ignore error on read only file */
data/civetweb-1.13+dfsg/src/civetweb.c:9075:18: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
mg_fclose(&file.access);
data/civetweb-1.13+dfsg/src/civetweb.c:9120:28: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (!is_file_opened(&file.access)) {
data/civetweb-1.13+dfsg/src/civetweb.c:9124:27: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (is_file_opened(&file.access)) {
data/civetweb-1.13+dfsg/src/civetweb.c:9126:25: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
(void)mg_fclose(&file.access); /* ignore error on read only file */
data/civetweb-1.13+dfsg/src/civetweb.c:9211:26: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
(void)mg_fclose(&file.access); /* ignore error on read only file */
data/civetweb-1.13+dfsg/src/civetweb.c:9279:2: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(tmp, fname);
data/civetweb-1.13+dfsg/src/civetweb.c:10097:24: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (len > 0 && filep->access.fp != NULL) {
data/civetweb-1.13+dfsg/src/civetweb.c:10106:32: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
int sf_file = fileno(filep->access.fp);
data/civetweb-1.13+dfsg/src/civetweb.c:10143:38: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if ((offset > 0) && (fseeko(filep->access.fp, offset, SEEK_SET) != 0)) {
data/civetweb-1.13+dfsg/src/civetweb.c:10163:57: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
(int)fread(buf, 1, (size_t)to_read, filep->access.fp))
data/civetweb-1.13+dfsg/src/civetweb.c:10185:9: [4] (buffer) sscanf:
The scanf() family's %s operation, without a limit specification, permits
buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
different input function. If the scanf format is influenceable by an
attacker, it's exploitable.
return sscanf(header, "bytes=%" INT64_FMT "-%" INT64_FMT, a, b);
data/civetweb-1.13+dfsg/src/civetweb.c:10339:25: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fclose_on_exec(&filep->access, conn);
data/civetweb-1.13+dfsg/src/civetweb.c:10356:16: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
&filep->access); /* ignore error on read only file */
data/civetweb-1.13+dfsg/src/civetweb.c:10475:26: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
(void)mg_fclose(&filep->access); /* ignore error on read only file */
data/civetweb-1.13+dfsg/src/civetweb.c:10486:23: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fclose_on_exec(&file.access, conn);
data/civetweb-1.13+dfsg/src/civetweb.c:10488:24: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
(void)mg_fclose(&file.access); /* Ignore errors for readonly files */
data/civetweb-1.13+dfsg/src/civetweb.c:10680:43: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
n = (int)fwrite(buf, 1, (size_t)ret, fi.access.fp);
data/civetweb-1.13+dfsg/src/civetweb.c:10683:12: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
&fi.access); /* File is bad and will be removed anyway. */
data/civetweb-1.13+dfsg/src/civetweb.c:10694:20: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (mg_fclose(&fi.access) != 0) {
data/civetweb-1.13+dfsg/src/civetweb.c:11740:7: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fout.access.fp = out;
data/civetweb-1.13+dfsg/src/civetweb.c:12014:8: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (access(path, W_OK) == 0) {
data/civetweb-1.13+dfsg/src/civetweb.c:12072:14: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
|| file.access.fp == NULL) {
data/civetweb-1.13+dfsg/src/civetweb.c:12073:25: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
(void)mg_fclose(&file.access);
data/civetweb-1.13+dfsg/src/civetweb.c:12082:23: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fclose_on_exec(&file.access, conn);
data/civetweb-1.13+dfsg/src/civetweb.c:12087:15: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fseeko(file.access.fp, r1, SEEK_SET);
data/civetweb-1.13+dfsg/src/civetweb.c:12090:36: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (!forward_body_data(conn, file.access.fp, INVALID_SOCKET, NULL)) {
data/civetweb-1.13+dfsg/src/civetweb.c:12094:25: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
(void)mg_fclose(&file.access);
data/civetweb-1.13+dfsg/src/civetweb.c:12098:22: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (mg_fclose(&file.access) != 0) {
data/civetweb-1.13+dfsg/src/civetweb.c:12142:6: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (access(path, W_OK) != 0) {
data/civetweb-1.13+dfsg/src/civetweb.c:12250:24: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fclose_on_exec(&file.access, conn);
data/civetweb-1.13+dfsg/src/civetweb.c:12257:25: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
(void)mg_fclose(&file.access); /* Ignore errors for readonly files */
data/civetweb-1.13+dfsg/src/civetweb.c:12273:13: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if ((file.access.fp = popen(cmd, "r")) == NULL) {
data/civetweb-1.13+dfsg/src/civetweb.c:12273:25: [4] (shell) popen:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
if ((file.access.fp = popen(cmd, "r")) == NULL) {
data/civetweb-1.13+dfsg/src/civetweb.c:12280:16: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
pclose(file.access.fp);
data/civetweb-1.13+dfsg/src/civetweb.c:12294:13: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (filep->access.fp != NULL) {
data/civetweb-1.13+dfsg/src/civetweb.c:12295:23: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
return fgetc(filep->access.fp);
data/civetweb-1.13+dfsg/src/civetweb.c:12444:26: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fclose_on_exec(&filep->access, conn);
data/civetweb-1.13+dfsg/src/civetweb.c:12458:27: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
(void)mg_fclose(&filep->access); /* Ignore errors for readonly files */
data/civetweb-1.13+dfsg/src/civetweb.c:15448:7: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fi.access.fp = NULL;
data/civetweb-1.13+dfsg/src/civetweb.c:15451:6: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fi.access.fp = NULL;
data/civetweb-1.13+dfsg/src/civetweb.c:15456:10: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if ((fi.access.fp == NULL)
data/civetweb-1.13+dfsg/src/civetweb.c:15497:9: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (fi.access.fp) {
data/civetweb-1.13+dfsg/src/civetweb.c:15499:16: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
flockfile(fi.access.fp);
data/civetweb-1.13+dfsg/src/civetweb.c:15500:18: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (fprintf(fi.access.fp, "%s\n", buf) < 1) {
data/civetweb-1.13+dfsg/src/civetweb.c:15503:17: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (fflush(fi.access.fp) != 0) {
data/civetweb-1.13+dfsg/src/civetweb.c:15506:18: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
funlockfile(fi.access.fp);
data/civetweb-1.13+dfsg/src/civetweb.c:15507:21: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (mg_fclose(&fi.access) != 0) {
data/civetweb-1.13+dfsg/src/civetweb.c:19414:2: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(name,
data/civetweb-1.13+dfsg/src/civetweb.c:20356:4: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(*dst, src);
data/civetweb-1.13+dfsg/src/civetweb.c:20689:3: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(append_eoobj, eoobj);
data/civetweb-1.13+dfsg/src/civetweb.c:20883:3: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(append_eoobj, eoobj);
data/civetweb-1.13+dfsg/src/civetweb.c:21141:3: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(append_eoobj, eoobj);
data/civetweb-1.13+dfsg/src/main.c:102:8: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
#undef printf
data/civetweb-1.13+dfsg/src/main.c:103:9: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
#define printf \
data/civetweb-1.13+dfsg/src/main.c:130:9: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
#define snprintf _snprintf
data/civetweb-1.13+dfsg/src/main.c:130:18: [4] (format) _snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
#define snprintf _snprintf
data/civetweb-1.13+dfsg/src/main.c:131:9: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
#define vsnprintf _vsnprintf
data/civetweb-1.13+dfsg/src/main.c:257:8: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
(void)vsnprintf(msg, sizeof(msg) - 1, fmt, ap);
data/civetweb-1.13+dfsg/src/main.c:740:5: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(s, "%s%s%s", options[2 * i + 1], multi_sep, value);
data/civetweb-1.13+dfsg/src/main.c:885:4: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(g_config_file_name, CONFIG_FILE2);
data/civetweb-1.13+dfsg/src/main.c:1810:4: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(title, g_server_name);
data/civetweb-1.13+dfsg/src/main.c:2937:4: [4] (shell) ShellExecute:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
ShellExecute(NULL, "open", url, NULL, NULL, SW_SHOW);
data/civetweb-1.13+dfsg/src/main.c:2941:4: [4] (shell) ShellExecute:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
ShellExecute(NULL, "open", g_website, NULL, NULL, SW_SHOW);
data/civetweb-1.13+dfsg/unittest/main.c:146:3: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(test_log_name, "%s.log", test_log_prefix);
data/civetweb-1.13+dfsg/unittest/main.c:148:3: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(test_xml_name, "%s.xml", test_log_prefix);
data/civetweb-1.13+dfsg/unittest/private.c:392:3: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(inout, tests[i].input);
data/civetweb-1.13+dfsg/unittest/private.c:898:2: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(date,
data/civetweb-1.13+dfsg/unittest/private.c:923:3: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(date,
data/civetweb-1.13+dfsg/unittest/public_server.c:77:2: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(r_path, "%s\\", a_path);
data/civetweb-1.13+dfsg/unittest/public_server.c:80:2: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(r_path, "..\\..\\..\\%s\\", a_path);
data/civetweb-1.13+dfsg/unittest/public_server.c:88:2: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(r_path, "%s/", a_path);
data/civetweb-1.13+dfsg/unittest/public_server.c:91:2: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(r_path,
data/civetweb-1.13+dfsg/unittest/public_server.c:118:2: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(cert_path, res);
data/civetweb-1.13+dfsg/unittest/public_server.c:175:2: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(buf, wd);
data/civetweb-1.13+dfsg/unittest/public_server.c:177:2: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(buf, ssl_cert);
data/civetweb-1.13+dfsg/unittest/public_server.c:180:2: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(buf, wd);
data/civetweb-1.13+dfsg/unittest/public_server.c:182:2: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(buf, ssl_cert);
data/civetweb-1.13+dfsg/unittest/public_server.c:197:8: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
(void)system("cmd /c copy C:\\OpenSSL-Win64\\libeay32.dll libeay32.dll");
data/civetweb-1.13+dfsg/unittest/public_server.c:198:8: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
(void)system("cmd /c copy C:\\OpenSSL-Win64\\libssl32.dll libssl32.dll");
data/civetweb-1.13+dfsg/unittest/public_server.c:199:8: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
(void)system("cmd /c copy C:\\OpenSSL-Win64\\ssleay32.dll ssleay32.dll");
data/civetweb-1.13+dfsg/unittest/public_server.c:200:8: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
(void)system("cmd /c copy C:\\OpenSSL-Win64\\libeay32.dll libeay64.dll");
data/civetweb-1.13+dfsg/unittest/public_server.c:201:8: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
(void)system("cmd /c copy C:\\OpenSSL-Win64\\libssl32.dll libssl64.dll");
data/civetweb-1.13+dfsg/unittest/public_server.c:202:8: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
(void)system("cmd /c copy C:\\OpenSSL-Win64\\ssleay32.dll ssleay64.dll");
data/civetweb-1.13+dfsg/unittest/public_server.c:204:8: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
(void)system("cmd /c copy C:\\OpenSSL-Win32\\libeay32.dll libeay32.dll");
data/civetweb-1.13+dfsg/unittest/public_server.c:205:8: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
(void)system("cmd /c copy C:\\OpenSSL-Win32\\libssl32.dll libssl32.dll");
data/civetweb-1.13+dfsg/unittest/public_server.c:206:8: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
(void)system("cmd /c copy C:\\OpenSSL-Win32\\ssleay32.dll ssleay32.dll");
data/civetweb-1.13+dfsg/unittest/public_server.c:733:2: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(server_cert, res_dir);
data/civetweb-1.13+dfsg/unittest/public_server.c:734:2: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(client_cert, res_dir);
data/civetweb-1.13+dfsg/unittest/public_server.c:1000:2: [4] (format) vprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
vprintf(f, l);
data/civetweb-1.13+dfsg/unittest/public_server.c:1384:2: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(request_handler2_url_expected,
data/civetweb-1.13+dfsg/unittest/public_server.c:1594:8: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
(void)system("chmod a+x test.cgi");
data/civetweb-1.13+dfsg/unittest/public_server.c:1630:2: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(ebuf, "%scgi_test.cgi", locate_test_exes());
data/civetweb-1.13+dfsg/unittest/public_server.c:1632:2: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(ebuf, "%scgi_test.cgi", locate_test_exes());
data/civetweb-1.13+dfsg/unittest/public_server.c:1657:2: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(cmd_buf, "copy %s\\cgi_test.cgi cgi_test.exe", locate_test_exes());
data/civetweb-1.13+dfsg/unittest/public_server.c:1659:2: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(cmd_buf, "cp %s/cgi_test.cgi cgi_test.cgi", locate_test_exes());
data/civetweb-1.13+dfsg/unittest/public_server.c:1661:8: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
(void)system(cmd_buf);
data/civetweb-1.13+dfsg/unittest/public_server.c:3372:2: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(HA1, "%s:%s:%s", "user", domain, "pass");
data/civetweb-1.13+dfsg/unittest/public_server.c:3373:2: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(HA2, "%s:/%s", "GET", test_file);
data/civetweb-1.13+dfsg/unittest/public_server.c:4417:2: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(path, "./%s", info->local_uri);
data/civetweb-1.13+dfsg/unittest/public_server.c:5267:2: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
vfprintf(stderr, expr, va);
data/civetweb-1.13+dfsg/unittest/public_server.c:5285:2: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
vfprintf(stderr, expr, va);
data/civetweb-1.13+dfsg/src/civetweb.c:5263:2: [3] (misc) InitializeCriticalSection:
Exceptions can be thrown in low-memory situations. Use
InitializeCriticalSectionAndSpinCount instead.
