Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/dbus-python-1.2.16/dbus-gmain/dbus-gmain.h
Examining data/dbus-python-1.2.16/dbus-gmain/dbus-gmain.c
Examining data/dbus-python-1.2.16/dbus-gmain/tests/test-thread-server.c
Examining data/dbus-python-1.2.16/dbus-gmain/tests/test-thread.h
Examining data/dbus-python-1.2.16/dbus-gmain/tests/test-thread-client.c
Examining data/dbus-python-1.2.16/dbus-gmain/tests/30574.c
Examining data/dbus-python-1.2.16/dbus-gmain/tests/util.h
Examining data/dbus-python-1.2.16/dbus-gmain/tests/util.c
Examining data/dbus-python-1.2.16/test/import-repeatedly.c
Examining data/dbus-python-1.2.16/test/dbus_py_test.c
Examining data/dbus-python-1.2.16/include/dbus/dbus-python.h
Examining data/dbus-python-1.2.16/dbus_glib_bindings/module.c
Examining data/dbus-python-1.2.16/dbus_bindings/validation.c
Examining data/dbus-python-1.2.16/dbus_bindings/types-internal.h
Examining data/dbus-python-1.2.16/dbus_bindings/string.c
Examining data/dbus-python-1.2.16/dbus_bindings/signature.c
Examining data/dbus-python-1.2.16/dbus_bindings/server.c
Examining data/dbus-python-1.2.16/dbus_bindings/pending-call.c
Examining data/dbus-python-1.2.16/dbus_bindings/module.c
Examining data/dbus-python-1.2.16/dbus_bindings/message-internal.h
Examining data/dbus-python-1.2.16/dbus_bindings/message-get-args.c
Examining data/dbus-python-1.2.16/dbus_bindings/message.c
Examining data/dbus-python-1.2.16/dbus_bindings/message-append.c
Examining data/dbus-python-1.2.16/dbus_bindings/mainloop.c
Examining data/dbus-python-1.2.16/dbus_bindings/libdbusconn.c
Examining data/dbus-python-1.2.16/dbus_bindings/unixfd.c
Examining data/dbus-python-1.2.16/dbus_bindings/int.c
Examining data/dbus-python-1.2.16/dbus_bindings/generic.c
Examining data/dbus-python-1.2.16/dbus_bindings/float.c
Examining data/dbus-python-1.2.16/dbus_bindings/exceptions.c
Examining data/dbus-python-1.2.16/dbus_bindings/debug.c
Examining data/dbus-python-1.2.16/dbus_bindings/dbus_bindings-internal.h
Examining data/dbus-python-1.2.16/dbus_bindings/containers.c
Examining data/dbus-python-1.2.16/dbus_bindings/conn-methods.c
Examining data/dbus-python-1.2.16/dbus_bindings/conn-internal.h
Examining data/dbus-python-1.2.16/dbus_bindings/conn.c
Examining data/dbus-python-1.2.16/dbus_bindings/compat-internal.h
Examining data/dbus-python-1.2.16/dbus_bindings/bytes.c
Examining data/dbus-python-1.2.16/dbus_bindings/bus.c
Examining data/dbus-python-1.2.16/dbus_bindings/abstract.c
FINAL RESULTS:
data/dbus-python-1.2.16/dbus_bindings/bytes.c:148:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char str[2] = { 0, 0 };
data/dbus-python-1.2.16/dbus_bindings/message-get-args.c:136:45: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(Py_ssize_t)strlen(sig_str)-3);
data/dbus-python-1.2.16/dbus_bindings/message-get-args.c:244:55: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
unicode = PyUnicode_DecodeUTF8(u.str, strlen(u.str), NULL);
data/dbus-python-1.2.16/dbus_bindings/string.c:82:41: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
unicode = PyUnicode_DecodeUTF8(str, strlen(str), NULL);
data/dbus-python-1.2.16/dbus_bindings/validation.c:56:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(name) > 255) {
data/dbus-python-1.2.16/dbus_bindings/validation.c:122:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(name) > 255) {
data/dbus-python-1.2.16/dbus_bindings/validation.c:157:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(name) > 255) {
ANALYSIS SUMMARY:
Hits = 7
Lines analyzed = 13227 in approximately 0.40 seconds (33226 lines/second)
Physical Source Lines of Code (SLOC) = 10146
Hits@level = [0] 35 [1] 6 [2] 1 [3] 0 [4] 0 [5] 0
Hits@level+ = [0+] 42 [1+] 7 [2+] 1 [3+] 0 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 4.13956 [1+] 0.689927 [2+] 0.098561 [3+] 0 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.