Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/agent.c
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/agent.h
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/configurator.c
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/configurator.h
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/connection.c
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/connection.h
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/dialog.c
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/dialog.h
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/interfaces.h
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/main.c
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/main.h
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/openconnect_helper.c
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/openconnect_helper.h
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.h
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/settings.h
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/settings_content.c
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/settings_content.h
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/status.c
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/status.h
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/style.c
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/style.h
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/technology.c
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/technology.h
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/util.c
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/util.h
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/vpn.c
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/vpn.h
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/wireless.c
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/wireless.h
Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/settings.c
FINAL RESULTS:
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/openconnect_helper.c:258:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[41] = {0, };
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/status.c:83:13: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
GtkWidget *open, *exit;
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/status.c:90:19: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
g_signal_connect(open, "activate", G_CALLBACK(status_activate),
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/status.c:93:41: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
gtk_container_add(GTK_CONTAINER(menu), open);
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/util.c:160:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[INET_ADDRSTRLEN];
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/util.c:166:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[INET6_ADDRSTRLEN];
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/dialog.c:302:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(strlen(params->log) >= max_log_length) {
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c:48:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(strlen(failure))
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c:438:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(strncmp(ia, error->message, strlen(ia)) &&
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c:439:33: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strncmp(c, error->message, strlen(c)) &&
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c:440:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strncmp(ip, error->message, strlen(ip)) &&
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c:441:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strncmp(oa, error->message, strlen(oa)) &&
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c:442:33: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strncmp(f, error->message, strlen(f)))
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c:446:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
!strncmp(ia, error->message, strlen(ia)))
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c:505:5: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(strlen(name))
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c:641:12: [1] (buffer) equal:
Function does not check the second iterator for over-read conditions
(CWE-126). This function is often discouraged by most C++ coding standards
in favor of its safer alternatives provided since C++14. Consider using a
form of this function that checks the second iterator before potentially
overflowing it.
equal = equal && old && g_variant_equal(old, svalue);
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c:647:5: [1] (buffer) equal:
Function does not check the second iterator for over-read conditions
(CWE-126). This function is often discouraged by most C++ coding standards
in favor of its safer alternatives provided since C++14. Consider using a
form of this function that checks the second iterator before potentially
overflowing it.
if(equal)
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/settings.c:227:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(!strlen(cur)) {
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/settings.c:230:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(!strlen(cur)) {
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/settings.c:361:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
!strlen(cur) || !strcmp("direct", cur));
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/settings_content.c:66:46: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
!strcmp(content->subkey, "Gateway") && !strlen(str))
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/settings_content.c:316:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(!strlen(value)) {
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/wireless.c:94:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int len = strlen(str);
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/wireless.c:102:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int len = strlen(str);
data/connman-gtk-1.1.1+git20180626.b72c6ab/src/wireless.c:263:5: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(strlen(name)) {
ANALYSIS SUMMARY:
Hits = 25
Lines analyzed = 7484 in approximately 0.20 seconds (36904 lines/second)
Physical Source Lines of Code (SLOC) = 5809
Hits@level = [0] 3 [1] 19 [2] 6 [3] 0 [4] 0 [5] 0
Hits@level+ = [0+] 28 [1+] 25 [2+] 6 [3+] 0 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 4.82011 [1+] 4.30367 [2+] 1.03288 [3+] 0 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.