InitializeCriticalSection(&mutex->sec);
data/civetweb-1.13+dfsg/src/civetweb.c:5279:2: [3] (misc) EnterCriticalSection:
On some versions of Windows, exceptions can be thrown in low-memory
situations. Use InitializeCriticalSectionAndSpinCount instead.
EnterCriticalSection(&mutex->sec);
data/civetweb-1.13+dfsg/src/civetweb.c:11471:11: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable can
be set more than once (CWE-807, CWE-20). Check environment variables
carefully before using them.
if ((s = getenv("PATH")) != NULL) {
data/civetweb-1.13+dfsg/src/civetweb.c:11484:11: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable can
be set more than once (CWE-807, CWE-20). Check environment variables
carefully before using them.
if ((s = getenv("COMSPEC")) != NULL) {
data/civetweb-1.13+dfsg/src/civetweb.c:11487:11: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable can
be set more than once (CWE-807, CWE-20). Check environment variables
carefully before using them.
if ((s = getenv("SYSTEMROOT")) != NULL) {
data/civetweb-1.13+dfsg/src/civetweb.c:11490:11: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable can
be set more than once (CWE-807, CWE-20). Check environment variables
carefully before using them.
if ((s = getenv("SystemDrive")) != NULL) {
data/civetweb-1.13+dfsg/src/civetweb.c:11493:11: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable can
be set more than once (CWE-807, CWE-20). Check environment variables
carefully before using them.
if ((s = getenv("ProgramFiles")) != NULL) {
data/civetweb-1.13+dfsg/src/civetweb.c:11496:11: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable can
be set more than once (CWE-807, CWE-20). Check environment variables
carefully before using them.
if ((s = getenv("ProgramFiles(x86)")) != NULL) {
data/civetweb-1.13+dfsg/src/civetweb.c:11500:11: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable can
be set more than once (CWE-807, CWE-20). Check environment variables
carefully before using them.
if ((s = getenv("LD_LIBRARY_PATH")) != NULL) {
data/civetweb-1.13+dfsg/src/civetweb.c:11505:11: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable can
be set more than once (CWE-807, CWE-20). Check environment variables
carefully before using them.
if ((s = getenv("PERLLIB")) != NULL) {
data/civetweb-1.13+dfsg/src/main.c:145:39: [3] (buffer) realpath:
This function does not protect against buffer overflows, and some
implementations can overflow internally (CWE-120/CWE-785!). Ensure that the
destination buffer is at least of size MAXPATHLEN, andto protect against
implementation problems, the input argument should also be checked to
ensure it is no larger than MAXPATHLEN.
#define abs_path(rel, abs, abs_size) (realpath((rel), (abs)))
data/civetweb-1.13+dfsg/unittest/cgi_test.c:18:27: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable can
be set more than once (CWE-807, CWE-20). Check environment variables
carefully before using them.
const char *req_method = getenv("REQUEST_METHOD");
data/civetweb-1.13+dfsg/unittest/cgi_test.c:19:27: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable can
be set more than once (CWE-807, CWE-20). Check environment variables
carefully before using them.
const char *con_length = getenv("CONTENT_LENGTH");
data/civetweb-1.13+dfsg/unittest/private_exe.c:38:14: [3] (buffer) realpath:
This function does not protect against buffer overflows, and some
implementations can overflow internally (CWE-120/CWE-785!). Ensure that the
destination buffer is at least of size MAXPATHLEN, andto protect against
implementation problems, the input argument should also be checked to
ensure it is no larger than MAXPATHLEN.
extern char *realpath(const char *path, char *resolved_path);
data/civetweb-1.13+dfsg/examples/embedded_c/embedded_c.c:329:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char outputbuf[33];
data/civetweb-1.13+dfsg/examples/embedded_c/embedded_c.c:340:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *f = fopen("test.txt", "wb");
data/civetweb-1.13+dfsg/examples/embedded_c/embedded_c.c:416:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[128];
data/civetweb-1.13+dfsg/examples/embedded_c/embedded_c.c:522:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char first_str[64], count_str[64];
data/civetweb-1.13+dfsg/examples/embedded_c/embedded_c.c:541:36: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
count = (count_str[0] == 0) ? 0 : atoi(count_str);
data/civetweb-1.13+dfsg/examples/embedded_c/embedded_c.c:567:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[2048];
data/civetweb-1.13+dfsg/examples/embedded_c/embedded_c.c:573:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1024];
data/civetweb-1.13+dfsg/examples/embedded_c/embedded_c.c:626:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char passwd[64];
data/civetweb-1.13+dfsg/examples/embedded_c/embedded_c.c:639:3: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(passwd, "%04u", (unsigned int)(firstload % 10000));
data/civetweb-1.13+dfsg/examples/embedded_c/embedded_c.c:897:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char text[32];
data/civetweb-1.13+dfsg/examples/embedded_c/embedded_c.c:901:2: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(text, "%lu", ++cnt);
data/civetweb-1.13+dfsg/examples/embedded_cpp/embedded_cpp.cpp:168:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1024];
data/civetweb-1.13+dfsg/examples/embedded_cpp/embedded_cpp.cpp:206:29: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
#define fopen_recursive fopen
data/civetweb-1.13+dfsg/examples/embedded_cpp/embedded_cpp.cpp:217:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1024];
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:91:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char version[15];
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:92:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(version, "%i.%i.%i", CJSON_VERSION_MAJOR, CJSON_VERSION_MINOR, CJSON_VERSION_PATCH);
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:166:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(copy, string, length);
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:271:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char number_c_string[64];
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:451:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(newbuffer, p->buffer, p->offset + 1);
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:481:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char number_buffer[26]; /* temporary buffer to print the number into */
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:493:18: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
length = sprintf((char*)number_buffer, "null");
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:498:18: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
length = sprintf((char*)number_buffer, "%1.15g", d);
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:504:22: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
length = sprintf((char*)number_buffer, "%1.17g", d);
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:850:9: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy((char*)output, "\"\"");
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:891:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(output + 1, input, output_length);
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:937:21: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf((char*)output_pointer, "u%04x", *input_pointer);
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:1129:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(printed, buffer->buffer, cjson_min(buffer->length, buffer->offset + 1));
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:1285:13: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy((char*)output, "null");
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:1294:13: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy((char*)output, "false");
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:1303:13: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy((char*)output, "true");
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:1323:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(output, item->valuestring, raw_length);
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:1838:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(reference, item, sizeof(cJSON));
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON_Utils.c:67:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(copy, string, length);
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON_Utils.c:779:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(root, &replacement, sizeof(cJSON));
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON_Utils.c:1176:17: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf((char*)new_path, "%lu", (unsigned long)index);
data/civetweb-1.13+dfsg/examples/rest/rest.c:94:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[1024];
data/civetweb-1.13+dfsg/examples/ws_client/ws_client.c:116:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(p->data, data, data_len);
data/civetweb-1.13+dfsg/examples/ws_client/ws_client.c:167:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char err_buf[100] = {0};
data/civetweb-1.13+dfsg/examples/ws_client/ws_client.c:252:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char txt[128];
data/civetweb-1.13+dfsg/examples/ws_client/ws_client.c:283:5: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(txt,
data/civetweb-1.13+dfsg/examples/ws_client/ws_client.c:297:3: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(txt,
data/civetweb-1.13+dfsg/fuzztest/fuzzmain.c:65:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char data[4096];
data/civetweb-1.13+dfsg/fuzztest/fuzzmain.c:73:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char req[1024 * 16];
data/civetweb-1.13+dfsg/fuzztest/fuzzmain.c:196:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char client_err_buf[256];
data/civetweb-1.13+dfsg/fuzztest/fuzzmain.c:197:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char client_data_buf[4096];
data/civetweb-1.13+dfsg/fuzztest/fuzzmain.c:260:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char trash[1024];
data/civetweb-1.13+dfsg/fuzztest/fuzzmain.c:282:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char URI[1024 * 64]; /* static, to avoid stack overflow */
data/civetweb-1.13+dfsg/fuzztest/fuzzmain.c:291:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(URI, data, size);
data/civetweb-1.13+dfsg/fuzztest/fuzzmain.c:329:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char trash[1024];
data/civetweb-1.13+dfsg/fuzztest/fuzzmain.c:363:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(RESPONSE.data, data, size);
data/civetweb-1.13+dfsg/fuzztest/fuzzmain.c:366:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char errbuf[256];
data/civetweb-1.13+dfsg/include/civetweb.h:160:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char remote_addr[48]; /* Client's IP address as a string. */
data/civetweb-1.13+dfsg/include/civetweb.h:1374:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
CIVETWEB_API char *mg_md5(char buf[33], ...);
data/civetweb-1.13+dfsg/include/civetweb.h:1374:27: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
CIVETWEB_API char *mg_md5(char buf[33], ...);
data/civetweb-1.13+dfsg/src/CivetServer.cpp:409:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char _cookieValue[4096];
data/civetweb-1.13+dfsg/src/CivetServer.cpp:476:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[2048];
data/civetweb-1.13+dfsg/src/CivetServer.cpp:528:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[256];
data/civetweb-1.13+dfsg/src/CivetServer.cpp:559:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[2048];
data/civetweb-1.13+dfsg/src/CivetServer.cpp:589:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[2] = {*src, '\0'};
data/civetweb-1.13+dfsg/src/CivetServer.cpp:590:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char dst_buf[4];
data/civetweb-1.13+dfsg/src/civetweb.c:123:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char static_assert_replacement[1];
data/civetweb-1.13+dfsg/src/civetweb.c:125:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
extern char static_assert_replacement[(cond) ? 1 : -1]
data/civetweb-1.13+dfsg/src/civetweb.c:819:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char d_name[PATH_MAX];
data/civetweb-1.13+dfsg/src/civetweb.c:1171:2: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t wa[W_PATH_MAX];
data/civetweb-1.13+dfsg/src/civetweb.c:1172:2: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t wb[W_PATH_MAX];
data/civetweb-1.13+dfsg/src/civetweb.c:1190:2: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t wbuf[W_PATH_MAX];
data/civetweb-1.13+dfsg/src/civetweb.c:1455:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char mallocStr[256];
data/civetweb-1.13+dfsg/src/civetweb.c:1507:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char mallocStr[256];
data/civetweb-1.13+dfsg/src/civetweb.c:1549:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char mallocStr[256];
data/civetweb-1.13+dfsg/src/civetweb.c:1737:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char txtbuf[4];
data/civetweb-1.13+dfsg/src/civetweb.c:1802:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&ret, &t, sizeof(pthread_t));
data/civetweb-1.13+dfsg/src/civetweb.c:2032:30: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(int (*)(SSL_CTX *, const char *, int))ssl_sw[11].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2034:30: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(int (*)(SSL_CTX *, const char *, int))ssl_sw[12].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2039:30: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(int (*)(SSL_CTX *, const char *))ssl_sw[15].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2049:30: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(int (*)(SSL_CTX *, const char *, const char *))ssl_sw[20].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2049:44: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(int (*)(SSL_CTX *, const char *, const char *))ssl_sw[20].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2053:34: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
