Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/procinfo-2.0.304/cygwin_rendercpupagestat.cpp
Examining data/procinfo-2.0.304/linux26_rendercpupagestat.cpp
Examining data/procinfo-2.0.304/linux26_netstat.cpp
Examining data/procinfo-2.0.304/diskStats.cpp
Examining data/procinfo-2.0.304/procinfo.cpp
Examining data/procinfo-2.0.304/interrupts.cpp
Examining data/procinfo-2.0.304/cygwin_procstat.cpp
Examining data/procinfo-2.0.304/rendercpupagestat.cpp
Parsing failed to find end of parameter list; semicolon terminated it in (buf, 63, "%15lu",
#else
snprintf(buf, 63, "%15llu",
#endif
uint64_t(pageDiff / (perSecond && !showTotals ?
( elapsed == 0 ? 1 : elapsed) : 1)));
vector<string> row;
row.push_back(name); row
Examining data/procinfo-2.0.304/tests/testTime.cpp
Examining data/procinfo-2.0.304/tests/select.c
Examining data/procinfo-2.0.304/tests/sizes.c
Examining data/procinfo-2.0.304/lib/prettyPrint.cpp
Examining data/procinfo-2.0.304/lib/timeRoutines.cpp
Examining data/procinfo-2.0.304/lib/routines.cpp
Examining data/procinfo-2.0.304/linux26_procstat.cpp
Examining data/procinfo-2.0.304/getmeminfo.cpp
FINAL RESULTS:
data/procinfo-2.0.304/lib/prettyPrint.cpp:44:10: [4] (format) vprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
code = vprintf(fmt, argp);
data/procinfo-2.0.304/lib/prettyPrint.cpp:99:4: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
snprintf(subline, 100, fmt, rows[i][j].c_str());
data/procinfo-2.0.304/lib/routines.cpp:255:2: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
snprintf(output, 31, fmtBuf, input);
data/procinfo-2.0.304/procinfo.cpp:239:14: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while((c = getopt(argc, argv, "n:N:SDdrbhHvps")) != -1) {
data/procinfo-2.0.304/diskStats.cpp:113:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[36]; bzero(buf, 36);
data/procinfo-2.0.304/diskStats.cpp:117:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[36]; bzero(buf, 36); // note callsite expects to align a 34-char string
data/procinfo-2.0.304/diskStats.cpp:133:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char output[40]; bzero(output, 40);
data/procinfo-2.0.304/interrupts.cpp:103:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[64]; bzero(buf, 64);
data/procinfo-2.0.304/lib/prettyPrint.cpp:92:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char fmt[16]; // oversized to be aligned on the stack.
data/procinfo-2.0.304/lib/prettyPrint.cpp:98:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char subline[128]; // ditto
data/procinfo-2.0.304/lib/routines.cpp:86:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[20+1]; // log10(2**64-1) = ~19.26
data/procinfo-2.0.304/lib/routines.cpp:98:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[20+1]; // log10(2**64-1) = ~19.26
data/procinfo-2.0.304/lib/routines.cpp:110:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[16]; // log10(2**32-1) = ~9.63
data/procinfo-2.0.304/lib/routines.cpp:116:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[16]; // log10(2**32-1) = ~9.63
data/procinfo-2.0.304/lib/routines.cpp:218:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
file.open(fileName);
data/procinfo-2.0.304/lib/routines.cpp:252:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char fmtBuf[3+(10*2)+1]; bzero(fmtBuf, sizeof(fmtBuf));
data/procinfo-2.0.304/lib/routines.cpp:254:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char output[32]; bzero(output, sizeof(output));
data/procinfo-2.0.304/lib/routines.cpp:260:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char output[32]; bzero(output, sizeof(output));
data/procinfo-2.0.304/lib/timeRoutines.cpp:213:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[64]; bzero(buf, 64);
data/procinfo-2.0.304/linux26_netstat.cpp:107:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char iface[32];
data/procinfo-2.0.304/rendercpupagestat.cpp:14:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[64]; bzero(buf, 64);
data/procinfo-2.0.304/rendercpupagestat.cpp:17:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char fractionalSeconds[3];
data/procinfo-2.0.304/rendercpupagestat.cpp:67:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[64]; bzero(buf, 64);
data/procinfo-2.0.304/diskStats.cpp:74:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if( isdigit(disk[strlen(disk)-1]) ) {
data/procinfo-2.0.304/procinfo.cpp:341:15: [1] (buffer) getchar:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
char key = getchar();
ANALYSIS SUMMARY:
Hits = 25
Lines analyzed = 2222 in approximately 0.09 seconds (24588 lines/second)
Physical Source Lines of Code (SLOC) = 1661
Hits@level = [0] 38 [1] 2 [2] 19 [3] 1 [4] 3 [5] 0
Hits@level+ = [0+] 63 [1+] 25 [2+] 23 [3+] 4 [4+] 3 [5+] 0
Hits/KSLOC@level+ = [0+] 37.929 [1+] 15.0512 [2+] 13.8471 [3+] 2.40819 [4+] 1.80614 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.