Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/grok-1.20110708.1/stringhelper.c
Examining data/grok-1.20110708.1/discover_main.c
Examining data/grok-1.20110708.1/grok_program.h
Examining data/grok-1.20110708.1/grok_matchconf.c
Examining data/grok-1.20110708.1/filters.h
Examining data/grok-1.20110708.1/stringhelper.h
Examining data/grok-1.20110708.1/predicates.h
Examining data/grok-1.20110708.1/grok_discover.h
Examining data/grok-1.20110708.1/predicates.c
Examining data/grok-1.20110708.1/grok.c
Examining data/grok-1.20110708.1/libc_helper.c
Examining data/grok-1.20110708.1/conf.tab.h
Examining data/grok-1.20110708.1/main.c
Examining data/grok-1.20110708.1/libc_helper.h
Examining data/grok-1.20110708.1/grok_logging.h
Examining data/grok-1.20110708.1/grok_capture_xdr.h
Examining data/grok-1.20110708.1/grok_capture.c
Examining data/grok-1.20110708.1/test/grok_manymanymany.test.c
Examining data/grok-1.20110708.1/test/test.h
Examining data/grok-1.20110708.1/test/grok_capture.test.c
Examining data/grok-1.20110708.1/test/stringhelper.test.c
Examining data/grok-1.20110708.1/test/grok_simple.test.c
Examining data/grok-1.20110708.1/test/predicates.test.c
Examining data/grok-1.20110708.1/test/grok_pattern.test.c
Examining data/grok-1.20110708.1/grok_program.c
Examining data/grok-1.20110708.1/grok_config.h
Examining data/grok-1.20110708.1/grok_matchconf.h
Examining data/grok-1.20110708.1/grok_discover.c
Examining data/grok-1.20110708.1/grok_input.c
Examining data/grok-1.20110708.1/conf.yy.c
Examining data/grok-1.20110708.1/grok_version.h
Examining data/grok-1.20110708.1/grok_config.c
Examining data/grok-1.20110708.1/grok_input.h
Examining data/grok-1.20110708.1/grok.h
Examining data/grok-1.20110708.1/grok_match.c
Examining data/grok-1.20110708.1/grok_capture_xdr.c
Examining data/grok-1.20110708.1/grok_capture.h
Examining data/grok-1.20110708.1/grok_match.h
Examining data/grok-1.20110708.1/grok_logging.c
Examining data/grok-1.20110708.1/grok_pattern.c
Examining data/grok-1.20110708.1/grok_pattern.h
Examining data/grok-1.20110708.1/grokre.c
Examining data/grok-1.20110708.1/grok_matchconf_macro.h
Examining data/grok-1.20110708.1/conf.tab.c
FINAL RESULTS:
data/grok-1.20110708.1/conf.tab.c:753:21: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
# define YYFPRINTF fprintf
data/grok-1.20110708.1/grok_input.c:171:3: [4] (shell) execlp:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
execlp("sh", "sh", "-c", gipt->cmd, NULL);
data/grok-1.20110708.1/grok_logging.c:33:3: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
vfprintf(out, format, args);
data/grok-1.20110708.1/grok_matchconf.c:420:7: [4] (shell) execlp:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
execlp("sh", "sh", NULL);
data/grok-1.20110708.1/grok_matchconf.c:422:7: [4] (shell) execlp:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
execlp("sh", "sh", "-c", gmc->shell, NULL);
data/grok-1.20110708.1/grokre.c:247:7: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
snprintf(capture_id_str, CAPTURE_ID_LEN + 1, CAPTURE_FORMAT, capture_id);
data/grok-1.20110708.1/grokre.c:406:5: [4] (buffer) sscanf:
The scanf() family's %s operation, without a limit specification, permits
buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
different input function. If the scanf format is influenceable by an
attacker, it's exploitable.
