Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/gip-1.7.0-1/src/lib_regexp.h Examining data/gip-1.7.0-1/src/gui_mainwindow.h Examining data/gip-1.7.0-1/src/lib_ipv4.c Examining data/gip-1.7.0-1/src/gui_prefixlist.h Examining data/gip-1.7.0-1/src/main.cc Examining data/gip-1.7.0-1/src/gui_aboutbox.cc Examining data/gip-1.7.0-1/src/lib_regexp.c Examining data/gip-1.7.0-1/src/lib_ipv4.h Examining data/gip-1.7.0-1/src/gui_ipv4_analyzer.h Examining data/gip-1.7.0-1/src/gui_aboutbox.h Examining data/gip-1.7.0-1/src/gui_mainwindow.cc Examining data/gip-1.7.0-1/src/gui_prefixlist.cc Examining data/gip-1.7.0-1/src/gui_ipv4_subnet_splitter.h Examining data/gip-1.7.0-1/src/gui_ipv4_subnet_calculator.h Examining data/gip-1.7.0-1/src/gui_ipv4_analyzer.cc Examining data/gip-1.7.0-1/src/gui_ipv4_subnet_calculator.cc Examining data/gip-1.7.0-1/src/gui_ipv4_subnet_splitter.cc Examining data/gip-1.7.0-1/src/dispatcher.cc Examining data/gip-1.7.0-1/src/dispatcher.h FINAL RESULTS: data/gip-1.7.0-1/src/gui_aboutbox.cc:35:3: [4] (format) snprintf: If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134). Use a constant for the format specification. snprintf(version, 2047, format, VERSION, SUBVERSION); data/gip-1.7.0-1/src/gui_aboutbox.cc:32:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char version[2048]; data/gip-1.7.0-1/src/gui_ipv4_analyzer.cc:368:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char text[16]; data/gip-1.7.0-1/src/gui_ipv4_analyzer.cc:383:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char text[100]; data/gip-1.7.0-1/src/gui_ipv4_analyzer.cc:396:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char text[100]; data/gip-1.7.0-1/src/gui_ipv4_analyzer.cc:411:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char text[100]; data/gip-1.7.0-1/src/gui_ipv4_analyzer.cc:424:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char network_text[16]; data/gip-1.7.0-1/src/gui_ipv4_analyzer.cc:438:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char broadcast_text[16]; data/gip-1.7.0-1/src/gui_ipv4_analyzer.cc:452:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char binary[36]; data/gip-1.7.0-1/src/gui_ipv4_analyzer.cc:467:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char binary[36]; data/gip-1.7.0-1/src/gui_ipv4_analyzer.cc:482:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char binary[36]; data/gip-1.7.0-1/src/gui_ipv4_analyzer.cc:497:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char binary[36]; data/gip-1.7.0-1/src/gui_ipv4_analyzer.cc:512:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char hex[20]; data/gip-1.7.0-1/src/gui_ipv4_analyzer.cc:527:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char hex[20]; data/gip-1.7.0-1/src/gui_ipv4_analyzer.cc:542:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char hex[20]; data/gip-1.7.0-1/src/gui_ipv4_analyzer.cc:557:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char hex[20]; data/gip-1.7.0-1/src/gui_ipv4_analyzer.cc:590:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char ip[36] = ""; data/gip-1.7.0-1/src/gui_ipv4_analyzer.cc:632:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char mask[36] = ""; data/gip-1.7.0-1/src/gui_ipv4_subnet_calculator.cc:131:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char ip[36] = ""; data/gip-1.7.0-1/src/gui_ipv4_subnet_splitter.cc:140:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char ip[36] = ""; data/gip-1.7.0-1/src/gui_prefixlist.cc:57:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char net_txt[36]; data/gip-1.7.0-1/src/gui_prefixlist.cc:58:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char len_txt[4]; data/gip-1.7.0-1/src/gui_prefixlist.cc:59:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char mask_txt[36]; data/gip-1.7.0-1/src/lib_ipv4.c:48:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char *matches[1+4]; data/gip-1.7.0-1/src/lib_ipv4.c:54:25: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). unsigned int byte = atoi(matches[i]); data/gip-1.7.0-1/src/lib_ipv4.c:86:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char *matches[1+2]; data/gip-1.7.0-1/src/lib_ipv4.c:93:31: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). err &= ipv4_check_prefixlen(atoi(matches[1])); // Check prefixlen. data/gip-1.7.0-1/src/lib_ipv4.c:107:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char *matches[1+4]; data/gip-1.7.0-1/src/lib_ipv4.c:114:25: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). unsigned int byte = atoi(matches[i]); data/gip-1.7.0-1/src/lib_ipv4.c:133:3: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(ip, "%i.%i.%i.%i", ((ip_int >> 24) & 0x000000FF), data/gip-1.7.0-1/src/lib_ipv4.c:165:5: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(ip_hex, "%02X", (ip_int >> (i * 8)) & 0xFF); data/gip-1.7.0-1/src/lib_regexp.c:69:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(pstr, to, tolen); data/gip-1.7.0-1/src/lib_regexp.c:143:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char regexp[1024]; data/gip-1.7.0-1/src/lib_regexp.c:170:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(result, string + pmatch[1].rm_so, (pmatch[1].rm_eo - pmatch[1].rm_so)); data/gip-1.7.0-1/src/lib_regexp.c:223:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(result, string + pmatch[i].rm_so, len); data/gip-1.7.0-1/src/lib_regexp.c:258:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char regexp[1024]; data/gip-1.7.0-1/src/lib_ipv4.c:166:15: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). ip_hex += strlen(ip_hex); data/gip-1.7.0-1/src/lib_regexp.c:60:19: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). int fromlen = strlen(from); data/gip-1.7.0-1/src/lib_regexp.c:61:19: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). int tolen = strlen(to); data/gip-1.7.0-1/src/lib_regexp.c:148:3: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(regexp, pattern, 1023); data/gip-1.7.0-1/src/lib_regexp.c:261:3: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(regexp, pattern, 1023); ANALYSIS SUMMARY: Hits = 41 Lines analyzed = 3184 in approximately 0.16 seconds (19702 lines/second) Physical Source Lines of Code (SLOC) = 2003 Hits@level = [0] 84 [1] 5 [2] 35 [3] 0 [4] 1 [5] 0 Hits@level+ = [0+] 125 [1+] 41 [2+] 36 [3+] 1 [4+] 1 [5+] 0 Hits/KSLOC@level+ = [0+] 62.4064 [1+] 20.4693 [2+] 17.973 [3+] 0.499251 [4+] 0.499251 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.