Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/osptoolkit-4.13.0/enroll/osptnepinit.h
Examining data/osptoolkit-4.13.0/enroll/osptneputil.c
Examining data/osptoolkit-4.13.0/enroll/osptnep.h
Examining data/osptoolkit-4.13.0/enroll/osptneperrno.h
Examining data/osptoolkit-4.13.0/enroll/osptnepdatatypes.h
Examining data/osptoolkit-4.13.0/enroll/osptneputil.h
Examining data/osptoolkit-4.13.0/enroll/osptnep.c
Examining data/osptoolkit-4.13.0/enroll/osptnepenroll.c
Examining data/osptoolkit-4.13.0/enroll/osptnepenroll.h
Examining data/osptoolkit-4.13.0/enroll/osptnepinit.c
Examining data/osptoolkit-4.13.0/test/nonblocking.c
Examining data/osptoolkit-4.13.0/test/test_app.c
Examining data/osptoolkit-4.13.0/test/syncque.c
Examining data/osptoolkit-4.13.0/test/syncque.h
Examining data/osptoolkit-4.13.0/test/nonblocking.h
Examining data/osptoolkit-4.13.0/src/ospprovider.c
Examining data/osptoolkit-4.13.0/src/ospmsgutil.c
Examining data/osptoolkit-4.13.0/src/ospciscoext.c
Examining data/osptoolkit-4.13.0/src/osphttp.c
Examining data/osptoolkit-4.13.0/src/ospcapcnf.c
Examining data/osptoolkit-4.13.0/src/ospasn1ids.c
Examining data/osptoolkit-4.13.0/src/ospproviderapi.c
Examining data/osptoolkit-4.13.0/src/ospb64.c
Examining data/osptoolkit-4.13.0/src/ospxml.c
Examining data/osptoolkit-4.13.0/src/ospstir.c
Examining data/osptoolkit-4.13.0/src/ospaudit.c
Examining data/osptoolkit-4.13.0/src/ospnossl.c
Examining data/osptoolkit-4.13.0/src/ospsecssl.c
Examining data/osptoolkit-4.13.0/src/osptnprobe.c
Examining data/osptoolkit-4.13.0/src/ospx509.c
Examining data/osptoolkit-4.13.0/src/ospmsgque.c
Examining data/osptoolkit-4.13.0/src/ospfail.c
Examining data/osptoolkit-4.13.0/src/ospreauthreq.c
Examining data/osptoolkit-4.13.0/src/ospbfr.c
Examining data/osptoolkit-4.13.0/src/ospostime.c
Examining data/osptoolkit-4.13.0/src/ospxmlelem.c
Examining data/osptoolkit-4.13.0/src/ospssl.c
Examining data/osptoolkit-4.13.0/src/ospstatistics.c
Examining data/osptoolkit-4.13.0/src/osptokeninfo.c
Examining data/osptoolkit-4.13.0/src/ospxmlparse.c
Examining data/osptoolkit-4.13.0/src/ospmsgdesc.c
Examining data/osptoolkit-4.13.0/src/ospasn1parse.c
Examining data/osptoolkit-4.13.0/src/ospcomm.c
Examining data/osptoolkit-4.13.0/src/ospinit.c
Examining data/osptoolkit-4.13.0/src/ospasn1.c
Examining data/osptoolkit-4.13.0/src/ospxmlenc.c
Examining data/osptoolkit-4.13.0/src/ospxmlattr.c
Examining data/osptoolkit-4.13.0/src/ospauthrsp.c
Examining data/osptoolkit-4.13.0/src/ospcapind.c
Examining data/osptoolkit-4.13.0/src/ospmime.c
Examining data/osptoolkit-4.13.0/src/ospusagecnf.c
Examining data/osptoolkit-4.13.0/src/ospauthcnf.c
Examining data/osptoolkit-4.13.0/src/ospcallid.c
Examining data/osptoolkit-4.13.0/src/ospsocket.c
Examining data/osptoolkit-4.13.0/src/osptoken.c
Examining data/osptoolkit-4.13.0/src/ospsecurity.c
Examining data/osptoolkit-4.13.0/src/osppkcs8.c
Examining data/osptoolkit-4.13.0/src/ospxmltype.c
Examining data/osptoolkit-4.13.0/src/ospaltinfo.c
Examining data/osptoolkit-4.13.0/src/ospxmlutil.c
Examining data/osptoolkit-4.13.0/src/osptnlog.c
Examining data/osptoolkit-4.13.0/src/ospcrypto.c
Examining data/osptoolkit-4.13.0/src/ospmsginfo.c
Examining data/osptoolkit-4.13.0/src/ospreauthrsp.c
Examining data/osptoolkit-4.13.0/src/osplist.c
Examining data/osptoolkit-4.13.0/src/ospusageind.c
Examining data/osptoolkit-4.13.0/src/ospmsgattr.c
Examining data/osptoolkit-4.13.0/src/ospdest.c
Examining data/osptoolkit-4.13.0/src/ospusage.c
Examining data/osptoolkit-4.13.0/src/ospauthreq.c
Examining data/osptoolkit-4.13.0/src/ospasn1object.c
Examining data/osptoolkit-4.13.0/src/ospauthind.c
Examining data/osptoolkit-4.13.0/src/osptrans.c
Examining data/osptoolkit-4.13.0/src/ospasn1primitives.c
Examining data/osptoolkit-4.13.0/src/osptransids.c
Examining data/osptoolkit-4.13.0/src/osptnaudit.c
Examining data/osptoolkit-4.13.0/src/osputils.c
Examining data/osptoolkit-4.13.0/src/ospstatus.c
Examining data/osptoolkit-4.13.0/src/osppkcs1.c
Examining data/osptoolkit-4.13.0/src/ospmsgelem.c
Examining data/osptoolkit-4.13.0/src/osppkcs7.c
Examining data/osptoolkit-4.13.0/src/osptransapi.c
Examining data/osptoolkit-4.13.0/src/ospopenssl.c
Examining data/osptoolkit-4.13.0/src/ospcryptowrap.c
Examining data/osptoolkit-4.13.0/include/osp/osputils.h
Examining data/osptoolkit-4.13.0/include/osp/ospaltinfo.h
Examining data/osptoolkit-4.13.0/include/osp/osppkcs7.h
Examining data/osptoolkit-4.13.0/include/osp/ospmsginfo.h
Examining data/osptoolkit-4.13.0/include/osp/ospcapind.h
Examining data/osptoolkit-4.13.0/include/osp/ospmsgattr.h
Examining data/osptoolkit-4.13.0/include/osp/ospcode.h
Examining data/osptoolkit-4.13.0/include/osp/ospdatatypes.h
Examining data/osptoolkit-4.13.0/include/osp/ospcrypto.h
Examining data/osptoolkit-4.13.0/include/osp/osptrans.h
Examining data/osptoolkit-4.13.0/include/osp/ospauthcnf.h
Examining data/osptoolkit-4.13.0/include/osp/ospossys.h
Examining data/osptoolkit-4.13.0/include/osp/ospdest.h
Examining data/osptoolkit-4.13.0/include/osp/ospaudit.h
Examining data/osptoolkit-4.13.0/include/osp/ospxmltype.h
Examining data/osptoolkit-4.13.0/include/osp/ospx500.h
Examining data/osptoolkit-4.13.0/include/osp/ospproviderapi.h
Examining data/osptoolkit-4.13.0/include/osp/ospauthind.h
Examining data/osptoolkit-4.13.0/include/osp/ospciscoext.h
Examining data/osptoolkit-4.13.0/include/osp/ospconfig.h
Examining data/osptoolkit-4.13.0/include/osp/ospinit.h
Examining data/osptoolkit-4.13.0/include/osp/ospostime.h
Examining data/osptoolkit-4.13.0/include/osp/ospasn1ids.h
Examining data/osptoolkit-4.13.0/include/osp/ospcomm.h
Examining data/osptoolkit-4.13.0/include/osp/ospstir.h
Examining data/osptoolkit-4.13.0/include/osp/ospcallid.h
Examining data/osptoolkit-4.13.0/include/osp/ospmsgque.h
Examining data/osptoolkit-4.13.0/include/osp/ospsecurity.h
Examining data/osptoolkit-4.13.0/include/osp/ospusagecnf.h
Examining data/osptoolkit-4.13.0/include/osp/osplibversion.h
Examining data/osptoolkit-4.13.0/include/osp/ospcryptowrap.h
Examining data/osptoolkit-4.13.0/include/osp/ospfail.h
Examining data/osptoolkit-4.13.0/include/osp/ospb64.h
Examining data/osptoolkit-4.13.0/include/osp/ospcustomdebug.h
Examining data/osptoolkit-4.13.0/include/osp/ospmsgpart.h
Examining data/osptoolkit-4.13.0/include/osp/ospmime.h
Examining data/osptoolkit-4.13.0/include/osp/ospxmlelem.h
Examining data/osptoolkit-4.13.0/include/osp/ospprovider.h
Examining data/osptoolkit-4.13.0/include/osp/osptnlog.h
Examining data/osptoolkit-4.13.0/include/osp/ospstatistics.h
Examining data/osptoolkit-4.13.0/include/osp/ospusageind.h
Examining data/osptoolkit-4.13.0/include/osp/osptoken.h
Examining data/osptoolkit-4.13.0/include/osp/osppkcs8.h
