Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/feedreader-2.10.0/libraries/htmlclean/htmlclean.c
Examining data/feedreader-2.10.0/libraries/htmlclean/htmlclean.h
Examining data/feedreader-2.10.0/libraries/htmlclean/main.c
Examining data/feedreader-2.10.0/libraries/htmlclean/test_htmlclean.c
Examining data/feedreader-2.10.0/libraries/libgd/gd-notification.c
Examining data/feedreader-2.10.0/libraries/libgd/gd-notification.h
Examining data/feedreader-2.10.0/libraries/libgd/gd-types-catalog.c
Examining data/feedreader-2.10.0/libraries/libgd/gd-types-catalog.h
Examining data/feedreader-2.10.0/libraries/libgd/gd.h
Examining data/feedreader-2.10.0/libraries/libgtkimageview/gtkimageview.h
Examining data/feedreader-2.10.0/libraries/libgtkimageview/gtkimageview.c
Examining data/feedreader-2.10.0/libraries/libmrss/mrss.h
Examining data/feedreader-2.10.0/libraries/libmrss/mrss_download.c
Examining data/feedreader-2.10.0/libraries/libmrss/mrss_edit.c
Examining data/feedreader-2.10.0/libraries/libmrss/mrss_free.c
Examining data/feedreader-2.10.0/libraries/libmrss/mrss_generic.c
Examining data/feedreader-2.10.0/libraries/libmrss/mrss_internal.h
Examining data/feedreader-2.10.0/libraries/libmrss/mrss_options.c
Examining data/feedreader-2.10.0/libraries/libmrss/mrss_parser.c
Examining data/feedreader-2.10.0/libraries/libmrss/mrss_search.c
Examining data/feedreader-2.10.0/libraries/libmrss/mrss_write.c
Examining data/feedreader-2.10.0/libraries/libnxml/nxml.h
Examining data/feedreader-2.10.0/libraries/libnxml/nxml_download.c
Examining data/feedreader-2.10.0/libraries/libnxml/nxml_easy.c
Examining data/feedreader-2.10.0/libraries/libnxml/nxml_edit.c
Examining data/feedreader-2.10.0/libraries/libnxml/nxml_error.c
Examining data/feedreader-2.10.0/libraries/libnxml/nxml_free.c
Examining data/feedreader-2.10.0/libraries/libnxml/nxml_init.c
Examining data/feedreader-2.10.0/libraries/libnxml/nxml_internal.h
Examining data/feedreader-2.10.0/libraries/libnxml/nxml_namespace.c
Examining data/feedreader-2.10.0/libraries/libnxml/nxml_string.c
Examining data/feedreader-2.10.0/libraries/libnxml/nxml_tools.c
Examining data/feedreader-2.10.0/libraries/libnxml/nxml_utf.c
Examining data/feedreader-2.10.0/libraries/libnxml/nxml_write.c
Examining data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c
Examining data/feedreader-2.10.0/libraries/rss-glib/rss-document-private.h
Examining data/feedreader-2.10.0/libraries/rss-glib/rss-document.c
Examining data/feedreader-2.10.0/libraries/rss-glib/rss-document.h
Examining data/feedreader-2.10.0/libraries/rss-glib/rss-glib.h
Examining data/feedreader-2.10.0/libraries/rss-glib/rss-item-private.h
Examining data/feedreader-2.10.0/libraries/rss-glib/rss-item.c
Examining data/feedreader-2.10.0/libraries/rss-glib/rss-item.h
Examining data/feedreader-2.10.0/libraries/rss-glib/rss-marshal.c
Examining data/feedreader-2.10.0/libraries/rss-glib/rss-marshal.h
Examining data/feedreader-2.10.0/libraries/rss-glib/rss-parser-private.h
Examining data/feedreader-2.10.0/libraries/rss-glib/rss-parser.c
Examining data/feedreader-2.10.0/libraries/rss-glib/rss-parser.h
Examining data/feedreader-2.10.0/libraries/rss-glib/rss-version.h
FINAL RESULTS:
data/feedreader-2.10.0/libraries/htmlclean/main.c:19:3: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(content, buffer);
data/feedreader-2.10.0/libraries/libmrss/mrss_parser.c:229:8: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (total + size, p);
data/feedreader-2.10.0/libraries/libmrss/mrss_write.c:1166:3: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
vfprintf ((FILE *) obj, str, va);
data/feedreader-2.10.0/libraries/libmrss/mrss_write.c:1179:9: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
len = vsnprintf (s, sizeof (s), str, va);
data/feedreader-2.10.0/libraries/libnxml/nxml_init.c:396:2: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
vfprintf(stderr, str, va);
data/feedreader-2.10.0/libraries/libnxml/nxml_write.c:347:2: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
vfprintf((FILE *)obj, str, va);
data/feedreader-2.10.0/libraries/libnxml/nxml_write.c:360:8: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
len = vsnprintf(s, sizeof(s), str, va);
data/feedreader-2.10.0/libraries/libnxml/nxml_write.c:368:3: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(*buffer, s);
data/feedreader-2.10.0/libraries/libnxml/nxml_write.c:377:3: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(*buffer, s);
data/feedreader-2.10.0/libraries/htmlclean/main.c:11:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[BUFFER_SIZE];
data/feedreader-2.10.0/libraries/libmrss/mrss_parser.c:262:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char datebuf[256];
data/feedreader-2.10.0/libraries/libmrss/mrss_parser.c:483:28: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
data->image_width = atoi (c);
data/feedreader-2.10.0/libraries/libmrss/mrss_parser.c:491:29: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
