Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/aflplusplus-2.68c/custom_mutators/honggfuzz/common.h
Examining data/aflplusplus-2.68c/custom_mutators/honggfuzz/custom_mutator_helpers.h
Examining data/aflplusplus-2.68c/custom_mutators/honggfuzz/honggfuzz.c
Examining data/aflplusplus-2.68c/custom_mutators/honggfuzz/honggfuzz.h
Examining data/aflplusplus-2.68c/custom_mutators/honggfuzz/input.h
Examining data/aflplusplus-2.68c/custom_mutators/honggfuzz/mangle.c
Examining data/aflplusplus-2.68c/custom_mutators/honggfuzz/mangle.h
Examining data/aflplusplus-2.68c/custom_mutators/radamsa/custom_mutator_helpers.h
Examining data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa-test.c
Examining data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa.c
Examining data/aflplusplus-2.68c/custom_mutators/radamsa/radamsa-mutator.c
Examining data/aflplusplus-2.68c/custom_mutators/radamsa/radamsa.h
Examining data/aflplusplus-2.68c/examples/afl_frida/afl-frida.c
Parsing failed to find end of parameter list; semicolon terminated it in (stderr, "CLIENT crc: %016llx len: %u\n", hash64(__afl_fuzz_ptr, *__a
    fprintf(stderr, "RECV:");
    for (int i = 0; i < *__afl_fuzz_len; i++)
      fprintf(stderr, "%02x", __afl_fuzz_ptr[i]);
    
Examining data/aflplusplus-2.68c/examples/afl_frida/afl-frida.h
Examining data/aflplusplus-2.68c/examples/afl_frida/libtestinstr.c
Examining data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-client.c
Examining data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-server.c
Examining data/aflplusplus-2.68c/examples/afl_proxy/afl-proxy.c
Examining data/aflplusplus-2.68c/examples/afl_untracer/afl-untracer.c
Examining data/aflplusplus-2.68c/examples/afl_untracer/libtestinstr.c
Examining data/aflplusplus-2.68c/examples/aflpp_driver/aflpp_driver.c
Examining data/aflplusplus-2.68c/examples/aflpp_driver/aflpp_driver_test.c
Examining data/aflplusplus-2.68c/examples/aflpp_driver/aflpp_qemu_driver.c
Examining data/aflplusplus-2.68c/examples/aflpp_driver/aflpp_qemu_driver_hook.c
Examining data/aflplusplus-2.68c/examples/argv_fuzzing/argv-fuzz-inl.h
Examining data/aflplusplus-2.68c/examples/argv_fuzzing/argvfuzz.c
Examining data/aflplusplus-2.68c/examples/custom_mutators/custom_mutator_helpers.h
Examining data/aflplusplus-2.68c/examples/custom_mutators/example.c
Examining data/aflplusplus-2.68c/examples/custom_mutators/post_library_gif.so.c
Examining data/aflplusplus-2.68c/examples/custom_mutators/post_library_png.so.c
Examining data/aflplusplus-2.68c/examples/custom_mutators/simple_example.c
Examining data/aflplusplus-2.68c/examples/defork/defork.c
Examining data/aflplusplus-2.68c/examples/defork/forking_target.c
Examining data/aflplusplus-2.68c/examples/persistent_demo/persistent_demo.c
Examining data/aflplusplus-2.68c/examples/persistent_demo/persistent_demo_new.c
Examining data/aflplusplus-2.68c/examples/persistent_demo/test-instr.c
Examining data/aflplusplus-2.68c/examples/qemu_persistent_hook/read_into_rdi.c
Examining data/aflplusplus-2.68c/examples/qemu_persistent_hook/test.c
Examining data/aflplusplus-2.68c/examples/socket_fuzzing/socketfuzz.c
Examining data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c
Examining data/aflplusplus-2.68c/gcc_plugin/afl-gcc-pass.so.cc
Examining data/aflplusplus-2.68c/gcc_plugin/afl-gcc-rt.o.c
Examining data/aflplusplus-2.68c/include/afl-as.h
Examining data/aflplusplus-2.68c/include/afl-fuzz.h
Examining data/aflplusplus-2.68c/include/afl-prealloc.h
Examining data/aflplusplus-2.68c/include/alloc-inl.h
Examining data/aflplusplus-2.68c/include/android-ashmem.h
Examining data/aflplusplus-2.68c/include/cmplog.h
Examining data/aflplusplus-2.68c/include/common.h
Examining data/aflplusplus-2.68c/include/config.h
Examining data/aflplusplus-2.68c/include/debug.h
Examining data/aflplusplus-2.68c/include/envs.h
Examining data/aflplusplus-2.68c/include/forkserver.h
Examining data/aflplusplus-2.68c/include/hash.h
Examining data/aflplusplus-2.68c/include/list.h
Examining data/aflplusplus-2.68c/include/sharedmem.h
Examining data/aflplusplus-2.68c/include/snapshot-inl.h
Examining data/aflplusplus-2.68c/include/types.h
Examining data/aflplusplus-2.68c/include/xxhash.h
Examining data/aflplusplus-2.68c/libdislocator/libdislocator.so.c
Examining data/aflplusplus-2.68c/libtokencap/libtokencap.so.c
Examining data/aflplusplus-2.68c/llvm_mode/LLVMInsTrim.so.cc
Examining data/aflplusplus-2.68c/llvm_mode/MarkNodes.cc
Examining data/aflplusplus-2.68c/llvm_mode/MarkNodes.h
Examining data/aflplusplus-2.68c/llvm_mode/SanitizerCoverageLTO.so.cc
Examining data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c
Examining data/aflplusplus-2.68c/llvm_mode/afl-ld-lto.c
Examining data/aflplusplus-2.68c/llvm_mode/afl-llvm-common.cc
Examining data/aflplusplus-2.68c/llvm_mode/afl-llvm-common.h
Examining data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentation.so.cc
Examining data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentlist.so.cc
Examining data/aflplusplus-2.68c/llvm_mode/afl-llvm-pass.so.cc
Examining data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt-lto.o.c
Examining data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c
Examining data/aflplusplus-2.68c/llvm_mode/cmplog-instructions-pass.cc
Examining data/aflplusplus-2.68c/llvm_mode/cmplog-routines-pass.cc
Examining data/aflplusplus-2.68c/llvm_mode/compare-transform-pass.so.cc
Examining data/aflplusplus-2.68c/llvm_mode/llvm-ngram-coverage.h
Examining data/aflplusplus-2.68c/llvm_mode/split-compares-pass.so.cc
Examining data/aflplusplus-2.68c/llvm_mode/split-switches-pass.so.cc
Examining data/aflplusplus-2.68c/qbdi_mode/demo-so.c
Examining data/aflplusplus-2.68c/qbdi_mode/template.cpp
Examining data/aflplusplus-2.68c/qemu_mode/libcompcov/compcovtest.cc
Examining data/aflplusplus-2.68c/qemu_mode/libcompcov/libcompcov.so.c
Examining data/aflplusplus-2.68c/qemu_mode/libcompcov/pmparser.h
Examining data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-common.h
Examining data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h
Examining data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-translate-inl.h
Examining data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-floats.h
Examining data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-tcg-inl.h
Examining data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-tcg-runtime-inl.h
Examining data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-translate-inl.h
Examining data/aflplusplus-2.68c/qemu_mode/unsigaction/unsigaction.c
Examining data/aflplusplus-2.68c/src/afl-analyze.c
Examining data/aflplusplus-2.68c/src/afl-as.c
Examining data/aflplusplus-2.68c/src/afl-common.c
Examining data/aflplusplus-2.68c/src/afl-forkserver.c
Examining data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c
Examining data/aflplusplus-2.68c/src/afl-fuzz-cmplog.c
Examining data/aflplusplus-2.68c/src/afl-fuzz-extras.c
Examining data/aflplusplus-2.68c/src/afl-fuzz-init.c
Examining data/aflplusplus-2.68c/src/afl-fuzz-mutators.c
Examining data/aflplusplus-2.68c/src/afl-fuzz-one.c
Examining data/aflplusplus-2.68c/src/afl-fuzz-python.c
Examining data/aflplusplus-2.68c/src/afl-fuzz-queue.c
Examining data/aflplusplus-2.68c/src/afl-fuzz-redqueen.c
Examining data/aflplusplus-2.68c/src/afl-fuzz-run.c
Examining data/aflplusplus-2.68c/src/afl-fuzz-state.c
Examining data/aflplusplus-2.68c/src/afl-fuzz-stats.c
Examining data/aflplusplus-2.68c/src/afl-fuzz.c
Examining data/aflplusplus-2.68c/src/afl-gcc.c
Examining data/aflplusplus-2.68c/src/afl-gotcpu.c
Examining data/aflplusplus-2.68c/src/afl-performance.c
Examining data/aflplusplus-2.68c/src/afl-sharedmem.c
Examining data/aflplusplus-2.68c/src/afl-showmap.c
Examining data/aflplusplus-2.68c/src/afl-tmin.c
Examining data/aflplusplus-2.68c/test-instr.c
Examining data/aflplusplus-2.68c/test/test-cmplog.c
Examining data/aflplusplus-2.68c/test/test-compcov.c
Examining data/aflplusplus-2.68c/test/test-custom-mutator.c
Examining data/aflplusplus-2.68c/test/test-floatingpoint.c
Examining data/aflplusplus-2.68c/test/test-fp_cases.c
Examining data/aflplusplus-2.68c/test/test-multiple-mutators.c
Examining data/aflplusplus-2.68c/test/test-unsigaction.c
Examining data/aflplusplus-2.68c/test/unittests/unit_hash.c
Examining data/aflplusplus-2.68c/test/unittests/unit_list.c
Examining data/aflplusplus-2.68c/test/unittests/unit_maybe_alloc.c
Examining data/aflplusplus-2.68c/test/unittests/unit_preallocable.c
Examining data/aflplusplus-2.68c/test/unittests/unit_rand.c
Examining data/aflplusplus-2.68c/unicorn_mode/samples/c/harness.c
Examining data/aflplusplus-2.68c/unicorn_mode/samples/c/persistent_target.c
Examining data/aflplusplus-2.68c/unicorn_mode/samples/compcov_x64/compcov_target.c
Examining data/aflplusplus-2.68c/unicorn_mode/samples/persistent/harness.c
Examining data/aflplusplus-2.68c/unicorn_mode/samples/persistent/persistent_target.c
Examining data/aflplusplus-2.68c/unicorn_mode/samples/persistent/simple_target_noncrashing.c
Examining data/aflplusplus-2.68c/unicorn_mode/samples/simple/simple_target.c

FINAL RESULTS:

data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa.c:4729:15:  [5] (race) readlink:
  This accepts filename arguments; if an attacker can move those files or
  change the link content, a race condition results. Also, it does not
  terminate with ASCII NUL. (CWE-362, CWE-20). Reconsider approach.
        len = readlink((const char *)a + W, (char *)fp + W, max);
data/aflplusplus-2.68c/custom_mutators/honggfuzz/honggfuzz.h:355:18:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    uint64_t     access;
data/aflplusplus-2.68c/custom_mutators/honggfuzz/mangle.c:835:3:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
  snprintf(buf, sizeof(buf), "%-19" PRId64, (int64_t)util_rnd64());
data/aflplusplus-2.68c/custom_mutators/honggfuzz/mangle.c:889:24:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
  len = HF_MIN((size_t)snprintf(numbuf, sizeof(numbuf), "%" PRIu64, val), len);
data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa.c:4573:7:  [4] (shell) execv:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
      execv(path, args);                     /* may return -1 and set errno */
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-server.c:171:9:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    if (access(use_dir, R_OK | W_OK | X_OK)) {
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:56:10:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    if (!access(tmp, R_OK)) {
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:80:10:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    if (!access(tmp, R_OK)) {
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:93:8:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
  if (!access(AFL_PATH "/afl-gcc-rt.o", R_OK)) {
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:309:5:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
    printf(cCYA
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:399:3:  [4] (shell) execvp:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
  execvp(cc_params[0], (char **)cc_params);
data/aflplusplus-2.68c/include/alloc-inl.h:53:18:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
      s32 _len = snprintf(NULL, 0, _str);              \
data/aflplusplus-2.68c/include/alloc-inl.h:56:7:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
      snprintf((char *)_tmp, _len + 1, _str);          \
data/aflplusplus-2.68c/include/alloc-inl.h:188:18:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
      s32 _len = snprintf(NULL, 0, _str);              \
data/aflplusplus-2.68c/include/alloc-inl.h:191:7:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
      snprintf((char *)_tmp, _len + 1, _str);          \
data/aflplusplus-2.68c/include/debug.h:174:22:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
  #define SAYF(x...) printf(x)
data/aflplusplus-2.68c/include/debug.h:176:22:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
  #define SAYF(x...) fprintf(stderr, x)
data/aflplusplus-2.68c/libdislocator/libdislocator.so.c:107:9:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
        fprintf(stderr, "[AFL] " _x); \
data/aflplusplus-2.68c/libdislocator/libdislocator.so.c:122:7:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
      fprintf(stderr, "*** [AFL] " _x); \
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:100:10:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    if (!access(tmp, R_OK)) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:128:10:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    if (!access(tmp, R_OK)) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:142:8:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
  if (!access(AFL_PATH "/afl-llvm-rt.so", R_OK)) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:145:8:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
  if (!access(AFL_PATH "/afl-llvm-rt.o", R_OK)) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:190:7:  [4] (format) sprintf:
  Potential format string problem (CWE-134). Make format string constant.
      sprintf(llvm_fullpath, CLANGPP_BIN);
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:202:7:  [4] (format) sprintf:
  Potential format string problem (CWE-134). Make format string constant.
      sprintf(llvm_fullpath, CLANG_BIN);
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:643:11:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
      if (access(cc_params[cc_par_cnt - 1], R_OK))
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:649:13:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
        if (access(cc_params[cc_par_cnt - 1], R_OK))
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:658:11:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
      if (access(cc_params[cc_par_cnt - 1], R_OK))
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:664:13:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
        if (access(cc_params[cc_par_cnt - 1], R_OK))
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:1136:3:  [4] (shell) execvp:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
  execvp(cc_params[0], (char **)cc_params);
data/aflplusplus-2.68c/llvm_mode/afl-ld-lto.c:327:30:  [4] (shell) execvp:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
    if (strlen(real_ld) > 1) execvp(real_ld, (char **)ld_params);
data/aflplusplus-2.68c/llvm_mode/afl-ld-lto.c:328:5:  [4] (shell) execvp:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
    execvp("ld", (char **)ld_params);  // fallback
data/aflplusplus-2.68c/qbdi_mode/template.cpp:192:3:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
  strcpy(input_pathname, argv[2]);
data/aflplusplus-2.68c/qemu_mode/libcompcov/pmparser.h:156:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(tmp->perm, perm);
data/aflplusplus-2.68c/qemu_mode/libcompcov/pmparser.h:165:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(tmp->dev, dev);
data/aflplusplus-2.68c/qemu_mode/libcompcov/pmparser.h:169:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(tmp->pathname, pathname);
data/aflplusplus-2.68c/src/afl-analyze.c:273:5:  [4] (shell) execv:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
    execv(target_path, argv);
data/aflplusplus-2.68c/src/afl-analyze.c:723:9:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    if (access(use_dir, R_OK | W_OK | X_OK)) {
data/aflplusplus-2.68c/src/afl-analyze.c:931:14:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
  doc_path = access(DOC_PATH, F_OK) ? "docs" : DOC_PATH;
data/aflplusplus-2.68c/src/afl-as.c:295:7:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
      fprintf(outf, use_64bit ? trampoline_fmt_64 : trampoline_fmt_32,
data/aflplusplus-2.68c/src/afl-as.c:412:9:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
        fprintf(outf, use_64bit ? trampoline_fmt_64 : trampoline_fmt_32,
data/aflplusplus-2.68c/src/afl-as.c:635:5:  [4] (shell) execvp:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
    execvp(as_params[0], (char **)as_params);
data/aflplusplus-2.68c/src/afl-common.c:162:9:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    if (access(cp, X_OK)) { FATAL("Unable to find '%s'", tmp); }
data/aflplusplus-2.68c/src/afl-common.c:179:10:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    if (!access(cp, X_OK)) {
data/aflplusplus-2.68c/src/afl-common.c:192:8:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
  if (!access(BIN_PATH "/afl-qemu-trace", X_OK)) {
data/aflplusplus-2.68c/src/afl-common.c:243:9:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    if (access(cp, X_OK)) { FATAL("Unable to find '%s'", tmp); }
data/aflplusplus-2.68c/src/afl-common.c:249:9:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    if (access(cp, X_OK)) { FATAL("Unable to find '%s'", tmp); }
data/aflplusplus-2.68c/src/afl-common.c:265:16:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    if (cp && !access(cp, X_OK)) {
data/aflplusplus-2.68c/src/afl-common.c:271:12:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
      if (!access(cp, X_OK)) {
data/aflplusplus-2.68c/src/afl-common.c:290:8:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
  if (!access(ncp, X_OK)) {
data/aflplusplus-2.68c/src/afl-common.c:294:10:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    if (!access(ncp, X_OK)) {
data/aflplusplus-2.68c/src/afl-common.c:550:7:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
      snprintf(buf, len, _fmt, ((_cast)val) / (_divisor)); \
data/aflplusplus-2.68c/src/afl-common.c:710:7:  [4] (format) sprintf:
  Potential format string problem (CWE-134). Make format string constant.