Examining data/osptoolkit-4.13.0/include/osp/ospasn1.h
Examining data/osptoolkit-4.13.0/include/osp/osptnprobe.h
Examining data/osptoolkit-4.13.0/include/osp/ospbfr.h
Examining data/osptoolkit-4.13.0/include/osp/ospreauthreq.h
Examining data/osptoolkit-4.13.0/include/osp/ospcapcnf.h
Examining data/osptoolkit-4.13.0/include/osp/ospauthrsp.h
Examining data/osptoolkit-4.13.0/include/osp/osposincl.h
Examining data/osptoolkit-4.13.0/include/osp/ospxmlattr.h
Examining data/osptoolkit-4.13.0/include/osp/ospmsg.h
Examining data/osptoolkit-4.13.0/include/osp/osperrno.h
Examining data/osptoolkit-4.13.0/include/osp/ospauthreq.h
Examining data/osptoolkit-4.13.0/include/osp/ospsslsess.h
Examining data/osptoolkit-4.13.0/include/osp/osptokeninfo.h
Examining data/osptoolkit-4.13.0/include/osp/ospxml.h
Examining data/osptoolkit-4.13.0/include/osp/osp.h
Examining data/osptoolkit-4.13.0/include/osp/ospmsgelem.h
Examining data/osptoolkit-4.13.0/include/osp/osplist.h
Examining data/osptoolkit-4.13.0/include/osp/ospmsgdesc.h
Examining data/osptoolkit-4.13.0/include/osp/ospdebug.h
Examining data/osptoolkit-4.13.0/include/osp/ospx509.h
Examining data/osptoolkit-4.13.0/include/osp/osphttp.h
Examining data/osptoolkit-4.13.0/include/osp/osptnaudit.h
Examining data/osptoolkit-4.13.0/include/osp/ospstatus.h
Examining data/osptoolkit-4.13.0/include/osp/ospxmldoc.h
Examining data/osptoolkit-4.13.0/include/osp/ospreauthrsp.h
Examining data/osptoolkit-4.13.0/include/osp/ospssl.h
Examining data/osptoolkit-4.13.0/include/osp/ospusage.h
Examining data/osptoolkit-4.13.0/include/osp/osppkcs1.h
Examining data/osptoolkit-4.13.0/include/osp/ospsocket.h
Examining data/osptoolkit-4.13.0/include/osp/osptransids.h
Examining data/osptoolkit-4.13.0/include/osp/osptransapi.h
FINAL RESULTS:
data/osptoolkit-4.13.0/include/osp/ospdebug.h:48:39: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
#define OSPM_PRINTTOERR(ospvParams); {fprintf ospvParams; fflush(stdout); }
data/osptoolkit-4.13.0/include/osp/ospossys.h:51:28: [4] (buffer) sscanf:
The scanf() family's %s operation, without a limit specification, permits
buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
different input function. If the scanf format is influenceable by an
attacker, it's exploitable.
#define OSPM_SSCANF(s,f,r) sscanf((const char*)s,f,&r[0])
data/osptoolkit-4.13.0/include/osp/ospossys.h:521:37: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
#define OSPM_STRCPY(s1,s2) strcpy((s1), (s2))
data/osptoolkit-4.13.0/include/osp/ospossys.h:597:21: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
#define OSPM_ACCESS access
data/osptoolkit-4.13.0/include/osp/ospossys.h:608:25: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
#define OSPM_PRINTF printf
data/osptoolkit-4.13.0/include/osp/ospossys.h:609:25: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
#define OSPM_SPRINTF sprintf
data/osptoolkit-4.13.0/src/ospasn1parse.c:65:57: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
related to the data structure field. Extractor can access
data/osptoolkit-4.13.0/src/ospcomm.c:761:9: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(ErrStr, "Host not found. Invalid Address: %s", svcpt->HostName);
data/osptoolkit-4.13.0/src/osphttp.c:651:9: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(ErrStr, "HTTP Status: 400 Bad Request, IP Address: %s",
data/osptoolkit-4.13.0/src/osphttp.c:656:9: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(ErrStr, "HTTP Status: 401 Unauthorized, IP Address: %s",
data/osptoolkit-4.13.0/src/osphttp.c:661:9: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(ErrStr, "HTTP Status: 404 Not Found, IP Address: %s",
data/osptoolkit-4.13.0/src/osphttp.c:666:9: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(ErrStr, "HTTP Status: 503 Service Unavailable, IP Address: %s",
data/osptoolkit-4.13.0/src/osphttp.c:671:9: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(ErrStr, "HTTP Status: 504 Server Not Ready, IP Address: %s",
data/osptoolkit-4.13.0/src/ospsocket.c:92:13: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(ErrStr, "Cannot communicate with application. Connection timed out to IP address: %s",
data/osptoolkit-4.13.0/src/ospsocket.c:98:13: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(ErrStr, "Cannot communicate with application. Connection timed out to IP address: %s",
data/osptoolkit-4.13.0/src/ospsocket.c:114:17: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(ErrStr, "Cannot communicate with application. Connection timed out to IP address: %s",
data/osptoolkit-4.13.0/src/ospsocket.c:120:17: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(ErrStr, "Cannot communicate with application. Connection timed out to IP address: %s",
data/osptoolkit-4.13.0/src/ospsocket.c:661:13: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(ErrStr, "Application slow in responding, response timed out to IP address: %s",
data/osptoolkit-4.13.0/src/ospsocket.c:674:13: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(ErrStr, "Connection to application has been reset. IP address: %s",
data/osptoolkit-4.13.0/src/osptnlog.c:47:5: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(timebuf, "%s %ld", &tm[4], getpid());
data/osptoolkit-4.13.0/src/osptnlog.c:63:5: [4] (format) vsprintf:
Potential format string problem (CWE-134). Make format string constant.
vsprintf(tmpbuf, fmt, ap);
data/osptoolkit-4.13.0/src/osptnlog.c:66:5: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(buf, tmpbuf);
data/osptoolkit-4.13.0/src/osptnlog.c:69:9: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(tmpbuf, "\n%s", buf);
data/osptoolkit-4.13.0/src/osptnlog.c:111:9: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(buf, "\n%s", tmpbuf);
data/osptoolkit-4.13.0/src/osptnlog.c:113:9: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(tmpbuf, "LOGDUMP - %s\n", msg);
data/osptoolkit-4.13.0/src/osptnlog.c:114:9: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(buf, tmpbuf);
data/osptoolkit-4.13.0/src/osptnlog.c:116:9: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(buf, tmpbuf);
data/osptoolkit-4.13.0/src/osptnlog.c:133:13: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(buf, "%05d: %s %s\n", (((i - 1) / DUMPLEN) * DUMPLEN), hexbuf, txtbuf);
data/osptoolkit-4.13.0/src/osptnlog.c:155:9: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(hexbuf, tmpbuf);
data/osptoolkit-4.13.0/src/osptnlog.c:159:5: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(buf, "%s %s\n", hexbuf, txtbuf);
data/osptoolkit-4.13.0/src/osptokeninfo.c:627:13: [4] (buffer) sscanf:
The scanf() family's %s operation, without a limit specification, permits
buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
different input function.