data->image_height = atoi (c);
data/feedreader-2.10.0/libraries/libmrss/mrss_parser.c:681:30: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
item->enclosure_length = atoi (attr);
data/feedreader-2.10.0/libraries/libmrss/mrss_parser.c:1112:22: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
data->cloud_port = atoi (attr);
data/feedreader-2.10.0/libraries/libmrss/mrss_parser.c:1133:20: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
data->ttl = atoi (c);
data/feedreader-2.10.0/libraries/libmrss/mrss_write.c:27:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1024];
data/feedreader-2.10.0/libraries/libmrss/mrss_write.c:1174:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char s[4096];
data/feedreader-2.10.0/libraries/libmrss/mrss_write.c:1210:14: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!(fl = fopen (file, "wb")))
data/feedreader-2.10.0/libraries/libnxml/nxml_download.c:46:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&(mem->mm[mem->size]), ptr, realsize);
data/feedreader-2.10.0/libraries/libnxml/nxml_free.c:173:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&priv, &data->priv, sizeof(__nxml_private_t));
data/feedreader-2.10.0/libraries/libnxml/nxml_free.c:175:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&data->priv, &priv, sizeof(__nxml_private_t));
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:104:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[2048];
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:117:14: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
value = atoi(buf);
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:135:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1024];
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:181:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char attr[1024];
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:192:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&attr[0], *buffer, byte);
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:200:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&attr[i], *buffer, byte);
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:364:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[1024];
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:423:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&name[0], *buffer, byte);
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:431:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&name[i], *buffer, byte);
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:519:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[1024];
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:536:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&str[0], *buffer, byte);
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:544:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&str[i], *buffer, byte);
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:868:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[1024];
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:886:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&str[0], *buffer, byte);
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:894:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&str[i], *buffer, byte);
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:943:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[1024];
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:990:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&str[0], *buffer, byte);
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:998:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&str[i], *buffer, byte);
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:1417:12: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((fd = open(file, O_RDONLY)) < 0)
data/feedreader-2.10.0/libraries/libnxml/nxml_string.c:109:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(st->string + st->size, what, size);
data/feedreader-2.10.0/libraries/libnxml/nxml_tools.c:92:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(attr, *buffer, i);
data/feedreader-2.10.0/libraries/libnxml/nxml_utf.c:96:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&ret[j], x, b); \
data/feedreader-2.10.0/libraries/libnxml/nxml_utf.c:164:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char a[2];
data/feedreader-2.10.0/libraries/libnxml/nxml_utf.c:177:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char a[3];
data/feedreader-2.10.0/libraries/libnxml/nxml_utf.c:191:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char a[4];
data/feedreader-2.10.0/libraries/libnxml/nxml_utf.c:206:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char a[5];
data/feedreader-2.10.0/libraries/libnxml/nxml_utf.c:279:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char a[2];
data/feedreader-2.10.0/libraries/libnxml/nxml_utf.c:292:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char a[3];
