Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/ampr-ripd-2.4/ampr-ripd.c FINAL RESULTS: data/ampr-ripd-2.4/ampr-ripd.c:430:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(ifr.ifr_name, dev); data/ampr-ripd-2.4/ampr-ripd.c:442:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(ifr.ifr_name, dev); data/ampr-ripd-2.4/ampr-ripd.c:557:16: [4] (buffer) sscanf: The scanf() family's %s operation, without a limit specification, permits buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a different input function. if (2 == sscanf(buffer, "%d %s", &nrtable, (char *)&sbuffer)) data/ampr-ripd-2.4/ampr-ripd.c:657:5: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(encb, "%s/%d", ipv4_ntoa_encap(ntohl(ip)), mask); data/ampr-ripd-2.4/ampr-ripd.c:658:5: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(nb, "%s/%d", ipv4_ntoa(ip), mask); data/ampr-ripd-2.4/ampr-ripd.c:843:10: [4] (shell) system: This causes a new program to execute and is difficult to use safely (CWE-78). try using a library call that implements the same functionality if available. i = system(syscmd); data/ampr-ripd-2.4/ampr-ripd.c:1312:10: [4] (shell) system: This causes a new program to execute and is difficult to use safely (CWE-78). try using a library call that implements the same functionality if available. i = system(syscmd); data/ampr-ripd-2.4/ampr-ripd.c:1889:14: [3] (buffer) getopt: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. while ((p = getopt(argc, argv, "dvsrh?i:a:p:t:m:w:f:e:F:E:x:g:L:")) != -1) data/ampr-ripd-2.4/ampr-ripd.c:293:12: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static char buf[INET_ADDRSTRLEN]; data/ampr-ripd-2.4/ampr-ripd.c:294:5: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(buf, "%d.%d.%d.%d", (ip & 0xff000000) >> 24, (ip & 0x00ff0000) >> 16, (ip & 0x0000ff00) >> 8, ip & 0x000000ff); data/ampr-ripd-2.4/ampr-ripd.c:327:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[255]; data/ampr-ripd-2.4/ampr-ripd.c:459:12: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static char buf[INET_ADDRSTRLEN]; data/ampr-ripd-2.4/ampr-ripd.c:461:5: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(buf, "%d.%d", (lip & 0xff000000) >> 24, (lip & 0x00ff0000) >> 16); data/ampr-ripd-2.4/ampr-ripd.c:465:2: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(p, ".%d", (lip & 0x0000ff00) >> 8); data/ampr-ripd-2.4/ampr-ripd.c:469:6: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(p, ".%d", lip & 0x000000ff); data/ampr-ripd-2.4/ampr-ripd.c:486:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buffer[255]; data/ampr-ripd-2.4/ampr-ripd.c:487:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char sbuffer[255]; data/ampr-ripd-2.4/ampr-ripd.c:544:12: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). rtf = fopen(RTAB_FILE, "r"); data/ampr-ripd-2.4/ampr-ripd.c:653:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[255]; data/ampr-ripd-2.4/ampr-ripd.c:654:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char encb[INET_ADDRSTRLEN + 3]; data/ampr-ripd-2.4/ampr-ripd.c:655:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char nb[INET_ADDRSTRLEN + 3]; data/ampr-ripd-2.4/ampr-ripd.c:809:12: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). efd = fopen(RTFILE, "w+"); data/ampr-ripd-2.4/ampr-ripd.c:858:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buffer[255]; data/ampr-ripd-2.4/ampr-ripd.c:865:8: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). efd = fopen(RTFILE, "r"); data/ampr-ripd-2.4/ampr-ripd.c:945:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(RTA_DATA(rta), data, len); data/ampr-ripd-2.4/ampr-ripd.c:965:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(RTA_DATA(subrta), data, alen); data/ampr-ripd-2.4/ampr-ripd.c:1048:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char nlrxbuf[4096]; data/ampr-ripd-2.4/ampr-ripd.c:1049:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char mxbuf[256]; data/ampr-ripd-2.4/ampr-ripd.c:1054:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[1024]; data/ampr-ripd-2.4/ampr-ripd.c:1703:23: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). sin.sin_port = htons(atoi(homeport)); data/ampr-ripd-2.4/ampr-ripd.c:1884:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char databuf[BUFFERSIZE]; data/ampr-ripd-2.4/ampr-ripd.c:2157:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&group.gr_group, &sin, sizeof(sin)); data/ampr-ripd-2.4/ampr-ripd.c:341:2: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(buf, plist, 254); data/ampr-ripd-2.4/ampr-ripd.c:464:11: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). p = &buf[strlen(buf)]; data/ampr-ripd-2.4/ampr-ripd.c:468:15: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). p = &buf[strlen(buf)]; data/ampr-ripd-2.4/ampr-ripd.c:522:14: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). for (i=0; i<strlen(arg); i++) data/ampr-ripd-2.4/ampr-ripd.c:528:9: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (i==strlen(arg)) /* we are all digits */ data/ampr-ripd-2.4/ampr-ripd.c:667:2: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(buf, plist, 254); data/ampr-ripd-2.4/ampr-ripd.c:878:14: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). p = &p[strlen("addprivate ")]; data/ampr-ripd-2.4/ampr-ripd.c:891:14: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). p = &p[strlen("encap ")]; data/ampr-ripd-2.4/ampr-ripd.c:1582:58: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (setsockopt(fwsd, SOL_SOCKET, SO_BINDTODEVICE, fwif, strlen(fwif)) < 0) data/ampr-ripd-2.4/ampr-ripd.c:1647:66: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (setsockopt(amprfwsd, SOL_SOCKET, SO_BINDTODEVICE, amprfwif, strlen(amprfwif)) < 0) data/ampr-ripd-2.4/ampr-ripd.c:1707:25: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). sendto(hsd, homedata, strlen(homedata), 0, (struct sockaddr *)&sin, sizeof(sin)); data/ampr-ripd-2.4/ampr-ripd.c:1711:25: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). sendto(hsd, shutdown, strlen(shutdown), 0, (struct sockaddr *)&sin, sizeof(sin)); data/ampr-ripd-2.4/ampr-ripd.c:2119:61: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (setsockopt(tunsd, SOL_SOCKET, SO_BINDTODEVICE, tunif, strlen(tunif)) < 0) data/ampr-ripd-2.4/ampr-ripd.c:2223:14: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). if ((len = read(tunsd, databuf, BUFFERSIZE)) < 0) ANALYSIS SUMMARY: Hits = 46 Lines analyzed = 2277 in approximately 0.06 seconds (36308 lines/second) Physical Source Lines of Code (SLOC) = 1789 Hits@level = [0] 127 [1] 14 [2] 24 [3] 1 [4] 7 [5] 0 Hits@level+ = [0+] 173 [1+] 46 [2+] 32 [3+] 8 [4+] 7 [5+] 0 Hits/KSLOC@level+ = [0+] 96.7021 [1+] 25.7127 [2+] 17.8871 [3+] 4.47177 [4+] 3.9128 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.