sscanf((const char *)ptr, "%s", val);
data/osptoolkit-4.13.0/src/ospxmlutil.c:776:21: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(buffer + j, OSPC_XMLESC_QUOT);
data/osptoolkit-4.13.0/src/ospxmlutil.c:780:21: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(buffer + j, OSPC_XMLESC_SINGLEQUOTE);
data/osptoolkit-4.13.0/src/ospxmlutil.c:784:21: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(buffer + j, OSPC_XMLESC_OPEN);
data/osptoolkit-4.13.0/src/ospxmlutil.c:788:21: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(buffer + j, OSPC_XMLESC_CLOSE);
data/osptoolkit-4.13.0/src/ospxmlutil.c:792:21: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(buffer + j, OSPC_XMLESC_REF);
data/osptoolkit-4.13.0/src/ospxmlutil.c:803:17: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(dest, buffer);
data/osptoolkit-4.13.0/src/ospxmlutil.c:860:17: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(dest, buffer);
data/osptoolkit-4.13.0/include/osp/ospossys.h:615:25: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable can
be set more than once (CWE-807, CWE-20). Check environment variables
carefully before using them.
#define OSPM_GETENV getenv
data/osptoolkit-4.13.0/src/ospaudit.c:452:10: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
char random[OSPC_MAX_RANDOM];
data/osptoolkit-4.13.0/src/ospaudit.c:454:17: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
OSPM_MEMSET(random, 0, OSPC_MAX_RANDOM);
data/osptoolkit-4.13.0/src/ospaudit.c:471:41: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
numbyteswritten = OSPPUtilGetRandom(random, 0);
data/osptoolkit-4.13.0/src/ospaudit.c:473:68: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
numbyteswritten = OSPPBfrWriteBlock(&(ospvAudit->Storage), random, numbyteswritten);
data/osptoolkit-4.13.0/src/ospaudit.c:477:21: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
OSPM_MEMSET(random, 0, OSPC_MAX_RANDOM);
data/osptoolkit-4.13.0/src/ospaudit.c:487:41: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
numbyteswritten = OSPPUtilGetRandom(random, 0);
data/osptoolkit-4.13.0/src/ospaudit.c:489:68: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
numbyteswritten = OSPPBfrWriteBlock(&(ospvAudit->Storage), random, numbyteswritten);
data/osptoolkit-4.13.0/src/ospauthreq.c:522:10: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
char random[OSPC_MAX_RANDOM];
data/osptoolkit-4.13.0/src/ospauthreq.c:533:17: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
OSPM_MEMSET(random, 0, OSPC_MAX_RANDOM);
data/osptoolkit-4.13.0/src/ospauthreq.c:567:31: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
if (OSPPUtilGetRandom(random, 0) > 0) {
data/osptoolkit-4.13.0/src/ospauthreq.c:568:88: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
attr = OSPPXMLAttrNew(OSPPMsgAttrGetName(OSPC_MATTR_RANDOM), (const char *)random);
data/osptoolkit-4.13.0/src/ospcapind.c:207:10: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
char random[OSPC_MAX_RANDOM];
data/osptoolkit-4.13.0/src/ospcapind.c:213:17: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
OSPM_MEMSET(random, 0, OSPC_MAX_RANDOM);
data/osptoolkit-4.13.0/src/ospcapind.c:219:40: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
numbytesrandom = OSPPUtilGetRandom(random, 0);
data/osptoolkit-4.13.0/src/ospcapind.c:240:38: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
OSPM_MEMCPY((*ospvIdBuffer), random, numbytesrandom);
data/osptoolkit-4.13.0/src/ospcapind.c:270:10: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
char random[OSPC_MAX_RANDOM];
data/osptoolkit-4.13.0/src/ospcapind.c:272:17: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
OSPM_MEMSET(random, 0, OSPC_MAX_RANDOM);
data/osptoolkit-4.13.0/src/ospcapind.c:288:23: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
OSPPUtilGetRandom(random, 0);
data/osptoolkit-4.13.0/src/ospcapind.c:289:80: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
attr = OSPPXMLAttrNew(OSPPMsgAttrGetName(OSPC_MATTR_RANDOM), (const char *)random);
data/osptoolkit-4.13.0/src/ospreauthreq.c:606:10: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
char random[OSPC_MAX_RANDOM];
data/osptoolkit-4.13.0/src/ospreauthreq.c:611:17: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
OSPM_MEMSET(random, 0, OSPC_MAX_RANDOM);
data/osptoolkit-4.13.0/src/ospreauthreq.c:644:32: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
if ((OSPPUtilGetRandom(random, 0) > 0) && (errcode == OSPC_ERR_NO_ERROR)) {
data/osptoolkit-4.13.0/src/ospreauthreq.c:645:88: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
attr = OSPPXMLAttrNew(OSPPMsgAttrGetName(OSPC_MATTR_RANDOM), (const char *)random);
data/osptoolkit-4.13.0/src/osptrans.c:1677:10: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
char random[OSPC_MAX_RANDOM];
data/osptoolkit-4.13.0/src/osptrans.c:1680:17: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
OSPM_MEMSET(random, 0, OSPC_MAX_RANDOM);
data/osptoolkit-4.13.0/src/osptrans.c:1852:48: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
numbytesrandom = OSPPUtilGetRandom(random, 0);
data/osptoolkit-4.13.0/src/osptrans.c:1857:58: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
OSPM_MEMCPY(ospvTrans->AuthReq->ComponentId, random, numbytesrandom);
data/osptoolkit-4.13.0/src/osptrans.c:1864:48: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
numbytesrandom = OSPPUtilGetRandom(random, 0);
data/osptoolkit-4.13.0/src/osptrans.c:1869:56: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
OSPM_MEMCPY(ospvTrans->AuthReq->MessageId, random, numbytesrandom);
data/osptoolkit-4.13.0/src/ospusageind.c:1233:10: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
char random[OSPC_MAX_RANDOM];
data/osptoolkit-4.13.0/src/ospusageind.c:1250:17: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
OSPM_MEMSET(random, 0, OSPC_MAX_RANDOM);
data/osptoolkit-4.13.0/src/ospusageind.c:1285:31: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
if (OSPPUtilGetRandom(random, 0) > 0) {
data/osptoolkit-4.13.0/src/ospusageind.c:1286:88: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
attr = OSPPXMLAttrNew(OSPPMsgAttrGetName(OSPC_MATTR_RANDOM), (const char *)random);
data/osptoolkit-4.13.0/src/osputils.c:216:5: [3] (random) srand:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
srand(seed);
data/osptoolkit-4.13.0/enroll/osptnep.c:271:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char nextArg[10000];
data/osptoolkit-4.13.0/enroll/osptnep.c:277:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char buf[4096], buf2[4096], *temp;
data/osptoolkit-4.13.0/enroll/osptnep.c:278:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char Reqbuf[4096], Reqbuf2[4096];
data/osptoolkit-4.13.0/enroll/osptnep.c:319:86: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
retVal = OSPPCopyString(&(enrollParams->Function), (unsigned char *)ospvArgv[argvIndex + 1]);
data/osptoolkit-4.13.0/enroll/osptnep.c:326:86: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
retVal = OSPPCopyString(&(enrollParams->Username), (unsigned char *)ospvArgv[argvIndex + 1]);
data/osptoolkit-4.13.0/enroll/osptnep.c:333:86: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
retVal = OSPPCopyString(&(enrollParams->Password), (unsigned char *)ospvArgv[argvIndex + 1]);
data/osptoolkit-4.13.0/enroll/osptnep.c:340:86: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
retVal = OSPPCopyString(&(enrollParams->DeviceId), (unsigned char *)ospvArgv[argvIndex + 1]);
data/osptoolkit-4.13.0/enroll/osptnep.c:347:88: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
retVal = OSPPCopyString(&(enrollParams->CustomerId), (unsigned char *)ospvArgv[argvIndex + 1]);
data/osptoolkit-4.13.0/enroll/osptnep.c:354:83: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
retVal = OSPPCopyString(&(enrollParams->CAUrl), (unsigned char *)ospvArgv[argvIndex + 1]);
data/osptoolkit-4.13.0/enroll/osptnep.c:361:84: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
retVal = OSPPCopyString(&(enrollParams->SSLUrl), (unsigned char *)ospvArgv[argvIndex + 1]);
data/osptoolkit-4.13.0/enroll/osptnep.c:421:86: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
retVal = OSPPCopyString(&(enrollParams->CAFprint), (unsigned char *)ospvArgv[argvIndex + 1]);
data/osptoolkit-4.13.0/enroll/osptnep.h:82:45: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
#define OSPM_ATOI(s) atoi(s)
data/osptoolkit-4.13.0/enroll/osptnepenroll.c:1849:17: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf((char *)destStr + destStrIndex, "%.2X", nextChar);
data/osptoolkit-4.13.0/include/osp/ospasn1.h:317:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char DataReference[OSPC_ASN1_DATAREF_MAXLENGTH];
