Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/libydpdict-1.0.4/misc/gentable.c
Examining data/libydpdict-1.0.4/misc/ydpstress.c
Examining data/libydpdict-1.0.4/misc/ydptest.c
Examining data/libydpdict-1.0.4/misc/ydpxml.c
Examining data/libydpdict-1.0.4/src/ydpdict.c
FINAL RESULTS:
data/libydpdict-1.0.4/misc/ydpstress.c:19:3: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
snprintf(dat, sizeof(dat), DICT_PATH "/dict%d.dat", dicts[j]);
data/libydpdict-1.0.4/misc/ydpstress.c:20:3: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
snprintf(idx, sizeof(idx), DICT_PATH "/dict%d.idx", dicts[j]);
data/libydpdict-1.0.4/misc/ydpxml.c:61:3: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
snprintf(dat, sizeof(dat), DICT_PATH "/dict%d.dat", dicts[j]);
data/libydpdict-1.0.4/misc/ydpxml.c:62:3: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
snprintf(idx, sizeof(idx), DICT_PATH "/dict%d.idx", dicts[j]);
data/libydpdict-1.0.4/src/ydpdict.c:484:2: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(*buf + len1, str);
data/libydpdict-1.0.4/src/ydpdict.c:976:4: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(result, ydpdict_phonetic_to_utf8_table[((unsigned char*) input)[i] - 128]);
data/libydpdict-1.0.4/src/ydpdict.c:980:4: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(result, tmp);
data/libydpdict-1.0.4/src/ydpdict.c:1015:4: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(result, ydpdict_windows1250_to_utf8_table[((unsigned char*) input)[i] - 128]);
data/libydpdict-1.0.4/src/ydpdict.c:1019:4: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(result, tmp);
data/libydpdict-1.0.4/src/ydpdict.c:1059:4: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(result, ydpdict_superscript_to_utf8_table[((unsigned char*) input)[i]]);
data/libydpdict-1.0.4/src/ydpdict.c:1061:4: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(result, ydpdict_windows1250_to_utf8_table[((unsigned char*) input)[i] - 128]);
data/libydpdict-1.0.4/src/ydpdict.c:1065:4: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(result, tmp);
data/libydpdict-1.0.4/misc/gentable.c:28:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char inbuf[2], outbuf[16], *in, *out;
data/libydpdict-1.0.4/misc/ydpstress.c:17:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char dat[4096], idx[4096];
data/libydpdict-1.0.4/misc/ydptest.c:10:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char dat[128], idx[128];
data/libydpdict-1.0.4/misc/ydptest.c:20:12: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
dictno = atoi(argv[1]);
data/libydpdict-1.0.4/misc/ydptest.c:23:12: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
dictno = atoi(argv[1]);
data/libydpdict-1.0.4/misc/ydptest.c:38:12: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
if (!(i = atoi(word)))
data/libydpdict-1.0.4/misc/ydptest.c:51:7: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen("ydptest.rtf", "w");
data/libydpdict-1.0.4/misc/ydptest.c:55:7: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen("ydptest.html", "w");
data/libydpdict-1.0.4/misc/ydpxml.c:59:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char dat[4096], idx[4096], prefix[128];
data/libydpdict-1.0.4/src/ydpdict.c:88:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char *ydpdict_phonetic_to_utf8_table[32] =
data/libydpdict-1.0.4/src/ydpdict.c:100:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char *ydpdict_superscript_to_utf8_table[10] =
data/libydpdict-1.0.4/src/ydpdict.c:109:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char *ydpdict_windows1250_to_utf8_table[128] =
data/libydpdict-1.0.4/src/ydpdict.c:197:14: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
dict->idx = fopen(idx, "rb");
data/libydpdict-1.0.4/src/ydpdict.c:202:14: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
dict->dat = fopen(dat, "rb");
data/libydpdict-1.0.4/src/ydpdict.c:252:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[256];
data/libydpdict-1.0.4/src/ydpdict.c:636:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char token[16];
data/libydpdict-1.0.4/src/ydpdict.c:797:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmp[2] = { *rtf, 0 };
data/libydpdict-1.0.4/src/ydpdict.c:806:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmp[2] = { *rtf, 0 };
data/libydpdict-1.0.4/src/ydpdict.c:978:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmp[2] = { input[i], 0 };
data/libydpdict-1.0.4/src/ydpdict.c:1017:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmp[2] = { input[i], 0 };
data/libydpdict-1.0.4/src/ydpdict.c:1063:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmp[2] = { input[i], 0 };
data/libydpdict-1.0.4/misc/ydpxml.c:28:37: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
doc = xmlCtxtReadMemory(ctxt, xml, strlen(xml), "", NULL, (validate) ? XML_PARSE_DTDVALID : 0);
data/libydpdict-1.0.4/src/ydpdict.c:368:46: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strncasecmp(dict->words[i].word, word, strlen(word)) == 0)
data/libydpdict-1.0.4/src/ydpdict.c:469:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len1 = strlen(*buf);
data/libydpdict-1.0.4/src/ydpdict.c:470:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len2 = strlen(str);
data/libydpdict-1.0.4/src/ydpdict.c:962:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len += strlen(ydpdict_phonetic_to_utf8_table[((unsigned char*) input)[i] - 128]);
data/libydpdict-1.0.4/src/ydpdict.c:1001:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len += strlen(ydpdict_windows1250_to_utf8_table[((unsigned char*) input)[i] - 128]);
data/libydpdict-1.0.4/src/ydpdict.c:1043:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len += strlen(ydpdict_superscript_to_utf8_table[((unsigned char*) input)[i]]);
data/libydpdict-1.0.4/src/ydpdict.c:1045:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len += strlen(ydpdict_windows1250_to_utf8_table[((unsigned char*) input)[i] - 128]);
ANALYSIS SUMMARY:
Hits = 41
Lines analyzed = 1347 in approximately 0.05 seconds (25363 lines/second)
Physical Source Lines of Code (SLOC) = 848
Hits@level = [0] 25 [1] 8 [2] 21 [3] 0 [4] 12 [5] 0
Hits@level+ = [0+] 66 [1+] 41 [2+] 33 [3+] 12 [4+] 12 [5+] 0
Hits/KSLOC@level+ = [0+] 77.8302 [1+] 48.3491 [2+] 38.9151 [3+] 14.1509 [4+] 14.1509 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.