Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/python-getdns-1.0.0~b1/context.c
Examining data/python-getdns-1.0.0~b1/context_util.c
Examining data/python-getdns-1.0.0~b1/getdns.c
Examining data/python-getdns-1.0.0~b1/pygetdns.h
Examining data/python-getdns-1.0.0~b1/pygetdns_util.c
Examining data/python-getdns-1.0.0~b1/result.c
FINAL RESULTS:
data/python-getdns-1.0.0~b1/pygetdns_util.c:887:9: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(error_str, "%s: %d", msg, ret);
data/python-getdns-1.0.0~b1/context.c:636:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char buf[sizeof(struct in6_addr)];
data/python-getdns-1.0.0~b1/pygetdns.h:68:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char userarg[BUFSIZ];
data/python-getdns-1.0.0~b1/pygetdns_util.c:372:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char buf[sizeof(struct in6_addr)];
data/python-getdns-1.0.0~b1/pygetdns_util.c:608:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char paddr_buf[256];
data/python-getdns-1.0.0~b1/pygetdns_util.c:885:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char error_str[512];
data/python-getdns-1.0.0~b1/pygetdns_util.c:1012:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(blob, data->data, data->size);
data/python-getdns-1.0.0~b1/context.c:314:26: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
value.size = strlen((char *)value.data);
data/python-getdns-1.0.0~b1/context.c:671:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
addr_type.size = strlen((char *)addr_type.data);
data/python-getdns-1.0.0~b1/context.c:672:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen((char *)addr_type.data) != 4) {
data/python-getdns-1.0.0~b1/context.c:752:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
value->size = strlen((char *)value->data);
data/python-getdns-1.0.0~b1/context.c:872:43: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "append_name", strlen("append_name"))) {
data/python-getdns-1.0.0~b1/context.c:881:48: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "dns_root_servers", strlen("dns_root_servers"))) {
data/python-getdns-1.0.0~b1/context.c:903:38: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "suffix", strlen("suffix"))) {
data/python-getdns-1.0.0~b1/context.c:917:47: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "resolution_type", strlen("resolution_type"))) {
data/python-getdns-1.0.0~b1/context.c:929:53: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "implementation_string", strlen("implementation_string"))) {
data/python-getdns-1.0.0~b1/context.c:943:46: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "version_string", strlen("version_string"))) {
data/python-getdns-1.0.0~b1/context.c:958:39: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "timeout", strlen("timeout"))) {
data/python-getdns-1.0.0~b1/context.c:966:44: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "idle_timeout", strlen("idle_timeout"))) {
data/python-getdns-1.0.0~b1/context.c:974:50: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "dns_transport_list", strlen("dns_transport_list"))) {
data/python-getdns-1.0.0~b1/context.c:994:57: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "limit_outstanding_queries", strlen("limit_outstanding_queries"))) {
data/python-getdns-1.0.0~b1/context.c:1004:59: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "tls_query_padding_blocksize", strlen("tls_query_padding_blocksize"))) {
data/python-getdns-1.0.0~b1/context.c:1014:58: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "edns_client_subnet_private", strlen("edns_client_subnet_private"))) {
data/python-getdns-1.0.0~b1/context.c:1024:50: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "tls_authentication", strlen("tls_authentication"))) {
data/python-getdns-1.0.0~b1/context.c:1034:48: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "follow_redirects", strlen("follow_redirects"))) {
data/python-getdns-1.0.0~b1/context.c:1043:52: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "dnssec_trust_anchors", strlen("dnssec_trust_anchors"))) {
data/python-getdns-1.0.0~b1/context.c:1055:51: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "dnssec_allowed_skew", strlen("dnssec_allowed_skew"))) {
data/python-getdns-1.0.0~b1/context.c:1064:61: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "edns_maximum_udp_payload_size", strlen("edns_maximum_udp_payload_size"))) {
data/python-getdns-1.0.0~b1/context.c:1073:51: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "edns_extended_rcode", strlen("edns_extended_rcode"))) {
data/python-getdns-1.0.0~b1/context.c:1082:44: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "edns_version", strlen("edns_version"))) {
data/python-getdns-1.0.0~b1/context.c:1091:43: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "edns_do_bit", strlen("edns_do_bit"))) {
data/python-getdns-1.0.0~b1/context.c:1101:42: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "namespaces", strlen("namespaces"))) {
data/python-getdns-1.0.0~b1/context.c:1122:58: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "upstream_recursive_servers", strlen("upstream_recursive_servers"))) {
data/python-getdns-1.0.0~b1/context.c:1139:52: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(attrname, "num_pending_requests", strlen("num_pending_requests"))) {