data/osptoolkit-4.13.0/include/osp/ospasn1.h:443:35: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
int PTPDataRefAddRef(unsigned char ospvDataReference[OSPC_ASN1_DATAREF_MAXLENGTH], unsigned char ospvNewReference);
data/osptoolkit-4.13.0/include/osp/ospasn1.h:665:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char buf[sizeof(OSPTUINT64)];
data/osptoolkit-4.13.0/include/osp/ospasn1.h:670:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char tag[OSPC_BER_MAX_TAG_LENGTH]; /* Complete tag */
data/osptoolkit-4.13.0/include/osp/ospauthind.h:36:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char SourceNumber[OSPC_SIZE_E164NUM];
data/osptoolkit-4.13.0/include/osp/ospauthind.h:37:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char DestinationNumber[OSPC_SIZE_E164NUM];
data/osptoolkit-4.13.0/include/osp/ospauthreq.h:34:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char SourceNumber[OSPC_SIZE_E164NUM];
data/osptoolkit-4.13.0/include/osp/ospauthreq.h:35:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char DestinationNumber[OSPC_SIZE_E164NUM];
data/osptoolkit-4.13.0/include/osp/ospdatatypes.h:183:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char unit[OSPC_SIZE_UNIT];
data/osptoolkit-4.13.0/include/osp/ospdatatypes.h:184:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char currency[OSPC_SIZE_CURRENCY];
data/osptoolkit-4.13.0/include/osp/ospdest.h:105:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char UserName[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospdest.h:106:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char UserId[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospdest.h:107:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char UserGroup[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospdest.h:112:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char SourceNumber[OSPC_SIZE_E164NUM];
data/osptoolkit-4.13.0/include/osp/ospdest.h:113:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char DestinationNumber[OSPC_SIZE_E164NUM];
data/osptoolkit-4.13.0/include/osp/ospdest.h:114:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char DestinationAddr[OSPC_SIZE_SIGNALADDR];
data/osptoolkit-4.13.0/include/osp/ospdest.h:115:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char DestinationDevAddr[OSPC_SIZE_SIGNALADDR];
data/osptoolkit-4.13.0/include/osp/ospdest.h:121:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char Authority[OSPC_SIZE_URL];
data/osptoolkit-4.13.0/include/osp/ospdest.h:128:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char NetworkId[OSPC_SIZE_NORID];
data/osptoolkit-4.13.0/include/osp/ospdest.h:131:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char NPRn[OSPC_SIZE_E164NUM];
data/osptoolkit-4.13.0/include/osp/ospdest.h:132:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char NPCic[OSPC_SIZE_NORID];
data/osptoolkit-4.13.0/include/osp/ospdest.h:134:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char OpName[OSPC_OPNAME_NUMBER][OSPC_SIZE_NORID];
data/osptoolkit-4.13.0/include/osp/ospdest.h:135:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char URL[OSPC_URL_NUMBER][OSPC_SIZE_URL];
data/osptoolkit-4.13.0/include/osp/ospdest.h:140:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char TransferId[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospdest.h:142:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char DestAudioAddr[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospdest.h:143:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char DestVideoAddr[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospdest.h:144:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ProxyEgressAddr[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospdest.h:146:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char CNAM[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospdest.h:148:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char CallType[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospdest.h:149:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char CallCategory[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospdest.h:150:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char NetworkType[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospdest.h:151:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char SwitchId[OSPC_SIZE_NORID];
data/osptoolkit-4.13.0/include/osp/ospdest.h:152:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char DestServiceProvider[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospfail.h:104:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tcdesc[OSPC_TCAUSE_NUMBER][OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospossys.h:43:34: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
#define OSPM_MEMCPY(p,s,z) (void)memcpy((void *)p,s,z)
data/osptoolkit-4.13.0/include/osp/ospossys.h:374:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cBuf[512]; \
data/osptoolkit-4.13.0/include/osp/ospossys.h:395:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cBuf[512]; \
data/osptoolkit-4.13.0/include/osp/ospreauthreq.h:37:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char SourceNumber[OSPC_SIZE_E164NUM];
data/osptoolkit-4.13.0/include/osp/ospreauthreq.h:38:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char DestinationNumber[OSPC_SIZE_E164NUM];
data/osptoolkit-4.13.0/include/osp/ospstir.h:25:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char Value[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospstir.h:31:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char IdSign[OSPC_SIZE_SIGNSTR];
data/osptoolkit-4.13.0/include/osp/ospstir.h:32:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char IdAlg[OSPC_SIZE_ALGSTR];
data/osptoolkit-4.13.0/include/osp/ospstir.h:33:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char IdInfo[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospstir.h:34:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char IdType[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospstir.h:36:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char IdCanon[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/osptokeninfo.h:29:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char lookAheadDest[OSPC_SIZE_SIGNALADDR];
data/osptoolkit-4.13.0/include/osp/osptokeninfo.h:35:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char SourceNumber[OSPC_SIZE_E164NUM];
data/osptoolkit-4.13.0/include/osp/osptokeninfo.h:36:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char DestinationNumber[OSPC_SIZE_E164NUM];
data/osptoolkit-4.13.0/include/osp/osptokeninfo.h:45:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char DestinationNetworkId[OSPC_SIZE_NORID];
data/osptoolkit-4.13.0/include/osp/osptrans.h:102:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char NPRn[OSPC_SIZE_E164NUM];
data/osptoolkit-4.13.0/include/osp/osptrans.h:103:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char NPCic[OSPC_SIZE_NORID];
data/osptoolkit-4.13.0/include/osp/osptrans.h:105:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char OpName[OSPC_OPNAME_NUMBER][OSPC_SIZE_NORID];
data/osptoolkit-4.13.0/include/osp/osptrans.h:107:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char Codec[OSPC_SERVICE_NUMBER][OSPC_CODEC_NUMBER][OSPC_SIZE_CODEC];
data/osptoolkit-4.13.0/include/osp/osptrans.h:109:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *CustomInfo[OSPC_MAX_INDEX];
data/osptoolkit-4.13.0/include/osp/osptrans.h:111:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char UsageSrcNetworkId[OSPC_SIZE_NORID];
data/osptoolkit-4.13.0/include/osp/osptrans.h:112:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char SrcRealm[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/osptrans.h:113:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char DestRealm[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/osptrans.h:114:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char SipHeader[OSPC_SIPHEADER_NUMBER][OSPC_NFORMAT_NUMBER][OSPC_SIZE_URL];
data/osptoolkit-4.13.0/include/osp/osptrans.h:115:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char DivDevInfo[OSPC_SIZE_SIGNALADDR];
data/osptoolkit-4.13.0/include/osp/osptrans.h:116:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ApplicationId[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/osptrans.h:121:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char NetworkTranslatedCalled[OSPC_SIZE_E164NUM];
