Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/dtach-0.9/attach.c
Examining data/dtach-0.9/dtach.h
Examining data/dtach-0.9/master.c
Examining data/dtach-0.9/main.c

FINAL RESULTS:

data/dtach-0.9/master.c:215:6:  [5] (race) chmod:
  This accepts filename arguments; if an attacker can move those files, a
  race condition results. (CWE-362). Use fchmod( ) instead.
	if (chmod(name, 0600) < 0)
data/dtach-0.9/master.c:239:3:  [5] (race) chmod:
  This accepts filename arguments; if an attacker can move those files, a
  race condition results. (CWE-362). Use fchmod( ) instead.
		chmod(sockname, newmode);
data/dtach-0.9/attach.c:65:2:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
	strcpy(sockun.sun_path, name);
data/dtach-0.9/attach.c:92:3:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
		printf(EOS "\r\n[detached]\r\n");
data/dtach-0.9/attach.c:94:3:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
		printf(EOS "\r\n[got signal %d - dying]\r\n", sig);
data/dtach-0.9/attach.c:119:3:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
		printf(EOS "\r\n");
data/dtach-0.9/attach.c:137:3:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
		printf(EOS "\r\n[detached]\r\n");
data/dtach-0.9/attach.c:242:4:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
			printf(EOS "\r\n[select failed]\r\n");
data/dtach-0.9/attach.c:253:5:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
				printf(EOS "\r\n[EOF - dtach terminating]"
data/dtach-0.9/attach.c:259:5:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
				printf(EOS "\r\n[read returned an error]\r\n");
data/dtach-0.9/master.c:126:3:  [4] (shell) execvp:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
		execvp(*argv, argv);
data/dtach-0.9/master.c:133:4:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
			printf(EOS "\r\n");
data/dtach-0.9/master.c:198:2:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
	strcpy(sockun.sun_path, name);
data/dtach-0.9/master.c:717:3:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
		strcpy(name, buf);
data/dtach-0.9/attach.c:152:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char buf[BUFSIZE];
data/dtach-0.9/attach.c:166:16:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
			int dirfd = open(".", O_RDONLY);
data/dtach-0.9/attach.c:311:16:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
			int dirfd = open(".", O_RDONLY);
data/dtach-0.9/dtach.h:113:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		unsigned char buf[sizeof(struct winsize)];
data/dtach-0.9/master.c:146:19:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		the_pty.slave = open(buf, O_RDWR|O_NOCTTY);
data/dtach-0.9/master.c:247:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char buf[BUFSIZE];
data/dtach-0.9/master.c:480:11:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	nullfd = open("/dev/null", O_RDWR);
data/dtach-0.9/master.c:574:16:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
			int dirfd = open(".", O_RDONLY);
data/dtach-0.9/master.c:649:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		char buf[1024];
data/dtach-0.9/master.c:680:11:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	master = open("/dev/ptc", O_RDWR|O_NOCTTY);
data/dtach-0.9/master.c:687:10:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	slave = open(buf, O_RDWR|O_NOCTTY);
data/dtach-0.9/master.c:691:11:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	master = open("/dev/ptmx", O_RDWR);
data/dtach-0.9/master.c:702:10:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	slave = open(buf, O_RDWR|O_NOCTTY);
data/dtach-0.9/master.c:757:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		fd = open("/dev/tty", O_RDWR|O_NOCTTY);
data/dtach-0.9/master.c:765:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		fd = open(buf, O_RDWR);
data/dtach-0.9/master.c:768:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		fd = open("/dev/tty", O_WRONLY);
data/dtach-0.9/master.c:779:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		fd = open(buf, O_RDWR);
data/dtach-0.9/attach.c:55:6:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	if (strlen(name) > sizeof(sockun.sun_path) - 1)
data/dtach-0.9/attach.c:249:18:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
			ssize_t len = read(s, buf, sizeof(buf));
data/dtach-0.9/attach.c:273:10:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
			len = read(0, pkt.u.buf, sizeof(pkt.u.buf));
data/dtach-0.9/attach.c:342:9:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
		len = read(0, pkt.u.buf, sizeof(pkt.u.buf));
data/dtach-0.9/main.c:99:32:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		if (strncmp(*argv, "--help", strlen(*argv)) == 0)
data/dtach-0.9/main.c:101:40:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		else if (strncmp(*argv, "--version", strlen(*argv)) == 0)
data/dtach-0.9/master.c:188:6:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	if (strlen(name) > sizeof(sockun.sun_path) - 1)
data/dtach-0.9/master.c:254:8:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	len = read(the_pty.fd, buf, sizeof(buf));
data/dtach-0.9/master.c:362:8:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	len = read(p->fd, &pkt, sizeof(struct packet));
data/dtach-0.9/master.c:653:9:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
		len = read(fd[0], buf, sizeof(buf));

ANALYSIS SUMMARY:

Hits = 41
Lines analyzed = 1582 in approximately 0.07 seconds (22460 lines/second)
Physical Source Lines of Code (SLOC) = 1174
Hits@level = [0]  33 [1]  10 [2]  17 [3]   0 [4]  12 [5]   2
Hits@level+ = [0+]  74 [1+]  41 [2+]  31 [3+]  14 [4+]  14 [5+]   2
Hits/KSLOC@level+ = [0+] 63.0324 [1+] 34.9233 [2+] 26.4055 [3+] 11.925 [4+] 11.925 [5+] 1.70358
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.