sscanf(nametable + offset + 2, CAPTURE_FORMAT, &capture_id);
data/grok-1.20110708.1/conf.tab.c:1063:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char const *yyarg[YYERROR_VERBOSE_ARGS_MAXIMUM];
data/grok-1.20110708.1/conf.tab.c:1080:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char yyformat[sizeof yyunexpected
data/grok-1.20110708.1/conf.tab.c:1286:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char yymsgbuf[128];
data/grok-1.20110708.1/conf.yy.c:971:17: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
{ yylval->num = atoi(yytext); return INTEGER; }
data/grok-1.20110708.1/discover_main.c:66:10: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fp = fopen(argv[0], "r");
data/grok-1.20110708.1/discover_main.c:69:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[4096];
data/grok-1.20110708.1/grok_capture.c:151:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(gct->extra.extra_val, &extra, gct->extra.extra_len);
data/grok-1.20110708.1/grok_discover.c:178:11: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&best_match, &gm, sizeof(grok_match_t));
data/grok-1.20110708.1/grok_input.c:98:14: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
gift->fd = open(gift->filename, O_RDONLY);
data/grok-1.20110708.1/grok_input.c:110:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&(gift->st), &st, sizeof(st));
data/grok-1.20110708.1/grok_input.c:234:16: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
gift->fd = open(gift->filename, O_RDONLY);
data/grok-1.20110708.1/grok_input.c:259:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&(gift->st), &st, sizeof(st));
data/grok-1.20110708.1/grok_match.c:56:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(*name, gct->name, *namelen);
data/grok-1.20110708.1/grok_matchconf.c:170:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(output, str, size);
data/grok-1.20110708.1/grok_matchconf.c:352:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(name_copy, name, name_len);
data/grok-1.20110708.1/grok_pattern.c:60:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
patfile = fopen(filename, "r");
data/grok-1.20110708.1/grokre.c:169:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char capture_id_str[CAPTURE_ID_LEN + 1];
data/grok-1.20110708.1/grokre.c:177:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(full_pattern, grok->pattern, full_len);
data/grok-1.20110708.1/main.c:65:10: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
yyin = fopen(config_file, "r");
data/grok-1.20110708.1/predicates.c:270:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(gpst->value, args + pos, gpst->len);
data/grok-1.20110708.1/stringhelper.c:63:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(*strp + start, replace, replace_len);
data/grok-1.20110708.1/stringhelper.c:75:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char replstr[8]; /* 7 should be enough (covers \uXXXX + null) */
data/grok-1.20110708.1/stringhelper.c:78:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char hits[256]; /* track chars found in the string */
data/grok-1.20110708.1/stringhelper.c:177:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(replstr, r, *replstr_len);
data/grok-1.20110708.1/stringhelper.c:182:18: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
*replstr_len = sprintf(replstr, "\\x%x", (unsigned char) c);
data/grok-1.20110708.1/stringhelper.c:191:20: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
*replstr_len = sprintf(replstr, "\\u00%02x",(unsigned char) c);
data/grok-1.20110708.1/stringhelper.c:239:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dup, src, len);
data/grok-1.20110708.1/test/grok_manymanymany.test.c:16:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[30];
data/grok-1.20110708.1/test/grok_manymanymany.test.c:17:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(buf, "%d", i);
data/grok-1.20110708.1/test/stringhelper.test.c:12:3: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(source, "world");
data/grok-1.20110708.1/test/stringhelper.test.c:13:3: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(dest, "hello there");
data/grok-1.20110708.1/conf.tab.c:944:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
# define yystrlen strlen
data/grok-1.20110708.1/conf.yy.c:691:14: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
(c = getc( yyin )) != EOF && c != '\n'; ++n ) \
data/grok-1.20110708.1/conf.yy.c:1816:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return yy_scan_bytes(yystr,strlen(yystr) );