      sprintf(buf, _fmt, ((_cast)val) / (_divisor));   \
data/aflplusplus-2.68c/src/afl-common.c:848:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(buf, "%s days, %d hrs, %d min, %d sec", val_buf, t_h, t_m, t_s);
data/aflplusplus-2.68c/src/afl-forkserver.c:63:3:  [4] (shell) execv:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
  execv(fsrv->target_path, argv);
data/aflplusplus-2.68c/src/afl-forkserver.c:268:7:  [4] (shell) execv:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
      execv(fsrv->target_path, argv);
data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c:434:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(ret, "sync:%s,src:%06u", afl->syncing_party, afl->syncing_case);
data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c:448:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(ret + strlen(ret), ",op:%s", afl->stage_short);
data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c:456:9:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
        sprintf(ret + strlen(ret), ",val:%s%+d",
data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c:488:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(fn, "%s/crashes/README.txt", afl->out_dir);
data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c:750:16:  [4] (shell) system:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
        (void)(system(afl->infoexec) + 1);
data/aflplusplus-2.68c/src/afl-fuzz-cmplog.c:42:3:  [4] (shell) execv:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
  execv(argv[0], argv);
data/aflplusplus-2.68c/src/afl-fuzz-extras.c:306:27:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    if (lstat(fn, &st) || access(fn, R_OK)) {
data/aflplusplus-2.68c/src/afl-fuzz-init.c:521:41:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
        if (unlikely(lstat(fn2, &st) || access(fn2, R_OK))) {
data/aflplusplus-2.68c/src/afl-fuzz-init.c:626:8:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
  if (!access(fn1, F_OK)) {
data/aflplusplus-2.68c/src/afl-fuzz-init.c:683:28:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    if (lstat(fn2, &st) || access(fn2, R_OK)) {
data/aflplusplus-2.68c/src/afl-fuzz-init.c:713:10:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    if (!access(dfn, F_OK)) { passed_det = 1; }
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1654:15:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    int res = access(fn, F_OK);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1880:7:  [4] (shell) system:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
  if (system("launchctl list 2>/dev/null | grep -q '\\.ReportCrash$'")) return;
data/aflplusplus-2.68c/src/afl-fuzz-mutators.c:278:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(afl->stage_name_buf, "ptrim %s",
data/aflplusplus-2.68c/src/afl-fuzz-one.c:3914:5:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
    snprintf(afl->stage_name_buf, STAGE_BUF_SIZE,
data/aflplusplus-2.68c/src/afl-fuzz-one.c:3964:9:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
        snprintf(afl->stage_name_buf, STAGE_BUF_SIZE,
data/aflplusplus-2.68c/src/afl-fuzz-queue.c:59:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(ldest, "../../%s", fn_name);
data/aflplusplus-2.68c/src/afl-fuzz-queue.c:60:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(fn, "%s/queue/.state/variable_behavior/%s", afl->out_dir, fn_name);
data/aflplusplus-2.68c/src/afl-fuzz-queue.c:85:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(fn, "%s/queue/.state/redundant_edges/%s", afl->out_dir,
data/aflplusplus-2.68c/src/afl-fuzz-run.c:516:7:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
      sprintf(qd_path, "%s/%s/is_main_node", afl->sync_dir, sd_ent->d_name);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:517:17:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
      int res = access(qd_path, F_OK);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:523:11:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
          sprintf(qd_path, "%s/is_main_node", afl->out_dir);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:540:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(qd_synced_path, "%s/.synced/%s.last", afl->out_dir, sd_ent->d_name);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:546:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(qd_path, "%s/%s/queue", afl->sync_dir, sd_ent->d_name);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:562:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(qd_synced_path, "%s/.synced/%s", afl->out_dir, sd_ent->d_name);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:677:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(path, "%s/is_main_node", afl->out_dir);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:743:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(afl->stage_name_buf, "trim %s/%s",
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:492:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:498:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:526:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(tmp, cRST);
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:535:7:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
      strcpy(tmp, cMGN);
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:542:7:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
      strcpy(tmp, cYEL);
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:550:7:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
      strcpy(tmp, cLGN);
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:556:7:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
      strcpy(tmp, cLBL);
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:599:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(tmp, "%s%s", u_stringify_int(IB(0), afl->unique_crashes),
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:607:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(tmp, "%s%s", u_stringify_int(IB(0), afl->unique_hangs),
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:623:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(tmp, "%s%s%u (%0.01f%%)", u_stringify_int(IB(0), afl->current_entry),
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:639:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->cur_skipped_paths),
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:652:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->queued_favored),
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:663:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(tmp, "%s/-", u_stringify_int(IB(0), afl->stage_cur));
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:667:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(tmp, "%s/%s (%0.02f%%)", u_stringify_int(IB(0), afl->stage_cur),
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:675:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->queued_with_cov),
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:680:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(tmp, "%s (%s%s unique)", u_stringify_int(IB(0), afl->total_crashes),
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:704:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(tmp, "%s/sec (%s)", u_stringify_float(IB(0), afl->stats_avg_exec),
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:711:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(tmp, "%s/sec", u_stringify_float(IB(0), afl->stats_avg_exec));
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:716:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(tmp, "%s (%s%s unique)", u_stringify_int(IB(0), afl->total_tmouts),
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:734:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(tmp, "%s/%s, %s/%s, %s/%s",
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:750:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(tmp, "%s/%s, %s/%s, %s/%s",
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:766:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(tmp, "%s/%s, %s/%s, %s/%s",
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:782:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(tmp, "%s/%s, %s/%s, %s/%s",
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:798:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(tmp, "%s/%s, %s/%s, %s/%s",
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:814:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(tmp, "%s/%s, %s/%s",
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:843:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(tmp, "%s/%s, %s/%s, %s/%s, %s/%s",
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:858:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(tmp, "%s/%s, %s/%s",
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:875:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(tmp, "%0.02f%%/%s, ",
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:887:5:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
    strcat(tmp, tmp2);
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:897:5:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
    strcat(tmp, tmp2);
data/aflplusplus-2.68c/src/afl-fuzz.c:275:14:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
  doc_path = access(DOC_PATH, F_OK) != 0 ? (u8 *)"docs" : (u8 *)DOC_PATH;
data/aflplusplus-2.68c/src/afl-fuzz.c:1163:9:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    if (access(tmpfile, F_OK) != -1) {
data/aflplusplus-2.68c/src/afl-fuzz.c:1512:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(path, "%s/is_main_node", afl->out_dir);
data/aflplusplus-2.68c/src/afl-gcc.c:69:10:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    if (!access(tmp, X_OK)) {
data/aflplusplus-2.68c/src/afl-gcc.c:93:10:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    if (!access(tmp, X_OK)) {
data/aflplusplus-2.68c/src/afl-gcc.c:106:8:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
  if (!access(AFL_PATH "/as", X_OK)) {
data/aflplusplus-2.68c/src/afl-gcc.c:481:3:  [4] (shell) execvp:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
  execvp(cc_params[0], (char **)cc_params);
data/aflplusplus-2.68c/src/afl-showmap.c:398:5:  [4] (shell) execv:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
    execv(fsrv->target_path, argv);
data/aflplusplus-2.68c/src/afl-showmap.c:666:14:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
  doc_path = access(DOC_PATH, F_OK) ? "docs" : DOC_PATH;
data/aflplusplus-2.68c/src/afl-showmap.c:1007:9:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    if (access(use_dir, R_OK | W_OK | X_OK)) {
data/aflplusplus-2.68c/src/afl-tmin.c:645:9:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
    if (access(use_dir, R_OK | W_OK | X_OK)) {
data/aflplusplus-2.68c/src/afl-tmin.c:873:14:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
  doc_path = access(DOC_PATH, F_OK) ? "docs" : DOC_PATH;
data/aflplusplus-2.68c/test/test-compcov.c:40:5:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
    strcat(buf, input);
data/aflplusplus-2.68c/test/unittests/unit_hash.c:38:8:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
#undef printf
data/aflplusplus-2.68c/test/unittests/unit_hash.c:39:12:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
extern int printf(const char *format, ...);
data/aflplusplus-2.68c/test/unittests/unit_list.c:37:8:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
#undef printf
data/aflplusplus-2.68c/test/unittests/unit_list.c:38:12:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
extern int printf(const char *format, ...);
data/aflplusplus-2.68c/test/unittests/unit_maybe_alloc.c:37:8:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
#undef printf
data/aflplusplus-2.68c/test/unittests/unit_maybe_alloc.c:38:12:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
extern int printf(const char *format, ...);
data/aflplusplus-2.68c/test/unittests/unit_preallocable.c:37:8:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
#undef printf
data/aflplusplus-2.68c/test/unittests/unit_preallocable.c:38:12:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
extern int printf(const char *format, ...);
data/aflplusplus-2.68c/test/unittests/unit_rand.c:39:8:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
#undef printf
data/aflplusplus-2.68c/test/unittests/unit_rand.c:40:12:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
extern int printf(const char *format, ...);
data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa.c:4559:43:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      return onum(stringp(a) ? (uintptr_t)getenv((const char *)a + W) : 0, 0);
data/aflplusplus-2.68c/custom_mutators/radamsa/radamsa-mutator.c:25:3:  [3] (random) srand:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
  srand(seed);
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-client.c:73:18:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  char *id_str = getenv(SHM_ENV_VAR);
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-client.c:76:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((ptr = getenv("AFL_MAP_SIZE")) != NULL) {
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-client.c:245:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((ptr = getenv("AFL_MAP_SIZE")) != NULL)
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-server.c:244:26:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      u8 *qemu_preload = getenv("QEMU_SET_ENV");
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-server.c:245:25:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      u8 *afl_preload = getenv("AFL_PRELOAD");
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-server.c:279:28:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1);
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-server.c:280:39:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      setenv("DYLD_INSERT_LIBRARIES", getenv("AFL_PRELOAD"), 1);
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-server.c:438:17:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
  while ((opt = getopt(argc, argv, "+i:f:m:t:QUWh")) > 0) {
data/aflplusplus-2.68c/examples/afl_proxy/afl-proxy.c:70:18:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  char *id_str = getenv(SHM_ENV_VAR);
data/aflplusplus-2.68c/examples/afl_proxy/afl-proxy.c:73:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((ptr = getenv("AFL_MAP_SIZE")) != NULL) {
data/aflplusplus-2.68c/examples/afl_untracer/afl-untracer.c:310:18:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  char *id_str = getenv(SHM_ENV_VAR);
data/aflplusplus-2.68c/examples/afl_untracer/afl-untracer.c:313:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((ptr = getenv("AFL_MAP_SIZE")) != NULL) {
data/aflplusplus-2.68c/examples/afl_untracer/afl-untracer.c:473:30:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  char *          filename = getenv("AFL_UNTRACER_FILE");
data/aflplusplus-2.68c/examples/afl_untracer/afl-untracer.c:474:29:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (!filename) filename = getenv("TRAPFUZZ_FILE");
data/aflplusplus-2.68c/examples/afl_untracer/afl-untracer.c:682:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_DEBUG")) debug = 1;
data/aflplusplus-2.68c/examples/aflpp_driver/aflpp_driver.c:137:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_DRIVER_DONT_DEFER")) {
data/aflplusplus-2.68c/examples/aflpp_driver/aflpp_driver.c:154:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      getenv("AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
data/aflplusplus-2.68c/examples/aflpp_driver/aflpp_driver.c:208:23:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  char *fd_mask_str = getenv("AFL_DRIVER_CLOSE_FD_MASK");
data/aflplusplus-2.68c/examples/aflpp_driver/aflpp_qemu_driver.c:24:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_QEMU_DRIVER_NO_HOOK")) {
data/aflplusplus-2.68c/examples/custom_mutators/example.c:58:3:  [3] (random) srand:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
  srand(seed);  // needed also by surgical_havoc_mutate()
data/aflplusplus-2.68c/examples/custom_mutators/simple_example.c:25:3:  [3] (random) srand:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
  srand(seed);
data/aflplusplus-2.68c/examples/defork/defork.c:24:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv(SHM_ENV_VAR)) {
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:49:18:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  u8 *afl_path = getenv("AFL_PATH");
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:123:19:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    u8 *alt_cxx = getenv("AFL_CXX");
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:128:18:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    u8 *alt_cc = getenv("AFL_CC");
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:171:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_HARDEN")) {
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:181:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_USE_ASAN")) {
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:183:11:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      if (getenv("AFL_USE_MSAN")) FATAL("ASAN and MSAN are mutually exclusive");
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:185:11:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      if (getenv("AFL_HARDEN"))
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:191:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    } else if (getenv("AFL_USE_MSAN")) {
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:193:11:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      if (getenv("AFL_USE_ASAN")) FATAL("ASAN and MSAN are mutually exclusive");
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:195:11:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      if (getenv("AFL_HARDEN"))
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:205:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_USE_UBSAN")) {
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:213:8:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (!getenv("AFL_DONT_OPTIMIZE")) {
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:221:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_NO_BUILTIN")) {
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:353:29:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  } else if ((isatty(2) && !getenv("AFL_QUIET")) ||
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:355:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
             getenv("AFL_DEBUG") != NULL) {
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:360:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_GCC_INSTRUMENT_FILE") == NULL &&
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:361:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
        getenv("AFL_GCC_WHITELIST") == NULL) {
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:378:15:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      ((ptr = getenv("AFL_MAP_SIZE")) || (ptr = getenv("AFL_MAPSIZE")))) {
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:378:49:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      ((ptr = getenv("AFL_MAP_SIZE")) || (ptr = getenv("AFL_MAPSIZE")))) {
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-pass.so.cc:538:22:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((isatty(2) && !getenv("AFL_QUIET")) || getenv("AFL_DEBUG") != NULL) {
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-pass.so.cc:538:46:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((isatty(2) && !getenv("AFL_QUIET")) || getenv("AFL_DEBUG") != NULL) {
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-pass.so.cc:548:26:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  char *inst_ratio_str = getenv("AFL_INST_RATIO");
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-pass.so.cc:560:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
             getenv("AFL_HARDEN") ? G_("hardened") : G_("non-hardened"));
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-pass.so.cc:566:38:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  char *instInstrumentListFilename = getenv("AFL_GCC_INSTRUMENT_FILE");
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-pass.so.cc:568:34:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    instInstrumentListFilename = getenv("AFL_GCC_WHITELIST");
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-pass.so.cc:583:28:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  } else if (!be_quiet && (getenv("AFL_LLVM_WHITELIST") ||
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-pass.so.cc:585:28:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
                           getenv("AFL_LLVM_INSTRUMENT_FILE"))) {
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-rt.o.c:85:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  u8 *id_str = getenv(SHM_ENV_VAR);
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-rt.o.c:308:21:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  is_persistent = !!getenv(PERSIST_ENV_VAR);
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-rt.o.c:310:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv(DEFER_ENV_VAR)) return;
data/aflplusplus-2.68c/include/types.h:119:24:  [3] (random) srandom:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
    #define AFL_SR(s) (srandom(s))
data/aflplusplus-2.68c/include/types.h:120:23:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
    #define AFL_R(x) (random() % (x))
data/aflplusplus-2.68c/include/types.h:127:20:  [3] (random) srandom:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
    #define SR(s) (srandom(s))
data/aflplusplus-2.68c/include/types.h:128:19:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
    #define R(x) (random() % (x))
data/aflplusplus-2.68c/libdislocator/libdislocator.so.c:60:9:  [3] (random) srand:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
        srand(time(NULL));           \
data/aflplusplus-2.68c/libdislocator/libdislocator.so.c:495:19:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  u8 *tmp = (u8 *)getenv("AFL_LD_LIMIT_MB");
data/aflplusplus-2.68c/libdislocator/libdislocator.so.c:507:15:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  tmp = (u8 *)getenv("AFL_RANDOM_ALLOC_CANARY");
data/aflplusplus-2.68c/libdislocator/libdislocator.so.c:511:21:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  alloc_verbose = !!getenv("AFL_LD_VERBOSE");