data/python-getdns-1.0.0~b1/context.c:1350:13: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(blob->userarg, userarg, BUFSIZ-1);
data/python-getdns-1.0.0~b1/context.c:1439:13: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(blob->userarg, userarg, BUFSIZ-1);
data/python-getdns-1.0.0~b1/context.c:1536:13: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(blob->userarg, userarg, BUFSIZ-1);
data/python-getdns-1.0.0~b1/context.c:1626:13: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(blob->userarg, userarg, BUFSIZ-1);
data/python-getdns-1.0.0~b1/pygetdns_util.c:186:57: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if ( (!strncmp(tmp_key, "dnssec_return_status", strlen("dnssec_return_status"))) ||
data/python-getdns-1.0.0~b1/pygetdns_util.c:187:63: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(!strncmp(tmp_key, "dnssec_return_all_statuses", strlen("dnssec_return_all_statuses"))) ||
data/python-getdns-1.0.0~b1/pygetdns_util.c:188:62: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(!strncmp(tmp_key, "dnssec_return_only_secure", strlen("dnssec_return_only_secure"))) ||
data/python-getdns-1.0.0~b1/pygetdns_util.c:189:67: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(!strncmp(tmp_key, "dnssec_return_validation_chain", strlen("dnssec_return_validation_chain"))) ||
data/python-getdns-1.0.0~b1/pygetdns_util.c:190:58: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(!strncmp(tmp_key, "return_both_v4_and_v6", strlen("return_both_v4_and_v6"))) ||
data/python-getdns-1.0.0~b1/pygetdns_util.c:191:59: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(!strncmp(tmp_key, "return_api_information", strlen("return_api_information"))) ||
data/python-getdns-1.0.0~b1/pygetdns_util.c:193:58: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(!strncmp(tmp_key, "return_call_debugging", strlen("return_call_debugging"))) ||
data/python-getdns-1.0.0~b1/pygetdns_util.c:195:58: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(!strncmp(tmp_key, "return_call_reporting", strlen("return_call_reporting"))) ||
data/python-getdns-1.0.0~b1/pygetdns_util.c:197:60: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(!strncmp(tmp_key, "add_warning_for_bad_dns", strlen("add_warning_for_bad_dns"))) ) {
data/python-getdns-1.0.0~b1/pygetdns_util.c:220:55: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
} else if (!strncmp(tmp_key, "specify_class", strlen("specify_class"))) { /* takes integer */
data/python-getdns-1.0.0~b1/pygetdns_util.c:243:60: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
} else if (!strncmp(tmp_key, "add_opt_parameters", strlen("add_opt_parameters"))) { /* this is a dict */
data/python-getdns-1.0.0~b1/pygetdns_util.c:263:73: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if ( (!strncmp(tmp_opt_key, "maximum_udp_payload_size", strlen("maximum_udp_payload_size"))) ||
data/python-getdns-1.0.0~b1/pygetdns_util.c:264:63: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(!strncmp(tmp_opt_key, "extended_rcode", strlen("extended_rcode"))) ||
data/python-getdns-1.0.0~b1/pygetdns_util.c:265:56: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(!strncmp(tmp_opt_key, "version", strlen("version"))) ||
data/python-getdns-1.0.0~b1/pygetdns_util.c:266:55: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(!strncmp(tmp_opt_key, "do_bit", strlen("do_bit"))) ) {
data/python-getdns-1.0.0~b1/pygetdns_util.c:281:62: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
} else if (!strncmp(tmp_opt_key, "options", strlen("options"))) { /* options */
data/python-getdns-1.0.0~b1/pygetdns_util.c:316:76: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp(tmpoptionlistkey, "option_code", strlen("option_code"))) {
data/python-getdns-1.0.0~b1/pygetdns_util.c:330:83: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
} else if (!strncmp(tmpoptionlistkey, "option_data", strlen("option_data"))) {
data/python-getdns-1.0.0~b1/pygetdns_util.c:421:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
addr_type.size = strlen((char *)addr_type.data);
data/python-getdns-1.0.0~b1/pygetdns_util.c:422:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen((char *)addr_type.data) != 4) {
data/python-getdns-1.0.0~b1/pygetdns_util.c:466:38: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
tls_auth_name.size = (size_t)strlen((char *)tls_auth_name.data);
data/python-getdns-1.0.0~b1/pygetdns_util.c:476:33: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
scope_id.size = (size_t)strlen((char *)scope_id.data);
data/python-getdns-1.0.0~b1/pygetdns_util.c:486:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
tsig_name.size = (size_t)strlen((char *)tsig_name.data);
data/python-getdns-1.0.0~b1/pygetdns_util.c:499:33: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
tsig_alg.size = (size_t)strlen((char *)tsig_alg.data);
ANALYSIS SUMMARY:
Hits = 62
Lines analyzed = 4215 in approximately 0.11 seconds (37249 lines/second)
Physical Source Lines of Code (SLOC) = 3538
Hits@level = [0] 2 [1] 55 [2] 6 [3] 0 [4] 1 [5] 0
Hits@level+ = [0+] 64 [1+] 62 [2+] 7 [3+] 1 [4+] 1 [5+] 0
Hits/KSLOC@level+ = [0+] 18.0893 [1+] 17.524 [2+] 1.97852 [3+] 0.282646 [4+] 0.282646 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.