Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/agent.c Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/agent.h Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/configurator.c Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/configurator.h Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/connection.c Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/connection.h Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/dialog.c Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/dialog.h Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/interfaces.h Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/main.c Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/main.h Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/openconnect_helper.c Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/openconnect_helper.h Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.h Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/settings.h Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/settings_content.c Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/settings_content.h Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/status.c Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/status.h Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/style.c Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/style.h Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/technology.c Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/technology.h Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/util.c Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/util.h Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/vpn.c Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/vpn.h Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/wireless.c Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/wireless.h Examining data/connman-gtk-1.1.1+git20180626.b72c6ab/src/settings.c FINAL RESULTS: data/connman-gtk-1.1.1+git20180626.b72c6ab/src/openconnect_helper.c:258:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[41] = {0, }; data/connman-gtk-1.1.1+git20180626.b72c6ab/src/status.c:83:13: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). GtkWidget *open, *exit; data/connman-gtk-1.1.1+git20180626.b72c6ab/src/status.c:90:19: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). g_signal_connect(open, "activate", G_CALLBACK(status_activate), data/connman-gtk-1.1.1+git20180626.b72c6ab/src/status.c:93:41: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). gtk_container_add(GTK_CONTAINER(menu), open); data/connman-gtk-1.1.1+git20180626.b72c6ab/src/util.c:160:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char str[INET_ADDRSTRLEN]; data/connman-gtk-1.1.1+git20180626.b72c6ab/src/util.c:166:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char str[INET6_ADDRSTRLEN]; data/connman-gtk-1.1.1+git20180626.b72c6ab/src/dialog.c:302:6: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if(strlen(params->log) >= max_log_length) { data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c:48:6: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if(strlen(failure)) data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c:438:34: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if(strncmp(ia, error->message, strlen(ia)) && data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c:439:33: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). strncmp(c, error->message, strlen(c)) && data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c:440:34: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). strncmp(ip, error->message, strlen(ip)) && data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c:441:34: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). strncmp(oa, error->message, strlen(oa)) && data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c:442:33: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). strncmp(f, error->message, strlen(f))) data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c:446:34: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). !strncmp(ia, error->message, strlen(ia))) data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c:505:5: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if(strlen(name)) data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c:641:12: [1] (buffer) equal: Function does not check the second iterator for over-read conditions (CWE-126). This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it. equal = equal && old && g_variant_equal(old, svalue); data/connman-gtk-1.1.1+git20180626.b72c6ab/src/service.c:647:5: [1] (buffer) equal: Function does not check the second iterator for over-read conditions (CWE-126). This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it. if(equal) data/connman-gtk-1.1.1+git20180626.b72c6ab/src/settings.c:227:6: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if(!strlen(cur)) { data/connman-gtk-1.1.1+git20180626.b72c6ab/src/settings.c:230:7: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if(!strlen(cur)) { data/connman-gtk-1.1.1+git20180626.b72c6ab/src/settings.c:361:34: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). !strlen(cur) || !strcmp("direct", cur)); data/connman-gtk-1.1.1+git20180626.b72c6ab/src/settings_content.c:66:46: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). !strcmp(content->subkey, "Gateway") && !strlen(str)) data/connman-gtk-1.1.1+git20180626.b72c6ab/src/settings_content.c:316:6: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if(!strlen(value)) { data/connman-gtk-1.1.1+git20180626.b72c6ab/src/wireless.c:94:12: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). int len = strlen(str); data/connman-gtk-1.1.1+git20180626.b72c6ab/src/wireless.c:102:12: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). int len = strlen(str); data/connman-gtk-1.1.1+git20180626.b72c6ab/src/wireless.c:263:5: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if(strlen(name)) { ANALYSIS SUMMARY: Hits = 25 Lines analyzed = 7484 in approximately 0.20 seconds (36904 lines/second) Physical Source Lines of Code (SLOC) = 5809 Hits@level = [0] 3 [1] 19 [2] 6 [3] 0 [4] 0 [5] 0 Hits@level+ = [0+] 28 [1+] 25 [2+] 6 [3+] 0 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 4.82011 [1+] 4.30367 [2+] 1.03288 [3+] 0 [4+] 0 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.