Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/python-utmp-0.9/constants.h
Examining data/python-utmp-0.9/makeconst.c
Examining data/python-utmp-0.9/utmpaccessmodule.c
FINAL RESULTS:
data/python-utmp-0.9/makeconst.c:6:16: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
#define PRL(s) printf(#s" = %i\n", s);
data/python-utmp-0.9/makeconst.c:8:17: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
#define PRLS(s) printf(#s" = \"%s\"\n", s);
data/python-utmp-0.9/utmpaccessmodule.c:10:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ut_line[UT_LINESIZE + 1]; /* device name of tty - "/dev/" */
data/python-utmp-0.9/utmpaccessmodule.c:11:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ut_id[UT_IDSIZE + 1]; /* init id or abbrev. ttyname */
data/python-utmp-0.9/utmpaccessmodule.c:12:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ut_user[UT_NAMESIZE + 1]; /* user name */
data/python-utmp-0.9/utmpaccessmodule.c:13:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ut_host[UT_HOSTSIZE + 1]; /* hostname for remote login */
data/python-utmp-0.9/utmpaccessmodule.c:108:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(m->ut_addr_v6, s->ut_addr_v6, 4 * sizeof(int32_t));
data/python-utmp-0.9/utmpaccessmodule.c:175:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(s->ut_addr_v6, m->ut_addr_v6, 4 * sizeof(int32_t));
data/python-utmp-0.9/utmpaccessmodule.c:204:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char _utmpfilename[MAXPATHLEN] = UTMP_FILE;
data/python-utmp-0.9/utmpaccessmodule.c:271:9: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen(_utmpfilename, "rb");
data/python-utmp-0.9/utmpaccessmodule.c:441:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen(_utmpfilename, "ab");
data/python-utmp-0.9/utmpaccessmodule.c:449:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen(_utmpfilename, "r+b");
data/python-utmp-0.9/utmpaccessmodule.c:81:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(m->ut_line, s->ut_line, UT_LINESIZE);
data/python-utmp-0.9/utmpaccessmodule.c:82:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(m->ut_id, checkid(s), UT_IDSIZE);
data/python-utmp-0.9/utmpaccessmodule.c:83:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(m->ut_user, s->ut_user, UT_NAMESIZE);
data/python-utmp-0.9/utmpaccessmodule.c:86:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(m->ut_host, s->ut_host, UT_HOSTSIZE);
data/python-utmp-0.9/utmpaccessmodule.c:134:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(s->ut_host, m->ut_host, UT_HOSTSIZE);
data/python-utmp-0.9/utmpaccessmodule.c:137:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(s->ut_user, m->ut_user, UT_NAMESIZE);
data/python-utmp-0.9/utmpaccessmodule.c:157:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(checkid(s), m->ut_id, UT_IDSIZE);
data/python-utmp-0.9/utmpaccessmodule.c:160:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(s->ut_line, m->ut_line, UT_LINESIZE);
data/python-utmp-0.9/utmpaccessmodule.c:213:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(_utmpfilename, name, sizeof(_utmpfilename));
data/python-utmp-0.9/utmpaccessmodule.c:366:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(myentry.ut_id, ut_id, UT_IDSIZE);
data/python-utmp-0.9/utmpaccessmodule.c:418:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(entry.ut_line, ut_line, UT_LINESIZE);
data/python-utmp-0.9/utmpaccessmodule.c:505:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(myentry.ut_line, ut_line, UT_LINESIZE);
data/python-utmp-0.9/utmpaccessmodule.c:506:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(myentry.ut_id, ut_id, UT_IDSIZE);
data/python-utmp-0.9/utmpaccessmodule.c:507:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(myentry.ut_user, ut_user, UT_NAMESIZE);
data/python-utmp-0.9/utmpaccessmodule.c:508:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(myentry.ut_host, ut_host, UT_HOSTSIZE);
ANALYSIS SUMMARY:
Hits = 27
Lines analyzed = 735 in approximately 0.03 seconds (24600 lines/second)
Physical Source Lines of Code (SLOC) = 583
Hits@level = [0] 3 [1] 15 [2] 10 [3] 0 [4] 2 [5] 0
Hits@level+ = [0+] 30 [1+] 27 [2+] 12 [3+] 2 [4+] 2 [5+] 0
Hits/KSLOC@level+ = [0+] 51.458 [1+] 46.3122 [2+] 20.5832 [3+] 3.43053 [4+] 3.43053 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.