data/aflplusplus-2.68c/libdislocator/libdislocator.so.c:512:17:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  hard_fail = !!getenv("AFL_LD_HARD_FAIL");
data/aflplusplus-2.68c/libdislocator/libdislocator.so.c:513:22:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  no_calloc_over = !!getenv("AFL_LD_NO_CALLOC_OVER");
data/aflplusplus-2.68c/libdislocator/libdislocator.so.c:514:25:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  align_allocations = !!getenv("AFL_ALIGNED_ALLOC");
data/aflplusplus-2.68c/libtokencap/libtokencap.so.c:769:12:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  u8 *fn = getenv("AFL_TOKEN_FILE");
data/aflplusplus-2.68c/llvm_mode/LLVMInsTrim.so.cc:106:24:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if ((isatty(2) && !getenv("AFL_QUIET")) || getenv("AFL_DEBUG") != NULL) {
data/aflplusplus-2.68c/llvm_mode/LLVMInsTrim.so.cc:106:48:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if ((isatty(2) && !getenv("AFL_QUIET")) || getenv("AFL_DEBUG") != NULL) {
data/aflplusplus-2.68c/llvm_mode/LLVMInsTrim.so.cc:114:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_DEBUG") != NULL) debug = 1;
data/aflplusplus-2.68c/llvm_mode/LLVMInsTrim.so.cc:123:35:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if ((neverZero_counters_str = getenv("AFL_LLVM_NOT_ZERO")) != NULL)
data/aflplusplus-2.68c/llvm_mode/LLVMInsTrim.so.cc:126:19:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    skip_nozero = getenv("AFL_LLVM_SKIP_NEVERZERO");
data/aflplusplus-2.68c/llvm_mode/LLVMInsTrim.so.cc:128:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_LLVM_INSTRIM_LOOPHEAD") != NULL ||
data/aflplusplus-2.68c/llvm_mode/LLVMInsTrim.so.cc:129:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
        getenv("LOOPHEAD") != NULL) {
data/aflplusplus-2.68c/llvm_mode/LLVMInsTrim.so.cc:136:35:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    char *       ngram_size_str = getenv("AFL_LLVM_NGRAM_SIZE");
data/aflplusplus-2.68c/llvm_mode/LLVMInsTrim.so.cc:137:43:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (!ngram_size_str) ngram_size_str = getenv("AFL_NGRAM_SIZE");
data/aflplusplus-2.68c/llvm_mode/LLVMInsTrim.so.cc:138:21:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    char *ctx_str = getenv("AFL_LLVM_CTX");
data/aflplusplus-2.68c/llvm_mode/LLVMInsTrim.so.cc:565:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_HARDEN") ? "hardened" : "non-hardened",
data/aflplusplus-2.68c/llvm_mode/LLVMInsTrim.so.cc:566:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_USE_ASAN") ? ", ASAN" : "",
data/aflplusplus-2.68c/llvm_mode/LLVMInsTrim.so.cc:567:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_USE_MSAN") ? ", MSAN" : "",
data/aflplusplus-2.68c/llvm_mode/LLVMInsTrim.so.cc:568:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_USE_CFISAN") ? ", CFISAN" : "",
data/aflplusplus-2.68c/llvm_mode/LLVMInsTrim.so.cc:569:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_USE_UBSAN") ? ", UBSAN" : "");
data/aflplusplus-2.68c/llvm_mode/SanitizerCoverageLTO.so.cc:423:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_DEBUG")) debug = 1;
data/aflplusplus-2.68c/llvm_mode/SanitizerCoverageLTO.so.cc:425:22:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((isatty(2) && !getenv("AFL_QUIET")) || debug) {
data/aflplusplus-2.68c/llvm_mode/SanitizerCoverageLTO.so.cc:434:17:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  skip_nozero = getenv("AFL_LLVM_SKIP_NEVERZERO");
data/aflplusplus-2.68c/llvm_mode/SanitizerCoverageLTO.so.cc:436:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((ptr = getenv("AFL_LLVM_LTO_STARTID")) != NULL)
data/aflplusplus-2.68c/llvm_mode/SanitizerCoverageLTO.so.cc:440:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((ptr = getenv("AFL_LLVM_DOCUMENT_IDS")) != NULL) {
data/aflplusplus-2.68c/llvm_mode/SanitizerCoverageLTO.so.cc:452:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((ptr = getenv("AFL_LLVM_MAP_ADDR"))) {
data/aflplusplus-2.68c/llvm_mode/SanitizerCoverageLTO.so.cc:459:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    } else if (getenv("AFL_LLVM_MAP_DYNAMIC")) {
data/aflplusplus-2.68c/llvm_mode/SanitizerCoverageLTO.so.cc:859:8:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (!getenv("AFL_LLVM_LTO_DONTWRITEID") || dictionary.size() || map_addr) {
data/aflplusplus-2.68c/llvm_mode/SanitizerCoverageLTO.so.cc:899:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_LLVM_LTO_DONTWRITEID") == NULL) {
data/aflplusplus-2.68c/llvm_mode/SanitizerCoverageLTO.so.cc:1001:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_HARDEN") ? "hardened" : "non-hardened",
data/aflplusplus-2.68c/llvm_mode/SanitizerCoverageLTO.so.cc:1002:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_USE_ASAN") ? ", ASAN" : "",
data/aflplusplus-2.68c/llvm_mode/SanitizerCoverageLTO.so.cc:1003:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_USE_MSAN") ? ", MSAN" : "",
data/aflplusplus-2.68c/llvm_mode/SanitizerCoverageLTO.so.cc:1004:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_USE_CFISAN") ? ", CFISAN" : "",
data/aflplusplus-2.68c/llvm_mode/SanitizerCoverageLTO.so.cc:1005:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_USE_UBSAN") ? ", UBSAN" : "");
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:89:18:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  u8 *afl_path = getenv("AFL_PATH");
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:186:19:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    u8 *alt_cxx = getenv("AFL_CXX");
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:198:18:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    u8 *alt_cc = getenv("AFL_CC");
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:232:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_LLVM_INSTRUMENT_FILE") != NULL ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:233:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
        getenv("AFL_LLVM_WHITELIST") || getenv("AFL_LLVM_ALLOWLIST") ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:233:41:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
        getenv("AFL_LLVM_WHITELIST") || getenv("AFL_LLVM_ALLOWLIST") ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:234:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
        getenv("AFL_LLVM_DENYLIST") || getenv("AFL_LLVM_BLOCKLIST")) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:234:40:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
        getenv("AFL_LLVM_DENYLIST") || getenv("AFL_LLVM_BLOCKLIST")) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:247:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("LAF_SPLIT_SWITCHES") || getenv("AFL_LLVM_LAF_SPLIT_SWITCHES")) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:247:39:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("LAF_SPLIT_SWITCHES") || getenv("AFL_LLVM_LAF_SPLIT_SWITCHES")) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:266:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("LAF_TRANSFORM_COMPARES") ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:267:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      getenv("AFL_LLVM_LAF_TRANSFORM_COMPARES")) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:286:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("LAF_SPLIT_COMPARES") || getenv("AFL_LLVM_LAF_SPLIT_COMPARES") ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:286:39:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("LAF_SPLIT_COMPARES") || getenv("AFL_LLVM_LAF_SPLIT_COMPARES") ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:287:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      getenv("AFL_LLVM_LAF_SPLIT_FLOATS")) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:459:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_HARDEN")) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:469:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_USE_ASAN")) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:471:11:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      if (getenv("AFL_USE_MSAN")) FATAL("ASAN and MSAN are mutually exclusive");
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:473:11:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      if (getenv("AFL_HARDEN"))
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:479:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    } else if (getenv("AFL_USE_MSAN")) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:481:11:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      if (getenv("AFL_USE_ASAN")) FATAL("ASAN and MSAN are mutually exclusive");
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:483:11:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      if (getenv("AFL_HARDEN"))
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:493:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_USE_UBSAN")) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:501:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_USE_CFISAN")) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:517:8:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (!getenv("AFL_DONT_OPTIMIZE")) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:527:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_NO_BUILTIN") || getenv("AFL_LLVM_LAF_TRANSFORM_COMPARES") ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:527:35:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_NO_BUILTIN") || getenv("AFL_LLVM_LAF_TRANSFORM_COMPARES") ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:528:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      getenv("LAF_TRANSFORM_COMPARES") || lto_mode) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:692:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_DEBUG")) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:695:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (strcmp(getenv("AFL_DEBUG"), "0") == 0) unsetenv("AFL_DEBUG");
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:697:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  } else if (getenv("AFL_QUIET"))
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:701:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("USE_TRACE_PC") || getenv("AFL_USE_TRACE_PC") ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:701:33:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("USE_TRACE_PC") || getenv("AFL_USE_TRACE_PC") ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:702:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      getenv("AFL_LLVM_USE_TRACE_PC") || getenv("AFL_TRACE_PC")) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:702:42:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      getenv("AFL_LLVM_USE_TRACE_PC") || getenv("AFL_TRACE_PC")) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:711:8:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((getenv("AFL_LLVM_INSTRUMENT_FILE") != NULL ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:712:8:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
       getenv("AFL_LLVM_WHITELIST") || getenv("AFL_LLVM_ALLOWLIST") ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:712:40:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
       getenv("AFL_LLVM_WHITELIST") || getenv("AFL_LLVM_ALLOWLIST") ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:713:8:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
       getenv("AFL_LLVM_DENYLIST") || getenv("AFL_LLVM_BLOCKLIST")) &&
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:713:39:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
       getenv("AFL_LLVM_DENYLIST") || getenv("AFL_LLVM_BLOCKLIST")) &&
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:714:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      getenv("AFL_DONT_OPTIMIZE"))
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:719:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_LLVM_INSTRIM") || getenv("INSTRIM") ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:719:37:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_LLVM_INSTRIM") || getenv("INSTRIM") ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:720:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      getenv("INSTRIM_LIB")) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:730:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_LLVM_CTX")) instrument_opt_mode |= INSTRUMENT_OPT_CTX;
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:732:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_LLVM_NGRAM_SIZE")) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:735:23:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    ngram_size = atoi(getenv("AFL_LLVM_NGRAM_SIZE"));
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:744:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_LLVM_INSTRUMENT")) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:746:22:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    u8 *ptr = strtok(getenv("AFL_LLVM_INSTRUMENT"), ":,;");
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:824:17:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
          ptr = getenv("AFL_LLVM_NGRAM_SIZE");
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:890:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_LLVM_INSTRUMENT_FILE") != NULL ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:891:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
        getenv("AFL_LLVM_WHITELIST") || getenv("AFL_LLVM_ALLOWLIST") ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:891:41:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
        getenv("AFL_LLVM_WHITELIST") || getenv("AFL_LLVM_ALLOWLIST") ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:892:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
        getenv("AFL_LLVM_DENYLIST") || getenv("AFL_LLVM_BLOCKLIST")) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:892:40:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
        getenv("AFL_LLVM_DENYLIST") || getenv("AFL_LLVM_BLOCKLIST")) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:945:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_LLVM_SKIP_NEVERZERO") && getenv("AFL_LLVM_NOT_ZERO"))
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:945:44:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_LLVM_SKIP_NEVERZERO") && getenv("AFL_LLVM_NOT_ZERO"))
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:951:8:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      (getenv("AFL_LLVM_INSTRUMENT_FILE") != NULL ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:952:8:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
       getenv("AFL_LLVM_WHITELIST") || getenv("AFL_LLVM_ALLOWLIST") ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:952:40:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
       getenv("AFL_LLVM_WHITELIST") || getenv("AFL_LLVM_ALLOWLIST") ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:953:8:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
       getenv("AFL_LLVM_DENYLIST") || getenv("AFL_LLVM_BLOCKLIST")))
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:953:39:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
       getenv("AFL_LLVM_DENYLIST") || getenv("AFL_LLVM_BLOCKLIST")))
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:1071:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
             getenv("AFL_DEBUG") != NULL) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:1089:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      ((ptr2 = getenv("AFL_MAP_SIZE")) || (ptr2 = getenv("AFL_MAPSIZE")))) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:1089:51:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      ((ptr2 = getenv("AFL_MAP_SIZE")) || (ptr2 = getenv("AFL_MAPSIZE")))) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:1108:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_LLVM_LAF_ALL")) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:1117:17:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  cmplog_mode = getenv("AFL_CMPLOG") || getenv("AFL_LLVM_CMPLOG");
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:1117:41:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  cmplog_mode = getenv("AFL_CMPLOG") || getenv("AFL_LLVM_CMPLOG");
data/aflplusplus-2.68c/llvm_mode/afl-ld-lto.c:178:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_LLVM_INSTRIM"))
data/aflplusplus-2.68c/llvm_mode/afl-ld-lto.c:180:19:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  else if ((ptr = getenv("AFL_LLVM_INSTRUMENT")) &&
data/aflplusplus-2.68c/llvm_mode/afl-ld-lto.c:255:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((ptr = getenv("AFL_LD_CALLER")) != NULL) {
data/aflplusplus-2.68c/llvm_mode/afl-ld-lto.c:261:21:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (isatty(2) && !getenv("AFL_QUIET") && !getenv("AFL_DEBUG")) {
data/aflplusplus-2.68c/llvm_mode/afl-ld-lto.c:261:45:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (isatty(2) && !getenv("AFL_QUIET") && !getenv("AFL_DEBUG")) {
data/aflplusplus-2.68c/llvm_mode/afl-ld-lto.c:270:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_DEBUG") != NULL) debug = 1;
data/aflplusplus-2.68c/llvm_mode/afl-ld-lto.c:271:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_PATH") != NULL) afl_path = getenv("AFL_PATH");
data/aflplusplus-2.68c/llvm_mode/afl-ld-lto.c:271:46:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_PATH") != NULL) afl_path = getenv("AFL_PATH");
data/aflplusplus-2.68c/llvm_mode/afl-ld-lto.c:272:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_LD_PASSTHROUGH") != NULL) passthrough = 1;
data/aflplusplus-2.68c/llvm_mode/afl-ld-lto.c:273:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_REAL_LD") != NULL) real_ld = getenv("AFL_REAL_LD");
data/aflplusplus-2.68c/llvm_mode/afl-ld-lto.c:273:48:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_REAL_LD") != NULL) real_ld = getenv("AFL_REAL_LD");
data/aflplusplus-2.68c/llvm_mode/afl-llvm-common.cc:96:21:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  char *allowlist = getenv("AFL_LLVM_ALLOWLIST");
data/aflplusplus-2.68c/llvm_mode/afl-llvm-common.cc:97:31:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (!allowlist) allowlist = getenv("AFL_LLVM_INSTRUMENT_FILE");
data/aflplusplus-2.68c/llvm_mode/afl-llvm-common.cc:98:31:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (!allowlist) allowlist = getenv("AFL_LLVM_WHITELIST");
data/aflplusplus-2.68c/llvm_mode/afl-llvm-common.cc:99:20:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  char *denylist = getenv("AFL_LLVM_DENYLIST");
data/aflplusplus-2.68c/llvm_mode/afl-llvm-common.cc:100:29:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (!denylist) denylist = getenv("AFL_LLVM_BLOCKLIST");
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentation.so.cc:69:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_DEBUG")) debug = 1;
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentation.so.cc:70:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if ((ptr = getenv("AFL_LLVM_LTO_STARTID")) != NULL)
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentation.so.cc:75:19:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    skip_nozero = getenv("AFL_LLVM_SKIP_NEVERZERO");
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentation.so.cc:110:3:  [3] (random) srand:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
  srand((unsigned int)time(NULL));
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentation.so.cc:122:22:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((isatty(2) && !getenv("AFL_QUIET")) || debug) {
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentation.so.cc:131:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((ptr = getenv("AFL_LLVM_DOCUMENT_IDS")) != NULL) {
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentation.so.cc:143:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((ptr = getenv("AFL_LLVM_MAP_ADDR"))) {
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentation.so.cc:150:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    } else if (getenv("AFL_LLVM_MAP_DYNAMIC")) {
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentation.so.cc:785:8:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (!getenv("AFL_LLVM_LTO_DONTWRITEID") || dictionary.size() || map_addr) {
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentation.so.cc:825:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_LLVM_LTO_DONTWRITEID") == NULL) {
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentation.so.cc:926:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_HARDEN") ? "hardened" : "non-hardened",
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentation.so.cc:927:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_USE_ASAN") ? ", ASAN" : "",
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentation.so.cc:928:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_USE_MSAN") ? ", MSAN" : "",
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentation.so.cc:929:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_USE_CFISAN") ? ", CFISAN" : "",
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentation.so.cc:930:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_USE_UBSAN") ? ", UBSAN" : "");
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentlist.so.cc:62:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_DEBUG")) debug = 1;
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentlist.so.cc:90:22:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((isatty(2) && !getenv("AFL_QUIET")) || getenv("AFL_DEBUG") != NULL) {
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentlist.so.cc:90:46:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((isatty(2) && !getenv("AFL_QUIET")) || getenv("AFL_DEBUG") != NULL) {
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentlist.so.cc:95:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  } else if (getenv("AFL_QUIET"))
data/aflplusplus-2.68c/llvm_mode/afl-llvm-pass.so.cc:143:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_DEBUG")) debug = 1;
data/aflplusplus-2.68c/llvm_mode/afl-llvm-pass.so.cc:145:22:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((isatty(2) && !getenv("AFL_QUIET")) || getenv("AFL_DEBUG") != NULL) {
data/aflplusplus-2.68c/llvm_mode/afl-llvm-pass.so.cc:145:46:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((isatty(2) && !getenv("AFL_QUIET")) || getenv("AFL_DEBUG") != NULL) {