data/osptoolkit-4.13.0/include/osp/osptrans.h:122:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char SrcServiceProvider[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/osptrans.h:123:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char SystemId[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/osptrans.h:124:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char RelatedReason[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/osptrans.h:126:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char CDRProxyHost[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/osptrans.h:127:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char CDRProxyFolder[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/osptrans.h:128:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char CDRProxySubfolder[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/osptrans.h:129:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char UserAgent[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/osptrans.h:130:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char SrcAudioAddr[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/osptrans.h:131:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char SrcVideoAddr[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/osptrans.h:132:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ProxyIngressAddr[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/osptrans.h:133:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char JIP[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/osptrans.h:138:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char SrcSwitchId[OSPC_SIZE_NORID];
data/osptoolkit-4.13.0/include/osp/osptrans.h:139:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char PCVICID[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospusageind.h:40:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ConferenceId[OSPC_SIZE_CONFID]; /* This is in chararcters */
data/osptoolkit-4.13.0/include/osp/ospusageind.h:48:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char SourceNumber[OSPC_SIZE_E164NUM];
data/osptoolkit-4.13.0/include/osp/ospusageind.h:49:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char DestinationNumber[OSPC_SIZE_E164NUM];
data/osptoolkit-4.13.0/include/osp/ospusageind.h:64:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char Codec[OSPC_SERVICE_NUMBER][OSPC_CODEC_NUMBER][OSPC_SIZE_CODEC];
data/osptoolkit-4.13.0/include/osp/ospusageind.h:70:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char TransferId[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospusageind.h:72:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char DestAudioAddr[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospusageind.h:73:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char DestVideoAddr[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospusageind.h:74:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char CallType[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospusageind.h:75:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char CallCategory[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospusageind.h:76:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char NetworkType[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospusageind.h:77:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char DestServiceProvider[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/include/osp/ospx500.h:33:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char fieldname[OSPC_MAX_FIELDNAME_LENGTH];
data/osptoolkit-4.13.0/include/osp/ospx500.h:34:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char fieldvalue[OSPC_MAX_FIELDVALUE_LENGTH];
data/osptoolkit-4.13.0/src/ospasn1.c:202:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char msg[100];
data/osptoolkit-4.13.0/src/ospasn1.c:257:17: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(msg, "Invalid ASN1 element tag: %02x at %06d", eInfo->Tag, (int) (eptr - ospvASN1Element));
data/osptoolkit-4.13.0/src/ospasn1.c:259:17: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(msg, "ERROR:ElementDecode - Tag=%0x", eInfo->Tag);
data/osptoolkit-4.13.0/src/ospasn1.c:476:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char msg[100];
data/osptoolkit-4.13.0/src/ospasn1.c:528:21: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(msg, "Tag mismatch, pt = %02x, e = %02x", parseRule->Tag, eInfo->Tag);
data/osptoolkit-4.13.0/src/ospasn1.c:530:21: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(msg, "Tag mismatch, pt = %02x, eInfo=NULL", parseRule->Tag);
data/osptoolkit-4.13.0/src/ospasn1.c:782:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char dataReference[OSPC_ASN1_DATAREF_MAXLENGTH];
data/osptoolkit-4.13.0/src/ospasn1object.c:330:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char dataReference[OSPC_ASN1_DATAREF_MAXLENGTH];
data/osptoolkit-4.13.0/src/ospasn1primitives.c:35:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char msg[100];
data/osptoolkit-4.13.0/src/ospasn1primitives.c:43:9: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(msg, "PrimitiveDecode - Tag=%0x", eInfo->Tag);
data/osptoolkit-4.13.0/src/ospasn1primitives.c:84:13: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(msg, "Invalid/Unsupported primitive tag %02x", eInfo->Tag);
data/osptoolkit-4.13.0/src/ospasn1primitives.c:98:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char msg[100];
data/osptoolkit-4.13.0/src/ospasn1primitives.c:140:17: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(msg, "Invalid/Unsupported primitive tag %02x", eInfo->Tag);
data/osptoolkit-4.13.0/src/ospasn1primitives.c:678:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char tmpBuffer[129];
data/osptoolkit-4.13.0/src/ospaudit.c:452:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char random[OSPC_MAX_RANDOM];
data/osptoolkit-4.13.0/src/ospauthreq.c:522:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char random[OSPC_MAX_RANDOM];
data/osptoolkit-4.13.0/src/ospb64.c:26:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char B64CharTab[64 + 1] = "ABCDEFGHIJKLMNOPQRSTUVWXYZ" "abcdefghijklmnopqrstuvwxyz" "0123456789+/";
data/osptoolkit-4.13.0/src/ospcapind.c:207:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char random[OSPC_MAX_RANDOM];
data/osptoolkit-4.13.0/src/ospcapind.c:208:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char counter[OSPC_MAX_RANDOM];
data/osptoolkit-4.13.0/src/ospcapind.c:270:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char random[OSPC_MAX_RANDOM];
data/osptoolkit-4.13.0/src/ospcomm.c:669:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ErrStr[100];
data/osptoolkit-4.13.0/src/ospcomm.c:792:37: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
svcpt->Port = htons((short) atoi(TmpBuf));
data/osptoolkit-4.13.0/src/ospcryptowrap.c:45:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char digestedData[OSPC_CRYPTO_DIGEST_BUFFER_MAXLENGTH];
data/osptoolkit-4.13.0/src/ospcryptowrap.c:138:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char decryptedData[OSPC_CRYPTO_ENCRYPT_BUFFER_MAXLENGTH];
data/osptoolkit-4.13.0/src/ospcryptowrap.c:198:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char digestedData[OSPC_CRYPTO_DIGEST_BUFFER_MAXLENGTH];
data/osptoolkit-4.13.0/src/osphttp.c:625:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ErrStr[200];
data/osptoolkit-4.13.0/src/osphttp.c:626:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[INET_ADDRSTRLEN];
data/osptoolkit-4.13.0/src/ospmime.c:297:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char msgtmp[20];
data/osptoolkit-4.13.0/src/ospmime.c:298:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char sigtmp[20];
data/osptoolkit-4.13.0/src/ospmime.c:302:18: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
msszln = sprintf(msgtmp, "%d", ospvMessage->MsgPart->Length);
data/osptoolkit-4.13.0/src/ospmime.c:305:19: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sigszln = sprintf(sigtmp, "%d", ospvMessage->SigPart->Length), sighdrln = OSPM_STRLEN(OSPC_MIME_SIG_HEADER);
data/osptoolkit-4.13.0/src/ospmsgutil.c:281:30: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char tmpbuf[5000];
data/osptoolkit-4.13.0/src/ospmsgutil.c:404:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char val[41]; /* 39 digits will accomodate 2^128 */ /*!!!PS added 1 */
data/osptoolkit-4.13.0/src/ospmsgutil.c:484:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char val[41]; /* 39 digits will accomodate 2^128 *//*!!!PS added 1 */
data/osptoolkit-4.13.0/src/ospmsgutil.c:532:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char val[4]; /* 39 digits will accomodate 2^128 *//*!!!PS added 1 */
