Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/oscpack-1.1.0/ip/PacketListener.h Examining data/oscpack-1.1.0/ip/NetworkingUtils.h Examining data/oscpack-1.1.0/ip/win32/NetworkingUtils.cpp Examining data/oscpack-1.1.0/ip/win32/UdpSocket.cpp Examining data/oscpack-1.1.0/ip/UdpSocket.h Examining data/oscpack-1.1.0/ip/TimerListener.h Examining data/oscpack-1.1.0/ip/IpEndpointName.h Examining data/oscpack-1.1.0/ip/IpEndpointName.cpp Examining data/oscpack-1.1.0/ip/posix/NetworkingUtils.cpp Examining data/oscpack-1.1.0/ip/posix/UdpSocket.cpp Examining data/oscpack-1.1.0/examples/SimpleReceive.cpp Examining data/oscpack-1.1.0/examples/OscDump.cpp Examining data/oscpack-1.1.0/examples/SimpleSend.cpp Examining data/oscpack-1.1.0/osc/OscPacketListener.h Examining data/oscpack-1.1.0/osc/OscPrintReceivedElements.cpp Examining data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp Examining data/oscpack-1.1.0/osc/OscTypes.h Examining data/oscpack-1.1.0/osc/OscOutboundPacketStream.h Examining data/oscpack-1.1.0/osc/OscTypes.cpp Examining data/oscpack-1.1.0/osc/OscException.h Examining data/oscpack-1.1.0/osc/MessageMappingOscPacketListener.h Examining data/oscpack-1.1.0/osc/OscPrintReceivedElements.h Examining data/oscpack-1.1.0/osc/OscReceivedElements.h Examining data/oscpack-1.1.0/osc/OscHostEndianness.h Examining data/oscpack-1.1.0/osc/OscReceivedElements.cpp Examining data/oscpack-1.1.0/tests/OscSendTests.cpp Examining data/oscpack-1.1.0/tests/OscReceiveTest.cpp Examining data/oscpack-1.1.0/tests/OscReceiveTest.h Examining data/oscpack-1.1.0/tests/OscUnitTests.h Examining data/oscpack-1.1.0/tests/OscSendTests.h Examining data/oscpack-1.1.0/tests/OscUnitTests.cpp FINAL RESULTS: data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:363:10: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). std::strcpy( messageCursor_, rhs.addressPattern ); data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:605:10: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). std::strcpy( argumentCurrent_, rhs ); data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:625:10: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). std::strcpy( argumentCurrent_, rhs ); data/oscpack-1.1.0/examples/OscDump.cpp:83:15: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). port = std::atoi( argv[1] ); data/oscpack-1.1.0/examples/SimpleSend.cpp:21:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buffer[OUTPUT_BUFFER_SIZE]; data/oscpack-1.1.0/ip/IpEndpointName.cpp:53:8: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. std::sprintf( s, "<any>" ); data/oscpack-1.1.0/ip/IpEndpointName.cpp:55:8: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. std::sprintf( s, "%d.%d.%d.%d", data/oscpack-1.1.0/ip/IpEndpointName.cpp:68:9: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. std::sprintf( s, "<any>:<any>" ); data/oscpack-1.1.0/ip/IpEndpointName.cpp:70:9: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. std::sprintf( s, "%d.%d.%d.%d:<any>", data/oscpack-1.1.0/ip/IpEndpointName.cpp:78:9: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. std::sprintf( s, "<any>:%d", port ); data/oscpack-1.1.0/ip/IpEndpointName.cpp:80:9: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. std::sprintf( s, "%d.%d.%d.%d:%d", data/oscpack-1.1.0/ip/posix/NetworkingUtils.cpp:59:14: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. std::memcpy( &a, h->h_addr_list[0], h->h_length ); data/oscpack-1.1.0/ip/win32/NetworkingUtils.cpp:90:14: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. std::memcpy( &a, h->h_addr_list[0], h->h_length ); data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:65:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char c[4]; data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:85:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char c[4]; data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:105:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char c[8]; data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:129:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char c[8]; data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:329:10: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. std::memcpy( messageCursor_, "#bundle\0", 8 ); data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:395:14: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. std::memcpy( tempTypeTags, typeTagsCurrent_, typeTagsCount ); data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:420:14: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. std::memcpy( messageCursor_, ",\0\0\0", 4 ); data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:489:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char c[4]; data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:577:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char c[8]; data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:648:10: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. std::memcpy( argumentCurrent_, rhs.data, rhs.size ); data/oscpack-1.1.0/osc/OscPrintReceivedElements.cpp:83:17: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char s[2] = {0}; data/oscpack-1.1.0/osc/OscReceivedElements.cpp:98:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char c[4]; data/oscpack-1.1.0/osc/OscReceivedElements.cpp:118:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char c[4]; data/oscpack-1.1.0/osc/OscReceivedElements.cpp:138:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char c[8]; data/oscpack-1.1.0/osc/OscReceivedElements.cpp:162:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char c[8]; data/oscpack-1.1.0/osc/OscReceivedElements.cpp:242:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char c[4]; data/oscpack-1.1.0/osc/OscReceivedElements.cpp:273:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char c[4]; data/oscpack-1.1.0/osc/OscReceivedElements.cpp:389:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char c[8]; data/oscpack-1.1.0/tests/OscReceiveTest.cpp:176:17: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char s[2] = {0}; data/oscpack-1.1.0/tests/OscReceiveTest.cpp:270:15: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). port = std::atoi( argv[1] ); data/oscpack-1.1.0/tests/OscSendTests.cpp:60:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buffer[IP_MTU_SIZE]; data/oscpack-1.1.0/tests/OscSendTests.cpp:216:21: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). port = std::atoi( argv[2] ); data/oscpack-1.1.0/tests/OscSendTests.cpp:221:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char hostIpAddress[ IpEndpointName::ADDRESS_STRING_LENGTH ]; data/oscpack-1.1.0/tests/OscUnitTests.cpp:116:10: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. std::memcpy( p, s, length ); data/oscpack-1.1.0/ip/posix/UdpSocket.cpp:482:21: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). read( breakPipe_[0], &c, 1 ); data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:249:29: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). + RoundUp4(std::strlen(addressPattern) + 1) + 4; data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:364:34: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). std::size_t rhsLength = std::strlen(rhs.addressPattern); data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:602:51: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). CheckForAvailableArgumentSpace( RoundUp4(std::strlen(rhs) + 1) ); data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:606:34: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). std::size_t rhsLength = std::strlen(rhs); data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:622:51: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). CheckForAvailableArgumentSpace( RoundUp4(std::strlen(rhs) + 1) ); data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:626:34: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). std::size_t rhsLength = std::strlen(rhs); data/oscpack-1.1.0/osc/OscPrintReceivedElements.cpp:130:35: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). size_t len = std::strlen( timeString ); ANALYSIS SUMMARY: Hits = 45 Lines analyzed = 6272 in approximately 0.19 seconds (33359 lines/second) Physical Source Lines of Code (SLOC) = 3675 Hits@level = [0] 2 [1] 8 [2] 34 [3] 0 [4] 3 [5] 0 Hits@level+ = [0+] 47 [1+] 45 [2+] 37 [3+] 3 [4+] 3 [5+] 0 Hits/KSLOC@level+ = [0+] 12.7891 [1+] 12.2449 [2+] 10.068 [3+] 0.816327 [4+] 0.816327 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.