data/aflplusplus-2.68c/llvm_mode/afl-llvm-pass.so.cc:169:33:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  char *       inst_ratio_str = getenv("AFL_INST_RATIO");
data/aflplusplus-2.68c/llvm_mode/afl-llvm-pass.so.cc:181:34:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  char *neverZero_counters_str = getenv("AFL_LLVM_NOT_ZERO");
data/aflplusplus-2.68c/llvm_mode/afl-llvm-pass.so.cc:183:17:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  skip_nozero = getenv("AFL_LLVM_SKIP_NEVERZERO");
data/aflplusplus-2.68c/llvm_mode/afl-llvm-pass.so.cc:187:26:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  char *ngram_size_str = getenv("AFL_LLVM_NGRAM_SIZE");
data/aflplusplus-2.68c/llvm_mode/afl-llvm-pass.so.cc:188:41:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (!ngram_size_str) ngram_size_str = getenv("AFL_NGRAM_SIZE");
data/aflplusplus-2.68c/llvm_mode/afl-llvm-pass.so.cc:189:13:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  ctx_str = getenv("AFL_LLVM_CTX");
data/aflplusplus-2.68c/llvm_mode/afl-llvm-pass.so.cc:626:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_HARDEN") ? "hardened" : "non-hardened",
data/aflplusplus-2.68c/llvm_mode/afl-llvm-pass.so.cc:627:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_USE_ASAN") ? ", ASAN" : "",
data/aflplusplus-2.68c/llvm_mode/afl-llvm-pass.so.cc:628:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_USE_MSAN") ? ", MSAN" : "",
data/aflplusplus-2.68c/llvm_mode/afl-llvm-pass.so.cc:629:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_USE_CFISAN") ? ", CFISAN" : "",
data/aflplusplus-2.68c/llvm_mode/afl-llvm-pass.so.cc:630:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_USE_UBSAN") ? ", UBSAN" : "");
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt-lto.o.c:23:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_DEBUG")) fprintf(stderr, "[__afl_auto_init_globals]\n");
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:129:18:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  char *id_str = getenv(SHM_FUZZ_ENV_VAR);
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:171:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_DEBUG")) {
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:193:18:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  char *id_str = getenv(SHM_ENV_VAR);
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:205:18:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      if ((ptr = getenv("AFL_MAP_SIZE")) != NULL) val = atoi(ptr);
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:210:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
          if (!getenv("AFL_QUIET"))
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:225:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
          if (!getenv("AFL_QUIET"))
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:243:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_DEBUG"))
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:358:12:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  id_str = getenv(CMPLOG_SHM_ENV_VAR);
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:360:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_DEBUG")) {
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:438:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_DEBUG")) {
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:614:48:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (/*!is_persistent &&*/ !__afl_cmp_map && !getenv("AFL_NO_SNAPSHOT") &&
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:650:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_DEBUG")) {
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:873:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:880:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_DEBUG"))
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:900:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) return;
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:902:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv(DEFER_ENV_VAR)) return;
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:912:21:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  is_persistent = !!getenv(PERSIST_ENV_VAR);
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:914:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) return;
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:924:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) return;
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:950:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) return;
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:1025:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_DEBUG")) {
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:1034:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  x = getenv("AFL_INST_RATIO");
data/aflplusplus-2.68c/llvm_mode/cmplog-instructions-pass.cc:261:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_QUIET") == NULL)
data/aflplusplus-2.68c/llvm_mode/cmplog-routines-pass.cc:181:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_QUIET") == NULL)
data/aflplusplus-2.68c/llvm_mode/compare-transform-pass.so.cc:557:21:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((isatty(2) && getenv("AFL_QUIET") == NULL) || getenv("AFL_DEBUG") != NULL)
data/aflplusplus-2.68c/llvm_mode/compare-transform-pass.so.cc:557:53:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((isatty(2) && getenv("AFL_QUIET") == NULL) || getenv("AFL_DEBUG") != NULL)
data/aflplusplus-2.68c/llvm_mode/split-compares-pass.so.cc:1256:20:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  char *bitw_env = getenv("AFL_LLVM_LAF_SPLIT_COMPARES_BITW");
data/aflplusplus-2.68c/llvm_mode/split-compares-pass.so.cc:1257:29:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (!bitw_env) bitw_env = getenv("LAF_SPLIT_COMPARES_BITW");
data/aflplusplus-2.68c/llvm_mode/split-compares-pass.so.cc:1260:19:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  enableFPSplit = getenv("AFL_LLVM_LAF_SPLIT_FLOATS") != NULL;
data/aflplusplus-2.68c/llvm_mode/split-compares-pass.so.cc:1262:21:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((isatty(2) && getenv("AFL_QUIET") == NULL) ||
data/aflplusplus-2.68c/llvm_mode/split-compares-pass.so.cc:1263:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      getenv("AFL_DEBUG") != NULL) {
data/aflplusplus-2.68c/llvm_mode/split-switches-pass.so.cc:417:21:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((isatty(2) && getenv("AFL_QUIET") == NULL) || getenv("AFL_DEBUG") != NULL)
data/aflplusplus-2.68c/llvm_mode/split-switches-pass.so.cc:417:53:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((isatty(2) && getenv("AFL_QUIET") == NULL) || getenv("AFL_DEBUG") != NULL)
data/aflplusplus-2.68c/qbdi_mode/template.cpp:58:18:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  char *id_str = getenv(SHM_ENV_VAR);
data/aflplusplus-2.68c/qemu_mode/libcompcov/libcompcov.so.c:99:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_QEMU_COMPCOV")) { __compcov_level = 1; }
data/aflplusplus-2.68c/qemu_mode/libcompcov/libcompcov.so.c:100:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_COMPCOV_LEVEL")) {
data/aflplusplus-2.68c/qemu_mode/libcompcov/libcompcov.so.c:102:28:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    __compcov_level = atoi(getenv("AFL_COMPCOV_LEVEL"));
data/aflplusplus-2.68c/qemu_mode/libcompcov/libcompcov.so.c:106:18:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  char *id_str = getenv(SHM_ENV_VAR);
data/aflplusplus-2.68c/qemu_mode/libcompcov/libcompcov.so.c:122:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_INST_LIBS")) {
data/aflplusplus-2.68c/qemu_mode/libcompcov/libcompcov.so.c:130:20:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  char *bin_name = getenv("AFL_COMPCOV_BINNAME");
data/aflplusplus-2.68c/qemu_mode/libcompcov/libcompcov.so.c:485:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_QEMU_COMPCOV_DEBUG") != NULL)
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:145:18:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  char *id_str = getenv(SHM_FUZZ_ENV_VAR);
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:163:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_DEBUG")) {
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:181:18:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  char *id_str = getenv(SHM_ENV_VAR), *inst_r = getenv("AFL_INST_RATIO");
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:181:49:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  char *id_str = getenv(SHM_ENV_VAR), *inst_r = getenv("AFL_INST_RATIO");
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:212:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("___AFL_EINS_ZWEI_POLIZEI___")) {  // CmpLog forkserver
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:214:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    id_str = getenv(CMPLOG_SHM_ENV_VAR);
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:228:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_INST_LIBS")) {
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:235:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_CODE_START"))
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:236:30:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    afl_start_code = strtoll(getenv("AFL_CODE_START"), NULL, 16);
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:237:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_CODE_END"))
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:238:28:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    afl_end_code = strtoll(getenv("AFL_CODE_END"), NULL, 16);
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:241:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_QEMU_COMPCOV")) { afl_compcov_level = 1; }
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:242:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_COMPCOV_LEVEL")) {
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:244:30:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    afl_compcov_level = atoi(getenv("AFL_COMPCOV_LEVEL"));
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:254:21:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  disable_caching = getenv("AFL_QEMU_DISABLE_CACHE") != NULL;
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:256:19:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  is_persistent = getenv("AFL_QEMU_PERSISTENT_ADDR") != NULL;
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:260:35:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    afl_persistent_addr = strtoll(getenv("AFL_QEMU_PERSISTENT_ADDR"), NULL, 0);
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:261:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_QEMU_PERSISTENT_RET"))
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:263:19:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
          strtoll(getenv("AFL_QEMU_PERSISTENT_RET"), NULL, 0);
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:268:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_QEMU_PERSISTENT_GPR")) persistent_save_gpr = 1;
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:270:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_QEMU_PERSISTENT_HOOK")) {
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:283:25:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    void *plib = dlopen(getenv("AFL_QEMU_PERSISTENT_HOOK"), RTLD_NOW);
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:287:15:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
              getenv("AFL_QEMU_PERSISTENT_HOOK"));
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:303:15:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
              getenv("AFL_QEMU_PERSISTENT_HOOK"));
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:312:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"))
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:314:17:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
        strtoll(getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"), NULL, 0);
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:316:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_QEMU_PERSISTENT_CNT"))
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:317:34:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    afl_persistent_cnt = strtoll(getenv("AFL_QEMU_PERSISTENT_CNT"), NULL, 0);
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:333:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_QEMU_DEBUG_MAPS")) open_self_maps(cpu->env_ptr, 0);
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:348:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_DEBUG"))
data/aflplusplus-2.68c/src/afl-analyze.c:813:26:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      u8 *qemu_preload = getenv("QEMU_SET_ENV");
data/aflplusplus-2.68c/src/afl-analyze.c:814:25:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      u8 *afl_preload = getenv("AFL_PRELOAD");
data/aflplusplus-2.68c/src/afl-analyze.c:848:28:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1);
data/aflplusplus-2.68c/src/afl-analyze.c:849:39:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      setenv("DYLD_INSERT_LIBRARIES", getenv("AFL_PRELOAD"), 1);
data/aflplusplus-2.68c/src/afl-analyze.c:935:17:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
  while ((opt = getopt(argc, argv, "+i:f:m:t:eQUWh")) > 0) {
data/aflplusplus-2.68c/src/afl-as.c:94:17:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  u8 *tmp_dir = getenv("TMPDIR"), *afl_as = getenv("AFL_AS");
data/aflplusplus-2.68c/src/afl-as.c:94:45:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  u8 *tmp_dir = getenv("TMPDIR"), *afl_as = getenv("AFL_AS");
data/aflplusplus-2.68c/src/afl-as.c:117:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    afl_as = getenv("AFL_CC");
data/aflplusplus-2.68c/src/afl-as.c:118:27:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (!afl_as) afl_as = getenv("AFL_CXX");
data/aflplusplus-2.68c/src/afl-as.c:129:29:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (!tmp_dir) { tmp_dir = getenv("TEMP"); }
data/aflplusplus-2.68c/src/afl-as.c:130:29:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (!tmp_dir) { tmp_dir = getenv("TMP"); }
data/aflplusplus-2.68c/src/afl-as.c:223:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
        getenv("AFL_AS_FORCE_INSTRUMENT") == NULL) {
data/aflplusplus-2.68c/src/afl-as.c:227:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    } else if (getenv("AFL_AS_FORCE_INSTRUMENT")) {
data/aflplusplus-2.68c/src/afl-as.c:236:54:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
                               (u32)time(NULL), (u32)random());
data/aflplusplus-2.68c/src/afl-as.c:515:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_HARDEN") ? "hardened" : "non-hardened",
data/aflplusplus-2.68c/src/afl-as.c:516:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_USE_ASAN") ? ", ASAN" : "",
data/aflplusplus-2.68c/src/afl-as.c:517:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_USE_MSAN") ? ", MSAN" : "",
data/aflplusplus-2.68c/src/afl-as.c:518:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
               getenv("AFL_USE_UBSAN") ? ", UBSAN" : "");
data/aflplusplus-2.68c/src/afl-as.c:536:24:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  u8 *inst_ratio_str = getenv("AFL_INST_RATIO");
data/aflplusplus-2.68c/src/afl-as.c:541:18:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  clang_mode = !!getenv(CLANG_ENV_VAR);
data/aflplusplus-2.68c/src/afl-as.c:543:22:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((isatty(2) && !getenv("AFL_QUIET")) || getenv("AFL_DEBUG") != NULL) {
data/aflplusplus-2.68c/src/afl-as.c:543:46:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((isatty(2) && !getenv("AFL_QUIET")) || getenv("AFL_DEBUG") != NULL) {
data/aflplusplus-2.68c/src/afl-as.c:598:3:  [3] (random) srandom:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
  srandom(rand_seed);
data/aflplusplus-2.68c/src/afl-as.c:612:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv(AS_LOOP_ENV_VAR)) {
data/aflplusplus-2.68c/src/afl-as.c:624:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_USE_ASAN") || getenv("AFL_USE_MSAN")) {
data/aflplusplus-2.68c/src/afl-as.c:624:33:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_USE_ASAN") || getenv("AFL_USE_MSAN")) {
data/aflplusplus-2.68c/src/afl-as.c:627:10:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (!getenv("AFL_INST_RATIO")) { inst_ratio /= 3; }
data/aflplusplus-2.68c/src/afl-as.c:644:8:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (!getenv("AFL_KEEP_ASSEMBLY")) { unlink(modified_file); }
data/aflplusplus-2.68c/src/afl-common.c:156:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  tmp = getenv("AFL_PATH");
data/aflplusplus-2.68c/src/afl-common.c:237:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  tmp = getenv("AFL_PATH");
data/aflplusplus-2.68c/src/afl-common.c:338:42:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (strchr(fname, '/') || !(env_path = getenv("PATH"))) {
data/aflplusplus-2.68c/src/afl-common.c:429:22:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
          if ((val = getenv(afl_environment_variables[i])) && !*val) {
data/aflplusplus-2.68c/src/afl-common.c:487:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((val = getenv(env)) != NULL) {
data/aflplusplus-2.68c/src/afl-common.c:862:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((ptr = getenv("AFL_MAP_SIZE")) || (ptr = getenv("AFL_MAPSIZE"))) {
data/aflplusplus-2.68c/src/afl-common.c:862:48:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((ptr = getenv("AFL_MAP_SIZE")) || (ptr = getenv("AFL_MAPSIZE"))) {
data/aflplusplus-2.68c/src/afl-forkserver.c:467:10:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (!getenv("LD_BIND_LAZY")) { setenv("LD_BIND_NOW", "1", 0); }
data/aflplusplus-2.68c/src/afl-forkserver.c:580:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_DEBUG")) {
data/aflplusplus-2.68c/src/afl-forkserver.c:914:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
        getenv(DEFER_ENV_VAR) ? "three" : "two",
data/aflplusplus-2.68c/src/afl-forkserver.c:915:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
        getenv(DEFER_ENV_VAR)
data/aflplusplus-2.68c/src/afl-forkserver.c:950:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_DEBUG")) {
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1932:10:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (!getenv("AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES")) {
data/aflplusplus-2.68c/src/afl-fuzz-init.c:2311:42:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (strchr(fname, '/') || !(env_path = getenv("PATH"))) {
data/aflplusplus-2.68c/src/afl-fuzz-init.c:2507:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  } else if (getenv("AFL_PERSISTENT")) {
data/aflplusplus-2.68c/src/afl-fuzz-init.c:2519:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  } else if (getenv("AFL_DEFER_FORKSRV")) {
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:47:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if ((val = getenv(afl_environment_variables[i])) != NULL) {
data/aflplusplus-2.68c/src/afl-fuzz.c:47:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  ptr = getenv(CPU_AFFINITY_ENV_VAR);
data/aflplusplus-2.68c/src/afl-fuzz.c:50:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  ptr = getenv("__AFL_TARGET_PID1");
data/aflplusplus-2.68c/src/afl-fuzz.c:53:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  ptr = getenv("__AFL_TARGET_PID2");
data/aflplusplus-2.68c/src/afl-fuzz.c:59:11:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    ptr = getenv(list[i]);
data/aflplusplus-2.68c/src/afl-fuzz.c:282:17:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
  while ((opt = getopt(
data/aflplusplus-2.68c/src/afl-fuzz.c:715:27:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
                ((double)(random() % 7000) * 0.0001 + 0.1);
data/aflplusplus-2.68c/src/afl-fuzz.c:884:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_NO_UI") && getenv("AFL_FORCE_UI")) {
data/aflplusplus-2.68c/src/afl-fuzz.c:884:30:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_NO_UI") && getenv("AFL_FORCE_UI")) {
data/aflplusplus-2.68c/src/afl-fuzz.c:997:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("LD_PRELOAD")) {
data/aflplusplus-2.68c/src/afl-fuzz.c:1009:26:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      u8 *qemu_preload = getenv("QEMU_SET_ENV");
data/aflplusplus-2.68c/src/afl-fuzz.c:1010:25:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      u8 *afl_preload = getenv("AFL_PRELOAD");
data/aflplusplus-2.68c/src/afl-fuzz.c:1044:28:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1);
data/aflplusplus-2.68c/src/afl-fuzz.c:1045:39:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      setenv("DYLD_INSERT_LIBRARIES", getenv("AFL_PRELOAD"), 1);
data/aflplusplus-2.68c/src/afl-fuzz.c:1051:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_LD_PRELOAD")) {
data/aflplusplus-2.68c/src/afl-gcc.c:62:18:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  u8 *afl_path = getenv("AFL_PATH");
data/aflplusplus-2.68c/src/afl-gcc.c:152:21:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      u8 *alt_cxx = getenv("AFL_CXX");
data/aflplusplus-2.68c/src/afl-gcc.c:157:20:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      u8 *alt_cc = getenv("AFL_CC");
data/aflplusplus-2.68c/src/afl-gcc.c:179:22:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      cc_params[0] = getenv("AFL_CXX");
data/aflplusplus-2.68c/src/afl-gcc.c:183:22:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      cc_params[0] = getenv("AFL_GCJ");
data/aflplusplus-2.68c/src/afl-gcc.c:187:22:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      cc_params[0] = getenv("AFL_CC");
data/aflplusplus-2.68c/src/afl-gcc.c:214:21:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      u8 *alt_cxx = getenv("AFL_CXX");
data/aflplusplus-2.68c/src/afl-gcc.c:219:20:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      u8 *alt_cc = getenv("AFL_GCJ");
data/aflplusplus-2.68c/src/afl-gcc.c:224:20:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      u8 *alt_cc = getenv("AFL_CC");
data/aflplusplus-2.68c/src/afl-gcc.c:283:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_HARDEN")) {