data/osptoolkit-4.13.0/src/ospmsgutil.c:549:9: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(val, "%03ld", ospvNumber);
data/osptoolkit-4.13.0/src/ospmsgutil.c:609:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char val[41]; /* 39 digits will accomodate 2^128 *//*!!!PS added 1 */
data/osptoolkit-4.13.0/src/ospmsgutil.c:687:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tstr[OSPC_SIZE_TIMESTRING];
data/osptoolkit-4.13.0/src/ospopenssl.c:497:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[256];
data/osptoolkit-4.13.0/src/ospproviderapi.c:751:26: [2] (integer) atol:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
custid = atol(ospvCustomerId);
data/osptoolkit-4.13.0/src/ospproviderapi.c:754:28: [2] (integer) atol:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
deviceid = atol(ospvDeviceId);
data/osptoolkit-4.13.0/src/ospreauthreq.c:606:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char random[OSPC_MAX_RANDOM];
data/osptoolkit-4.13.0/src/ospsocket.c:71:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ErrStr[200];
data/osptoolkit-4.13.0/src/ospsocket.c:72:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[INET_ADDRSTRLEN];
data/osptoolkit-4.13.0/src/ospsocket.c:418:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char recvheadbuf[OSPC_RECVBUF_SZ] = { "" };
data/osptoolkit-4.13.0/src/ospsocket.c:428:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[INET_ADDRSTRLEN];
data/osptoolkit-4.13.0/src/ospsocket.c:639:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ErrStr[200];
data/osptoolkit-4.13.0/src/ospsocket.c:640:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[INET_ADDRSTRLEN];
data/osptoolkit-4.13.0/src/ospssl.c:160:68: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
errorcode = OSPPSSLWrapGetData((void *)&((unsigned char *)ospvBuffer)[bufidx], &len,
data/osptoolkit-4.13.0/src/ospssl.c:163:64: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
errorcode = OSPPSockRead(ospvHttp, &((unsigned char *)ospvBuffer)[bufidx], &len);
data/osptoolkit-4.13.0/src/ospssl.c:171:32: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
if (((unsigned char *)ospvBuffer)[bufidx] == ospvDelimiter[delimitidx]) {
data/osptoolkit-4.13.0/src/ospssl.c:198:28: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
((unsigned char *)ospvBuffer)[bufidx] = '\0';
data/osptoolkit-4.13.0/src/ospssl.c:210:60: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
errorcode = OSPPSockRead(ospvHttp, &((unsigned char *)ospvBuffer)[bufidx], &len);
data/osptoolkit-4.13.0/src/osptnlog.c:34:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char buf[BUFSZ];
data/osptoolkit-4.13.0/src/osptnlog.c:35:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char tmpbuf[BUFSZ];
data/osptoolkit-4.13.0/src/osptnlog.c:94:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char hexbuf[(DUMPLEN * 3) + 5];
data/osptoolkit-4.13.0/src/osptnlog.c:95:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char txtbuf[(DUMPLEN) + 5];
data/osptoolkit-4.13.0/src/osptnlog.c:115:9: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(tmpbuf, "LENGTH = %6d =========================================================", len);
data/osptoolkit-4.13.0/src/osptnlog.c:151:13: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(tmpbuf, "%02x ", (unsigned int) c);
data/osptoolkit-4.13.0/src/osptnlog.c:153:13: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(tmpbuf, " ");
data/osptoolkit-4.13.0/src/osptnlog.c:160:5: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant string.
strcat(buf, "=========================================================================\n\n");
data/osptoolkit-4.13.0/src/osptnlog.c:175:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char logfile[100];
data/osptoolkit-4.13.0/src/osptnlog.c:190:13: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
logfd = open(logfile, O_WRONLY | O_APPEND | O_CREAT, LOGPERM);
data/osptoolkit-4.13.0/src/osptnprobe.c:314:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char recvbuf[100];
data/osptoolkit-4.13.0/src/osptokeninfo.c:598:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char val[200]; /* Assume that there wont be any field more than 200 bytes in length */
data/osptoolkit-4.13.0/src/osptokeninfo.c:713:32: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
duration = atoi((const char *)(val + 2));
data/osptoolkit-4.13.0/src/osptrans.c:1677:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char random[OSPC_MAX_RANDOM];
data/osptoolkit-4.13.0/src/osptrans.c:1678:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char counter[OSPC_MAX_RANDOM];
data/osptoolkit-4.13.0/src/osptransapi.c:115:64: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
OSPM_STRCPY(trans->PricingInfo[i].unit, (const char *)ospvInfo[i]->unit);
data/osptoolkit-4.13.0/src/osptransapi.c:116:68: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
OSPM_STRCPY(trans->PricingInfo[i].currency, (const char *)ospvInfo[i]->currency);
data/osptoolkit-4.13.0/src/osptransapi.c:3404:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char AsciiTokenMsg[1000]; /* The assumption is that the ASCII
data/osptoolkit-4.13.0/src/osptransids.c:617:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[30];
data/osptoolkit-4.13.0/src/osptransids.c:629:9: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(buf, "%016I64x", pTrans->ospmTransactionId);
data/osptoolkit-4.13.0/src/osptransids.c:644:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[30];
data/osptoolkit-4.13.0/src/osptransids.c:655:9: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(buf, "%016I64x", pTrans->ospmTransactionId);
data/osptoolkit-4.13.0/src/ospusage.c:562:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/src/ospusageind.c:1233:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char random[OSPC_MAX_RANDOM];
data/osptoolkit-4.13.0/src/ospusageind.c:2176:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[64];
data/osptoolkit-4.13.0/src/ospusageind.c:2179:9: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(buf, "%d", ospvDestinationCount);
data/osptoolkit-4.13.0/src/osputils.c:34:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char returnstring[50];
data/osptoolkit-4.13.0/src/osputils.c:226:20: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
numchars = sprintf(ospvRandom, "%u", (unsigned) randnum);
data/osptoolkit-4.13.0/src/ospx509.c:115:37: [2] (integer) atol:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
*ospvDeviceId = atol(value);
data/osptoolkit-4.13.0/src/ospx509.c:121:39: [2] (integer) atol:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
*ospvCustomerId = atol(value);
data/osptoolkit-4.13.0/src/ospx509.c:147:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char currentDate[OSPC_SIZE_TIMESTRING] = "";
data/osptoolkit-4.13.0/src/ospx509.c:148:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char notBeforeString[OSPC_SIZE_TIMESTRING] = "";
data/osptoolkit-4.13.0/src/ospx509.c:149:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char notAfterString[OSPC_SIZE_TIMESTRING] = "";
data/osptoolkit-4.13.0/src/ospxmlenc.c:96:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[OSPC_XMLDOC_ITEMSIZE];
data/osptoolkit-4.13.0/src/ospxmlparse.c:104:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[OSPC_XMLDOC_ITEMSIZE];
data/osptoolkit-4.13.0/src/ospxmlparse.c:1005:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char scratch[OSPC_XMLDOC_DECLENDLEN + 1];
data/osptoolkit-4.13.0/src/ospxmlparse.c:1049:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char scratch[OSPC_XMLDOC_COMMENTENDLEN + 1];
data/osptoolkit-4.13.0/src/ospxmlparse.c:1092:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char scratch[OSPC_XMLDOC_PIENDLEN + 1];
data/osptoolkit-4.13.0/src/ospxmlparse.c:1135:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char scratch[OSPC_XMLDOC_ELEMENTDECLENDLEN + 1];
data/osptoolkit-4.13.0/src/ospxmlparse.c:1178:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char scratch[OSPC_XMLDOC_ENTITYDECLENDLEN + 1];
data/osptoolkit-4.13.0/src/ospxmlparse.c:1221:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char scratch[OSPC_XMLDOC_ATTLISTENDLEN + 1];
data/osptoolkit-4.13.0/src/ospxmlparse.c:1264:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char scratch[OSPC_XMLDOC_CDATABEGLEN + 1];
data/osptoolkit-4.13.0/src/ospxmlparse.c:1292:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char scratch[OSPC_XMLDOC_CDATAENDLEN + 1];
data/osptoolkit-4.13.0/src/ospxmlparse.c:1320:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char scratch[OSPC_XMLDOC_DECLBEGLEN + 1];
data/osptoolkit-4.13.0/src/ospxmlparse.c:1368:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char scratch[OSPC_XMLDOC_COMMENTBEGLEN + 1];
