Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/libprintsys-0.6/acconfig.h
Examining data/libprintsys-0.6/src/printsys.c
Examining data/libprintsys-0.6/src/printcap.h
Examining data/libprintsys-0.6/src/printsys.h
Examining data/libprintsys-0.6/src/pcap.c
Examining data/libprintsys-0.6/src/pcaptest.c
Examining data/libprintsys-0.6/src/printcap.c
FINAL RESULTS:
data/libprintsys-0.6/src/pcap.c:211:2: [4] (buffer) wcscpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using a function version that stops copying at the end
of the buffer.
wcscpy(option_name,cur+1);
data/libprintsys-0.6/src/printcap.c:378:2: [4] (buffer) wcscpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using a function version that stops copying at the end
of the buffer.
wcscpy(fields->key,cur_field->key);
data/libprintsys-0.6/src/printcap.c:381:2: [4] (buffer) wcscpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using a function version that stops copying at the end
of the buffer.
wcscpy(fields->value,cur_field->value);
data/libprintsys-0.6/src/printcap.c:508:21: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
uptodate(printer->system);
data/libprintsys-0.6/src/printcap.c:540:21: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
uptodate(printer->system);
data/libprintsys-0.6/src/printsys.c:85:35: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
LPS_Error_t lps_end(LPS_System_t *system){
data/libprintsys-0.6/src/printsys.c:86:7: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
if(!system)
data/libprintsys-0.6/src/printsys.c:91:16: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
printcap_end(system);
data/libprintsys-0.6/src/printsys.c:92:8: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
free(system);
data/libprintsys-0.6/src/printsys.c:220:52: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
LPS_Printer_t *testpr=lps_get_printer(printer->system,*cur,NULL);
data/libprintsys-0.6/src/printsys.c:329:3: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(addr->sun_path, LPS_SOCK_PATHNAME);
data/libprintsys-0.6/src/printsys.c:542:5: [4] (buffer) wcscpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using a function version that stops copying at the end
of the buffer.
wcscpy(tmp_dest1,job->attributes->key);
data/libprintsys-0.6/src/printsys.c:547:7: [4] (buffer) wcscat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120).
wcscat(tmp_dest1,cur->key);
data/libprintsys-0.6/src/printsys.c:775:3: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(addr->sun_path, LPS_SOCK_PATHNAME);
data/libprintsys-0.6/src/printsys.c:1191:7: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
len=vsnprintf(buf, 1000, fmt, ap);
data/libprintsys-0.6/src/printsys.c:1202:3: [4] (format) vsprintf:
Potential format string problem (CWE-134). Make format string constant.
vsprintf(retval+base_len,fmt,ap);
data/libprintsys-0.6/src/printsys.h:75:43: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
extern LPS_Error_t lps_end (LPS_System_t *system);
data/libprintsys-0.6/src/printsys.h:102:17: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
LPS_System_t *system;
data/libprintsys-0.6/src/pcap.c:183:20: [3] (buffer) getopt_long:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while ((curarg = getopt_long(argc, argv, "+?P:vS:", long_options, NULL))
data/libprintsys-0.6/src/printcap.c:182:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[MAXBUF];
data/libprintsys-0.6/src/printcap.c:197:11: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
pc_fd = open(data->printcapfile, O_RDONLY);
data/libprintsys-0.6/src/printcap.c:498:10: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
int fd=open(data->printcapfile,O_WRONLY|O_CREAT|O_TRUNC,0644);
data/libprintsys-0.6/src/printcap.c:533:10: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
int fd=open(data->printcapfile,O_WRONLY|O_CREAT|O_TRUNC,0644);
data/libprintsys-0.6/src/printsys.c:53:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char errbuf[ERRBUF_SIZE];
data/libprintsys-0.6/src/printsys.c:436:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char control[CMSG_SPACE(sizeof(int))*2];
data/libprintsys-0.6/src/printsys.c:466:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char control[CMSG_SPACE(sizeof(int))];
data/libprintsys-0.6/src/printsys.c:496:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(retval,first,(i+1)*sizeof(LPS_Pair_t));
data/libprintsys-0.6/src/printsys.c:664:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1024 * 8];
data/libprintsys-0.6/src/printsys.c:832:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmpbuf[BUFSIZE];
data/libprintsys-0.6/src/printsys.c:844:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(cur,tmpbuf,len_read);
data/libprintsys-0.6/src/printsys.c:864:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(residue+residue_len,curbuf,len_read);
data/libprintsys-0.6/src/printsys.c:874:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(residue,cur+1,residue_len);
data/libprintsys-0.6/src/printsys.c:923:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(residue+residue_len,curbuf,len_read);
data/libprintsys-0.6/src/printsys.c:933:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(residue,residue+sizeof(total_len),residue_len);
data/libprintsys-0.6/src/printsys.c:972:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(curpos,curatt->key,len*sizeof(wchar_t));
data/libprintsys-0.6/src/printsys.c:977:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(curpos,curatt->value,len*sizeof(wchar_t));
data/libprintsys-0.6/src/printsys.c:994:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(key,attr_str+cur,len*sizeof(wchar_t));