#define SSL_get_version (*(const char *(*)(SSL *))ssl_sw[24].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2056:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(const char *(*)(const SSL_CIPHER *))ssl_sw[26].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2059:39: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(int (*)(SSL_CTX *, const unsigned char *, unsigned int))ssl_sw[28].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2062:30: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(int (*)(SSL_CTX *, const char *))ssl_sw[30].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2069:28: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
#define SSL_get_ex_data (*(char *(*)(const SSL *, int))ssl_sw[33].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2070:49: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
#define SSL_set_ex_data (*(void (*)(SSL *, int, char *))ssl_sw[34].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2074:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(const char *(*)(const SSL *, int type))ssl_sw[36].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2078:39: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(int (*)(SSL_CTX *, const unsigned char *, unsigned))ssl_sw[39].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2124:29: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
#define ERR_error_string (*(char *(*)(unsigned long, char *))crypto_sw[1].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2124:54: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
#define ERR_error_string (*(char *(*)(unsigned long, char *))crypto_sw[1].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2130:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(char *(*)(X509_NAME *, char *, int))crypto_sw[6].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2130:28: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(char *(*)(X509_NAME *, char *, int))crypto_sw[6].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2133:29: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(const EVP_MD *(*)(const char *))crypto_sw[8].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2139:46: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
#define i2d_X509 (*(int (*)(X509 *, unsigned char **))crypto_sw[10].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2140:22: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
#define BN_bn2hex (*(char *(*)(const BIGNUM *a))crypto_sw[11].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2236:30: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(int (*)(SSL_CTX *, const char *, int))ssl_sw[11].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2238:30: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(int (*)(SSL_CTX *, const char *, int))ssl_sw[12].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2244:30: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(int (*)(SSL_CTX *, const char *))ssl_sw[16].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2254:30: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(int (*)(SSL_CTX *, const char *, const char *))ssl_sw[21].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2254:44: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(int (*)(SSL_CTX *, const char *, const char *))ssl_sw[21].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2258:34: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
#define SSL_get_version (*(const char *(*)(SSL *))ssl_sw[25].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2261:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(const char *(*)(const SSL_CIPHER *))ssl_sw[27].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2264:39: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(int (*)(SSL_CTX *, const unsigned char *, unsigned int))ssl_sw[29].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2267:30: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(int (*)(SSL_CTX *, const char *))ssl_sw[31].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2271:28: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
#define SSL_get_ex_data (*(char *(*)(const SSL *, int))ssl_sw[33].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2272:49: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
#define SSL_set_ex_data (*(void (*)(SSL *, int, char *))ssl_sw[34].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2276:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(const char *(*)(const SSL *, int type))ssl_sw[36].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2280:39: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(int (*)(SSL_CTX *, const unsigned char *, unsigned))ssl_sw[39].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2330:39: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(void (*)(void (*)(int, int, const char *, int)))crypto_sw[1].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2334:29: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
#define ERR_error_string (*(char *(*)(unsigned long, char *))crypto_sw[4].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2334:54: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
#define ERR_error_string (*(char *(*)(unsigned long, char *))crypto_sw[4].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2345:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(char *(*)(X509_NAME *, char *, int))crypto_sw[14].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2345:28: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(char *(*)(X509_NAME *, char *, int))crypto_sw[14].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2348:38: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(int (*)(ASN1_INTEGER *, unsigned char **))crypto_sw[16].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2350:29: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(*(const EVP_MD *(*)(const char *))crypto_sw[17].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2356:46: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
#define i2d_X509 (*(int (*)(X509 *, unsigned char **))crypto_sw[19].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2357:22: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
#define BN_bn2hex (*(char *(*)(const BIGNUM *a))crypto_sw[20].ptr)
data/civetweb-1.13+dfsg/src/civetweb.c:2850:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *config[NUM_OPTIONS]; /* Civetweb configuration parameters */
data/civetweb-1.13+dfsg/src/civetweb.c:3340:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char threadName[16 + 1]; /* 16 = Max. thread length in Linux/OSX/.. */
data/civetweb-1.13+dfsg/src/civetweb.c:3501:3: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t wbuf[W_PATH_MAX];
data/civetweb-1.13+dfsg/src/civetweb.c:3519:22: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
filep->access.fp = fopen(path, "r");
data/civetweb-1.13+dfsg/src/civetweb.c:3522:22: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
filep->access.fp = fopen(path, "w");
data/civetweb-1.13+dfsg/src/civetweb.c:3525:22: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
filep->access.fp = fopen(path, "a");
data/civetweb-1.13+dfsg/src/civetweb.c:3943:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[MG_BUF_LEN], src_addr[IP_ADDR_STR_LEN];
data/civetweb-1.13+dfsg/src/civetweb.c:4083:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char txt[16];
data/civetweb-1.13+dfsg/src/civetweb.c:4087:3: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(txt, "%03i", conn->response_info.status_code);
data/civetweb-1.13+dfsg/src/civetweb.c:4089:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(tls->txtbuf, txt, 4);
data/civetweb-1.13+dfsg/src/civetweb.c:4091:4: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(tls->txtbuf, "ERR");
data/civetweb-1.13+dfsg/src/civetweb.c:4100:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(((struct mg_connection *)conn)->request_info.http_headers,
data/civetweb-1.13+dfsg/src/civetweb.c:4206:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char portstr[16];
data/civetweb-1.13+dfsg/src/civetweb.c:4207:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char server_ip[48];
data/civetweb-1.13+dfsg/src/civetweb.c:4210:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(portstr, ":%u", (unsigned)port);
data/civetweb-1.13+dfsg/src/civetweb.c:4625:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char val[64];
data/civetweb-1.13+dfsg/src/civetweb.c:4638:12: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
max_age = atoi(conn->dom_ctx->config[STATIC_FILE_MAX_AGE]);
data/civetweb-1.13+dfsg/src/civetweb.c:4675:18: [2] (integer) atol:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
long max_age = atol(conn->dom_ctx->config[STRICT_HTTPS_MAX_AGE]);
data/civetweb-1.13+dfsg/src/civetweb.c:4677:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char val[64];
data/civetweb-1.13+dfsg/src/civetweb.c:4907:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char errmsg_buf[MG_BUF_LEN];
data/civetweb-1.13+dfsg/src/civetweb.c:4912:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char path_buf[PATH_MAX];
data/civetweb-1.13+dfsg/src/civetweb.c:5122:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char len[32];
data/civetweb-1.13+dfsg/src/civetweb.c:5162:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char reply[MG_BUF_LEN];
data/civetweb-1.13+dfsg/src/civetweb.c:5507:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[PATH_MAX], buf2[PATH_MAX];
data/civetweb-1.13+dfsg/src/civetweb.c:5508:2: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t wbuf2[W_PATH_MAX + 1];
data/civetweb-1.13+dfsg/src/civetweb.c:5518:2: [2] (buffer) MultiByteToWideChar:
Requires maximum length in CHARACTERS, not bytes (CWE-120).
MultiByteToWideChar(CP_UTF8, 0, buf, -1, wbuf, (int)wbuf_len);
data/civetweb-1.13+dfsg/src/civetweb.c:5578:2: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t wbuf[W_PATH_MAX];
data/civetweb-1.13+dfsg/src/civetweb.c:5626:2: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t wbuf[W_PATH_MAX];
data/civetweb-1.13+dfsg/src/civetweb.c:5635:2: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t wbuf[W_PATH_MAX];
data/civetweb-1.13+dfsg/src/civetweb.c:5657:2: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t wpath[W_PATH_MAX];
data/civetweb-1.13+dfsg/src/civetweb.c:5669:10: [2] (buffer) wcscat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Risk is low because the source is a constant string.
(void)wcscat(wpath, L"\\*");
data/civetweb-1.13+dfsg/src/civetweb.c:5896:2: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t wbuf[W_PATH_MAX];
data/civetweb-1.13+dfsg/src/civetweb.c:5991:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char full_dir[PATH_MAX], cmdline[PATH_MAX], buf[PATH_MAX];
data/civetweb-1.13+dfsg/src/civetweb.c:6670:13: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
timeout = atoi(ctx->dd.config[REQUEST_TIMEOUT]) / 1000.0;
data/civetweb-1.13+dfsg/src/civetweb.c:6887:13: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
timeout = atoi(conn->dom_ctx->config[REQUEST_TIMEOUT]) / 1000.0;
data/civetweb-1.13+dfsg/src/civetweb.c:6926:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[MG_BUF_LEN];
data/civetweb-1.13+dfsg/src/civetweb.c:6974:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf, body, (size_t)buffered_len);
data/civetweb-1.13+dfsg/src/civetweb.c:7058:6: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char x[2];
data/civetweb-1.13+dfsg/src/civetweb.c:7071:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char lenbuf[64];
data/civetweb-1.13+dfsg/src/civetweb.c:7212:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char lenbuf[16];
data/civetweb-1.13+dfsg/src/civetweb.c:7218:2: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(lenbuf, "%x\r\n", chunk_len);
data/civetweb-1.13+dfsg/src/civetweb.c:7352:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char mem[MG_BUF_LEN];
data/civetweb-1.13+dfsg/src/civetweb.c:7576:25: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
url_decode_in_place((char *)form_fields[i].name);
data/civetweb-1.13+dfsg/src/civetweb.c:7579:25: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
url_decode_in_place((char *)form_fields[i].value);
data/civetweb-1.13+dfsg/src/civetweb.c:7881:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char gz_path[PATH_MAX];
data/civetweb-1.13+dfsg/src/civetweb.c:8069:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(tmp_str, filename, tmp_str_len + 1);
data/civetweb-1.13+dfsg/src/civetweb.c:8129:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(filename, tmp_str, script_name_len + 1);
data/civetweb-1.13+dfsg/src/civetweb.c:8234:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char month_str[32] = {0};
data/civetweb-1.13+dfsg/src/civetweb.c:8622:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *
data/civetweb-1.13+dfsg/src/civetweb.c:8623:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
mg_md5(char buf[33], ...)
data/civetweb-1.13+dfsg/src/civetweb.c:8655:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ha2[32 + 1], expected_response[32 + 1];
data/civetweb-1.13+dfsg/src/civetweb.c:8696:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[PATH_MAX];
data/civetweb-1.13+dfsg/src/civetweb.c:8913:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[256 + 256 + 40];
data/civetweb-1.13+dfsg/src/civetweb.c:9034:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[MG_BUF_LEN];
data/civetweb-1.13+dfsg/src/civetweb.c:9087:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char fname[PATH_MAX];
data/civetweb-1.13+dfsg/src/civetweb.c:9144:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/civetweb-1.13+dfsg/src/civetweb.c:9228:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char line[512], u[512] = "", d[512] = "", ha1[33], tmp[PATH_MAX + 8];
data/civetweb-1.13+dfsg/src/civetweb.c:9280:2: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant string.