data/osptoolkit-4.13.0/src/ospxmlparse.c:1401:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char scratch[OSPC_XMLDOC_PIBEGLEN + 1];
data/osptoolkit-4.13.0/src/ospxmlparse.c:1437:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char scratch[OSPC_XMLDOC_DTDBEGLEN + 1];
data/osptoolkit-4.13.0/src/ospxmlparse.c:1473:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char scratch[OSPC_XMLDOC_ELEMENTDECLBEGLEN + 1];
data/osptoolkit-4.13.0/src/ospxmlparse.c:1509:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char scratch[OSPC_XMLDOC_ATTLISTBEGLEN + 1];
data/osptoolkit-4.13.0/src/ospxmlparse.c:1545:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char scratch[OSPC_XMLDOC_ENTITYDECLBEGLEN + 1];
data/osptoolkit-4.13.0/src/ospxmlparse.c:1581:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char scratch[OSPC_XMLDOC_CDATABEGLEN + 1];
data/osptoolkit-4.13.0/src/ospxmlparse.c:1617:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char scratch[OSPC_XMLDOC_CDATAENDLEN + 1];
data/osptoolkit-4.13.0/src/ospxmlutil.c:356:40: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
if (OSPM_MEMCMP((const char *)ospvName, (const char *)OSPVXMLDocEntities[cnt].Name,
data/osptoolkit-4.13.0/src/ospxmlutil.c:356:64: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
if (OSPM_MEMCMP((const char *)ospvName, (const char *)OSPVXMLDocEntities[cnt].Name,
data/osptoolkit-4.13.0/src/ospxmlutil.c:357:40: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
OSPM_STRLEN((const char *)OSPVXMLDocEntities[cnt].Name)) == 0)
data/osptoolkit-4.13.0/src/ospxmlutil.c:626:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char entity[OSPC_XMLDOC_ENTITYSIZE];
data/osptoolkit-4.13.0/src/ospxmlutil.c:638:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char translatedEntity[OSPC_XMLDOC_ENTITYSIZE];
data/osptoolkit-4.13.0/src/ospxmlutil.c:764:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[OSPC_XMLDOC_ITEMSIZE];
data/osptoolkit-4.13.0/src/ospxmlutil.c:822:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[OSPC_XMLDOC_ITEMSIZE];
data/osptoolkit-4.13.0/test/nonblocking.c:59:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ospvConferenceId[OSPC_SIZE_CONFID]; /* In - ConferenceId */
data/osptoolkit-4.13.0/test/test_app.c:48:21: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
#define _Open open
data/osptoolkit-4.13.0/test/test_app.c:88:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char validafter[TIMESTAMP_SZ], validuntil[TIMESTAMP_SZ];
data/osptoolkit-4.13.0/test/test_app.c:92:17: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static unsigned char ret_cid[CALL_ID_SZ];
data/osptoolkit-4.13.0/test/test_app.c:93:17: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static unsigned char c_id[CALL_ID_SZ + 1] = { "1234567890123456" };
data/osptoolkit-4.13.0/test/test_app.c:94:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char callednumber[CALLED_NUM_SZ];
data/osptoolkit-4.13.0/test/test_app.c:95:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char callingnumber[CALLING_NUM_SZ];
data/osptoolkit-4.13.0/test/test_app.c:96:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char dest[DESTINATION_SZ] = { "" };
data/osptoolkit-4.13.0/test/test_app.c:97:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char destdev[DESTINATION_SZ] = { "" };
data/osptoolkit-4.13.0/test/test_app.c:99:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char c_token[TOKEN_SZ] = { "" };
data/osptoolkit-4.13.0/test/test_app.c:138:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char *servicepoints[MAX_SERVICE_POINTS];
data/osptoolkit-4.13.0/test/test_app.c:139:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char *capURLs[MAX_SERVICE_POINTS];
data/osptoolkit-4.13.0/test/test_app.c:220:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char customer_id[64];
data/osptoolkit-4.13.0/test/test_app.c:221:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char device_id[64];
data/osptoolkit-4.13.0/test/test_app.c:222:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char searchstr[20];
data/osptoolkit-4.13.0/test/test_app.c:238:9: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(searchstr, "cacert_%d.pem", i);
data/osptoolkit-4.13.0/test/test_app.c:270:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(customer_id, "%ld", custid);
data/osptoolkit-4.13.0/test/test_app.c:271:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(device_id, "%ld", devid);
data/osptoolkit-4.13.0/test/test_app.c:331:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char msg[100] = "";
data/osptoolkit-4.13.0/test/test_app.c:354:51: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
errcode = OSPPASN1ElementDecode((unsigned char *)certs[i], &eInfo, 0);
data/osptoolkit-4.13.0/test/test_app.c:356:9: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(msg, "Authority Certificate #%02d of %02d (%d bytes)", i + 1, certCount, eInfo->ElementLength);
data/osptoolkit-4.13.0/test/test_app.c:371:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char searchstr[20];
data/osptoolkit-4.13.0/test/test_app.c:377:9: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(searchstr, "cacert_%d.pem", i);
data/osptoolkit-4.13.0/test/test_app.c:503:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char msg[100];
data/osptoolkit-4.13.0/test/test_app.c:531:9: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(msg, "Local Certificate (%d bytes)", eInfo->ElementLength);
data/osptoolkit-4.13.0/test/test_app.c:538:9: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(msg, "Private Key (%d bytes)", privkey.PrivateKeyLength);
data/osptoolkit-4.13.0/test/test_app.c:615:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *svcpts[MAX_SERVICE_POINTS];
data/osptoolkit-4.13.0/test/test_app.c:705:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char SrcNetId[OSPC_SIZE_NORID];
data/osptoolkit-4.13.0/test/test_app.c:706:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char DestNetId[OSPC_SIZE_NORID];
data/osptoolkit-4.13.0/test/test_app.c:888:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char msg[100];
data/osptoolkit-4.13.0/test/test_app.c:927:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char msg[100];
data/osptoolkit-4.13.0/test/test_app.c:969:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char *val[NUM_CALL_IDS] = {
data/osptoolkit-4.13.0/test/test_app.c:991:61: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
callids[i] = OSPPCallIdNew(lens[i], (const unsigned char *)val[i]);
data/osptoolkit-4.13.0/test/test_app.c:1205:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char token2[TOKEN_SZ];
data/osptoolkit-4.13.0/test/test_app.c:1299:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char token2[TOKEN_SZ];
data/osptoolkit-4.13.0/test/test_app.c:1561:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char LookAheadDest[DESTINATION_SZ] = { "" };
data/osptoolkit-4.13.0/test/test_app.c:1788:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char msg[100] = "";
data/osptoolkit-4.13.0/test/test_app.c:1822:17: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(msg, "CAIndex=%d is self signed", caIndex);
data/osptoolkit-4.13.0/test/test_app.c:1829:13: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(msg, "CAIndex=%d, Next CAIndex=%d", caIndex, nextCAIndex);
data/osptoolkit-4.13.0/test/test_app.c:1901:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char *fingerprints[number] = { "fingerprint1", "fingerprint2", "fingerprint3" };
data/osptoolkit-4.13.0/test/test_app.c:2157:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[64];
data/osptoolkit-4.13.0/test/test_app.c:2160:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(buf, "[172.16.0.1]:%d", index++);
data/osptoolkit-4.13.0/test/test_app.c:2162:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(buf, "gateway.transnexus.com:%d", index++);
data/osptoolkit-4.13.0/test/test_app.c:2180:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[64];
data/osptoolkit-4.13.0/test/test_app.c:2183:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(buf, "[192.168.0.1]:%d", index++);
data/osptoolkit-4.13.0/test/test_app.c:2212:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char rn[OSPC_SIZE_E164NUM];
data/osptoolkit-4.13.0/test/test_app.c:2213:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cic[OSPC_SIZE_NORID];
data/osptoolkit-4.13.0/test/test_app.c:2227:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char opname[OSPC_SIZE_NORID];
data/osptoolkit-4.13.0/test/test_app.c:2250:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char url[OSPC_SIZE_NORID];