data/grok-1.20110708.1/grok_capture.c:103:58: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
by_name_list = tctreeget(grok->captures_by_name, name, strlen(name),
data/grok-1.20110708.1/grok_capture.c:120:31: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(subname), &unused_size);
data/grok-1.20110708.1/grok_discover.c:227:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
score += strlen(grok->full_pattern) / 2;
data/grok-1.20110708.1/grok_input.c:276:11: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
bytes = read(gift->fd, gift->readbuffer, gift->st.st_blksize);
data/grok-1.20110708.1/grok_matchconf.c:167:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(str);
data/grok-1.20110708.1/grok_matchconf.c:205:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
value_len = strlen(value);
data/grok-1.20110708.1/grok_matchconf.c:244:41: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
gm->subject, strlen(gm->subject));
data/grok-1.20110708.1/grok_pattern.c:137:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
*regexp_len = strlen(line) - (*regexp - line);
data/grok-1.20110708.1/grokre.c:62:39: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return grok_compilen(grok, pattern, strlen(pattern));
data/grok-1.20110708.1/grokre.c:110:33: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return grok_execn(grok, text, strlen(text), gm);
data/grok-1.20110708.1/grokre.c:252:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
gct->name_len = strlen(gct->name);
data/grok-1.20110708.1/grokre.c:254:26: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
gct->subname_len = strlen(gct->subname);
data/grok-1.20110708.1/grokre.c:301:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
assert(strlen(full_pattern) == full_len);
data/grok-1.20110708.1/predicates.c:107:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(gprt->pattern, args + start, end - start);
data/grok-1.20110708.1/predicates.c:134:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
gct->predicate_func_name_len = strlen("grok_predicate_regexp");
data/grok-1.20110708.1/predicates.c:216:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
gct->predicate_func_name_len = strlen("grok_predicate_numcompare");
data/grok-1.20110708.1/predicates.c:273:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
gct->predicate_func_name_len = strlen("grok_predicate_strcompare");
data/grok-1.20110708.1/stringhelper.c:43:19: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
replace_len = strlen(replace);
data/grok-1.20110708.1/stringhelper.c:45:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
*strp_len = strlen(*strp);
data/grok-1.20110708.1/stringhelper.c:86:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
chars_len = strlen(chars);
data/grok-1.20110708.1/stringhelper.c:247:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return (string_ncount(src, strlen(src), charlist, strlen(charlist)));
data/grok-1.20110708.1/stringhelper.c:247:53: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return (string_ncount(src, strlen(src), charlist, strlen(charlist)));
data/grok-1.20110708.1/test/grok_capture.test.c:15:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
src.name_len = strlen(src.name);
data/grok-1.20110708.1/test/grok_capture.test.c:36:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
src.name_len = strlen(src.name);
data/grok-1.20110708.1/test/stringhelper.test.c:15:44: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
substr_replace(&dest, &dlen, &dalloc, 6, strlen(dest), source, slen);
data/grok-1.20110708.1/test/stringhelper.test.c:32:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
CU_ASSERT(dlen == strlen(source));
data/grok-1.20110708.1/test/stringhelper.test.c:50:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
CU_ASSERT(dlen == strlen(expect));
data/grok-1.20110708.1/test/stringhelper.test.c:58:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int len = strlen(source);
data/grok-1.20110708.1/test/stringhelper.test.c:69:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int len = strlen(source);
data/grok-1.20110708.1/test/stringhelper.test.c:97:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(s);
ANALYSIS SUMMARY:
Hits = 71
Lines analyzed = 8710 in approximately 0.30 seconds (29476 lines/second)
Physical Source Lines of Code (SLOC) = 6155
Hits@level = [0] 46 [1] 33 [2] 31 [3] 0 [4] 7 [5] 0
Hits@level+ = [0+] 117 [1+] 71 [2+] 38 [3+] 7 [4+] 7 [5+] 0
Hits/KSLOC@level+ = [0+] 19.0089 [1+] 11.5353 [2+] 6.17384 [3+] 1.13729 [4+] 1.13729 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.