strcat(tmp, ".tmp");
data/civetweb-1.13+dfsg/src/civetweb.c:9284:12: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((fp = fopen(fname, "a+")) != NULL) {
data/civetweb-1.13+dfsg/src/civetweb.c:9289:12: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((fp = fopen(fname, "r")) == NULL) {
data/civetweb-1.13+dfsg/src/civetweb.c:9291:20: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
} else if ((fp2 = fopen(tmp, "w+")) == NULL) {
data/civetweb-1.13+dfsg/src/civetweb.c:9370:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dst, res->ai_addr, res->ai_addrlen);
data/civetweb-1.13+dfsg/src/civetweb.c:9646:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char size[64], mod[64];
data/civetweb-1.13+dfsg/src/civetweb.c:9669:5: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(p, "&");
data/civetweb-1.13+dfsg/src/civetweb.c:9671:5: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(p, "<");
data/civetweb-1.13+dfsg/src/civetweb.c:9673:5: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(p, ">");
data/civetweb-1.13+dfsg/src/civetweb.c:9807:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char path[PATH_MAX];
data/civetweb-1.13+dfsg/src/civetweb.c:9864:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char path[PATH_MAX];
data/civetweb-1.13+dfsg/src/civetweb.c:9973:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char date[64], *esc, *p;
data/civetweb-1.13+dfsg/src/civetweb.c:10001:6: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(p, "&");
data/civetweb-1.13+dfsg/src/civetweb.c:10003:6: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(p, "<");
data/civetweb-1.13+dfsg/src/civetweb.c:10005:6: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(p, ">");
data/civetweb-1.13+dfsg/src/civetweb.c:10084:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[MG_BUF_LEN];
data/civetweb-1.13+dfsg/src/civetweb.c:10235:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char lm[64], etag[64];
data/civetweb-1.13+dfsg/src/civetweb.c:10236:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char range[128]; /* large enough, so there will be no overflow */
data/civetweb-1.13+dfsg/src/civetweb.c:10241:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char gz_path[PATH_MAX];
data/civetweb-1.13+dfsg/src/civetweb.c:10436:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char len[32];
data/civetweb-1.13+dfsg/src/civetweb.c:10500:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char etag[64];
data/civetweb-1.13+dfsg/src/civetweb.c:10515:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char lm[64], etag[64];
data/civetweb-1.13+dfsg/src/civetweb.c:10603:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[PATH_MAX];
data/civetweb-1.13+dfsg/src/civetweb.c:10616:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf, path, len);
data/civetweb-1.13+dfsg/src/civetweb.c:10653:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[MG_BUF_LEN];
data/civetweb-1.13+dfsg/src/civetweb.c:10754:20: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
parse_http_headers(char **buf, struct mg_header hdr[MG_MAX_HEADERS])
data/civetweb-1.13+dfsg/src/civetweb.c:11203:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[MG_BUF_LEN];
data/civetweb-1.13+dfsg/src/civetweb.c:11376:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *p, src_addr[IP_ADDR_STR_LEN], http_var_name[128];
data/civetweb-1.13+dfsg/src/civetweb.c:11608:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *pbuf, dir[PATH_MAX], *p;
data/civetweb-1.13+dfsg/src/civetweb.c:11836:23: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
conn->status_code = atoi(status);
data/civetweb-1.13+dfsg/src/civetweb.c:12184:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char file_name[MG_BUF_LEN], path[512], *p;
data/civetweb-1.13+dfsg/src/civetweb.c:12266:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cmd[1024] = "";
data/civetweb-1.13+dfsg/src/civetweb.c:12308:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[MG_BUF_LEN];
data/civetweb-1.13+dfsg/src/civetweb.c:12413:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char date[64];
data/civetweb-1.13+dfsg/src/civetweb.c:12504:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *href, mtime[64];
data/civetweb-1.13+dfsg/src/civetweb.c:12573:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char date[64];
data/civetweb-1.13+dfsg/src/civetweb.c:12664:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[100], sha[20], b64_sha[sizeof(sha) * 2];
data/civetweb-1.13+dfsg/src/civetweb.c:12738:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char mask[4];
data/civetweb-1.13+dfsg/src/civetweb.c:12743:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char mem[4096];
data/civetweb-1.13+dfsg/src/civetweb.c:12759:13: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
timeout = atoi(conn->dom_ctx->config[WEBSOCKET_TIMEOUT]) / 1000.0;
data/civetweb-1.13+dfsg/src/civetweb.c:12762:13: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
timeout = atoi(conn->dom_ctx->config[REQUEST_TIMEOUT]) / 1000.0;
data/civetweb-1.13+dfsg/src/civetweb.c:12795:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&l1, &buf[2], 4); /* Use memcpy for alignment */
data/civetweb-1.13+dfsg/src/civetweb.c:12796:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&l2, &buf[6], 4);
data/civetweb-1.13+dfsg/src/civetweb.c:12843:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, buf + header_len, len);
data/civetweb-1.13+dfsg/src/civetweb.c:12887:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, buf + header_len, (size_t)data_len);
data/civetweb-1.13+dfsg/src/civetweb.c:13112:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char header[14];
data/civetweb-1.13+dfsg/src/civetweb.c:13183:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(header + 2, &len, 2);
data/civetweb-1.13+dfsg/src/civetweb.c:13190:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(header + 2, &len1, 4);
data/civetweb-1.13+dfsg/src/civetweb.c:13191:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(header + 6, &len2, 4);
data/civetweb-1.13+dfsg/src/civetweb.c:13198:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(header + headerLen, &masking_key, 4);
data/civetweb-1.13+dfsg/src/civetweb.c:13326:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char key3[8];
data/civetweb-1.13+dfsg/src/civetweb.c:13359:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char *protocols[64]; // max 64 headers
data/civetweb-1.13+dfsg/src/civetweb.c:13598:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ad[50];
data/civetweb-1.13+dfsg/src/civetweb.c:13839:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char target_url[MG_BUF_LEN];
data/civetweb-1.13+dfsg/src/civetweb.c:13860:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(target_url + slen1 + 1,
data/civetweb-1.13+dfsg/src/civetweb.c:14288:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char path[PATH_MAX];
data/civetweb-1.13+dfsg/src/civetweb.c:14307:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char date[64];
data/civetweb-1.13+dfsg/src/civetweb.c:14735:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(new_path, ri->request_uri, len);
data/civetweb-1.13+dfsg/src/civetweb.c:14934:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[100] = {0};
data/civetweb-1.13+dfsg/src/civetweb.c:15005:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char hostname[256];
data/civetweb-1.13+dfsg/src/civetweb.c:15430:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char date[64], src_addr[IP_ADDR_STR_LEN];
data/civetweb-1.13+dfsg/src/civetweb.c:15436:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[4096];
data/civetweb-1.13+dfsg/src/civetweb.c:15774:12: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
int to = atoi(conn->dom_ctx->config[REQUEST_TIMEOUT]);
data/civetweb-1.13+dfsg/src/civetweb.c:15891:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str_buf[1024];
data/civetweb-1.13+dfsg/src/civetweb.c:15892:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char buf[256];
data/civetweb-1.13+dfsg/src/civetweb.c:16054:8: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant string.
strcat(ebuf, "...");
data/civetweb-1.13+dfsg/src/civetweb.c:16541:17: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
protocol_ver = atoi(dom_ctx->config[SSL_PROTOCOL_VERSION]);
data/civetweb-1.13+dfsg/src/civetweb.c:16697:19: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
verify_depth = atoi(dom_ctx->config[SSL_VERIFY_DEPTH]);
data/civetweb-1.13+dfsg/src/civetweb.c:16714:29: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
? atoi(dom_ctx->config[SSL_CACHE_TIMEOUT])
data/civetweb-1.13+dfsg/src/civetweb.c:16747:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ebuf[128];
data/civetweb-1.13+dfsg/src/civetweb.c:16990:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[MG_BUF_LEN];
data/civetweb-1.13+dfsg/src/civetweb.c:17024:20: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
linger_timeout = atoi(conn->dom_ctx->config[LINGER_TIMEOUT]);
data/civetweb-1.13+dfsg/src/civetweb.c:17250:16: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
(unsigned)atoi(config_options[MAX_REQUEST_SIZE].default_value);
data/civetweb-1.13+dfsg/src/civetweb.c:17996:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char txt[32]; /* will not overflow */
data/civetweb-1.13+dfsg/src/civetweb.c:18436:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ebuf[100];
data/civetweb-1.13+dfsg/src/civetweb.c:19019:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char src_addr[IP_ADDR_STR_LEN];
data/civetweb-1.13+dfsg/src/civetweb.c:19390:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[128];
data/civetweb-1.13+dfsg/src/civetweb.c:19625:9: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
itmp = atoi(ctx->dd.config[MAX_REQUEST_SIZE]);
data/civetweb-1.13+dfsg/src/civetweb.c:19646:9: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
itmp = atoi(ctx->dd.config[CONNECTION_QUEUE_SIZE]);
data/civetweb-1.13+dfsg/src/civetweb.c:19685:22: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
workerthreadcount = atoi(ctx->dd.config[NUM_THREADS]);
data/civetweb-1.13+dfsg/src/civetweb.c:19729:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ebuf[256];
data/civetweb-1.13+dfsg/src/civetweb.c:20760:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char start_time_str[64] = {0};
data/civetweb-1.13+dfsg/src/civetweb.c:20761:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char now_str[64] = {0};
data/civetweb-1.13+dfsg/src/civetweb.c:21047:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char start_time_str[64] = {0};
data/civetweb-1.13+dfsg/src/civetweb.c:21048:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char close_time_str[64] = {0};
data/civetweb-1.13+dfsg/src/civetweb.c:21227:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ebuf[128];
data/civetweb-1.13+dfsg/src/main.c:188:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char g_server_base_name[40]; /* Set by init_server_name() */
data/civetweb-1.13+dfsg/src/main.c:204:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char g_config_file_name[PATH_MAX] =
data/civetweb-1.13+dfsg/src/main.c:254:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char msg[512] = "";
data/civetweb-1.13+dfsg/src/main.c:356:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char url[128];
data/civetweb-1.13+dfsg/src/main.c:407:12: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((fp = fopen(path, "r")) != NULL) {
data/civetweb-1.13+dfsg/src/main.c:409:19: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
} else if ((fp = fopen(path, "a+")) != NULL) {
data/civetweb-1.13+dfsg/src/main.c:439:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(p, str, len);
data/civetweb-1.13+dfsg/src/main.c:505:6: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char mbc[16];
data/civetweb-1.13+dfsg/src/main.c:508:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(d, mbc, (unsigned)mbl);
data/civetweb-1.13+dfsg/src/main.c:735:10: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
(char *)malloc(strlen(options[2 * i + 1])
data/civetweb-1.13+dfsg/src/main.c:771:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char line[MAX_CONF_FILE_LINE_SIZE], *p;
data/civetweb-1.13+dfsg/src/main.c:776:7: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fp = fopen(config_file, "r");
data/civetweb-1.13+dfsg/src/main.c:879:7: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fp = fopen(g_config_file_name, "r");
data/civetweb-1.13+dfsg/src/main.c:883:8: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fp = fopen(CONFIG_FILE2, "r");
data/civetweb-1.13+dfsg/src/main.c:1003:2: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t wbuf[1024];
data/civetweb-1.13+dfsg/src/main.c:1004:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char mbbuf[1024];
data/civetweb-1.13+dfsg/src/main.c:1035:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char path[PATH_MAX] = "", absolute[PATH_MAX] = "";
data/civetweb-1.13+dfsg/src/main.c:1126:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ebuf[1024] = {0};
data/civetweb-1.13+dfsg/src/main.c:1203:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1024] = {0};
data/civetweb-1.13+dfsg/src/main.c:1286:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *options[2 * MAX_OPTIONS + 1];
data/civetweb-1.13+dfsg/src/main.c:1405:16: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((fp = fopen(PID_FILE, "w")) == 0) {
data/civetweb-1.13+dfsg/src/main.c:1558:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[256];
data/civetweb-1.13+dfsg/src/main.c:1573:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char value[2000] = "";
data/civetweb-1.13+dfsg/src/main.c:1617:2: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t caption[1];
data/civetweb-1.13+dfsg/src/main.c:1619:2: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t fontface[7]; /* L"Tahoma" = 6 characters + terminating zero */
data/civetweb-1.13+dfsg/src/main.c:1650:2: [2] (buffer) wcscpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using a function version that stops copying at the end
of the buffer. Risk is low because the source is a constant string.
wcscpy(dlg->header.fontface, L"Tahoma");
data/civetweb-1.13+dfsg/src/main.c:1665:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *file_options[MAX_OPTIONS * 2 + 1] = {0};
data/civetweb-1.13+dfsg/src/main.c:1680:14: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((fp = fopen(g_config_file_name, "w+")) != NULL) {
data/civetweb-1.13+dfsg/src/main.c:1759:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char path[PATH_MAX] = "";
data/civetweb-1.13+dfsg/src/main.c:1811:4: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant string.
