Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/hyphen-2.8.8/hnjalloc.h
Examining data/hyphen-2.8.8/example.c
Examining data/hyphen-2.8.8/substrings.c
Examining data/hyphen-2.8.8/hyphen.c
Examining data/hyphen-2.8.8/hyphen.h
Examining data/hyphen-2.8.8/hnjalloc.c
FINAL RESULTS:
data/hyphen-2.8.8/example.c:65:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUFSIZE + 1];
data/hyphen-2.8.8/example.c:70:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char hword[BUFSIZE * 2];
data/hyphen-2.8.8/example.c:120:12: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
wtclst = fopen(argv[wtc],"r");
data/hyphen-2.8.8/hyphen.c:72:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (newstr, s, l);
data/hyphen-2.8.8/hyphen.c:247:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char word[MAX_CHARS];
data/hyphen-2.8.8/hyphen.c:248:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pattern[MAX_CHARS];
data/hyphen-2.8.8/hyphen.c:258:20: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
dict->lhmin = atoi(buf + 13);
data/hyphen-2.8.8/hyphen.c:261:20: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
dict->rhmin = atoi(buf + 14);
data/hyphen-2.8.8/hyphen.c:264:21: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
dict->clhmin = atoi(buf + 21);
data/hyphen-2.8.8/hyphen.c:267:21: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
dict->crhmin = atoi(buf + 22);
data/hyphen-2.8.8/hyphen.c:298:47: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
replindex = (signed char) atoi(index + 1) - 1;
data/hyphen-2.8.8/hyphen.c:299:45: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
replcut = (signed char) atoi(index2 + 1);
data/hyphen-2.8.8/hyphen.c:379:7: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen (fn, "r");
data/hyphen-2.8.8/hyphen.c:394:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[MAX_CHARS];
data/hyphen-2.8.8/hyphen.h:77:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cset[MAX_NAME];
data/hyphen-2.8.8/substrings.c:166:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char *pattab_key[MAXPATHS];
data/hyphen-2.8.8/substrings.c:167:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char *pattab_val[MAXPATHS];
data/hyphen-2.8.8/substrings.c:168:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char *newpattab_key[MAXPATHS];
data/hyphen-2.8.8/substrings.c:169:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char *newpattab_val[MAXPATHS];
data/hyphen-2.8.8/substrings.c:175:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char format[132]; // 64+65+newline+zero+spare
data/hyphen-2.8.8/substrings.c:178:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((in = fopen(argv[1],"r"))==NULL) die("Could not read input");
data/hyphen-2.8.8/substrings.c:179:14: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((out = fopen(argv[2],"w"))==NULL) die("Could not create output");
data/hyphen-2.8.8/substrings.c:220:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char subpat[132];
data/hyphen-2.8.8/example.c:33:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for (i = 0; (i + 1) < strlen(word); i++) {
data/hyphen-2.8.8/example.c:129:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
k = strlen(buf);
data/hyphen-2.8.8/hyphen.c:70:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
l = strlen (s);
data/hyphen-2.8.8/hyphen.c:80:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int k = strlen(s);
data/hyphen-2.8.8/hyphen.c:274:40: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
char * nhe = dict->nohyphen + strlen(dict->nohyphen) - 1;
data/hyphen-2.8.8/hyphen.c:304:41: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
replcut = (signed char) strlen(buf);
data/hyphen-2.8.8/hyphen.c:332:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for (; pc < (strlen(word) + 1); pc++) {
data/hyphen-2.8.8/hyphen.c:357:61: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
dict->states[state_num].replcut = (signed char) strlen(word);
data/hyphen-2.8.8/hyphen.c:434:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(dict[k]->cset, dict[0]->cset, sizeof(dict[k]->cset)-1);
data/hyphen-2.8.8/hyphen.c:450:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120). Risk is low because the source is a
constant string.
strncpy(buf, "1-1\n", MAX_CHARS-1); // buf rewritten by hnj_hyphen_load here
data/hyphen-2.8.8/hyphen.c:606:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for (k = 0; k < i - strlen (state_str); k++)
data/hyphen-2.8.8/hyphen.c:634:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
offset = i + 1 - strlen (match);
data/hyphen-2.8.8/hyphen.c:756:38: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hnj_hyphen_strnlen(rh + 1, strlen(rh + 1), utf8)) < rhmin) {
data/hyphen-2.8.8/hyphen.c:838:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for (k = 0; k < i - strlen (state_str); k++)
data/hyphen-2.8.8/hyphen.c:869:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
offset = i + 1 - strlen (match);
data/hyphen-2.8.8/hyphen.c:942:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
j += strlen(matchrepl[matchindex[i]]);
data/hyphen-2.8.8/hyphen.c:973:17: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(prep_word + offset, (*rep)[i], prep_word_size - offset - 1);
data/hyphen-2.8.8/hyphen.c:1005:17: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(prep_word + offset, word, prep_word_size - offset - 1);
data/hyphen-2.8.8/hyphen.c:1087:9: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(hyphword + offset, (*rep)[i], hyphenslen - offset - 1);
data/hyphen-2.8.8/hyphen.c:1089:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
j += strlen((*rep)[i]) - (*pos)[i];
data/hyphen-2.8.8/hyphen.c:1117:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hyphens[nhy - word + strlen(nh) - 1] = '0';
data/hyphen-2.8.8/hyphen.c:1121:19: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
nh = nh + strlen(nh) + 1;
data/hyphen-2.8.8/hyphen.c:1158:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hyphens[nhy - word + strlen(nh) - 1] = 0;
data/hyphen-2.8.8/hyphen.c:1162:19: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
nh = nh + strlen(nh) + 1;
data/hyphen-2.8.8/substrings.c:109:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int l=strlen(expr);
data/hyphen-2.8.8/substrings.c:151:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int l1 = strlen(expr);
data/hyphen-2.8.8/substrings.c:152:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int l2 = strlen(subexpr);
data/hyphen-2.8.8/substrings.c:182:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int l = strlen(format);
data/hyphen-2.8.8/substrings.c:214:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int patsize = strlen(pat);
data/hyphen-2.8.8/substrings.c:221:9: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(subpat,pat+i,j); subpat[j]=0;
data/hyphen-2.8.8/substrings.c:227:11: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(newpat, pat+0,l); newpat[l]=0;
ANALYSIS SUMMARY:
Hits = 54
Lines analyzed = 1933 in approximately 0.13 seconds (14507 lines/second)
Physical Source Lines of Code (SLOC) = 1395
Hits@level = [0] 35 [1] 31 [2] 23 [3] 0 [4] 0 [5] 0
Hits@level+ = [0+] 89 [1+] 54 [2+] 23 [3+] 0 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 63.7993 [1+] 38.7097 [2+] 16.4875 [3+] 0 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.