data/aflplusplus-2.68c/src/afl-gcc.c:297:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  } else if (getenv("AFL_USE_ASAN")) {
data/aflplusplus-2.68c/src/afl-gcc.c:299:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_USE_MSAN")) {
data/aflplusplus-2.68c/src/afl-gcc.c:305:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_HARDEN")) {
data/aflplusplus-2.68c/src/afl-gcc.c:314:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  } else if (getenv("AFL_USE_MSAN")) {
data/aflplusplus-2.68c/src/afl-gcc.c:316:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_USE_ASAN")) {
data/aflplusplus-2.68c/src/afl-gcc.c:322:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_HARDEN")) {
data/aflplusplus-2.68c/src/afl-gcc.c:333:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_USE_UBSAN")) {
data/aflplusplus-2.68c/src/afl-gcc.c:345:8:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (!getenv("AFL_DONT_OPTIMIZE")) {
data/aflplusplus-2.68c/src/afl-gcc.c:372:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_NO_BUILTIN")) {
data/aflplusplus-2.68c/src/afl-gcc.c:430:22:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((isatty(2) && !getenv("AFL_QUIET")) || getenv("AFL_DEBUG") != NULL) {
data/aflplusplus-2.68c/src/afl-gcc.c:430:46:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if ((isatty(2) && !getenv("AFL_QUIET")) || getenv("AFL_DEBUG") != NULL) {
data/aflplusplus-2.68c/src/afl-gcc.c:466:15:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      ((ptr = getenv("AFL_MAP_SIZE")) || (ptr = getenv("AFL_MAPSIZE")))) {
data/aflplusplus-2.68c/src/afl-gcc.c:466:49:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      ((ptr = getenv("AFL_MAP_SIZE")) || (ptr = getenv("AFL_MAPSIZE")))) {
data/aflplusplus-2.68c/src/afl-sharedmem.c:152:69:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
  snprintf(shm->g_shm_file_path, L_tmpnam, "/afl_%d_%ld", getpid(), random());
data/aflplusplus-2.68c/src/afl-sharedmem.c:191:24:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
             getpid(), random());
data/aflplusplus-2.68c/src/afl-showmap.c:207:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  u8 cco = !!getenv("AFL_CMIN_CRASHES_ONLY"),
data/aflplusplus-2.68c/src/afl-showmap.c:208:14:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
     caa = !!getenv("AFL_CMIN_ALLOW_ANY");
data/aflplusplus-2.68c/src/afl-showmap.c:394:10:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (!getenv("LD_BIND_LAZY")) { setenv("LD_BIND_NOW", "1", 0); }
data/aflplusplus-2.68c/src/afl-showmap.c:519:26:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      u8 *qemu_preload = getenv("QEMU_SET_ENV");
data/aflplusplus-2.68c/src/afl-showmap.c:520:25:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      u8 *afl_preload = getenv("AFL_PRELOAD");
data/aflplusplus-2.68c/src/afl-showmap.c:554:28:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1);
data/aflplusplus-2.68c/src/afl-showmap.c:555:39:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      setenv("DYLD_INSERT_LIBRARIES", getenv("AFL_PRELOAD"), 1);
data/aflplusplus-2.68c/src/afl-showmap.c:668:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_QUIET") != NULL) { be_quiet = 1; }
data/aflplusplus-2.68c/src/afl-showmap.c:670:17:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
  while ((opt = getopt(argc, argv, "+i:o:f:m:t:A:eqCZQUWbcrh")) > 0) {
data/aflplusplus-2.68c/src/afl-showmap.c:867:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_DEBUG")) {
data/aflplusplus-2.68c/src/afl-showmap.c:961:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_DEBUG_GDB")) wait_for_gdb = 1;
data/aflplusplus-2.68c/src/afl-showmap.c:1041:9:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if (getenv("AFL_FORKSRV_INIT_TMOUT")) {
data/aflplusplus-2.68c/src/afl-showmap.c:1043:37:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      s32 forksrv_init_tmout = atoi(getenv("AFL_FORKSRV_INIT_TMOUT"));
data/aflplusplus-2.68c/src/afl-tmin.c:742:26:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      u8 *qemu_preload = getenv("QEMU_SET_ENV");
data/aflplusplus-2.68c/src/afl-tmin.c:743:25:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      u8 *afl_preload = getenv("AFL_PRELOAD");
data/aflplusplus-2.68c/src/afl-tmin.c:777:28:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1);
data/aflplusplus-2.68c/src/afl-tmin.c:778:39:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      setenv("DYLD_INSERT_LIBRARIES", getenv("AFL_PRELOAD"), 1);
data/aflplusplus-2.68c/src/afl-tmin.c:877:17:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
  while ((opt = getopt(argc, argv, "+i:o:f:m:t:B:xeQUWHh")) > 0) {
data/aflplusplus-2.68c/src/afl-tmin.c:1108:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  if (getenv("AFL_FORKSRV_INIT_TMOUT")) {
data/aflplusplus-2.68c/src/afl-tmin.c:1110:35:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    s32 forksrv_init_tmout = atoi(getenv("AFL_FORKSRV_INIT_TMOUT"));
data/aflplusplus-2.68c/custom_mutators/honggfuzz/honggfuzz.c:76:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(run.global->mutate.dictionary[run.global->mutate.dictionaryCnt].val,
data/aflplusplus-2.68c/custom_mutators/honggfuzz/honggfuzz.c:89:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(run.global->mutate.dictionary[run.global->mutate.dictionaryCnt].val,
data/aflplusplus-2.68c/custom_mutators/honggfuzz/honggfuzz.c:117:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(data->mutator_buf, buf, buf_size);
data/aflplusplus-2.68c/custom_mutators/honggfuzz/honggfuzz.h:153:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char               path[PATH_MAX];
data/aflplusplus-2.68c/custom_mutators/honggfuzz/honggfuzz.h:207:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char        workDir[PATH_MAX];
data/aflplusplus-2.68c/custom_mutators/honggfuzz/honggfuzz.h:235:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char               env_vals[128][4096];
data/aflplusplus-2.68c/custom_mutators/honggfuzz/honggfuzz.h:259:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char    cmdline_txt[65];
data/aflplusplus-2.68c/custom_mutators/honggfuzz/honggfuzz.h:352:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char         crashFileName[PATH_MAX];
data/aflplusplus-2.68c/custom_mutators/honggfuzz/honggfuzz.h:357:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char         report[_HF_REPORT_SIZE];
data/aflplusplus-2.68c/custom_mutators/honggfuzz/mangle.c:190:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(tmpbuf, &run->dynfile->data[off1], len);
data/aflplusplus-2.68c/custom_mutators/honggfuzz/mangle.c:192:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(&run->dynfile->data[off2], tmpbuf, len);
data/aflplusplus-2.68c/custom_mutators/honggfuzz/mangle.c:209:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(tmpbuf, &run->dynfile->data[off], len);
data/aflplusplus-2.68c/custom_mutators/honggfuzz/mangle.c:834:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[20];
data/aflplusplus-2.68c/custom_mutators/honggfuzz/mangle.c:860:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char   numbuf[21] = {};
data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa-test.c:31:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char path[32];
data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa-test.c:34:3:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
  sprintf(path, "/tmp/libradamsa-%d.fuzz", num);
data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa-test.c:35:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fd = open(path, O_WRONLY | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR);
data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa-test.c:49:15:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  int    fd = open(spath, O_RDONLY, 0);
data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa.c:4275:18:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
        int fd = open((const char *)a + W, cnum(b), immval(c));
data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa.c:4332:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy((word *)ipa + 1, &addr.sin_addr, 4);
data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa.c:4523:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy((word *)ipa + 1, &si_other.sin_addr, 4);
data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa.c:4860:11:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
          memcpy((word *)rv + 1, n, 6);
data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa.c:4866:11:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
          memcpy((word *)rv + 1, n, 4);
data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa.c:5058:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(state + 1, R + 3, acc * W);                   /* first arg at R3 */
data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa.c:5079:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(state + 1, R + 1, (acc - 2) * W);
data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa.c:5097:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(fp + 1, R, NR * W);
data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa.c:5101:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(R, fp + 1, NR * W);
data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa.c:5396:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(t + 1, R + 3, acc * W);
data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa.c:61612:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy((word *)mkraw(type, size) + 1, hp, size);
data/aflplusplus-2.68c/examples/afl_frida/afl-frida.c:231:12:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  if ((f = fopen("/proc/self/maps", "r")) == NULL) {
data/aflplusplus-2.68c/examples/afl_frida/afl-frida.c:415:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(code_range, details->range, sizeof(*code_range));
data/aflplusplus-2.68c/examples/afl_frida/afl-frida.c:490:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(__afl_area_ptr, (void *)AFL_PERSISTENT, sizeof(AFL_PERSISTENT) + 1);
data/aflplusplus-2.68c/examples/afl_frida/afl-frida.c:491:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(__afl_area_ptr + 32, (void *)AFL_DEFER_FORKSVR,
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-client.c:78:15:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    u32 val = atoi(ptr);
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-client.c:143:18:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    u32 shm_id = atoi(id_str);
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-client.c:174:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(tmp, &status, 4);
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-client.c:241:20:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    if ((max_len = atoi(argv[3])) < 0)
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-client.c:246:27:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    if ((__afl_map_size = atoi(ptr)) < 8)
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-server.c:113:9:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  ret = open(path, O_RDWR | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-server.c:164:23:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fsrv->dev_null_fd = open("/dev/null", O_RDWR);
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-server.c:184:18:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fsrv->out_fd = open(out_file, O_RDWR | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-server.c:423:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char                str[INET6_ADDRSTRLEN];
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-server.c:445:16:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
        port = atoi(optarg);
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-server.c:518:28:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
        fsrv->exec_tmout = atoi(optarg);
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-server.c:677:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(send_buf + 4, fsrv->trace_bits, fsrv->map_size);
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-server.c:680:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(buf2, &fsrv->child_status, 4);
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-server.c:689:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(send_buf, &fsrv->child_status, 4);
data/aflplusplus-2.68c/examples/afl_proxy/afl-proxy.c:75:15:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    u32 val = atoi(ptr);
data/aflplusplus-2.68c/examples/afl_proxy/afl-proxy.c:140:18:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    u32 shm_id = atoi(id_str);
data/aflplusplus-2.68c/examples/afl_proxy/afl-proxy.c:171:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(tmp, &status, 4);
data/aflplusplus-2.68c/examples/afl_untracer/afl-untracer.c:127:12:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  if ((f = fopen("/proc/self/maps", "r")) == NULL)
data/aflplusplus-2.68c/examples/afl_untracer/afl-untracer.c:315:15:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    u32 val = atoi(ptr);
data/aflplusplus-2.68c/examples/afl_untracer/afl-untracer.c:380:18:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    u32 shm_id = atoi(id_str);
data/aflplusplus-2.68c/examples/afl_untracer/afl-untracer.c:410:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(tmp, &status, 4);
data/aflplusplus-2.68c/examples/afl_untracer/afl-untracer.c:477:19:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  FILE *patches = fopen(filename, "r");
data/aflplusplus-2.68c/examples/aflpp_driver/aflpp_driver.c:177:16:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  FILE *temp = fopen("/dev/null", "w");
data/aflplusplus-2.68c/examples/aflpp_driver/aflpp_driver.c:210:17:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
  int fd_mask = atoi(fd_mask_str);
data/aflplusplus-2.68c/examples/aflpp_driver/aflpp_driver.c:231:14:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    int fd = open(argv[i], O_RDONLY);
data/aflplusplus-2.68c/examples/aflpp_driver/aflpp_driver.c:277:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(dummy_input, (void *)AFL_PERSISTENT, sizeof(AFL_PERSISTENT));
data/aflplusplus-2.68c/examples/aflpp_driver/aflpp_driver.c:278:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(dummy_input + 32, (void *)AFL_DEFER_FORKSVR,
data/aflplusplus-2.68c/examples/aflpp_driver/aflpp_driver.c:282:9:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    N = atoi(argv[1] + 1);
data/aflplusplus-2.68c/examples/aflpp_driver/aflpp_driver.c:283:30:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
  else if (argc == 2 && (N = atoi(argv[1])) > 0)
data/aflplusplus-2.68c/examples/aflpp_driver/aflpp_qemu_driver_hook.c:12:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(g2h(regs[REGS_RDI]), input_buf, input_len);
data/aflplusplus-2.68c/examples/argv_fuzzing/argv-fuzz-inl.h:60:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  static char  in_buf[MAX_CMDLINE_LEN];
data/aflplusplus-2.68c/examples/argv_fuzzing/argv-fuzz-inl.h:61:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  static char *ret[MAX_CMDLINE_PAR];
data/aflplusplus-2.68c/examples/custom_mutators/example.c:110:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(mutated_out, commands[rand() % 3], 3);
data/aflplusplus-2.68c/examples/custom_mutators/example.c:155:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(post_process_buf + 5, buf, buf_size);
data/aflplusplus-2.68c/examples/custom_mutators/example.c:205:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(data->trim_buf, buf, buf_size);
data/aflplusplus-2.68c/examples/custom_mutators/post_library_gif.so.c:140:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(*out_buf, in_buf, len);
data/aflplusplus-2.68c/examples/custom_mutators/post_library_gif.so.c:144:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(*out_buf, HEADER, strlen(HEADER));
data/aflplusplus-2.68c/examples/custom_mutators/post_library_png.so.c:129:11:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
          memcpy(new_buf, in_buf, len);
data/aflplusplus-2.68c/examples/defork/forking_target.c:26:15:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    FILE *f = fopen(argv[1], "r");
data/aflplusplus-2.68c/examples/defork/forking_target.c:27:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char  buf[4096];
data/aflplusplus-2.68c/examples/persistent_demo/persistent_demo.c:36:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[100]; /* Example-only buffer, you'd replace it with other global or
data/aflplusplus-2.68c/examples/persistent_demo/persistent_demo_new.c:35:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
unsigned char fuzz_buf[1024000];
data/aflplusplus-2.68c/examples/persistent_demo/test-instr.c:34:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char                fn[32];
data/aflplusplus-2.68c/examples/persistent_demo/test-instr.c:35:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(fn, "%09u:test-instr", counter);
data/aflplusplus-2.68c/examples/persistent_demo/test-instr.c:36:18:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    int fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
data/aflplusplus-2.68c/examples/qemu_persistent_hook/read_into_rdi.c:49:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(g2h(regs[R_EDI]), input_buf, input_len);
data/aflplusplus-2.68c/examples/qemu_persistent_hook/test.c:28:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char data[1024];
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-fast.c:380:20:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    u32 map_size = atoi(ptr);
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-pass.so.cc:573:16:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    fileStream.open(instInstrumentListFilename);
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-rt.o.c:121:18:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    u32 shm_id = atoi(id_str);
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-rt.o.c:157:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(tmp, &map_size, 4);
data/aflplusplus-2.68c/include/afl-fuzz.h:348:8:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
extern char *power_names[POWER_SCHEDULES_NUM];
data/aflplusplus-2.68c/include/alloc-inl.h:164:16:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  return (u8 *)memcpy(ret, str, size);
data/aflplusplus-2.68c/include/alloc-inl.h:365:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(ret + ALLOC_OFF_HEAD, orig + ALLOC_OFF_HEAD, MIN(size, old_size));
data/aflplusplus-2.68c/include/alloc-inl.h:409:10:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  return memcpy(ret, str, size);
data/aflplusplus-2.68c/include/android-ashmem.h:73:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char ourkey[11];
data/aflplusplus-2.68c/include/android-ashmem.h:75:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fd = open(ASHMEM_DEVICE, O_RDWR);
data/aflplusplus-2.68c/include/android-ashmem.h:78:3:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
  sprintf(ourkey, "%d", __key);
data/aflplusplus-2.68c/include/sharedmem.h:40:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char g_shm_file_path[L_tmpnam];
data/aflplusplus-2.68c/include/sharedmem.h:42:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char cmplog_g_shm_file_path[L_tmpnam];
data/aflplusplus-2.68c/include/snapshot-inl.h:71:25:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  afl_snapshot_dev_fd = open(AFL_SNAPSHOT_FILE_NAME, 0);
data/aflplusplus-2.68c/include/xxhash.h:378:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char digest[4];
data/aflplusplus-2.68c/include/xxhash.h:433:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char digest[sizeof(XXH64_hash_t)];
data/aflplusplus-2.68c/include/xxhash.h:641:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char digest[sizeof(XXH128_hash_t)];
data/aflplusplus-2.68c/include/xxhash.h:730:33:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  XXH_ALIGN_MEMBER(64, unsigned char customSecret[XXH3_SECRET_DEFAULT_SIZE]);
data/aflplusplus-2.68c/include/xxhash.h:731:33:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  XXH_ALIGN_MEMBER(64, unsigned char buffer[XXH3_INTERNALBUFFER_SIZE]);
data/aflplusplus-2.68c/include/xxhash.h:999:10:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  return memcpy(dest, src, size);
data/aflplusplus-2.68c/include/xxhash.h:1611:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(dstState, srcState, sizeof(*dstState));
data/aflplusplus-2.68c/include/xxhash.h:1626:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(statePtr, &state, sizeof(state) - sizeof(state.reserved));
data/aflplusplus-2.68c/include/xxhash.h:1762:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(dst, &hash, sizeof(*dst));
data/aflplusplus-2.68c/include/xxhash.h:2299:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(dstState, srcState, sizeof(*dstState));
data/aflplusplus-2.68c/include/xxhash.h:2314:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(statePtr, &state, sizeof(state) - sizeof(state.reserved64));
data/aflplusplus-2.68c/include/xxhash.h:2435:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(dst, &hash, sizeof(*dst));
data/aflplusplus-2.68c/include/xxhash.h:2835:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(&ret, ptr, sizeof(xxh_u64x2));
data/aflplusplus-2.68c/include/xxhash.h:3457:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(dst, &v64, sizeof(v64));
data/aflplusplus-2.68c/include/xxhash.h:4615:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(dst_state, src_state, sizeof(*dst_state));
data/aflplusplus-2.68c/include/xxhash.h:4789:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(state->buffer + sizeof(state->buffer) - XXH_STRIPE_LEN,
data/aflplusplus-2.68c/include/xxhash.h:4822:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(acc, state->acc, sizeof(state->acc));
data/aflplusplus-2.68c/include/xxhash.h:4841:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(lastStripe, state->buffer + sizeof(state->buffer) - catchupSize,
data/aflplusplus-2.68c/include/xxhash.h:4843:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(lastStripe + catchupSize, state->buffer, state->bufferedSize);
data/aflplusplus-2.68c/include/xxhash.h:4882:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(secretBuffer, XXH3_kSecret, XXH_SECRET_DEFAULT_SIZE);
data/aflplusplus-2.68c/include/xxhash.h:4908:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(seeds, customSeed, toFill);