strcat(title, " settings");
data/civetweb-1.13+dfsg/src/main.c:2103:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char domain[256], user[256], password[256];
data/civetweb-1.13+dfsg/src/main.c:2266:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char text[64];
data/civetweb-1.13+dfsg/src/main.c:2431:3: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(text,
data/civetweb-1.13+dfsg/src/main.c:2523:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char path[PATH_MAX] = PASSWORDS_FILE_NAME;
data/civetweb-1.13+dfsg/src/main.c:2524:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char strbuf[256], u[256], d[256];
data/civetweb-1.13+dfsg/src/main.c:2554:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen(path, "a+");
data/civetweb-1.13+dfsg/src/main.c:2568:7: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen(path, "r+");
data/civetweb-1.13+dfsg/src/main.c:2819:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char path[PATH_MAX + 20] = ""; /* Path to executable plus magic argument */
data/civetweb-1.13+dfsg/src/main.c:2880:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[200];
data/civetweb-1.13+dfsg/src/main.c:2889:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *service_argv[2];
data/civetweb-1.13+dfsg/unittest/cgi_test.c:13:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1024];
data/civetweb-1.13+dfsg/unittest/main.c:72:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char test_log_name[FILENAME_LEN];
data/civetweb-1.13+dfsg/unittest/main.c:73:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char test_xml_name[FILENAME_LEN];
data/civetweb-1.13+dfsg/unittest/main.c:129:4: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(test_log_name, "test-%03i.log", i);
data/civetweb-1.13+dfsg/unittest/main.c:130:8: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen(test_log_name, "r");
data/civetweb-1.13+dfsg/unittest/main.c:140:4: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(test_xml_name, "test-%03i.xml", i);
data/civetweb-1.13+dfsg/unittest/private.c:52:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char tmp_parse_buffer[1024];
data/civetweb-1.13+dfsg/unittest/private.c:58:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(tmp_parse_buffer, buf, (size_t)len);
data/civetweb-1.13+dfsg/unittest/private.c:66:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(tmp_parse_buffer, buf, (size_t)len);
data/civetweb-1.13+dfsg/unittest/private.c:391:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char inout[256];
data/civetweb-1.13+dfsg/unittest/private.c:507:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[MG_BUF_LEN], *p = buf;
data/civetweb-1.13+dfsg/unittest/private.c:536:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[16];
data/civetweb-1.13+dfsg/unittest/private.c:579:2: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(buf, "1234567890");
data/civetweb-1.13+dfsg/unittest/private.c:712:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/civetweb-1.13+dfsg/unittest/private.c:816:2: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(buf, "AbcDef");
data/civetweb-1.13+dfsg/unittest/private.c:820:2: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(buf, "A%20B+C");
data/civetweb-1.13+dfsg/unittest/private.c:834:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char in[1024];
data/civetweb-1.13+dfsg/unittest/private.c:835:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char out[1024];
data/civetweb-1.13+dfsg/unittest/private.c:882:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char date[64] = {0};
data/civetweb-1.13+dfsg/unittest/private.c:943:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[48] = {0};
data/civetweb-1.13+dfsg/unittest/public_func.c:246:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[32];
data/civetweb-1.13+dfsg/unittest/public_func.c:313:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[32];
data/civetweb-1.13+dfsg/unittest/public_func.c:422:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[33];
data/civetweb-1.13+dfsg/unittest/public_func.c:477:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[20];
data/civetweb-1.13+dfsg/unittest/public_func.c:500:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[20];
data/civetweb-1.13+dfsg/unittest/public_func.c:540:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[256] = {0};
data/civetweb-1.13+dfsg/unittest/public_func.c:551:2: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(buf, "test");
data/civetweb-1.13+dfsg/unittest/public_func.c:557:2: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(buf, "key=val");
data/civetweb-1.13+dfsg/unittest/public_func.c:563:2: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(buf, "key=val&key2=val2");
data/civetweb-1.13+dfsg/unittest/public_func.c:571:2: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(buf, "k1=v1&k2=v2&k3=&k4&k5=v5");
data/civetweb-1.13+dfsg/unittest/public_func.c:585:2: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(buf, "key=v+l1&key2=v%20l2");
data/civetweb-1.13+dfsg/unittest/public_server.c:73:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char r_path[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:108:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char cert_path[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:119:2: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant string.
strcat(cert_path, "ssl_cert.pem");
data/civetweb-1.13+dfsg/unittest/public_server.c:156:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char wd[300];
data/civetweb-1.13+dfsg/unittest/public_server.c:157:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[500];
data/civetweb-1.13+dfsg/unittest/public_server.c:178:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen(buf, "rb");
data/civetweb-1.13+dfsg/unittest/public_server.c:183:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen(buf, "r");
data/civetweb-1.13+dfsg/unittest/public_server.c:345:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char *OPTIONS[16];
data/civetweb-1.13+dfsg/unittest/public_server.c:355:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char errmsg[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:358:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char client_err[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:592:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char errmsg[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:594:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char *OPTIONS[8]; /* initializer list here is rejected by CI test */
data/civetweb-1.13+dfsg/unittest/public_server.c:599:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char client_err[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:718:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char errmsg[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:721:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char client_err[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:726:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char *OPTIONS[32]; /* initializer list here is rejected by CI test */
data/civetweb-1.13+dfsg/unittest/public_server.c:728:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char server_cert[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:729:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char client_cert[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:736:2: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant string.
strcat(server_cert, "cert\\server.pem");
data/civetweb-1.13+dfsg/unittest/public_server.c:737:2: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant string.
strcat(client_cert, "cert\\client.pem");
data/civetweb-1.13+dfsg/unittest/public_server.c:739:2: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant string.
strcat(server_cert, "cert/server.pem");
data/civetweb-1.13+dfsg/unittest/public_server.c:740:2: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant string.
strcat(client_cert, "cert/client.pem");
data/civetweb-1.13+dfsg/unittest/public_server.c:822:3: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(client_err,
data/civetweb-1.13+dfsg/unittest/public_server.c:880:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char chunk_data[32];
data/civetweb-1.13+dfsg/unittest/public_server.c:909:2: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(chunk_data, "123456789A123456789B123456789C");
data/civetweb-1.13+dfsg/unittest/public_server.c:928:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char request_handler2_url_expected[128] = {0};
data/civetweb-1.13+dfsg/unittest/public_server.c:940:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char url_buffer[128];
data/civetweb-1.13+dfsg/unittest/public_server.c:1043:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char long_ws_buf[long_ws_buf_len_64];
data/civetweb-1.13+dfsg/unittest/public_server.c:1186:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(pclient_data->data, data, data_len);
data/civetweb-1.13+dfsg/unittest/public_server.c:1225:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ebuf[1024];
data/civetweb-1.13+dfsg/unittest/public_server.c:1229:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char uri[64];
data/civetweb-1.13+dfsg/unittest/public_server.c:1230:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1 + 2 + 3 + 4 + 5 + 6 + 7 + 8 + 9 + 10 + 8];
data/civetweb-1.13+dfsg/unittest/public_server.c:1257:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char *OPTIONS[16];
data/civetweb-1.13+dfsg/unittest/public_server.c:1291:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cmd_buf[1024];
data/civetweb-1.13+dfsg/unittest/public_server.c:1361:3: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(uri, "/U%u", i);
data/civetweb-1.13+dfsg/unittest/public_server.c:1365:3: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(uri, "/U%u", i);
data/civetweb-1.13+dfsg/unittest/public_server.c:1369:3: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(uri, "/U%u", i);
data/civetweb-1.13+dfsg/unittest/public_server.c:1373:3: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(uri, "/U%u", i);
data/civetweb-1.13+dfsg/unittest/public_server.c:1377:3: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(uri, "/U%u", i);
data/civetweb-1.13+dfsg/unittest/public_server.c:1545:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen("test.txt", "wb");
data/civetweb-1.13+dfsg/unittest/public_server.c:1547:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen("test.txt", "w");
data/civetweb-1.13+dfsg/unittest/public_server.c:1558:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen("test_gz.txt.gz", "wb");
data/civetweb-1.13+dfsg/unittest/public_server.c:1560:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen("test_gz.txt.gz", "w");
data/civetweb-1.13+dfsg/unittest/public_server.c:1569:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen("test.cgi", "wb");
data/civetweb-1.13+dfsg/unittest/public_server.c:1574:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen("test.cgi.cmd", "w");
data/civetweb-1.13+dfsg/unittest/public_server.c:1584:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen("test.cgi", "w");
data/civetweb-1.13+dfsg/unittest/public_server.c:1635:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cwd[512];
data/civetweb-1.13+dfsg/unittest/public_server.c:2330:3: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant string.
strcat(path, ".txt");
data/civetweb-1.13+dfsg/unittest/public_server.c:2351:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(value, value_untruncated, valuelen);
data/civetweb-1.13+dfsg/unittest/public_server.c:2502:7: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen(path, "r");
data/civetweb-1.13+dfsg/unittest/public_server.c:2505:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[32] = {0};
data/civetweb-1.13+dfsg/unittest/public_server.c:2517:7: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen(path, "rb");
data/civetweb-1.13+dfsg/unittest/public_server.c:2519:7: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen(path, "r");
data/civetweb-1.13+dfsg/unittest/public_server.c:2523:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[32] = {0};
data/civetweb-1.13+dfsg/unittest/public_server.c:2631:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char lenbuf[16];
data/civetweb-1.13+dfsg/unittest/public_server.c:2638:2: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(lenbuf, "%x\r\n", chunk_len);
data/civetweb-1.13+dfsg/unittest/public_server.c:2667:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char *OPTIONS[8];
data/civetweb-1.13+dfsg/unittest/public_server.c:2670:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ebuf[1024];
data/civetweb-1.13+dfsg/unittest/public_server.c:3234:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char client_err[256], nonce[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:3247:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char HA1[256], HA2[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:3248:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char HA1_md5_buf[33], HA2_md5_buf[33], HA_md5_buf[33];
data/civetweb-1.13+dfsg/unittest/public_server.c:3268:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen(test_file, "w");
data/civetweb-1.13+dfsg/unittest/public_server.c:3363:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(nonce,
data/civetweb-1.13+dfsg/unittest/public_server.c:3576:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char client_err[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:3642:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char bad_thread_num[32] = "badnumber";
data/civetweb-1.13+dfsg/unittest/public_server.c:3645:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char errmsg[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:3648:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char client_err[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:3652:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char *OPTIONS[32];
data/civetweb-1.13+dfsg/unittest/public_server.c:3702:2: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(bad_thread_num, "%u", MAX_WORKER_THREADS + 1);
data/civetweb-1.13+dfsg/unittest/public_server.c:3704:2: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(bad_thread_num, "%lu", 1000000000lu);
data/civetweb-1.13+dfsg/unittest/public_server.c:3730:2: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(bad_thread_num, "%i", 1);
data/civetweb-1.13+dfsg/unittest/public_server.c:3768:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen("error.htm", "wt");
data/civetweb-1.13+dfsg/unittest/public_server.c:3800:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen("error4xx.htm", "wt");
data/civetweb-1.13+dfsg/unittest/public_server.c:3832:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen("error404.htm", "wt");
data/civetweb-1.13+dfsg/unittest/public_server.c:3919:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char *OPTIONS[32];
data/civetweb-1.13+dfsg/unittest/public_server.c:3924:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char client_err_buf[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:3925:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char client_data_buf[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:3930:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1024];
data/civetweb-1.13+dfsg/unittest/public_server.c:3989:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen("access.log", "r");
data/civetweb-1.13+dfsg/unittest/public_server.c:4003:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen("error.log", "r");
data/civetweb-1.13+dfsg/unittest/public_server.c:4027:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen("access.log", "r");
data/civetweb-1.13+dfsg/unittest/public_server.c:4039:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen("error.log", "r");
data/civetweb-1.13+dfsg/unittest/public_server.c:4124:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char *OPTIONS[32];
data/civetweb-1.13+dfsg/unittest/public_server.c:4129:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char client_err_buf[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:4130:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char client_data_buf[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:4163:2: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(client_err_buf, "reset-content");
data/civetweb-1.13+dfsg/unittest/public_server.c:4276:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char *OPTIONS[32];
data/civetweb-1.13+dfsg/unittest/public_server.c:4281:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char errmsg[256] = {0};
data/civetweb-1.13+dfsg/unittest/public_server.c:4285:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char client_err_buf[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:4286:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char client_data_buf[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:4409:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char path[4096] = {0};
data/civetweb-1.13+dfsg/unittest/public_server.c:4481:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char client_err_buf[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:4482:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char client_data_buf[1024];
data/civetweb-1.13+dfsg/unittest/public_server.c:4486:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char check_data[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:4488:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char errmsg[256] = {0};
data/civetweb-1.13+dfsg/unittest/public_server.c:4560:2: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(check_data, "(%i bytes saved)", test_mg_store_body_con_len);
data/civetweb-1.13+dfsg/unittest/public_server.c:4608:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char *OPTIONS[32];
data/civetweb-1.13+dfsg/unittest/public_server.c:4616:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char client_err_buf[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:4617:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char client_data_buf[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:4726:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char client_err_buf[256];
data/civetweb-1.13+dfsg/unittest/public_server.c:4727:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char client_data_buf[4096];
data/civetweb-1.13+dfsg/unittest/public_server.c:5006:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char *OPTIONS[32];
data/civetweb-1.13+dfsg/unittest/shared.c:34:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char s_test_directory[1024] = {'\0'};
data/civetweb-1.13+dfsg/unittest/testclient.c:53:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char rbuffer[1024];
data/civetweb-1.13+dfsg/unittest/testclient.c:68:11: [2] (integer) atol:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
ret = atol(rbuffer + 9);
data/civetweb-1.13+dfsg/unittest/testclient.c:79:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char wbuffer[256];
data/civetweb-1.13+dfsg/unittest/testclient.c:92:17: [2] (integer) atol:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
con_count = atol(argv[3]);
data/civetweb-1.13+dfsg/unittest/testclient.c:96:14: [2] (integer) atol:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
portno = atol(argv[2]);
data/civetweb-1.13+dfsg/unittest/testclient.c:110:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(server->h_addr, &serv_addr.sin_addr.s_addr, server->h_length);
data/civetweb-1.13+dfsg/unittest/testclient.c:113:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(wbuffer, "GET / HTTP/1.0\r\n\r\n");
data/civetweb-1.13+dfsg/examples/embedded_c/embedded_c.c:444:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(context->file[context->index - 1].name, filename, 128);
data/civetweb-1.13+dfsg/examples/embedded_c/embedded_c.c:813:59: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
mg_websocket_write(conn, MG_WEBSOCKET_OPCODE_TEXT, text, strlen(text));
data/civetweb-1.13+dfsg/examples/embedded_c/embedded_c.c:880:3: [1] (obsolete) usleep:
This C routine is considered obsolete (as opposed to the shell command by
the same name). The interaction of this function with SIGALRM and other
timer functions such as sleep(), alarm(), setitimer(), and nanosleep() is
unspecified (CWE-676). Use nanosleep(2) or setitimer(2) instead.
