Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/php-radius-1.4.0~b1/radius-1.4.0b1/pecl-compat/src/misc.h
Examining data/php-radius-1.4.0~b1/radius-1.4.0b1/pecl-compat/src/zend_API.h
Examining data/php-radius-1.4.0~b1/radius-1.4.0b1/pecl-compat/src/zend_hash.h
Examining data/php-radius-1.4.0~b1/radius-1.4.0b1/pecl-compat/src/zend_resource.h
Examining data/php-radius-1.4.0~b1/radius-1.4.0b1/pecl-compat/src/zend_string.h
Examining data/php-radius-1.4.0~b1/radius-1.4.0b1/pecl-compat/compat.h
Examining data/php-radius-1.4.0~b1/radius-1.4.0b1/php_radius.h
Examining data/php-radius-1.4.0~b1/radius-1.4.0b1/radius.c
Examining data/php-radius-1.4.0~b1/radius-1.4.0b1/radius_init_const.h
Examining data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c
Examining data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.h
Examining data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib_compat.c
Examining data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib_compat.h
Examining data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib_md5.h
Examining data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib_private.h
Examining data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib_vs.h
FINAL RESULTS:
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:87:2: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
vsnprintf(h->errmsg, ERRSIZE, format, ap);
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:472:4: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(msg, h->errmsg);
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:1242:13: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
php_uint32 random;
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:1296:33: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
out->data[0] = (unsigned char) random | 0x80;
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:1297:34: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
out->data[1] = (unsigned char) (random >> 8);
data/php-radius-1.4.0~b1/radius-1.4.0b1/pecl-compat/src/misc.h:67:28: [2] (buffer) bcopy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
# define memmove(a, b, c) bcopy(b, a, c)
data/php-radius-1.4.0~b1/radius-1.4.0b1/pecl-compat/src/zend_string.h:40:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char val[1];
data/php-radius-1.4.0~b1/radius-1.4.0b1/pecl-compat/src/zend_string.h:135:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ZSTR_VAL(ret), str, len);
data/php-radius-1.4.0~b1/radius-1.4.0b1/pecl-compat/src/zend_string.h:171:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ZSTR_VAL(ret), ZSTR_VAL(s), MIN(len, ZSTR_LEN(s)) + 1);
data/php-radius-1.4.0~b1/radius-1.4.0b1/pecl-compat/src/zend_string.h:194:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ZSTR_VAL(ret), ZSTR_VAL(s), ZSTR_LEN(s) + 1);
data/php-radius-1.4.0~b1/radius-1.4.0b1/pecl-compat/src/zend_string.h:217:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ZSTR_VAL(ret), ZSTR_VAL(s), len + 1);
data/php-radius-1.4.0~b1/radius-1.4.0b1/pecl-compat/src/zend_string.h:238:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ZSTR_VAL(ret), ZSTR_VAL(s), MIN((n * m) + l, ZSTR_LEN(s)) + 1);
data/php-radius-1.4.0~b1/radius-1.4.0b1/radius.c:724:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[LEN_AUTH];
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:95:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char md5[16];
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:103:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(md5, &h->request[POS_AUTH], LEN_AUTH);
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:151:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char md5[16];
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:217:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(h->pass, value, len);
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:263:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&h->request[h->req_len], actual_value, len);
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:297:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&srvp->addr.sin_addr, hent->h_addr,
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:345:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[MAXCONFLINE];
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:351:12: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((fp = fopen(path, "r")) == NULL) {
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:359:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *fields[5];
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:361:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char msg[ERRSIZE];
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:600:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&value.s_addr, data, sizeof value.s_addr);
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:609:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&value, data, sizeof value);
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:620:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(s, data, len);
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:1051:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(attr->attrib_data + 1, actual_value, len);
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:1053:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(attr->attrib_data, actual_value, len);
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:1097:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf, h->request + POS_AUTH, LEN_AUTH);
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:1117:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char R[LEN_AUTH];
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:1166:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char R[LEN_AUTH]; /* variable names as per rfc2548 */
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:1230:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(demangled, P + 1, *len);
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:1236:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char authenticator[16];
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:1238:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char intermediate[16];
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib_private.h:81:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char errmsg[ERRSIZE]; /* Most recent error message */
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib_private.h:82:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char request[MSGSIZE]; /* Request to send */
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib_private.h:85:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pass[PASSSIZE]; /* Cleartext password */
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib_private.h:89:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char response[MSGSIZE]; /* Response received */
data/php-radius-1.4.0~b1/radius-1.4.0b1/pecl-compat/src/zend_API.h:40:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
Z_STRLEN_P(__z) = strlen(__s); \
data/php-radius-1.4.0~b1/radius-1.4.0b1/pecl-compat/src/zend_API.h:68:81: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
#define add_assoc_string(__arg, __key, __str) add_assoc_string_ex(__arg, __key, strlen(__key)+1, __str, 1)
data/php-radius-1.4.0~b1/radius-1.4.0b1/pecl-compat/src/zend_API.h:71:90: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
#define add_assoc_stringl(__arg, __key, __str, __len) add_assoc_stringl_ex(__arg, __key, strlen(__key)+1, __str, __len, 1)
data/php-radius-1.4.0~b1/radius-1.4.0b1/radius.c:218:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
RETURN_STRINGL(msg, strlen(msg));
data/php-radius-1.4.0~b1/radius-1.4.0b1/radius.c:651:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
RETURN_STRINGL(addr_dot, strlen(addr_dot));
data/php-radius-1.4.0~b1/radius-1.4.0b1/radius.c:686:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
RETVAL_STRINGL(val, strlen(val));
data/php-radius-1.4.0~b1/radius-1.4.0b1/radius.c:757:26: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
RETURN_STRINGL(secret, strlen(secret));
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:109:33: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
MD5Update(&ctx, srvp->secret, strlen(srvp->secret));
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:138:32: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
MD5Update(&ctx, srvp->secret, strlen(srvp->secret));
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:175:32: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
MD5Update(&ctx, srvp->secret, strlen(srvp->secret));
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:334:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(h->servers[srv].secret));
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:376:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(buf);
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:828:36: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return rad_put_attr(h, type, str, strlen(str), options);
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:1089:52: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return (rad_put_vendor_attr(h, vendor, type, str, strlen(str), options));
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:1140:25: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
MD5Update(&Context, S, strlen(S));
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:1152:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
MD5Update(&Context, S, strlen(S));
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:1189:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
Slen = strlen(S);
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:1303:26: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
MD5Update(&md5, secret, strlen(secret));
data/php-radius-1.4.0~b1/radius-1.4.0b1/radlib.c:1322:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
MD5Update(&md5, secret, strlen(secret));
ANALYSIS SUMMARY:
Hits = 57
Lines analyzed = 4409 in approximately 0.13 seconds (34055 lines/second)
Physical Source Lines of Code (SLOC) = 3010
Hits@level = [0] 6 [1] 19 [2] 33 [3] 3 [4] 2 [5] 0
Hits@level+ = [0+] 63 [1+] 57 [2+] 38 [3+] 5 [4+] 2 [5+] 0
Hits/KSLOC@level+ = [0+] 20.9302 [1+] 18.9369 [2+] 12.6246 [3+] 1.66113 [4+] 0.664452 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.