data/aflplusplus-2.68c/include/xxhash.h:4912:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy((char *)seeds + filled, seeds, toFill);
data/aflplusplus-2.68c/include/xxhash.h:4920:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(secretBuffer, &scrambler, sizeof(scrambler));
data/aflplusplus-2.68c/include/xxhash.h:4928:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy((char *)secretBuffer + segmentStart, &segment, sizeof(segment));
data/aflplusplus-2.68c/include/xxhash.h:5555:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(dst, &hash.high64, sizeof(hash.high64));
data/aflplusplus-2.68c/include/xxhash.h:5556:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy((char *)dst + sizeof(hash.high64), &hash.low64, sizeof(hash.low64));
data/aflplusplus-2.68c/libdislocator/libdislocator.so.c:385:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(ret, ptr, MIN(len, PTR_L(ptr)));
data/aflplusplus-2.68c/libtokencap/libtokencap.so.c:98:13:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  FILE *f = fopen("/proc/self/maps", "r");
data/aflplusplus-2.68c/libtokencap/libtokencap.so.c:257:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char     path[PATH_MAX];
data/aflplusplus-2.68c/libtokencap/libtokencap.so.c:263:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fd = open(path, O_RDONLY);
data/aflplusplus-2.68c/libtokencap/libtokencap.so.c:329:9:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
        sprintf(buf + pos, "\\x%02x", ptr[i]);
data/aflplusplus-2.68c/libtokencap/libtokencap.so.c:770:33:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  if (fn) __tokencap_out_file = open(fn, O_RDWR | O_CREAT | O_APPEND, 0655);
data/aflplusplus-2.68c/llvm_mode/LLVMInsTrim.so.cc:563:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      char modeline[100];
data/aflplusplus-2.68c/llvm_mode/SanitizerCoverageLTO.so.cc:437:26:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    if ((afl_global_id = atoi(ptr)) < 0)
data/aflplusplus-2.68c/llvm_mode/SanitizerCoverageLTO.so.cc:442:25:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    if ((documentFile = fopen(ptr, "a")) == NULL)
data/aflplusplus-2.68c/llvm_mode/SanitizerCoverageLTO.so.cc:948:13:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
            memcpy(ptr + offset, token.c_str(), token.length());
data/aflplusplus-2.68c/llvm_mode/SanitizerCoverageLTO.so.cc:999:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      char modeline[100];
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:70:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char instrument_mode_string[18][18] = {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:735:18:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    ngram_size = atoi(getenv("AFL_LLVM_NGRAM_SIZE"));
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:835:22:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
        ngram_size = atoi(ptr);
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:1091:20:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    u32 map_size = atoi(ptr2);
data/aflplusplus-2.68c/llvm_mode/afl-ld-lto.c:253:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char thecwd[PATH_MAX];
data/aflplusplus-2.68c/llvm_mode/afl-llvm-common.cc:111:16:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    fileStream.open(allowlist);
data/aflplusplus-2.68c/llvm_mode/afl-llvm-common.cc:186:16:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    fileStream.open(denylist);
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentation.so.cc:71:28:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
      if ((afl_global_id = atoi(ptr)) < 0 || afl_global_id >= MAP_SIZE)
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentation.so.cc:133:25:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    if ((documentFile = fopen(ptr, "a")) == NULL)
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentation.so.cc:873:13:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
            memcpy(ptr + offset, token.c_str(), token.length());
data/aflplusplus-2.68c/llvm_mode/afl-llvm-lto-instrumentation.so.cc:924:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      char modeline[100];
data/aflplusplus-2.68c/llvm_mode/afl-llvm-pass.so.cc:624:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      char modeline[100];
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:154:18:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    u32 shm_id = atoi(id_str);
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:205:57:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
      if ((ptr = getenv("AFL_MAP_SIZE")) != NULL) val = atoi(ptr);
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:309:18:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    u32 shm_id = atoi(id_str);
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:398:18:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    u32 shm_id = atoi(id_str);
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:430:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(tmp, &status, 4);
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:512:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      char            fn[32];
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:513:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(fn, "%09u:forkserver", counter);
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:514:20:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
      s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:639:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(tmp, &status, 4);
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:725:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      char            fn[32];
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:726:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(fn, "%09u:forkserver", counter);
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:727:20:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
      s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:1035:28:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
  if (x) inst_ratio = (u32)atoi(x);
data/aflplusplus-2.68c/llvm_mode/split-compares-pass.so.cc:1258:26:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
  if (bitw_env) { bitw = atoi(bitw_env); }
data/aflplusplus-2.68c/qbdi_mode/template.cpp:46:17:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static unsigned char
data/aflplusplus-2.68c/qbdi_mode/template.cpp:52:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char input_pathname[PATH_MAX];
data/aflplusplus-2.68c/qbdi_mode/template.cpp:62:14:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    shm_id = atoi(id_str);
data/aflplusplus-2.68c/qbdi_mode/template.cpp:76:19:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  static unsigned char tmp[4];
data/aflplusplus-2.68c/qbdi_mode/template.cpp:128:14:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  FILE *fp = fopen(path, "rb");
data/aflplusplus-2.68c/qemu_mode/libcompcov/compcovtest.cc:30:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buffer[44] = {/* zero padding */};
data/aflplusplus-2.68c/qemu_mode/libcompcov/libcompcov.so.c:102:23:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    __compcov_level = atoi(getenv("AFL_COMPCOV_LEVEL"));
data/aflplusplus-2.68c/qemu_mode/libcompcov/libcompcov.so.c:111:14:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    shm_id = atoi(id_str);
data/aflplusplus-2.68c/qemu_mode/libcompcov/libcompcov.so.c:168:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char debugbuf[4096];
data/aflplusplus-2.68c/qemu_mode/libcompcov/libcompcov.so.c:487:9:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
        open("compcov.debug", O_WRONLY | O_CREAT | O_TRUNC | O_SYNC, 0644);
data/aflplusplus-2.68c/qemu_mode/libcompcov/pmparser.h:39:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char  perm[5];  //< permissions rwxp
data/aflplusplus-2.68c/qemu_mode/libcompcov/pmparser.h:46:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char dev[12];  //< dev major:minor
data/aflplusplus-2.68c/qemu_mode/libcompcov/pmparser.h:49:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char pathname[600];  //< the path of the file that backs the area
data/aflplusplus-2.68c/qemu_mode/libcompcov/pmparser.h:112:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char               maps_path[500];
data/aflplusplus-2.68c/qemu_mode/libcompcov/pmparser.h:115:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(maps_path, "/proc/%d/maps", pid);
data/aflplusplus-2.68c/qemu_mode/libcompcov/pmparser.h:119:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(maps_path, "/proc/self/maps");
data/aflplusplus-2.68c/qemu_mode/libcompcov/pmparser.h:123:16:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  FILE *file = fopen(maps_path, "r");
data/aflplusplus-2.68c/qemu_mode/libcompcov/pmparser.h:133:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[PROCMAPS_LINE_MAX_LENGTH];
data/aflplusplus-2.68c/qemu_mode/libcompcov/pmparser.h:138:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char addr1[20], addr2[20], perm[8], offset[20], dev[10], inode[30],
data/aflplusplus-2.68c/qemu_mode/libcompcov/pmparser.h:167:18:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    tmp->inode = atoi(inode);
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:52:17:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static unsigned char
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:149:18:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    u32 shm_id = atoi(id_str);
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:189:9:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    r = atoi(inst_r);
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:200:14:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    shm_id = atoi(id_str);
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:218:20:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
      u32 shm_id = atoi(id_str);
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:244:25:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    afl_compcov_level = atoi(getenv("AFL_COMPCOV_LEVEL"));
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:328:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char tmp[4] = {0};
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:350:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(tmp, &status, 4);
data/aflplusplus-2.68c/src/afl-analyze.c:176:20:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  s32         fd = open(in_file, O_RDONLY);
data/aflplusplus-2.68c/src/afl-analyze.c:207:9:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  ret = open(path, O_RDWR | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/src/afl-analyze.c:716:17:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  dev_null_fd = open("/dev/null", O_RDWR);
data/aflplusplus-2.68c/src/afl-analyze.c:1019:22:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
        exec_tmout = atoi(optarg);
data/aflplusplus-2.68c/src/afl-as.c:268:11:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    inf = fopen(input_file, "r");
data/aflplusplus-2.68c/src/afl-as.c:277:11:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  outfd = open(modified_file, O_WRONLY | O_EXCL | O_CREAT, 0600);
data/aflplusplus-2.68c/src/afl-as.c:513:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      char modeline[100];
data/aflplusplus-2.68c/src/afl-common.c:148:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(&new_argv[3], &argv[1], (int)(sizeof(char *)) * (argc - 1));
data/aflplusplus-2.68c/src/afl-common.c:230:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(&new_argv[2], &argv[1], (int)(sizeof(char *)) * (argc - 1));
data/aflplusplus-2.68c/src/afl-common.c:359:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(cur_elem, env_path, delim - env_path);
data/aflplusplus-2.68c/src/afl-common.c:505:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  s32 fd = open(fname, O_RDONLY);
data/aflplusplus-2.68c/src/afl-common.c:751:3:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
  strcpy(buf, "infty");
data/aflplusplus-2.68c/src/afl-common.c:763:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(buf, "%0.02f", val);
data/aflplusplus-2.68c/src/afl-common.c:767:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(buf, "%0.01f", val);
data/aflplusplus-2.68c/src/afl-common.c:819:3:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
  strcpy(buf, "infty");
data/aflplusplus-2.68c/src/afl-common.c:836:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(buf, "none seen yet");
data/aflplusplus-2.68c/src/afl-common.c:864:16:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    map_size = atoi(ptr);
data/aflplusplus-2.68c/src/afl-common.c:887:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
data/aflplusplus-2.68c/src/afl-common.c:905:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
data/aflplusplus-2.68c/src/afl-forkserver.c:208:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char tmp[4] = {0, 0, 0, 0};
data/aflplusplus-2.68c/src/afl-forkserver.c:529:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char pid_buf[16];
data/aflplusplus-2.68c/src/afl-forkserver.c:530:3:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
  sprintf(pid_buf, "%d", fsrv->fsrv_pid);
data/aflplusplus-2.68c/src/afl-forkserver.c:948:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(fsrv->shmem_fuzz, buf, len);
data/aflplusplus-2.68c/src/afl-forkserver.c:975:14:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
        fd = open(fsrv->out_file, O_WRONLY | O_CREAT | O_TRUNC, 0600);
data/aflplusplus-2.68c/src/afl-forkserver.c:980:14:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
        fd = open(fsrv->out_file, O_WRONLY | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c:42:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fd = open(fname, O_WRONLY | O_CREAT | O_TRUNC, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c:438:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(ret, "src:%06u", afl->current_entry);
data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c:442:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(ret + strlen(ret), "+%06d", afl->splicing_with);
data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c:446:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(ret + strlen(ret), ",time:%llu", get_cur_time() - afl->start_time);
data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c:452:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(ret + strlen(ret), ",pos:%d", afl->stage_cur_byte);
data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c:464:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(ret + strlen(ret), ",rep:%d", afl->stage_cur_val);
data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c:470:19:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
  if (hnb == 2) { strcat(ret, ",+cov"); }
data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c:490:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c:624:10:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    fd = open(queue_fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c:773:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-extras.c:65:7:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  f = fopen(fname, "r");
data/aflplusplus-2.68c/src/afl-fuzz-extras.c:123:11:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
      if (atoi(lptr) > (s32)dict_level) { continue; }
data/aflplusplus-2.68c/src/afl-fuzz-extras.c:276:18:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    dict_level = atoi(x + 1);
data/aflplusplus-2.68c/src/afl-fuzz-extras.c:340:10:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    fd = open(fn, O_RDONLY);
data/aflplusplus-2.68c/src/afl-fuzz-extras.c:397:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(afl->extras[afl->extras_cnt].data, mem, len);
data/aflplusplus-2.68c/src/afl-fuzz-extras.c:510:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(afl->a_extras[afl->a_extras_cnt].data, mem, len);
data/aflplusplus-2.68c/src/afl-fuzz-extras.c:518:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(afl->a_extras[i].data, mem, len);
data/aflplusplus-2.68c/src/afl-fuzz-extras.c:553:10:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-extras.c:578:10:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    fd = open(fn, O_RDONLY);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:154:21:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
      if ((lockfd = open(lockfile, O_RDWR | O_CREAT | O_EXCL, 0600)) < 0) {
data/aflplusplus-2.68c/src/afl-fuzz-init.c:205:15:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    if (!(f = fopen(fn, "r"))) { continue; }
data/aflplusplus-2.68c/src/afl-fuzz-init.c:564:18:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
        int fd = open(fn2, O_RDONLY);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:760:10:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    fd = open(q->fname, O_RDONLY);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1002:9:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  sfd = open(old_path, O_RDONLY);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1005:9:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  dfd = open(new_path, O_WRONLY | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1154:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fd = open(fn, O_RDONLY);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1166:9:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
  ret = atoi(off + 20);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1196:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fd = open(fn, O_RDONLY);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1208:9:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
  ret = atoi(off + 20);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1268:13:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  FILE *f = fopen("/proc/stat", "r");
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1279:14:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
      val += atoi(tmp + 14);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1355:26:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  afl->fsrv.out_dir_fd = open(afl->out_dir, O_RDONLY);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1375:7:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  f = fopen(fn, "r");
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1693:28:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    afl->fsrv.out_dir_fd = open(afl->out_dir, O_RDONLY);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1711:14:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    int fd = open(x, O_CREAT | O_RDWR, 0644);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1786:27:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  afl->fsrv.dev_null_fd = open("/dev/null", O_RDWR);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1789:30:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  afl->fsrv.dev_urandom_fd = open("/dev/urandom", O_RDONLY);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1795:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fd = open(tmp, O_WRONLY | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1822:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fd = open(tmp, O_WRONLY | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1857:22:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  afl->fsrv.out_fd = open(afl->fsrv.out_file, O_RDWR | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1906:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  s32 fd = open("/proc/sys/kernel/core_pattern", O_RDONLY);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1969:7:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  f = fopen("/sys/devices/system/cpu/cpu0/cpufreq/scaling_governor", "r");
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1985:9:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    f = fopen(tmp, "r");
data/aflplusplus-2.68c/src/afl-fuzz-init.c:2004:7:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  f = fopen("/sys/devices/system/cpu/cpu0/cpufreq/scaling_min_freq", "r");
data/aflplusplus-2.68c/src/afl-fuzz-init.c:2013:7:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  f = fopen("/sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq", "r");
data/aflplusplus-2.68c/src/afl-fuzz-init.c:2113:13:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  FILE *f = fopen("/proc/stat", "r");
data/aflplusplus-2.68c/src/afl-fuzz-init.c:2330:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(cur_elem, env_path, delim - env_path);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:2393:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fd = open(afl->fsrv.target_path, O_RDONLY);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:2559:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(tmp, "%.32s...", afl->use_banner);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:2656:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(buf, argv[i], l);
data/aflplusplus-2.68c/src/afl-fuzz-mutators.c:335:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(in_buf, retbuf, retlen);
data/aflplusplus-2.68c/src/afl-fuzz-mutators.c:343:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(afl->clean_trace_custom, afl->fsrv.trace_bits,
data/aflplusplus-2.68c/src/afl-fuzz-mutators.c:398:10:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    fd = open(q->fname, O_WRONLY | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-mutators.c:405:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(afl->fsrv.trace_bits, afl->clean_trace_custom, afl->fsrv.map_size);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:458:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fd = open(afl->queue_cur->fname, O_RDONLY);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:551:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(out_buf, in_buf, len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:1530:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(out_buf + i, afl->extras[j].data, last_len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:1539:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(out_buf + i, in_buf + i, last_len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:1574:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(ex_tmp + i, afl->extras[j].data, afl->extras[j].len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:1577:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(ex_tmp + i + afl->extras[j].len, out_buf + i, len - i);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:1634:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(out_buf + i, afl->a_extras[j].data, last_len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:1643:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(out_buf + i, in_buf + i, last_len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:1738:16:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
