Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/gnome-system-log-3.9.90/src/logview-loglist.c
Examining data/gnome-system-log-3.9.90/src/logview-utils.c
Examining data/gnome-system-log-3.9.90/src/logview-findbar.c
Examining data/gnome-system-log-3.9.90/src/logview-log.c
Examining data/gnome-system-log-3.9.90/src/logview-filter-manager.h
Examining data/gnome-system-log-3.9.90/src/logview-window.h
Examining data/gnome-system-log-3.9.90/src/logview-about.h
Examining data/gnome-system-log-3.9.90/src/logview-manager.h
Examining data/gnome-system-log-3.9.90/src/logview-app.h
Examining data/gnome-system-log-3.9.90/src/logview-utils.h
Examining data/gnome-system-log-3.9.90/src/logview-filter.c
Examining data/gnome-system-log-3.9.90/src/logview-app.c
Examining data/gnome-system-log-3.9.90/src/logview-log.h
Examining data/gnome-system-log-3.9.90/src/logview-loglist.h
Examining data/gnome-system-log-3.9.90/src/logview-findbar.h
Examining data/gnome-system-log-3.9.90/src/logview-prefs.h
Examining data/gnome-system-log-3.9.90/src/tests/test-reader.c
Examining data/gnome-system-log-3.9.90/src/logview-filter-manager.c
Examining data/gnome-system-log-3.9.90/src/logview-manager.c
Examining data/gnome-system-log-3.9.90/src/logview-main.c
Examining data/gnome-system-log-3.9.90/src/logview-filter.h
Examining data/gnome-system-log-3.9.90/src/logview-window.c
Examining data/gnome-system-log-3.9.90/src/logview-prefs.c
FINAL RESULTS:
data/gnome-system-log-3.9.90/src/logview-app.c:64:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cbuf[BUFSIZ];
data/gnome-system-log-3.9.90/src/logview-app.c:69:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((cf = fopen ("/etc/syslog.conf", "r")) == NULL) {
data/gnome-system-log-3.9.90/src/logview-log.c:615:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char * parse_data[2];
data/gnome-system-log-3.9.90/src/logview-window.c:1170:33: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
open);
data/gnome-system-log-3.9.90/src/logview-window.c:1171:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (open) {
data/gnome-system-log-3.9.90/src/logview-filter-manager.c:87:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strlen (name)) {
data/gnome-system-log-3.9.90/src/logview-filter-manager.c:123:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strlen (regex)) {
data/gnome-system-log-3.9.90/src/logview-prefs.c:154:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen (tokens[FILTER_FOREGROUND])) {
data/gnome-system-log-3.9.90/src/logview-prefs.c:160:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen (tokens[FILTER_BACKGROUND])) {
data/gnome-system-log-3.9.90/src/logview-window.c:524:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
name = action_name + strlen ("filter_");
data/gnome-system-log-3.9.90/src/logview-window.c:560:63: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
name = (gchar *) g_variant_get_string (variant, NULL) + strlen ("win.filter_");
data/gnome-system-log-3.9.90/src/logview-window.c:561:70: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
action_name = (gchar *) g_variant_get_string (variant, NULL) + strlen ("win.");
data/gnome-system-log-3.9.90/src/logview-window.c:766:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen (lines[i]);
data/gnome-system-log-3.9.90/src/logview-window.c:773:56: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
gtk_text_buffer_insert (buffer, &iter, lines[i], strlen (lines[i]));
data/gnome-system-log-3.9.90/src/logview-window.c:824:56: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
gtk_text_buffer_insert (buffer, &iter, lines[i], strlen (lines[i]));
ANALYSIS SUMMARY:
Hits = 15
Lines analyzed = 6589 in approximately 0.31 seconds (21336 lines/second)
Physical Source Lines of Code (SLOC) = 4695
Hits@level = [0] 0 [1] 10 [2] 5 [3] 0 [4] 0 [5] 0
Hits@level+ = [0+] 15 [1+] 15 [2+] 5 [3+] 0 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 3.19489 [1+] 3.19489 [2+] 1.06496 [3+] 0 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.