data/libprintsys-0.6/src/printsys.c:1002:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(value,attr_str+cur,len*sizeof(wchar_t));
data/libprintsys-0.6/src/printsys.c:1049:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf, line_end + 1,len=strlen(line_end+1)+1);
data/libprintsys-0.6/src/printsys.c:1138:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf,line_end+1,strlen(line_end+1)+1);
data/libprintsys-0.6/src/printsys.c:1184:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1000]; // just to make it easier to debug
data/libprintsys-0.6/src/pcap.c:118:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
n = strlen(curr_sd);
data/libprintsys-0.6/src/pcap.c:206:51: [1] (buffer) wcslen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
option_name = (wchar_t *)malloc(sizeof(wchar_t)*(wcslen(cur + 1)+1));
data/libprintsys-0.6/src/pcap.c:227:26: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
while( spooldir[(len=strlen(spooldir)-1)]=='/')
data/libprintsys-0.6/src/printcap.c:217:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
for (bytes=read(pc_fd,buf,1023);bytes!=0;bytes=read(pc_fd,buf,1023)) {
data/libprintsys-0.6/src/printcap.c:217:50: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
for (bytes=read(pc_fd,buf,1023);bytes!=0;bytes=read(pc_fd,buf,1023)) {
data/libprintsys-0.6/src/printcap.c:377:12: [1] (buffer) wcslen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(wcslen(cur_field->key)+1));
data/libprintsys-0.6/src/printcap.c:380:10: [1] (buffer) wcslen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(wcslen(cur_field->value)+1));
data/libprintsys-0.6/src/printcap.c:460:25: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
retval=write(fd,str,strlen(str));
data/libprintsys-0.6/src/printsys.c:313:19: [1] (buffer) wcslen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
iov[1].iov_len=(wcslen(prname)+1)*sizeof(wchar_t);
data/libprintsys-0.6/src/printsys.c:325:46: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
addr = malloc(sizeof(struct sockaddr_un) + strlen(LPS_SOCK_PATHNAME));
data/libprintsys-0.6/src/printsys.c:327:48: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memset(addr, 0, sizeof(struct sockaddr_un) + strlen(LPS_SOCK_PATHNAME));
data/libprintsys-0.6/src/printsys.c:350:19: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
switch(len_read=read(sock,errbuf,ERRBUF_SIZE)){
data/libprintsys-0.6/src/printsys.c:390:19: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
switch(len_read=read(sock,errbuf,ERRBUF_SIZE-1)){
data/libprintsys-0.6/src/printsys.c:536:16: [1] (buffer) wcslen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t len=wcslen(job->attributes->key)+2;
data/libprintsys-0.6/src/printsys.c:544:7: [1] (buffer) wcscat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Risk is low because the source is a constant
character.
wcscat(tmp_dest1,L",");
data/libprintsys-0.6/src/printsys.c:545:12: [1] (buffer) wcslen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len+=wcslen(cur->key);
data/libprintsys-0.6/src/printsys.c:666:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while ((len = read(infd, buf, sizeof(buf))) != 0){
data/libprintsys-0.6/src/printsys.c:767:46: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
addr = malloc(sizeof(struct sockaddr_un) + strlen(LPS_SOCK_PATHNAME));
data/libprintsys-0.6/src/printsys.c:773:48: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memset(addr, 0, sizeof(struct sockaddr_un) + strlen(LPS_SOCK_PATHNAME));
data/libprintsys-0.6/src/printsys.c:791:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t len=strlen(ns)+1;
data/libprintsys-0.6/src/printsys.c:834:19: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while((len_read=read(fd,tmpbuf,BUFSIZE))!=0){
data/libprintsys-0.6/src/printsys.c:885:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t len=strlen(ns)+1;
data/libprintsys-0.6/src/printsys.c:893:8: [1] (buffer) wcslen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len=(wcslen(prname)+1)*sizeof(wchar_t);
data/libprintsys-0.6/src/printsys.c:964:15: [1] (buffer) wcslen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
*length+=(wcslen(curatt->key)+wcslen(curatt->value))*sizeof(wchar_t)+
data/libprintsys-0.6/src/printsys.c:964:35: [1] (buffer) wcslen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
*length+=(wcslen(curatt->key)+wcslen(curatt->value))*sizeof(wchar_t)+
data/libprintsys-0.6/src/printsys.c:970:28: [1] (buffer) wcslen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len=(*(size_t*)curpos)=wcslen(curatt->key);
data/libprintsys-0.6/src/printsys.c:975:28: [1] (buffer) wcslen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len=(*(size_t*)curpos)=wcslen(curatt->value);
data/libprintsys-0.6/src/printsys.c:1043:7: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(commline, curpos, line_end - curpos + 2);
data/libprintsys-0.6/src/printsys.c:1049:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memcpy(buf, line_end + 1,len=strlen(line_end+1)+1);
data/libprintsys-0.6/src/printsys.c:1093:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(*curkv) == 0)
data/libprintsys-0.6/src/printsys.c:1138:25: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memcpy(buf,line_end+1,strlen(line_end+1)+1);
data/libprintsys-0.6/src/printsys.c:1195:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
base_len = strlen(base);
ANALYSIS SUMMARY:
Hits = 73
Lines analyzed = 2242 in approximately 0.13 seconds (17063 lines/second)
Physical Source Lines of Code (SLOC) = 1620
Hits@level = [0] 34 [1] 32 [2] 22 [3] 1 [4] 18 [5] 0
Hits@level+ = [0+] 107 [1+] 73 [2+] 41 [3+] 19 [4+] 18 [5+] 0
Hits/KSLOC@level+ = [0+] 66.0494 [1+] 45.0617 [2+] 25.3086 [3+] 11.7284 [4+] 11.1111 [5+] 0
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.