          fd = open(target->fname, O_RDONLY);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:1797:11:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
          memcpy(out_buf, in_buf, len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:1931:17:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                memcpy(out_buf, custom_havoc_buf, temp_len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:2174:13:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
            memcpy(new_buf, out_buf, clone_to);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:2180:15:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
              memcpy(new_buf + clone_to, out_buf + clone_from, clone_len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:2192:13:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
            memcpy(new_buf + clone_to + clone_len, out_buf + clone_to,
data/aflplusplus-2.68c/src/afl-fuzz-one.c:2263:17:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                memcpy(out_buf + insert_at, afl->a_extras[use_extra].data,
data/aflplusplus-2.68c/src/afl-fuzz-one.c:2277:17:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                memcpy(out_buf + insert_at, afl->extras[use_extra].data,
data/aflplusplus-2.68c/src/afl-fuzz-one.c:2318:15:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
              memcpy(out_buf + insert_at, ptr, extra_len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:2358:18:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
            fd = open(target->fname, O_RDONLY);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:2413:15:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
              memcpy(temp_buf, out_buf, clone_to);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:2417:15:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
              memcpy(temp_buf + clone_to, new_buf + clone_from, clone_len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:2420:15:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
              memcpy(temp_buf + clone_to + clone_len, out_buf + clone_to,
data/aflplusplus-2.68c/src/afl-fuzz-one.c:2447:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(out_buf, in_buf, len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:2536:10:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    fd = open(target->fname, O_RDONLY);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:2562:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(new_buf, in_buf, split_at);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:2568:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(out_buf, in_buf, len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:2688:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fd = open(afl->queue_cur->fname, O_RDONLY);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:2776:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(out_buf, in_buf, len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:3762:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(out_buf + i, afl->extras[j].data, last_len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:3771:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(out_buf + i, in_buf + i, last_len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:3806:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(ex_tmp + i, afl->extras[j].data, afl->extras[j].len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:3809:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(ex_tmp + i + afl->extras[j].len, out_buf + i, len - i);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:3865:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(out_buf + i, afl->a_extras[j].data, last_len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:3874:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(out_buf + i, in_buf + i, last_len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:4234:17:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                memcpy(new_buf, out_buf, clone_to);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:4240:19:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                  memcpy(new_buf + clone_to, out_buf + clone_from, clone_len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:4253:17:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                memcpy(new_buf + clone_to + clone_len, out_buf + clone_to,
data/aflplusplus-2.68c/src/afl-fuzz-one.c:4320:17:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                memcpy(out_buf + insert_at, afl->a_extras[use_extra].data,
data/aflplusplus-2.68c/src/afl-fuzz-one.c:4333:17:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                memcpy(out_buf + insert_at, afl->extras[use_extra].data,
data/aflplusplus-2.68c/src/afl-fuzz-one.c:4381:15:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
              memcpy(out_buf + insert_at, ptr, extra_len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:4410:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(out_buf, in_buf, len);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:4549:14:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
        fd = open(target->fname, O_RDONLY);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:4580:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(new_buf, in_buf, split_at);
data/aflplusplus-2.68c/src/afl-fuzz-one.c:4585:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(out_buf, in_buf, len);
data/aflplusplus-2.68c/src/afl-fuzz-python.c:101:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(*out_buf, PyByteArray_AsString(py_value), mutated_size);
data/aflplusplus-2.68c/src/afl-fuzz-python.c:427:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(py->post_process_buf, PyByteArray_AsString(py_value),
data/aflplusplus-2.68c/src/afl-fuzz-python.c:573:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(*out_buf, PyByteArray_AsString(py_value), ret);
data/aflplusplus-2.68c/src/afl-fuzz-python.c:642:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(*out_buf, PyByteArray_AsString(py_value), mutated_size);
data/aflplusplus-2.68c/src/afl-fuzz-queue.c:41:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-queue.c:64:14:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    s32 fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-queue.c:92:10:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-queue.c:114:13:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  if ((fd = open(q->fname, O_RDONLY)) < 0) return 0;
data/aflplusplus-2.68c/src/afl-fuzz-redqueen.c:138:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(backup, buf + rng->start, s);
data/aflplusplus-2.68c/src/afl-fuzz-redqueen.c:159:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(buf + rng->start, backup, s);
data/aflplusplus-2.68c/src/afl-fuzz-redqueen.c:202:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
      fd = open(afl->queue_cur->fname, O_WRONLY | O_CREAT | O_TRUNC, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-redqueen.c:207:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
      fd = open(afl->queue_cur->fname, O_WRONLY | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-redqueen.c:270:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char        buf[64];
data/aflplusplus-2.68c/src/afl-fuzz-redqueen.c:279:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(buf, beg, sz);
data/aflplusplus-2.68c/src/afl-fuzz-redqueen.c:293:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char               buf[64];
data/aflplusplus-2.68c/src/afl-fuzz-redqueen.c:303:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(buf, beg, sz);
data/aflplusplus-2.68c/src/afl-fuzz-redqueen.c:359:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(new_buf, buf, idx);
data/aflplusplus-2.68c/src/afl-fuzz-redqueen.c:362:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(new_buf + idx + num_len, buf_8 + old_len, len - idx - old_len);
data/aflplusplus-2.68c/src/afl-fuzz-redqueen.c:373:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(new_buf, buf, idx);
data/aflplusplus-2.68c/src/afl-fuzz-redqueen.c:376:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(new_buf + idx + num_len, buf_8 + old_len, len - idx - old_len);
data/aflplusplus-2.68c/src/afl-fuzz-redqueen.c:669:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(save, &buf[idx], its_len);
data/aflplusplus-2.68c/src/afl-fuzz-redqueen.c:688:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(&buf[idx], save, i);
data/aflplusplus-2.68c/src/afl-fuzz-redqueen.c:821:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(afl->orig_cmp_map, afl->shm.cmp_map, sizeof(struct cmp_map));
data/aflplusplus-2.68c/src/afl-fuzz-redqueen.c:890:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(orig_buf, buf, len);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:80:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char fn[PATH_MAX];
data/aflplusplus-2.68c/src/afl-fuzz-run.c:84:17:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  if ((doc_fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600)) >= 0) {
data/aflplusplus-2.68c/src/afl-fuzz-run.c:172:26:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
          if (skip_at) { memcpy(mem_trimmed, (u8 *)mem, skip_at); }
data/aflplusplus-2.68c/src/afl-fuzz-run.c:176:13:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
            memcpy(mem_trimmed + skip_at, (u8 *)mem + skip_at + skip_len,
data/aflplusplus-2.68c/src/afl-fuzz-run.c:209:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(afl->fsrv.shmem_fuzz, new_buf, new_size);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:215:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(afl->fsrv.shmem_fuzz, mem, skip_at);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:217:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(afl->fsrv.shmem_fuzz, mem + skip_at + skip_len, tail_len);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:248:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
      fd = open(afl->fsrv.out_file, O_WRONLY | O_CREAT | O_TRUNC, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:253:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
      fd = open(afl->fsrv.out_file, O_WRONLY | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:352:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(afl->first_trace, afl->fsrv.trace_bits, afl->fsrv.map_size);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:408:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(afl->first_trace, afl->fsrv.trace_bits, afl->fsrv.map_size);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:541:13:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    id_fd = open(qd_synced_path, O_RDWR | O_CREAT | O_TRUNC, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:564:13:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    id_fd = open(qd_synced_path, O_RDWR | O_CREAT, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:587:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(entry, "id:%06u", next_min_accept);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:617:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
      fd = open(path, O_RDONLY);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:678:14:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    int fd = open(path, O_CREAT | O_RDWR, 0644);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:788:11:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
          memcpy(afl->clean_trace, afl->fsrv.trace_bits, afl->fsrv.map_size);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:818:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
      fd = open(q->fname, O_WRONLY | O_CREAT | O_TRUNC, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:833:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
      fd = open(q->fname, O_WRONLY | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/src/afl-fuzz-run.c:843:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(afl->fsrv.trace_bits, afl->clean_trace, afl->fsrv.map_size);
data/aflplusplus-2.68c/src/afl-fuzz-state.c:33:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char *power_names[POWER_SCHEDULES_NUM] = {"explore", "exploit", "fast",
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:629:3:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
  sprintf(tmp, "%0.02f%% / %0.02f%%",
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:644:3:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
  sprintf(tmp, "%0.02f bits/tuple", t_bytes ? (((double)t_bits) / t_bytes) : 0);
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:730:5:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
    strcpy(tmp, "n/a, n/a, n/a");
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:824:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(tmp, "%0.02f%%", stab_ratio);
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:828:5:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
    strcpy(tmp, "n/a");
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:871:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(tmp, "n/a, ");
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:886:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(tmp2, "n/a");
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:893:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(tmp2, "%0.02f%%",
data/aflplusplus-2.68c/src/afl-fuzz.c:44:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char *list[4] = {SHM_ENV_VAR, SHM_FUZZ_ENV_VAR, CMPLOG_SHM_ENV_VAR, NULL};
data/aflplusplus-2.68c/src/afl-fuzz.c:51:27:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
  if (ptr && *ptr && (i = atoi(ptr)) > 0) kill(i, SIGKILL);
data/aflplusplus-2.68c/src/afl-fuzz.c:54:27:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
  if (ptr && *ptr && (i = atoi(ptr)) > 0) kill(i, SIGKILL);
data/aflplusplus-2.68c/src/afl-fuzz.c:68:14:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
      shmctl(atoi(ptr), IPC_RMID, NULL);
data/aflplusplus-2.68c/src/afl-fuzz.c:956:22:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    s32 hang_tmout = atoi(afl->afl_env.afl_hang_tmout);
data/aflplusplus-2.68c/src/afl-fuzz.c:964:26:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    s32 max_det_extras = atoi(afl->afl_env.afl_max_det_extras);
data/aflplusplus-2.68c/src/afl-fuzz.c:976:28:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    afl->fsrv.init_tmout = atoi(afl->afl_env.afl_forksrv_init_tmout);
data/aflplusplus-2.68c/src/afl-fuzz.c:1149:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char tmpfile[PATH_MAX];
data/aflplusplus-2.68c/src/afl-fuzz.c:1149:10:  [2] (tmpfile) tmpfile:
  Function tmpfile() has a security flaw on some systems (e.g., older System
  V systems) (CWE-377).
    char tmpfile[PATH_MAX];
data/aflplusplus-2.68c/src/afl-fuzz.c:1153:16:  [2] (tmpfile) tmpfile:
  Function tmpfile() has a security flaw on some systems (e.g., older System
  V systems) (CWE-377).
      snprintf(tmpfile, PATH_MAX, "%s/.cur_input.%s", afl->tmp_dir,
data/aflplusplus-2.68c/src/afl-fuzz.c:1158:16:  [2] (tmpfile) tmpfile:
  Function tmpfile() has a security flaw on some systems (e.g., older System
  V systems) (CWE-377).
      snprintf(tmpfile, PATH_MAX, "%s/.cur_input", afl->tmp_dir);
data/aflplusplus-2.68c/src/afl-fuzz.c:1163:16:  [2] (tmpfile) tmpfile:
  Function tmpfile() has a security flaw on some systems (e.g., older System
  V systems) (CWE-377).
    if (access(tmpfile, F_OK) != -1) {
data/aflplusplus-2.68c/src/afl-fuzz.c:1168:11:  [2] (tmpfile) tmpfile:
  Function tmpfile() has a security flaw on some systems (e.g., older System
  V systems) (CWE-377).
          tmpfile);
data/aflplusplus-2.68c/src/afl-gcc.c:468:20:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    u32 map_size = atoi(ptr);
data/aflplusplus-2.68c/src/afl-showmap.c:214:10:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    fd = open(outfile, O_WRONLY);
data/aflplusplus-2.68c/src/afl-showmap.c:226:10:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    fd = open(outfile, O_WRONLY | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/src/afl-showmap.c:309:20:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  s32         fd = open(in_file, O_RDONLY);
data/aflplusplus-2.68c/src/afl-showmap.c:353:16:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
      s32 fd = open("/dev/null", O_RDWR);
data/aflplusplus-2.68c/src/afl-showmap.c:759:30:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
          fsrv->exec_tmout = atoi(optarg);
data/aflplusplus-2.68c/src/afl-showmap.c:963:25:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    fsrv->dev_null_fd = open("/dev/null", O_RDWR);
data/aflplusplus-2.68c/src/afl-showmap.c:1018:20:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    fsrv->out_fd = open(stdin_file, O_RDWR | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/src/afl-showmap.c:1043:32:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
      s32 forksrv_init_tmout = atoi(getenv("AFL_FORKSRV_INIT_TMOUT"));
data/aflplusplus-2.68c/src/afl-showmap.c:1115:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(fsrv->trace_bits, coverage_map, map_size);
data/aflplusplus-2.68c/src/afl-tmin.c:207:20:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  s32         fd = open(in_file, O_RDONLY);
data/aflplusplus-2.68c/src/afl-tmin.c:238:9:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  ret = open(path, O_RDWR | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/src/afl-tmin.c:379:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(tmp_buf, in_data, in_len);
data/aflplusplus-2.68c/src/afl-tmin.c:451:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(tmp_buf, in_data, del_pos);
data/aflplusplus-2.68c/src/afl-tmin.c:454:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(tmp_buf + del_pos, in_data + del_pos + del_len, tail_len);
data/aflplusplus-2.68c/src/afl-tmin.c:460:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(in_data, tmp_buf, del_pos + tail_len);
data/aflplusplus-2.68c/src/afl-tmin.c:519:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(tmp_buf, in_data, in_len);
data/aflplusplus-2.68c/src/afl-tmin.c:531:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(in_data, tmp_buf, in_len);
data/aflplusplus-2.68c/src/afl-tmin.c:554:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(tmp_buf, in_data, in_len);
data/aflplusplus-2.68c/src/afl-tmin.c:638:23:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fsrv->dev_null_fd = open("/dev/null", O_RDWR);
data/aflplusplus-2.68c/src/afl-tmin.c:659:18:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fsrv->out_fd = open(out_file, O_RDWR | O_CREAT | O_EXCL, 0600);
data/aflplusplus-2.68c/src/afl-tmin.c:979:28:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
        fsrv->exec_tmout = atoi(optarg);
data/aflplusplus-2.68c/src/afl-tmin.c:1110:30:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    s32 forksrv_init_tmout = atoi(getenv("AFL_FORKSRV_INIT_TMOUT"));
data/aflplusplus-2.68c/test-instr.c:24:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char  buff[8];
data/aflplusplus-2.68c/test-instr.c:36:17:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
      if ((fd = open(argv[2], O_RDONLY)) < 0) {
data/aflplusplus-2.68c/test/test-cmplog.c:9:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char    buf[1024];
data/aflplusplus-2.68c/test/test-compcov.c:12:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char  shortval[4] = "abc";
data/aflplusplus-2.68c/test/test-compcov.c:34:52:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
  else if (strncasecmp(input, "Grapes", argc > 2 ? atoi(argv[2]) : 3) == 0)
data/aflplusplus-2.68c/test/test-compcov.c:39:5:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
    strcpy(buf, "TEST");
data/aflplusplus-2.68c/test/test-custom-mutator.c:14:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char str[100];
data/aflplusplus-2.68c/test/test-multiple-mutators.c:15:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char s[100];
data/aflplusplus-2.68c/test/unittests/unit_hash.c:51:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char bitmap[64] = {0};
data/aflplusplus-2.68c/test/unittests/unit_rand.c:69:31:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    afl.fsrv.dev_urandom_fd = open("/dev/urandom", O_RDONLY);
data/aflplusplus-2.68c/unicorn_mode/samples/c/harness.c:92:14:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    int fd = open(filename, O_RDONLY);
data/aflplusplus-2.68c/unicorn_mode/samples/c/persistent_target.c:27:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      ((char *)data_len)[(uint64_t)data_buf] = data_buf[data_len + 1];
data/aflplusplus-2.68c/unicorn_mode/samples/persistent/harness.c:96:14:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    int fd = open(filename, O_RDONLY);
data/aflplusplus-2.68c/unicorn_mode/samples/persistent/persistent_target.c:27:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      ((char *)data_len)[(uint64_t)data_buf] = data_buf[data_len + 1];
data/aflplusplus-2.68c/custom_mutators/honggfuzz/mangle.c:861:3:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
  strncpy(numbuf, (const char *)&run->dynfile->data[off], len);
data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa-test.c:60:14:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  if (len != read(fd, input, len)) {
data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa.c:4343:15:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
        len = read(immval(a), fp + 1, len < max ? len : max);
data/aflplusplus-2.68c/custom_mutators/radamsa/libradamsa.c:4748:16:  [1] (access) umask:
  Ensure that umask is given most restrictive possible setting (e.g., 066 or
  077) (CWE-732).
