Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/vblade-24/ata.c Examining data/vblade-24/bpf.c Examining data/vblade-24/config.h Examining data/vblade-24/config/u64.c Examining data/vblade-24/fns.h Examining data/vblade-24/freebsd.c Examining data/vblade-24/linux.c Examining data/vblade-24/linux.h Examining data/vblade-24/dat.h Examining data/vblade-24/aoe.c FINAL RESULTS: data/vblade-24/aoe.c:480:15: [3] (buffer) getopt: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. while ((ch = getopt(argc, argv, "b:dsrm:o:l:")) != -1) { data/vblade-24/aoe.c:25:1: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char config[Nconfig]; data/vblade-24/aoe.c:39:1: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char serial[Nserial+1]; data/vblade-24/aoe.c:61:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(p->data, config, nconfig); data/vblade-24/aoe.c:69:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(p->h.dst, &masks[i*Alen], Alen); data/vblade-24/aoe.c:164:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(config, p->data, nconfig); data/vblade-24/aoe.c:399:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char nip[4]; data/vblade-24/aoe.c:462:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char h[32]; data/vblade-24/aoe.c:483:13: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). bufcnt = atoi(optarg); data/vblade-24/aoe.c:519:8: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). bfd = open(argv[3], omode); data/vblade-24/aoe.c:524:10: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). shelf = atoi(argv[0]); data/vblade-24/aoe.c:525:9: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). slot = atoi(argv[1]); data/vblade-24/ata.c:87:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[64]; data/vblade-24/ata.c:98:2: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(buf, "V%d", VBLADE_VERSION); data/vblade-24/bpf.c:118:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(bpf_program->bf_insns, insns, sizeof(insns)); data/vblade-24/dat.h:174:8: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. extern char serial[Nserial+1]; data/vblade-24/freebsd.c:52:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char device[sizeof BPF_DEV]; data/vblade-24/freebsd.c:63:13: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if ((fd = open(device, O_RDWR)) > 0) data/vblade-24/freebsd.c:200:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(ea, LLADDR(sdl), ETHER_ADDR_LEN); data/vblade-24/freebsd.c:245:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(buf, (void *)(pktbp + bh->bh_hdrlen), data/vblade-24/freebsd.c:57:2: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(device, BPF_DEV, sizeof BPF_DEV); data/vblade-24/freebsd.c:93:9: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). (void)strncpy(ifr.ifr_name, eth, data/vblade-24/freebsd.c:235:15: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). if ((pktn = read(fd, pktbuf, pktbufsz)) < 0) { data/vblade-24/linux.c:138:9: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). return read(fd, buf, sz); ANALYSIS SUMMARY: Hits = 24 Lines analyzed = 1577 in approximately 0.04 seconds (35529 lines/second) Physical Source Lines of Code (SLOC) = 1308 Hits@level = [0] 16 [1] 4 [2] 19 [3] 1 [4] 0 [5] 0 Hits@level+ = [0+] 40 [1+] 24 [2+] 20 [3+] 1 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 30.581 [1+] 18.3486 [2+] 15.2905 [3+] 0.764526 [4+] 0 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.