Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c FINAL RESULTS: data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:214:9: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(message, "FITSIO status = %d: %s\n", status, status_str); data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:450:9: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(repr, "fits file: %s", filename); data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:206:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char status_str[FLEN_STATUS], errmsg[FLEN_ERRMSG]; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:207:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char message[1024]; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:442:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char filename[FLEN_FILENAME]; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:443:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char repr[2056]; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:462:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char filename[FLEN_FILENAME]; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:617:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char extname[FLEN_VALUE]; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:618:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char hduname[FLEN_VALUE]; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:707:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char comptype[20]; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:917:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char extname[FLEN_VALUE]; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:952:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char mess[255]; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:1018:13: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(mess,"Unsupported numpy table datatype %d", npy_dtype); data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:1031:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char mess[255]; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:1127:13: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(mess,"Unsupported numpy image datatype %d", npy_dtype); data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:1660:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char keyname[20]; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:1690:13: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(keyname, "TDIM%d", colnum); data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:1849:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char keyname[20]; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:1851:9: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(keyname, "TDIM%d", colnum); data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:2445:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char card[FLEN_CARD]; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:2730:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char card[FLEN_CARD]; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:2741:9: [2] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). Risk is low because the source is a constant string. strcpy(card, "CONTINUE"); data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:4235:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char keyname[FLEN_KEYWORD]; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:4236:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char value[FLEN_VALUE]; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:4237:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char comment[FLEN_COMMENT]; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:4238:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char card[FLEN_CARD]; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:4569:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char dtype[2]={0}; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:4588:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char dtype[2]={0}; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:4619:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char name[FLEN_VALUE]={0}; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:4620:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char value[FLEN_VALUE]={0}; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:4621:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char comment[FLEN_COMMENT]={0}; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:4627:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char dtype[2]={0}; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:71:12: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). size = strlen(str); data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:94:12: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). size = strlen(str); data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:216:18: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). nleft -= strlen(status_str)+1; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:219:13: [1] (buffer) strncat: Easily used incorrectly (e.g., incorrectly computing the correct maximum size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf, or automatically resizing strings. strncat(message, errmsg, nleft-1); data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:220:22: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). nleft -= strlen(errmsg)+1; data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:222:17: [1] (buffer) strncat: Easily used incorrectly (e.g., incorrectly computing the correct maximum size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf, or automatically resizing strings. Risk is low because the source is a constant character. strncat(message, "\n", nleft-1); data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:1488:13: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(extname) > 0) { data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:1760:13: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(extname) > 0) { data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:2459:5: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(card, cardin, FLEN_CARD); data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:2501:9: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(comment_in) > 0) { data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:2545:9: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(comment_in) > 0) { data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:2588:9: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(comment_in) > 0) { data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:2630:9: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(comment_in) > 0) { data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:2736:11: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). len = strlen(cont); data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:2742:9: [1] (buffer) strncat: Easily used incorrectly (e.g., incorrectly computing the correct maximum size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf, or automatically resizing strings. strncat(card, &cont[ii], 72); data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:2810:9: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(comment_in) > 0) { data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:4250:11: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). lcont=strlen("CONTINUE"); data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:4251:11: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). lcomm=strlen("COMMENT"); data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:4290:12: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). ls=strlen(keyname); data/python-fitsio-1.1.3+dfsg/fitsio/fitsio_pywrap.c:4345:40: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (!is_string_value && 0==strlen(longstr) && !is_comment) { ANALYSIS SUMMARY: Hits = 52 Lines analyzed = 4847 in approximately 0.11 seconds (44642 lines/second) Physical Source Lines of Code (SLOC) = 3430 Hits@level = [0] 0 [1] 20 [2] 30 [3] 0 [4] 2 [5] 0 Hits@level+ = [0+] 52 [1+] 52 [2+] 32 [3+] 2 [4+] 2 [5+] 0 Hits/KSLOC@level+ = [0+] 15.1603 [1+] 15.1603 [2+] 9.32945 [3+] 0.58309 [4+] 0.58309 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.