usleep(1000);
data/civetweb-1.13+dfsg/examples/embedded_c/embedded_c.c:902:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
textlen = strlen(text);
data/civetweb-1.13+dfsg/examples/embedded_cpp/embedded_cpp.cpp:223:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(buf)>255) {
data/civetweb-1.13+dfsg/examples/embedded_cpp/embedded_cpp.cpp:236:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(buf)>1020) {
data/civetweb-1.13+dfsg/examples/embedded_cpp/embedded_cpp.cpp:356:60: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
mg_websocket_write(conn, MG_WEBSOCKET_OPCODE_TEXT, text, strlen(text));
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:160:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
length = strlen((const char*)string) + sizeof("");
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:471:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
buffer->offset += strlen((const char*)buffer_pointer);
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:1016:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
buffer.length = strlen((const char*)value) + sizeof("");
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON.c:1317:26: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
raw_length = strlen(item->valuestring) + sizeof("");
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON_Utils.c:61:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
length = strlen((const char*)string) + sizeof("");
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON_Utils.c:205:76: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
unsigned char *full_pointer = (unsigned char*)cJSON_malloc(strlen((char*)target_pointer) + 20 + sizeof("/"));
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON_Utils.c:222:76: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
unsigned char *full_pointer = (unsigned char*)cJSON_malloc(strlen((char*)target_pointer) + pointer_encoded_length((unsigned char*)current_child->string) + 2);
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON_Utils.c:1092:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t path_length = strlen((const char*)path);
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON_Utils.c:1148:68: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
unsigned char *new_path = (unsigned char*)cJSON_malloc(strlen((const char*)path) + 20 + sizeof("/")); /* Allow space for 64bit int. log10(2^64) = 20 */
data/civetweb-1.13+dfsg/examples/rest/cJSON/cJSON_Utils.c:1217:42: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t path_length = strlen((const char*)path);
data/civetweb-1.13+dfsg/examples/rest/rest.c:39:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t json_str_len = strlen(json_str);
data/civetweb-1.13+dfsg/examples/ws_client/ws_client.c:213:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(greetings));
data/civetweb-1.13+dfsg/examples/ws_client/ws_client.c:244:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(greetings));
data/civetweb-1.13+dfsg/examples/ws_client/ws_client.c:267:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(txt));
data/civetweb-1.13+dfsg/examples/ws_client/ws_client.c:290:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(txt));
data/civetweb-1.13+dfsg/examples/ws_client/ws_client.c:303:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(txt));
data/civetweb-1.13+dfsg/examples/ws_client/ws_client.c:320:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(txt));
data/civetweb-1.13+dfsg/src/CivetServer.cpp:432:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
urlDecode(src, strlen(src), dst, is_form_url_encoded);
data/civetweb-1.13+dfsg/src/CivetServer.cpp:511:28: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
getParam(formParams, strlen(formParams), name, dst, occurrence);
data/civetweb-1.13+dfsg/src/CivetServer.cpp:515:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
getParam(queryString, strlen(queryString), name, dst, occurrence);
data/civetweb-1.13+dfsg/src/CivetServer.cpp:572:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
urlEncode(src, strlen(src), dst, append);
data/civetweb-1.13+dfsg/src/civetweb.c:645:9: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
#define read(x, y, z) (_read((x), (y), (unsigned)z))
data/civetweb-1.13+dfsg/src/civetweb.c:901:22: [1] (obsolete) usleep:
This C routine is considered obsolete (as opposed to the shell command by
the same name). The interaction of this function with SIGALRM and other
timer functions such as sleep(), alarm(), setitimer(), and nanosleep() is
unspecified (CWE-676). Use nanosleep(2) or setitimer(2) instead.
#define mg_sleep(x) (usleep((x)*1000))
data/civetweb-1.13+dfsg/src/civetweb.c:3215:11: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
s = (int)read(evhdl, &u, sizeof(u));
data/civetweb-1.13+dfsg/src/civetweb.c:3623:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return mg_strndup_ctx(str, strlen(str), ctx);
data/civetweb-1.13+dfsg/src/civetweb.c:3629:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return mg_strndup_ctx(str, strlen(str), NULL);
data/civetweb-1.13+dfsg/src/civetweb.c:3636:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t i, big_len = strlen(big_str), small_len = strlen(small_str);
data/civetweb-1.13+dfsg/src/civetweb.c:3636:51: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t i, big_len = strlen(big_str), small_len = strlen(small_str);
data/civetweb-1.13+dfsg/src/civetweb.c:4088:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(txt) == 3) {
data/civetweb-1.13+dfsg/src/civetweb.c:4430:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
list = val->ptr + strlen(val->ptr);
data/civetweb-1.13+dfsg/src/civetweb.c:4508:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = (ptrdiff_t)strlen(str + j);
data/civetweb-1.13+dfsg/src/civetweb.c:4535:31: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return match_prefix(pattern, strlen(pattern), str);
data/civetweb-1.13+dfsg/src/civetweb.c:5011:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = (int)strlen(path_buf);
data/civetweb-1.13+dfsg/src/civetweb.c:5076:31: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
mg_write(conn, errmsg_buf, strlen(errmsg_buf));
data/civetweb-1.13+dfsg/src/civetweb.c:5218:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
content_len = strlen(reply);
data/civetweb-1.13+dfsg/src/civetweb.c:5476:47: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(void)memmove(path + i + 1, path + i + 2, strlen(path + i + 1));
data/civetweb-1.13+dfsg/src/civetweb.c:5596:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(path);
data/civetweb-1.13+dfsg/src/civetweb.c:5667:8: [1] (buffer) wcslen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if ((wcslen(wpath) + 2 < ARRAY_SIZE(wpath)) && (attrs != 0xFFFFFFFF)
data/civetweb-1.13+dfsg/src/civetweb.c:5971:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
char *e = s + strlen(s);
data/civetweb-1.13+dfsg/src/civetweb.c:6727:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
nread = (int)read(fileno(fp), buf, (size_t)len);
data/civetweb-1.13+dfsg/src/civetweb.c:7219:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
lenbuf_len = strlen(lenbuf);
data/civetweb-1.13+dfsg/src/civetweb.c:7416:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int len = (int)strlen(buf);
data/civetweb-1.13+dfsg/src/civetweb.c:7450:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
name_len = strlen(name);
data/civetweb-1.13+dfsg/src/civetweb.c:7607:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
name_len = (int)strlen(var_name);
data/civetweb-1.13+dfsg/src/civetweb.c:7608:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
end = s + strlen(s);
data/civetweb-1.13+dfsg/src/civetweb.c:7821:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t n = strlen(path);
data/civetweb-1.13+dfsg/src/civetweb.c:7970:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int uri_len = (int)strlen(uri);
data/civetweb-1.13+dfsg/src/civetweb.c:8063:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
tmp_str_len = strlen(filename);
data/civetweb-1.13+dfsg/src/civetweb.c:8092:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(filename + sep_pos + 1) + 1);
data/civetweb-1.13+dfsg/src/civetweb.c:8107:32: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t script_name_len = strlen(tmp_str);
data/civetweb-1.13+dfsg/src/civetweb.c:8112:32: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t subres_name_len = strlen(subres_name);
data/civetweb-1.13+dfsg/src/civetweb.c:8239:7: [1] (buffer) sscanf:
It's unclear if the %s limit in the format string is small enough
(CWE-120). Check that the limit is sufficiently small, or use a different
input function.
if ((sscanf(datetime,
data/civetweb-1.13+dfsg/src/civetweb.c:8248:10: [1] (buffer) sscanf:
It's unclear if the %s limit in the format string is small enough
(CWE-120). Check that the limit is sufficiently small, or use a different
input function.
|| (sscanf(datetime,
data/civetweb-1.13+dfsg/src/civetweb.c:8257:10: [1] (buffer) sscanf:
It's unclear if the %s limit in the format string is small enough
(CWE-120). Check that the limit is sufficiently small, or use a different
input function.
|| (sscanf(datetime,
data/civetweb-1.13+dfsg/src/civetweb.c:8266:10: [1] (buffer) sscanf:
It's unclear if the %s limit in the format string is small enough
(CWE-120). Check that the limit is sufficiently small, or use a different
input function.