data/osptoolkit-4.13.0/test/test_app.c:2265:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cnam[OSPC_SIZE_NORID];
data/osptoolkit-4.13.0/test/test_app.c:2459:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char sign[OSPC_SIZE_SIGNSTR];
data/osptoolkit-4.13.0/test/test_app.c:2460:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char alg[OSPC_SIZE_ALGSTR];
data/osptoolkit-4.13.0/test/test_app.c:2461:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char info[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/test/test_app.c:2462:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char type[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/test/test_app.c:2463:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char canon[OSPC_SIZE_NORSTR];
data/osptoolkit-4.13.0/test/test_app.c:2482:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char swid[OSPC_SIZE_NORID];
data/osptoolkit-4.13.0/test/test_app.c:3126:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char inbuf[256];
data/osptoolkit-4.13.0/test/test_app.c:3213:23: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
funcnum = atoi(inbuf);
data/osptoolkit-4.13.0/test/test_app.c:3226:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char inbuf[512];
data/osptoolkit-4.13.0/test/test_app.c:3227:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmp_addr[20];
data/osptoolkit-4.13.0/test/test_app.c:3230:15: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((fp = fopen(CONFIG_FILENAME, "r")) == (FILE *)NULL) {
data/osptoolkit-4.13.0/test/test_app.c:3264:26: [2] (integer) atol:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
custid = atol((const char *)&inbuf[7]);
data/osptoolkit-4.13.0/test/test_app.c:3266:25: [2] (integer) atol:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
devid = atol((const char *)&inbuf[6]);
data/osptoolkit-4.13.0/test/test_app.c:3272:34: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
num_test_calls = atoi(&inbuf[11]);
data/osptoolkit-4.13.0/test/test_app.c:3274:44: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
tokenalgo = (token_algo_t) atoi(&inbuf[10]);
data/osptoolkit-4.13.0/test/test_app.c:3296:40: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
almostOutOfResources = atoi(&inbuf[15]);
data/osptoolkit-4.13.0/test/test_app.c:3298:35: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
hardwareSupport = atoi(&inbuf[10]);
data/osptoolkit-4.13.0/test/test_app.c:3300:26: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
TCcode = atoi(&inbuf[7]);
data/osptoolkit-4.13.0/test/test_app.c:3302:56: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
CallingNumFormat = (OSPE_NUMBER_FORMAT)atoi(&inbuf[19]);
data/osptoolkit-4.13.0/test/test_app.c:3304:55: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
CalledNumFormat = (OSPE_NUMBER_FORMAT)atoi(&inbuf[18]);
data/osptoolkit-4.13.0/test/test_app.c:3309:45: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
SPMsgCount[spindex++] = atoi(&inbuf[9]);
data/osptoolkit-4.13.0/test/test_app.c:3312:36: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
DEF_HTTP_MAXCONN = atoi(&inbuf[17]);
data/osptoolkit-4.13.0/test/test_app.c:3318:51: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
CapSPMsgCount[Capspindex++] = atoi(&inbuf[12]);
data/osptoolkit-4.13.0/test/test_app.c:3341:41: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
IS_PDD_INFO_AVAILABLE = atoi(&inbuf[22]);
data/osptoolkit-4.13.0/test/test_app.c:3493:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char Localcallednumber[CALLED_NUM_SZ];
data/osptoolkit-4.13.0/test/test_app.c:3494:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char Localcallingnumber[CALLING_NUM_SZ];
data/osptoolkit-4.13.0/test/test_app.c:3495:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char Localdest[DESTINATION_SZ] = { "" };
data/osptoolkit-4.13.0/test/test_app.c:3496:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char Localdestdev[DESTINATION_SZ] = { "" };
data/osptoolkit-4.13.0/test/test_app.c:3497:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char Localvalidafter[TIMESTAMP_SZ], Localvaliduntil[TIMESTAMP_SZ];
data/osptoolkit-4.13.0/include/osp/ospossys.h:532:58: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
#define OSPM_STRLEN(s) ((s != OSPC_OSNULL)? strlen(s) : 0)
data/osptoolkit-4.13.0/include/osp/ospossys.h:533:37: [1] (buffer) strncat:
Easily used incorrectly (e.g., incorrectly computing the correct maximum
size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf,
or automatically resizing strings.
#define OSPM_STRNCAT(s1,s2,n) strncat((s1), (s2), (n))
data/osptoolkit-4.13.0/include/osp/ospossys.h:534:39: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
#define OSPM_STRNCPY(s1,s2,n); { strncpy((char *)(s1), (const char *)(s2), (n)); (s1)[n - 1] = '\0'; }
data/osptoolkit-4.13.0/src/osptnlog.c:76:5: [1] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant character.
strcat(buf, "\n");
data/osptoolkit-4.13.0/src/osptnlog.c:120:9: [1] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant character.
strcat(buf, "\n");
data/osptoolkit-4.13.0/src/ospxmlutil.c:768:19: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
srcsize = strlen(src);
data/osptoolkit-4.13.0/src/ospxmlutil.c:826:19: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
srcsize = strlen(src);
data/osptoolkit-4.13.0/test/test_app.c:49:21: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
#define _Read read
data/osptoolkit-4.13.0/test/test_app.c:710:27: [1] (buffer) getchar:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while ((SrcNetId[i] = getchar()) != '\n')
data/osptoolkit-4.13.0/test/test_app.c:719:28: [1] (buffer) getchar:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while ((DestNetId[i] = getchar()) != '\n')
data/osptoolkit-4.13.0/test/test_app.c:1085:5: [1] (buffer) getchar:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
getchar();
data/osptoolkit-4.13.0/test/test_app.c:1100:5: [1] (buffer) getchar:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
getchar();
data/osptoolkit-4.13.0/test/test_app.c:1115:5: [1] (buffer) getchar:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
getchar();
data/osptoolkit-4.13.0/test/test_app.c:1130:5: [1] (buffer) getchar:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
getchar();
data/osptoolkit-4.13.0/test/test_app.c:1145:5: [1] (buffer) getchar:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
getchar();
data/osptoolkit-4.13.0/test/test_app.c:1160:5: [1] (buffer) getchar:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
getchar();
data/osptoolkit-4.13.0/test/test_app.c:1175:5: [1] (buffer) getchar:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
getchar();
data/osptoolkit-4.13.0/test/test_app.c:1493:32: [1] (buffer) getchar:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while ((callingnumber[i] = getchar()) != '\n')
data/osptoolkit-4.13.0/test/test_app.c:1518:31: [1] (buffer) getchar:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while ((callednumber[i] = getchar()) != '\n')
data/osptoolkit-4.13.0/test/test_app.c:2452:65: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
errcode = OSPPTransactionSetIdentity(OSPVTransactionHandle, strlen(sign), (const unsigned char *)sign, alg, info, type, strlen(canon), (const unsigned char *)canon);
data/osptoolkit-4.13.0/test/test_app.c:2452:125: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
errcode = OSPPTransactionSetIdentity(OSPVTransactionHandle, strlen(sign), (const unsigned char *)sign, alg, info, type, strlen(canon), (const unsigned char *)canon);
data/osptoolkit-4.13.0/test/test_app.c:2652:9: [1] (buffer) getchar:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
getchar();
data/osptoolkit-4.13.0/test/test_app.c:2661:9: [1] (buffer) getchar:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
getchar();
data/osptoolkit-4.13.0/test/test_app.c:2752:17: [1] (buffer) getchar:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
getchar();
data/osptoolkit-4.13.0/test/test_app.c:2757:9: [1] (buffer) getchar:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
getchar();
data/osptoolkit-4.13.0/test/test_app.c:3404:17: [1] (buffer) getchar:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
getchar();
ANALYSIS SUMMARY:
Hits = 390
Lines analyzed = 64748 in approximately 1.65 seconds (39351 lines/second)
Physical Source Lines of Code (SLOC) = 42275
Hits@level = [0] 318 [1] 26 [2] 291 [3] 35 [4] 38 [5] 0
Hits@level+ = [0+] 708 [1+] 390 [2+] 364 [3+] 73 [4+] 38 [5+] 0
Hits/KSLOC@level+ = [0+] 16.7475 [1+] 9.22531 [2+] 8.61029 [3+] 1.72679 [4+] 0.898876 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.