data/feedreader-2.10.0/libraries/libnxml/nxml_utf.c:306:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char a[4];
data/feedreader-2.10.0/libraries/libnxml/nxml_utf.c:321:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char a[5];
data/feedreader-2.10.0/libraries/libnxml/nxml_write.c:27:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1024];
data/feedreader-2.10.0/libraries/libnxml/nxml_write.c:355:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char s[4096];
data/feedreader-2.10.0/libraries/libnxml/nxml_write.c:392:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!(fl = fopen(file, "wb")))
data/feedreader-2.10.0/libraries/htmlclean/htmlclean.c:36:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t len = strlen(text);
data/feedreader-2.10.0/libraries/htmlclean/htmlclean.c:70:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(text) == 0)
data/feedreader-2.10.0/libraries/htmlclean/main.c:17:19: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
content_size += strlen(buffer);
data/feedreader-2.10.0/libraries/libmrss/mrss_parser.c:157:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size = strlen (total);
data/feedreader-2.10.0/libraries/libmrss/mrss_parser.c:213:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen (p);
data/feedreader-2.10.0/libraries/libmrss/mrss_write.c:36:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen (str);
data/feedreader-2.10.0/libraries/libmrss/mrss_write.c:1187:7: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy (*buffer, s, len + 1);
data/feedreader-2.10.0/libraries/libmrss/mrss_write.c:1192:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
sizeof (char) * (strlen (*buffer) +
data/feedreader-2.10.0/libraries/libmrss/mrss_write.c:1195:7: [1] (buffer) strncat:
Easily used incorrectly (e.g., incorrectly computing the correct maximum
size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf,
or automatically resizing strings.
strncat (*buffer, s, len + 1);
data/feedreader-2.10.0/libraries/libnxml/nxml_namespace.c:160:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int len = strlen(e->name);
data/feedreader-2.10.0/libraries/libnxml/nxml_namespace.c:191:32: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
char *a = strdup(e->name + strlen(list->ns->prefix) + 1);
data/feedreader-2.10.0/libraries/libnxml/nxml_namespace.c:223:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(e->value);
data/feedreader-2.10.0/libraries/libnxml/nxml_namespace.c:253:33: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
char *a = strdup(e->value + strlen(list->ns->prefix) + 1);
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:112:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(buf, buffer + i + 2, last);
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:143:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(buf, buffer + i + 1, last);
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:151:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(entity->entity));
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:159:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
i += strlen(entity->name) + 1;
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:267:44: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!(v = __nxml_parse_string(doc, value, strlen(value))))
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:338:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(value, *buffer, i);
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:626:10: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size = strlen(value);
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:1181:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
r_size = strlen(r_buffer);
data/feedreader-2.10.0/libraries/libnxml/nxml_parser.c:1427:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if ((ret = read(fd, buffer + len, st.st_size - len)) <= 0)
data/feedreader-2.10.0/libraries/libnxml/nxml_string.c:32:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size = strlen(str);
data/feedreader-2.10.0/libraries/libnxml/nxml_string.c:94:10: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size = strlen(what);
data/feedreader-2.10.0/libraries/libnxml/nxml_tools.c:111:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
i = strlen(tmp);
data/feedreader-2.10.0/libraries/libnxml/nxml_write.c:41:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(str);
data/feedreader-2.10.0/libraries/libnxml/nxml_write.c:373:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
sizeof(char) * (strlen(*buffer) +
ANALYSIS SUMMARY:
Hits = 82
Lines analyzed = 18424 in approximately 0.55 seconds (33762 lines/second)
Physical Source Lines of Code (SLOC) = 11948
Hits@level = [0] 3 [1] 27 [2] 46 [3] 0 [4] 9 [5] 0
Hits@level+ = [0+] 85 [1+] 82 [2+] 55 [3+] 9 [4+] 9 [5+] 0
Hits/KSLOC@level+ = [0+] 7.11416 [1+] 6.86307 [2+] 4.60328 [3+] 0.753264 [4+] 0.753264 [5+] 0
Dot directories skipped = 2 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.