|| (sscanf(datetime,
data/civetweb-1.13+dfsg/src/civetweb.c:8556:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
path_len = strlen(path);
data/civetweb-1.13+dfsg/src/civetweb.c:8579:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
path_len = strlen(path);
data/civetweb-1.13+dfsg/src/civetweb.c:8601:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
vec->len = strlen(vec->ptr);
data/civetweb-1.13+dfsg/src/civetweb.c:8634:43: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
md5_append(&ctx, (const md5_byte_t *)p, strlen(p));
data/civetweb-1.13+dfsg/src/civetweb.c:8664:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(response) != 32) {
data/civetweb-1.13+dfsg/src/civetweb.c:8735:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for (p = path, e = p + strlen(p) - 1; e > p; e--) {
data/civetweb-1.13+dfsg/src/civetweb.c:8935:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
l = strlen(workdata->buf);
data/civetweb-1.13+dfsg/src/civetweb.c:9274:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if ((strlen(fname) + 4) >= PATH_MAX) {
data/civetweb-1.13+dfsg/src/civetweb.c:9463:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t l = strlen(host + 1);
data/civetweb-1.13+dfsg/src/civetweb.c:9655:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
namesize = strlen(de->file_name) + 1;
data/civetweb-1.13+dfsg/src/civetweb.c:9666:52: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for (i = 0, p = esc; de->file_name[i]; i++, p += strlen(p)) {
data/civetweb-1.13+dfsg/src/civetweb.c:9996:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
esc = (char *)mg_malloc(strlen(title) * 5 + 1);
data/civetweb-1.13+dfsg/src/civetweb.c:9998:45: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for (i = 0, p = esc; title[i]; i++, p += strlen(p)) {
data/civetweb-1.13+dfsg/src/civetweb.c:10265:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
mime_vec.len = strlen(mime_type);
data/civetweb-1.13+dfsg/src/civetweb.c:11338:10: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
n += strlen(added + n) + 1;
data/civetweb-1.13+dfsg/src/civetweb.c:11359:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
n = strlen(added) + 1;
data/civetweb-1.13+dfsg/src/civetweb.c:11427:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
uri_len = (int)strlen(conn->request_info.local_uri);
data/civetweb-1.13+dfsg/src/civetweb.c:11446:25: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
uri_len - (int)strlen(conn->path_info),
data/civetweb-1.13+dfsg/src/civetweb.c:12224:10: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(path);
data/civetweb-1.13+dfsg/src/civetweb.c:12295:10: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
return fgetc(filep->access.fp);
data/civetweb-1.13+dfsg/src/civetweb.c:12510:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
href_size = (strlen(uri) + strlen(name)) * 3 + 1;
data/civetweb-1.13+dfsg/src/civetweb.c:12510:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
href_size = (strlen(uri) + strlen(name)) * 3 + 1;
data/civetweb-1.13+dfsg/src/civetweb.c:12678:56: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
SHA1_Update(&sha_ctx, (unsigned char *)buf, (uint32_t)strlen(buf));
data/civetweb-1.13+dfsg/src/civetweb.c:13380:33: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
: (unsigned long)strlen(protocol);
data/civetweb-1.13+dfsg/src/civetweb.c:13386:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if ((strlen(subprotocols->subprotocols[idx]) == len)
data/civetweb-1.13+dfsg/src/civetweb.c:13760:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
host->len = strlen(host_header);
data/civetweb-1.13+dfsg/src/civetweb.c:13782:10: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if ((strlen(sslhost) != host.len)
data/civetweb-1.13+dfsg/src/civetweb.c:13796:10: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if ((strlen(dom->config[AUTHENTICATION_DOMAIN]) == host.len)
data/civetweb-1.13+dfsg/src/civetweb.c:13856:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t slen1 = strlen(target_url);
data/civetweb-1.13+dfsg/src/civetweb.c:13857:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t slen2 = strlen(conn->request_info.query_string);
data/civetweb-1.13+dfsg/src/civetweb.c:13897:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t urilen = strlen(uri);
data/civetweb-1.13+dfsg/src/civetweb.c:14171:19: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t urilen = strlen(uri);
data/civetweb-1.13+dfsg/src/civetweb.c:14341:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
uri_len = (int)strlen(ri->local_uri);
data/civetweb-1.13+dfsg/src/civetweb.c:14358:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
uri_len = (int)strlen(ri->local_uri);
data/civetweb-1.13+dfsg/src/civetweb.c:14730:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t len = strlen(ri->request_uri);
data/civetweb-1.13+dfsg/src/civetweb.c:15107:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int portslen = (int)strlen(ports);
data/civetweb-1.13+dfsg/src/civetweb.c:16044:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t cur_len = strlen(ebuf);
data/civetweb-1.13+dfsg/src/civetweb.c:16467:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
*len = (unsigned int)strlen((const char *)data);
data/civetweb-1.13+dfsg/src/civetweb.c:16479:40: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
unsigned int alpn_len = (unsigned int)strlen((char *)alpn_proto_list);
data/civetweb-1.13+dfsg/src/civetweb.c:16624:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(phys_ctx->dd.config[LISTENING_PORTS]));
data/civetweb-1.13+dfsg/src/civetweb.c:16627:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(dom_ctx->config[AUTHENTICATION_DOMAIN]));
data/civetweb-1.13+dfsg/src/civetweb.c:17710:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
server_domain_len = strlen(server_domain);
data/civetweb-1.13+dfsg/src/civetweb.c:20352:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t len = strlen(src);
data/civetweb-1.13+dfsg/src/main.c:432:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(str) + 1;
data/civetweb-1.13+dfsg/src/main.c:472:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memmove(d + 1, d + 2, strlen(d + 1));
data/civetweb-1.13+dfsg/src/main.c:476:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memmove(d + 1, d + 2, strlen(d + 1));
data/civetweb-1.13+dfsg/src/main.c:480:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memmove(d + 1, d + 2, strlen(d + 1));
data/civetweb-1.13+dfsg/src/main.c:484:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memmove(d + 1, d + 2, strlen(d + 1));
data/civetweb-1.13+dfsg/src/main.c:488:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memmove(d + 1, d + 2, strlen(d + 1));
data/civetweb-1.13+dfsg/src/main.c:492:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memmove(d + 1, d + 2, strlen(d + 1));
data/civetweb-1.13+dfsg/src/main.c:496:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memmove(d + 1, d + 2, strlen(d + 1));
data/civetweb-1.13+dfsg/src/main.c:509:31: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memmove(d + mbl, d + 6, strlen(d + 5));
data/civetweb-1.13+dfsg/src/main.c:523:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memmove(d + 1, d + 2, strlen(d + 1));
data/civetweb-1.13+dfsg/src/main.c:529:28: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memmove(d + 1, d + 4, strlen(d + 3));
data/civetweb-1.13+dfsg/src/main.c:537:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memmove(d + 1, d + 2, strlen(d + 1));
data/civetweb-1.13+dfsg/src/main.c:541:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memmove(d + 1, d + 2, strlen(d + 1));
data/civetweb-1.13+dfsg/src/main.c:545:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memmove(d + 1, d + 2, strlen(d + 1));
data/civetweb-1.13+dfsg/src/main.c:549:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memmove(d + 1, d + 2, strlen(d + 1));
data/civetweb-1.13+dfsg/src/main.c:735:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(char *)malloc(strlen(options[2 * i + 1])
data/civetweb-1.13+dfsg/src/main.c:736:26: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
+ strlen(multi_sep) + strlen(value) + 1);
data/civetweb-1.13+dfsg/src/main.c:736:46: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
+ strlen(multi_sep) + strlen(value) + 1);
data/civetweb-1.13+dfsg/src/main.c:804:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for (j = strlen(p); (j > 0)
data/civetweb-1.13+dfsg/src/main.c:945:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
DEBUG_ASSERT((strlen(mg_version()) + 12) < sizeof(g_server_base_name));
data/civetweb-1.13+dfsg/src/main.c:1010:9: [1] (buffer) MultiByteToWideChar:
Requires maximum length in CHARACTERS, not bytes (CWE-120). Risk is very
low, the length appears to be in characters not bytes.
len = MultiByteToWideChar(
data/civetweb-1.13+dfsg/src/main.c:1059:3: [1] (buffer) strncat:
Easily used incorrectly (e.g., incorrectly computing the correct maximum
size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf,
or automatically resizing strings. Risk is low because the source is a
constant character.
strncat(path, "/", sizeof(path) - strlen(path) - 1);
data/civetweb-1.13+dfsg/src/main.c:1059:37: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strncat(path, "/", sizeof(path) - strlen(path) - 1);
data/civetweb-1.13+dfsg/src/main.c:1060:3: [1] (buffer) strncat:
Easily used incorrectly (e.g., incorrectly computing the correct maximum
size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf,
or automatically resizing strings.
strncat(path, option_value, sizeof(path) - strlen(path) - 1);
data/civetweb-1.13+dfsg/src/main.c:1060:46: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strncat(path, option_value, sizeof(path) - strlen(path) - 1);
data/civetweb-1.13+dfsg/src/main.c:1808:26: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
title = (char *)malloc(strlen(g_server_name) + 16);
data/civetweb-1.13+dfsg/src/main.c:1899:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
DEBUG_ASSERT(strlen(inBuf->buffer) < inBuf->buflen);
data/civetweb-1.13+dfsg/src/main.c:2185:33: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
WORD cap_len = caption ? (WORD)strlen(caption) : 0;
data/civetweb-1.13+dfsg/src/main.c:2834:3: [1] (buffer) strncat:
Easily used incorrectly (e.g., incorrectly computing the correct maximum
size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf,
or automatically resizing strings. Risk is low because the source is a
constant character.
strncat(path, " ", sizeof(path) - 1 - strlen(path));
data/civetweb-1.13+dfsg/src/main.c:2834:41: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strncat(path, " ", sizeof(path) - 1 - strlen(path));
data/civetweb-1.13+dfsg/src/main.c:2835:3: [1] (buffer) strncat:
Easily used incorrectly (e.g., incorrectly computing the correct maximum
size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf,
or automatically resizing strings.