      return F(umask(immval(a)));
data/aflplusplus-2.68c/examples/afl_frida/afl-frida.c:266:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        if (n[strlen(n) - 1] == '\n') n[strlen(n) - 1] = 0;
data/aflplusplus-2.68c/examples/afl_frida/afl-frida.c:266:41:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        if (n[strlen(n) - 1] == '\n') n[strlen(n) - 1] = 0;
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-client.c:187:7:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  if (read(FORKSRV_FD, &status, 4) != 4) return 0;
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-client.c:190:12:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  status = read(0, buf, max_len);
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-client.c:275:24:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                       strlen(interface) + 1) < 0)
data/aflplusplus-2.68c/examples/afl_network_proxy/afl-network-server.c:248:33:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      s32 i, afl_preload_size = strlen(afl_preload);
data/aflplusplus-2.68c/examples/afl_proxy/afl-proxy.c:184:7:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  if (read(FORKSRV_FD, &status, 4) != 4) return 0;
data/aflplusplus-2.68c/examples/afl_proxy/afl-proxy.c:187:12:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  status = read(0, buf, max_len);
data/aflplusplus-2.68c/examples/afl_untracer/afl-untracer.c:156:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        if (n[strlen(n) - 1] == '\n') n[strlen(n) - 1] = 0;
data/aflplusplus-2.68c/examples/afl_untracer/afl-untracer.c:156:41:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        if (n[strlen(n) - 1] == '\n') n[strlen(n) - 1] = 0;
data/aflplusplus-2.68c/examples/afl_untracer/afl-untracer.c:243:40:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if (strncmp(liblist[i].name, name, strlen(name)) == 0) return &liblist[i];
data/aflplusplus-2.68c/examples/afl_untracer/afl-untracer.c:423:7:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  if (read(FORKSRV_FD, &status, 4) != 4) do_exit = 1;
data/aflplusplus-2.68c/examples/afl_untracer/afl-untracer.c:429:19:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    if ((status = read(0, buf, max_len)) <= 0) exit(-1);
data/aflplusplus-2.68c/examples/aflpp_driver/aflpp_driver.c:233:22:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    ssize_t length = read(fd, buf, MAX_FILE);
data/aflplusplus-2.68c/examples/aflpp_driver/aflpp_qemu_driver.c:14:14:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  size_t l = read(0, AflInputBuf, kMaxAflInputSize);
data/aflplusplus-2.68c/examples/argv_fuzzing/argv-fuzz-inl.h:66:7:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  if (read(0, in_buf, MAX_CMDLINE_LEN - 2) < 0) {}
data/aflplusplus-2.68c/examples/custom_mutators/post_library_gif.so.c:111:13:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if (len < strlen(HEADER)) return 0;
data/aflplusplus-2.68c/examples/custom_mutators/post_library_gif.so.c:115:31:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if (!memcmp(in_buf, HEADER, strlen(HEADER))) {
data/aflplusplus-2.68c/examples/custom_mutators/post_library_gif.so.c:144:28:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  memcpy(*out_buf, HEADER, strlen(HEADER));
data/aflplusplus-2.68c/examples/persistent_demo/persistent_demo.c:61:11:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    len = read(0, buf, 100);
data/aflplusplus-2.68c/examples/persistent_demo/persistent_demo_new.c:40:38:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  #define __AFL_LOOP(x) ((fuzz_len = read(0, fuzz_buf, sizeof(fuzz_buf))) > 0 ?
data/aflplusplus-2.68c/gcc_plugin/afl-gcc-rt.o.c:170:9:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    if (read(FORKSRV_FD, &was_killed, 4) != 4) exit(1);
data/aflplusplus-2.68c/include/alloc-inl.h:158:10:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  size = strlen((char *)str) + 1;
data/aflplusplus-2.68c/include/alloc-inl.h:397:10:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  size = strlen((char *)str) + 1;
data/aflplusplus-2.68c/include/debug.h:289:16:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    s32 _res = read(fd, buf, _len);                            \
data/aflplusplus-2.68c/libdislocator/libdislocator.so.c:426:7:  [1] (free) memalign:
  On some systems (though not Linux-based systems) an attempt to free()
  results from memalign() may fail. This may, on a few systems, be
  exploitable. Also note that memalign() may not check that the boundary
  parameter is correct (CWE-676). Use posix_memalign instead (defined in
  POSIX's 1003.1d). Don't switch to valloc(); it is marked as obsolete in BSD
  4.3, as legacy in SUSv2, and is no longer defined in SUSv3. In some cases,
  malloc()'s alignment may be sufficient.
void *memalign(size_t align, size_t len) {
data/aflplusplus-2.68c/libtokencap/libtokencap.so.c:355:53:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if (__tokencap_is_ro(str1)) __tokencap_dump(str1, strlen(str1), 1);
data/aflplusplus-2.68c/libtokencap/libtokencap.so.c:356:53:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if (__tokencap_is_ro(str2)) __tokencap_dump(str2, strlen(str2), 1);
data/aflplusplus-2.68c/libtokencap/libtokencap.so.c:405:53:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if (__tokencap_is_ro(str1)) __tokencap_dump(str1, strlen(str1), 1);
data/aflplusplus-2.68c/libtokencap/libtokencap.so.c:406:53:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if (__tokencap_is_ro(str2)) __tokencap_dump(str2, strlen(str2), 1);
data/aflplusplus-2.68c/libtokencap/libtokencap.so.c:510:31:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    __tokencap_dump(haystack, strlen(haystack), 1);
data/aflplusplus-2.68c/libtokencap/libtokencap.so.c:512:57:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if (__tokencap_is_ro(needle)) __tokencap_dump(needle, strlen(needle), 1);
data/aflplusplus-2.68c/libtokencap/libtokencap.so.c:539:31:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    __tokencap_dump(haystack, strlen(haystack), 1);
data/aflplusplus-2.68c/libtokencap/libtokencap.so.c:541:57:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if (__tokencap_is_ro(needle)) __tokencap_dump(needle, strlen(needle), 1);
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:404:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if (cpp_mode && strlen(libdir) && strncmp(libdir, "/usr", 4) &&
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:750:35:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      if (strncasecmp(ptr, "afl", strlen("afl")) == 0 ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:751:39:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
          strncasecmp(ptr, "classic", strlen("classic")) == 0) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:767:40:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      if (strncasecmp(ptr, "pc-guard", strlen("pc-guard")) == 0 ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:768:39:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
          strncasecmp(ptr, "pcguard", strlen("pcguard")) == 0) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:778:35:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      if (strncasecmp(ptr, "cfg", strlen("cfg")) == 0 ||
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:779:39:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
          strncasecmp(ptr, "instrim", strlen("instrim")) == 0) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:795:35:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      if (strncasecmp(ptr, "lto", strlen("lto")) == 0) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:806:35:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      if (strncasecmp(ptr, "ctx", strlen("ctx")) == 0) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:813:37:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      if (strncasecmp(ptr, "ngram", strlen("ngram")) == 0) {
data/aflplusplus-2.68c/llvm_mode/afl-clang-fast.c:815:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        ptr += strlen("ngram");
data/aflplusplus-2.68c/llvm_mode/afl-ld-lto.c:89:42:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        if (strncmp(argv[i], "-plugin=", strlen("-plugin=")) == 0) {
data/aflplusplus-2.68c/llvm_mode/afl-ld-lto.c:281:46:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
    if (getcwd(thecwd, sizeof(thecwd)) != 0) strcpy(thecwd, ".");
data/aflplusplus-2.68c/llvm_mode/afl-ld-lto.c:327:9:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if (strlen(real_ld) > 1) execvp(real_ld, (char **)ld_params);
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:436:9:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    if (read(FORKSRV_FD, &was_killed, 4) != 4) _exit(1);
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:461:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
              strlen("Error: could not send dictionary len\n"));
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:473:17:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                strlen("Error: could not send dictionary\n"));
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:504:11:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
      if (read(FORKSRV_FD, &was_killed, 4) != 4) _exit(1);
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:648:9:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    if (read(FORKSRV_FD, &was_killed, 4) != 4) _exit(1);
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:673:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
              strlen("Error: could not send dictionary len\n"));
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:685:17:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                strlen("Error: could not send dictionary\n"));
data/aflplusplus-2.68c/llvm_mode/afl-llvm-rt.o.c:717:11:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
      if (read(FORKSRV_FD, &was_killed, 4) != 4) _exit(1);
data/aflplusplus-2.68c/qbdi_mode/template.cpp:86:9:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    if (read(FORKSRV_FD, &was_killed, 4) != 4) exit(2);
data/aflplusplus-2.68c/qemu_mode/libcompcov/libcompcov.so.c:172:31:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    write(debug_fd, debugbuf, strlen(debugbuf));
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:363:9:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    if (read(FORKSRV_FD, &was_killed, 4) != 4) exit(2);
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:385:9:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    if (read(FORKSRV_FD, &was_killed, 4) != 4) exit(2);
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:585:9:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    if (read(fd, &t, sizeof(struct afl_tsl)) != sizeof(struct afl_tsl)) break;
data/aflplusplus-2.68c/qemu_mode/patches/afl-qemu-cpu-inl.h:616:11:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
      if (read(fd, &c, sizeof(struct afl_chain)) != sizeof(struct afl_chain))
data/aflplusplus-2.68c/src/afl-analyze.c:817:33:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      s32 i, afl_preload_size = strlen(afl_preload);
data/aflplusplus-2.68c/src/afl-as.c:220:38:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if (strncmp(input_file, tmp_dir, strlen(tmp_dir)) &&
data/aflplusplus-2.68c/src/afl-as.c:595:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    for (j = 0; j < strlen(argv[i]); j++)
data/aflplusplus-2.68c/src/afl-common.c:425:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                    strlen(afl_environment_variables[i])) == 0 &&
data/aflplusplus-2.68c/src/afl-common.c:426:17:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            env[strlen(afl_environment_variables[i])] == '=') {
data/aflplusplus-2.68c/src/afl-common.c:451:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                    strlen(afl_environment_deprecated[i])) == 0 &&
data/aflplusplus-2.68c/src/afl-common.c:452:17:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            env[strlen(afl_environment_deprecated[i])] == '=') {
data/aflplusplus-2.68c/src/afl-common.c:591:3:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120). Risk is low because the source is a
  constant string.
  strncpy(buf, "infty", len);
data/aflplusplus-2.68c/src/afl-common.c:660:3:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120). Risk is low because the source is a
  constant string.
  strncpy(buf, "infty", len - 1);
data/aflplusplus-2.68c/src/afl-forkserver.c:160:16:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    len_read = read(fd, (u8 *)buf, 4);
data/aflplusplus-2.68c/src/afl-forkserver.c:231:9:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    if (read(FORKSRV_FD, &was_killed, 4) != 4) { exit(0); }
data/aflplusplus-2.68c/src/afl-forkserver.c:569:12:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    rlen = read(fsrv->fsrv_st_fd, &status, 4);
data/aflplusplus-2.68c/src/afl-forkserver.c:703:13:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
        if (read(fsrv->fsrv_st_fd, &status, 4) != 4) {
data/aflplusplus-2.68c/src/afl-forkserver.c:726:18:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
          rlen = read(fsrv->fsrv_st_fd, dict + offset, len);
data/aflplusplus-2.68c/src/afl-forkserver.c:1039:14:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  if ((res = read(fsrv->fsrv_st_fd, &fsrv->child_pid, 4)) != 4) {
data/aflplusplus-2.68c/src/afl-forkserver.c:1058:9:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    if (read(fsrv->fsrv_st_fd, &fsrv->child_status, 4) < 4) { exec_ms = 0; }
data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c:442:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      sprintf(ret + strlen(ret), "+%06d", afl->splicing_with);
data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c:446:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    sprintf(ret + strlen(ret), ",time:%llu", get_cur_time() - afl->start_time);
data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c:448:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    sprintf(ret + strlen(ret), ",op:%s", afl->stage_short);
data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c:452:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      sprintf(ret + strlen(ret), ",pos:%d", afl->stage_cur_byte);
data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c:456:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        sprintf(ret + strlen(ret), ",val:%s%+d",
data/aflplusplus-2.68c/src/afl-fuzz-bitmap.c:464:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      sprintf(ret + strlen(ret), ",rep:%d", afl->stage_cur_val);
data/aflplusplus-2.68c/src/afl-fuzz-extras.c:84:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    rptr = lptr + strlen(lptr) - 1;
data/aflplusplus-2.68c/src/afl-fuzz-extras.c:591:11:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    len = read(fd, tmp, MAX_AUTO_EXTRA + 1);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:163:9:  [1] (obsolete) usleep:
  This C routine is considered obsolete (as opposed to the shell command by
  the same name). The interaction of this function with SIGALRM and other
  timer functions such as sleep(), alarm(), setitimer(), and nanosleep() is
  unspecified (CWE-676). Use nanosleep(2) or setitimer(2) instead.
        usleep(1000);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:765:9:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    if (read(fd, use_mem, q->len) != (ssize_t)q->len) {
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1010:15:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  while ((i = read(sfd, tmp, 64 * 1024)) > 0) {
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1159:7:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  i = read(fd, tmp, sizeof(tmp) - 1);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1201:7:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  i = read(fd, tmp, sizeof(tmp) - 1);
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1231:53:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        (!prefix || !strncmp(d_ent->d_name, prefix, strlen(prefix)))) {
data/aflplusplus-2.68c/src/afl-fuzz-init.c:1913:7:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  if (read(fd, &fchar, 1) == 1 && fchar == '|') {
data/aflplusplus-2.68c/src/afl-fuzz-init.c:2193:7:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if (strlen(afl->sync_id) > 32) { FATAL("Fuzzer ID too long"); }
data/aflplusplus-2.68c/src/afl-fuzz-init.c:2450:43:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      !memmem(f_data, f_len, SHM_ENV_VAR, strlen(SHM_ENV_VAR) + 1)) {
data/aflplusplus-2.68c/src/afl-fuzz-init.c:2477:42:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      memmem(f_data, f_len, SHM_ENV_VAR, strlen(SHM_ENV_VAR) + 1)) {
data/aflplusplus-2.68c/src/afl-fuzz-init.c:2499:42:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if (memmem(f_data, f_len, PERSIST_SIG, strlen(PERSIST_SIG) + 1)) {
data/aflplusplus-2.68c/src/afl-fuzz-init.c:2513:40:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if (memmem(f_data, f_len, DEFER_SIG, strlen(DEFER_SIG) + 1)) {
data/aflplusplus-2.68c/src/afl-fuzz-init.c:2556:7:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if (strlen(afl->use_banner) > 32) {
data/aflplusplus-2.68c/src/afl-fuzz-init.c:2644:12:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    len += strlen(argv[i]) + 1;
data/aflplusplus-2.68c/src/afl-fuzz-init.c:2652:13:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    u32 l = strlen(argv[i]);
data/aflplusplus-2.68c/src/afl-fuzz-queue.c:115:15:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  if ((comp = read(fd, buf, len)) != len) return 0;
data/aflplusplus-2.68c/src/afl-fuzz-run.c:568:9:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    if (read(id_fd, &min_accept, sizeof(u32)) == sizeof(u32)) {
data/aflplusplus-2.68c/src/afl-fuzz-state.c:184:13:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            strlen(afl_environment_variables[i]);
data/aflplusplus-2.68c/src/afl-fuzz-state.c:380:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                    strlen(afl_environment_variables[i])) == 0 &&
data/aflplusplus-2.68c/src/afl-fuzz-state.c:381:17:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            env[strlen(afl_environment_variables[i])] == '=') {
data/aflplusplus-2.68c/src/afl-fuzz-state.c:397:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                    strlen(afl_environment_deprecated[i])) == 0 &&
data/aflplusplus-2.68c/src/afl-fuzz-state.c:398:17:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            env[strlen(afl_environment_deprecated[i])] == '=') {
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:64:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      for (j = 0; j < strlen(argv[i]); j++)
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:486:46:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  banner_len = (afl->crash_mode ? 24 : 22) + strlen(VERSION) +
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:487:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
               strlen(afl->use_banner) + strlen(afl->power_name) + 3 + 5;
data/aflplusplus-2.68c/src/afl-fuzz-stats.c:487:42:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
               strlen(afl->use_banner) + strlen(afl->power_name) + 3 + 5;
data/aflplusplus-2.68c/src/afl-fuzz.c:1013:33:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      s32 i, afl_preload_size = strlen(afl_preload);
data/aflplusplus-2.68c/src/afl-showmap.c:523:33:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      s32 i, afl_preload_size = strlen(afl_preload);
data/aflplusplus-2.68c/src/afl-tmin.c:746:33:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      s32 i, afl_preload_size = strlen(afl_preload);
data/aflplusplus-2.68c/test-instr.c:43:9:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    if (read(fd, buf, sizeof(buf)) < 1) {
data/aflplusplus-2.68c/test/test-cmplog.c:11:12:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  if ((i = read(0, buf, sizeof(buf) - 1)) < 24) return 0;
data/aflplusplus-2.68c/test/test-compcov.c:16:19:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    ssize_t ret = read(0, buffer, sizeof(buffer) - 1);
data/aflplusplus-2.68c/test/test-custom-mutator.c:15:3:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  read(0, str, 100);
data/aflplusplus-2.68c/test/test-multiple-mutators.c:16:3:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  read(0, s, 100);
data/aflplusplus-2.68c/unicorn_mode/samples/c/persistent_target.c:21:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  uint64_t data_len = strlen(data_buf);
data/aflplusplus-2.68c/unicorn_mode/samples/persistent/persistent_target.c:21:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  uint64_t data_len = strlen(data_buf);

ANALYSIS SUMMARY:

Hits = 1060
Lines analyzed = 121048 in approximately 3.00 seconds (40369 lines/second)
Physical Source Lines of Code (SLOC) = 81904
Hits@level = [0] 373 [1] 126 [2] 410 [3] 388 [4] 135 [5]   1
Hits@level+ = [0+] 1433 [1+] 1060 [2+] 934 [3+] 524 [4+] 136 [5+]   1
Hits/KSLOC@level+ = [0+] 17.4961 [1+] 12.942 [2+] 11.4036 [3+] 6.39773 [4+] 1.66048 [5+] 0.0122094
Symlinks skipped = 5 (--allowlink overrides but see doc for security issue)
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.