strncat(path, service_magic_argument, sizeof(path) - 1 - strlen(path));
data/civetweb-1.13+dfsg/src/main.c:2835:60: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strncat(path, service_magic_argument, sizeof(path) - 1 - strlen(path));
data/civetweb-1.13+dfsg/unittest/cgi_test.c:27:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
fwrite(response_header, 1, strlen(response_header), stdout);
data/civetweb-1.13+dfsg/unittest/main.c:56:32: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
const size_t suite_arg_size = strlen(suite_arg);
data/civetweb-1.13+dfsg/unittest/main.c:58:36: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
const size_t test_case_arg_size = strlen(test_case_arg);
data/civetweb-1.13+dfsg/unittest/main.c:60:35: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
const size_t test_dir_arg_size = strlen(test_dir_arg);
data/civetweb-1.13+dfsg/unittest/main.c:62:35: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
const size_t test_log_arg_size = strlen(test_log_arg);
data/civetweb-1.13+dfsg/unittest/main.c:81:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
&& (strlen(argv[i]) > suite_arg_size)) {
data/civetweb-1.13+dfsg/unittest/main.c:84:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
&& (strlen(argv[i]) > test_case_arg_size)) {
data/civetweb-1.13+dfsg/unittest/main.c:87:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
&& (strlen(argv[i]) > test_dir_arg_size)) {
data/civetweb-1.13+dfsg/unittest/main.c:90:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
&& (strlen(argv[i]) > test_log_arg_size)) {
data/civetweb-1.13+dfsg/unittest/main.c:92:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if ((strlen(test_log_prefix) + 16) > FILENAME_LEN) {
data/civetweb-1.13+dfsg/unittest/private.c:98:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int lenreq1 = (int)strlen(req1);
data/civetweb-1.13+dfsg/unittest/private.c:99:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int lenreq2 = (int)strlen(req2);
data/civetweb-1.13+dfsg/unittest/private.c:100:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int lenreq3 = (int)strlen(req3);
data/civetweb-1.13+dfsg/unittest/private.c:101:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int lenreq4 = (int)strlen(req4);
data/civetweb-1.13+dfsg/unittest/private.c:102:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int lenreq5 = (int)strlen(req5);
data/civetweb-1.13+dfsg/unittest/private.c:103:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int lenreq6 = (int)strlen(req6);
data/civetweb-1.13+dfsg/unittest/private.c:104:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int lenreq7 = (int)strlen(req7);
data/civetweb-1.13+dfsg/unittest/private.c:105:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int lenreq8 = (int)strlen(req8);
data/civetweb-1.13+dfsg/unittest/private.c:106:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int lenreq9 = (int)strlen(req9);
data/civetweb-1.13+dfsg/unittest/private.c:107:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int lenreq10 = (int)strlen(req10);
data/civetweb-1.13+dfsg/unittest/private.c:108:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int lenreq11 = (int)strlen(req11);
data/civetweb-1.13+dfsg/unittest/private.c:109:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int lenreq12 = (int)strlen(req12);
data/civetweb-1.13+dfsg/unittest/private.c:233:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int lenreq1 = (int)strlen(req1);
data/civetweb-1.13+dfsg/unittest/private.c:234:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int lenreq2 = (int)strlen(req2);
data/civetweb-1.13+dfsg/unittest/private.c:235:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int lenreq3 = (int)strlen(req3);
data/civetweb-1.13+dfsg/unittest/private.c:236:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int lenreq4 = (int)strlen(req4);
data/civetweb-1.13+dfsg/unittest/private.c:669:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
vec.len = strlen(vec.ptr);
data/civetweb-1.13+dfsg/unittest/private.c:699:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
vec.len = strlen(vec.ptr);
data/civetweb-1.13+dfsg/unittest/private.c:758:45: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
base64_encode((unsigned char *)alpha, (int)strlen(alpha), buf);
data/civetweb-1.13+dfsg/unittest/private.c:762:48: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
base64_encode((unsigned char *)nonalpha, (int)strlen(nonalpha), buf);
data/civetweb-1.13+dfsg/unittest/private.c:770:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(int)strlen(alpha_b64_enc),
data/civetweb-1.13+dfsg/unittest/private.c:774:53: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_uint_eq((unsigned int)len, (unsigned int)strlen(alpha));
data/civetweb-1.13+dfsg/unittest/private.c:785:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(ret, (int)strlen(buf));
data/civetweb-1.13+dfsg/unittest/private.c:786:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(ret, (int)strlen(alpha));
data/civetweb-1.13+dfsg/unittest/private.c:791:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(ret, (int)strlen(buf));
data/civetweb-1.13+dfsg/unittest/private.c:792:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(ret, (int)strlen(nonalpha_url_enc1));
data/civetweb-1.13+dfsg/unittest/private.c:796:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ret = mg_url_decode(alpha, (int)strlen(alpha), buf, sizeof(buf), 0);
data/civetweb-1.13+dfsg/unittest/private.c:797:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(ret, (int)strlen(buf));
data/civetweb-1.13+dfsg/unittest/private.c:798:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(ret, (int)strlen(alpha));
data/civetweb-1.13+dfsg/unittest/private.c:803:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
nonalpha_url_enc1, (int)strlen(nonalpha_url_enc1), buf, sizeof(buf), 0);
data/civetweb-1.13+dfsg/unittest/private.c:804:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(ret, (int)strlen(buf));
data/civetweb-1.13+dfsg/unittest/private.c:805:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(ret, (int)strlen(nonalpha));
data/civetweb-1.13+dfsg/unittest/private.c:810:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
nonalpha_url_enc2, (int)strlen(nonalpha_url_enc2), buf, sizeof(buf), 0);
data/civetweb-1.13+dfsg/unittest/private.c:811:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(ret, (int)strlen(buf));
data/civetweb-1.13+dfsg/unittest/private.c:812:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(ret, (int)strlen(nonalpha));
data/civetweb-1.13+dfsg/unittest/private.c:954:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_uint_eq(strlen(str), 40);
data/civetweb-1.13+dfsg/unittest/private.c:962:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_uint_eq(strlen(str), 40);
data/civetweb-1.13+dfsg/unittest/private.c:970:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_uint_eq(strlen(str), 40);
data/civetweb-1.13+dfsg/unittest/private.c:976:55: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
SHA1_Update(&sha_ctx, (uint8_t *)test_str, (uint32_t)strlen(test_str));
data/civetweb-1.13+dfsg/unittest/private.c:979:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_uint_eq(strlen(str), 40);
data/civetweb-1.13+dfsg/unittest/private.c:989:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_uint_eq(strlen(str), 40);
data/civetweb-1.13+dfsg/unittest/private.c:999:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_uint_eq(strlen(str), 40);
data/civetweb-1.13+dfsg/unittest/public_func.c:114:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ret = (int)strlen(buf);
data/civetweb-1.13+dfsg/unittest/public_func.c:126:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = (int)strlen(buf);
data/civetweb-1.13+dfsg/unittest/public_func.c:138:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = (int)strlen(buf);
data/civetweb-1.13+dfsg/unittest/public_func.c:174:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = (int)strlen(default_options[i].name);
data/civetweb-1.13+dfsg/unittest/public_func.c:340:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
longquery, strlen(longquery), "notfound", buf, sizeof(buf), 0);
data/civetweb-1.13+dfsg/unittest/public_func.c:345:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
shortquery, strlen(shortquery), "notfound", buf, sizeof(buf), 0);
data/civetweb-1.13+dfsg/unittest/public_func.c:350:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(shortquery),
data/civetweb-1.13+dfsg/unittest/public_func.c:359:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
shortquery, strlen(shortquery), "key1", buf, sizeof(buf), 1);
data/civetweb-1.13+dfsg/unittest/public_func.c:365:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
shortquery, strlen(shortquery), "key1", buf, sizeof(buf), 0);
data/civetweb-1.13+dfsg/unittest/public_func.c:371:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
shortquery, strlen(shortquery), "key2", buf, sizeof(buf), 0);
data/civetweb-1.13+dfsg/unittest/public_func.c:377:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
shortquery, strlen(shortquery), "key3", buf, sizeof(buf), 0);
data/civetweb-1.13+dfsg/unittest/public_func.c:383:31: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ret = mg_get_var(shortquery, strlen(shortquery), "key1", buf, sizeof(buf));
data/civetweb-1.13+dfsg/unittest/public_func.c:390:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
mg_get_var2(longquery, strlen(longquery), "key7", buf, sizeof(buf), 0);
data/civetweb-1.13+dfsg/unittest/public_func.c:398:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
mg_get_var2(longquery, strlen(longquery), "key7", buf, sizeof(buf), 1);
data/civetweb-1.13+dfsg/unittest/public_func.c:405:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
mg_get_var2(longquery, strlen(longquery), "key5", buf, sizeof(buf), 0);
data/civetweb-1.13+dfsg/unittest/public_func.c:412:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
mg_get_var2(longquery, strlen(longquery), "key6", buf, sizeof(buf), 0);
data/civetweb-1.13+dfsg/unittest/public_func.c:547:2: [1] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant character.
strcpy(buf, "");
data/civetweb-1.13+dfsg/unittest/public_func.c:605:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(resp);
data/civetweb-1.13+dfsg/unittest/public_server.c:113:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
l = strlen(res);
data/civetweb-1.13+dfsg/unittest/public_server.c:176:2: [1] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant character.
strcat(buf, "\\");
data/civetweb-1.13+dfsg/unittest/public_server.c:181:2: [1] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant character.
strcat(buf, "/");
data/civetweb-1.13+dfsg/unittest/public_server.c:253:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(ud, message, 255);
data/civetweb-1.13+dfsg/unittest/public_server.c:1346:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t len_check_1 = strlen(opt);
data/civetweb-1.13+dfsg/unittest/public_server.c:1347:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t len_check_2 = strlen(cgi_env_opt);
data/civetweb-1.13+dfsg/unittest/public_server.c:1424:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(i, (int)strlen(expected));
data/civetweb-1.13+dfsg/unittest/public_server.c:1448:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(i, (int)strlen(expected));
data/civetweb-1.13+dfsg/unittest/public_server.c:1463:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(i, (int)strlen(expected));
data/civetweb-1.13+dfsg/unittest/public_server.c:1479:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(i, (int)strlen(expected));
data/civetweb-1.13+dfsg/unittest/public_server.c:1516:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(i, (int)strlen(expected));
data/civetweb-1.13+dfsg/unittest/public_server.c:1551:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
i = (int)strlen(plain_file_content);
data/civetweb-1.13+dfsg/unittest/public_server.c:1572:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
fwrite(cgi_script_content, strlen(cgi_script_content), 1, f);
data/civetweb-1.13+dfsg/unittest/public_server.c:1581:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
fwrite(cgi_script_content, strlen(cgi_script_content), 1, f);
data/civetweb-1.13+dfsg/unittest/public_server.c:1592:35: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(void)fwrite(cgi_script_content, strlen(cgi_script_content), 1, f);
data/civetweb-1.13+dfsg/unittest/public_server.c:1847:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(i, (int)strlen(expected));
data/civetweb-1.13+dfsg/unittest/public_server.c:1873:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(i, (int)strlen(expected));
data/civetweb-1.13+dfsg/unittest/public_server.c:1900:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(i, (int)strlen(expected));
data/civetweb-1.13+dfsg/unittest/public_server.c:1927:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(i, (int)strlen(expected));
data/civetweb-1.13+dfsg/unittest/public_server.c:2329:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(path, key, pathlen - 8);
data/civetweb-1.13+dfsg/unittest/public_server.c:2492:44: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(myfile_content_len, (int)strlen(myfile_content));
data/civetweb-1.13+dfsg/unittest/public_server.c:2514:45: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(myfile_content_len, (int)strlen(myfile_content));
data/civetweb-1.13+dfsg/unittest/public_server.c:2639:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
lenbuf_len = strlen(lenbuf);
data/civetweb-1.13+dfsg/unittest/public_server.c:2657:48: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
send_chunk_stringl(conn, chunk, (unsigned int)strlen(chunk));
data/civetweb-1.13+dfsg/unittest/public_server.c:2857:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
body_len = strlen(multipart_body);
data/civetweb-1.13+dfsg/unittest/public_server.c:2908:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
body_len = strlen(multipart_body);
data/civetweb-1.13+dfsg/unittest/public_server.c:2955:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
body_len = strlen(multipart_body);
data/civetweb-1.13+dfsg/unittest/public_server.c:3153:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
bound_len = strlen(boundary);
data/civetweb-1.13+dfsg/unittest/public_server.c:3261:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(domain);
data/civetweb-1.13+dfsg/unittest/public_server.c:3348:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(str);
data/civetweb-1.13+dfsg/unittest/public_server.c:3350:49: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert(!strncmp(auth_request + len, domain, strlen(domain)));
data/civetweb-1.13+dfsg/unittest/public_server.c:3351:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len += strlen(domain);
data/civetweb-1.13+dfsg/unittest/public_server.c:3353:46: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert(!strncmp(auth_request + len, str, strlen(str)));
data/civetweb-1.13+dfsg/unittest/public_server.c:3354:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len += strlen(str);
data/civetweb-1.13+dfsg/unittest/public_server.c:3994:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = (int)strlen(buf);
data/civetweb-1.13+dfsg/unittest/public_server.c:4044:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = (int)strlen(buf);
data/civetweb-1.13+dfsg/unittest/public_server.c:4084:28: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
blocklen = (unsigned long)strlen(block);
data/civetweb-1.13+dfsg/unittest/public_server.c:4259:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
blocklen = strlen(block);
data/civetweb-1.13+dfsg/unittest/public_server.c:4885:37: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
unsigned long len = (unsigned long)strlen(msg) + 1;
data/civetweb-1.13+dfsg/unittest/public_server.c:4902:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = (unsigned long)strlen(msg) + 1;
data/civetweb-1.13+dfsg/unittest/shared.c:45:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(s_test_directory, path, sizeof(s_test_directory) - 1);
data/civetweb-1.13+dfsg/unittest/testclient.c:39:19: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int req_len = strlen(request);
data/civetweb-1.13+dfsg/unittest/testclient.c:57:9: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
n = read(conn, rbuffer, sizeof(rbuffer));
ANALYSIS SUMMARY:
Hits = 857
Lines analyzed = 43616 in approximately 1.69 seconds (25762 lines/second)
Physical Source Lines of Code (SLOC) = 31496
Hits@level = [0] 226 [1] 250 [2] 437 [3] 14 [4] 156 [5] 0
Hits@level+ = [0+] 1083 [1+] 857 [2+] 607 [3+] 170 [4+] 156 [5+] 0
Hits/KSLOC@level+ = [0+] 34.3853 [1+] 27.2098 [2+] 19.2723 [3+] 5.39751 [4+] 4.95301 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.