Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/basemap-1.2.2+dfsg/nad2bin.c
Examining data/basemap-1.2.2+dfsg/src/_geoslib.c
FINAL RESULTS:
data/basemap-1.2.2+dfsg/src/_geoslib.c:735:5: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(__PYX_DEFAULT_STRING_ENCODING, default_encoding_c);
data/basemap-1.2.2+dfsg/nad2bin.c:153:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!(fp = fopen(output_file, "wb"))) {
data/basemap-1.2.2+dfsg/nad2bin.c:172:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char header[160];
data/basemap-1.2.2+dfsg/nad2bin.c:174:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!(fp = fopen(output_file, "wb"))) {
data/basemap-1.2.2+dfsg/nad2bin.c:184:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( header + 0, "CTABLE V2.0 ", 16 );
data/basemap-1.2.2+dfsg/nad2bin.c:185:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( header + 16, ct.id, 80 );
data/basemap-1.2.2+dfsg/nad2bin.c:186:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( header + 96, &ct.ll.lam, 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:187:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( header + 104, &ct.ll.phi, 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:188:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( header + 112, &ct.del.lam, 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:189:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( header + 120, &ct.del.phi, 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:190:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( header + 128, &ct.lim.lam, 4 );
data/basemap-1.2.2+dfsg/nad2bin.c:191:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( header + 132, &ct.lim.phi, 4 );
data/basemap-1.2.2+dfsg/nad2bin.c:220:20: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!(fp = fopen(output_file, "wb")))
data/basemap-1.2.2+dfsg/nad2bin.c:230:13: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char achHeader[11*16];
data/basemap-1.2.2+dfsg/nad2bin.c:234:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 0*16, "NUM_OREC", 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:237:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 1*16, "NUM_SREC", 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:240:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 2*16, "NUM_FILE", 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:243:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 3*16, "GS_TYPE ", 16 );
data/basemap-1.2.2+dfsg/nad2bin.c:244:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 3*16+8, GS_TYPE, MIN(16,strlen(GS_TYPE)) );
data/basemap-1.2.2+dfsg/nad2bin.c:246:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 4*16, "VERSION ", 16 );
data/basemap-1.2.2+dfsg/nad2bin.c:247:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 4*16+8, VERSION, MIN(16,strlen(VERSION)) );
data/basemap-1.2.2+dfsg/nad2bin.c:249:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 5*16, "SYSTEM_F ", 16 );
data/basemap-1.2.2+dfsg/nad2bin.c:250:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 5*16+8, SYSTEM_F, MIN(16,strlen(SYSTEM_F)) );
data/basemap-1.2.2+dfsg/nad2bin.c:252:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 6*16, "SYSTEM_T ", 16 );
data/basemap-1.2.2+dfsg/nad2bin.c:253:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 6*16+8, SYSTEM_T, MIN(16,strlen(SYSTEM_T)) );
data/basemap-1.2.2+dfsg/nad2bin.c:255:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 7*16, "MAJOR_F ", 8);
data/basemap-1.2.2+dfsg/nad2bin.c:256:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 8*16, "MINOR_F ", 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:257:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 9*16, "MAJOR_T ", 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:258:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 10*16, "MINOR_T ", 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:267:22: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char achHeader[11*16];
data/basemap-1.2.2+dfsg/nad2bin.c:279:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 0*16, "SUB_NAME ", 16 );
data/basemap-1.2.2+dfsg/nad2bin.c:280:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 0*16+8, SUB_NAME, MIN(16,strlen(SUB_NAME)) );
data/basemap-1.2.2+dfsg/nad2bin.c:282:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 1*16, "PARENT ", 16 );
data/basemap-1.2.2+dfsg/nad2bin.c:283:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 1*16+8, "NONE", MIN(16,strlen("NONE")) );
data/basemap-1.2.2+dfsg/nad2bin.c:285:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 2*16, "CREATED ", 16 );
data/basemap-1.2.2+dfsg/nad2bin.c:286:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 2*16+8, CREATED, MIN(16,strlen(CREATED)) );
data/basemap-1.2.2+dfsg/nad2bin.c:288:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 3*16, "UPDATED ", 16 );
data/basemap-1.2.2+dfsg/nad2bin.c:289:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 3*16+8, UPDATED, MIN(16,strlen(UPDATED)) );
data/basemap-1.2.2+dfsg/nad2bin.c:291:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 4*16, "S_LAT ", 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:293:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 4*16 + 8, &dfValue, 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:295:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 5*16, "N_LAT ", 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:297:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 5*16 + 8, &dfValue, 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:299:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 6*16, "E_LONG ", 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:301:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 6*16 + 8, &dfValue, 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:303:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 7*16, "W_LONG ", 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:305:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 7*16 + 8, &dfValue, 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:307:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 8*16, "LAT_INC ", 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:309:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 8*16 + 8, &dfValue, 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:311:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 9*16, "LONG_INC", 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:313:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 9*16 + 8, &dfValue, 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:315:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 10*16, "GS_COUNT", 8 );
data/basemap-1.2.2+dfsg/nad2bin.c:316:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( achHeader + 10*16+8, &nGSCount, 4 );
data/basemap-1.2.2+dfsg/src/_geoslib.c:688:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ascii_chars[128];
data/basemap-1.2.2+dfsg/src/_geoslib.c:8065:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ctversion[4], rtversion[4];
data/basemap-1.2.2+dfsg/src/_geoslib.c:8069:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char message[200];
data/basemap-1.2.2+dfsg/src/_geoslib.c:8106:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char warning[200];
data/basemap-1.2.2+dfsg/nad2bin.c:244:58: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memcpy( achHeader + 3*16+8, GS_TYPE, MIN(16,strlen(GS_TYPE)) );
data/basemap-1.2.2+dfsg/nad2bin.c:247:58: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memcpy( achHeader + 4*16+8, VERSION, MIN(16,strlen(VERSION)) );
data/basemap-1.2.2+dfsg/nad2bin.c:250:59: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memcpy( achHeader + 5*16+8, SYSTEM_F, MIN(16,strlen(SYSTEM_F)) );
data/basemap-1.2.2+dfsg/nad2bin.c:253:59: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memcpy( achHeader + 6*16+8, SYSTEM_T, MIN(16,strlen(SYSTEM_T)) );
data/basemap-1.2.2+dfsg/nad2bin.c:280:59: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memcpy( achHeader + 0*16+8, SUB_NAME, MIN(16,strlen(SUB_NAME)) );
data/basemap-1.2.2+dfsg/nad2bin.c:283:57: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memcpy( achHeader + 1*16+8, "NONE", MIN(16,strlen("NONE")) );
data/basemap-1.2.2+dfsg/nad2bin.c:286:58: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memcpy( achHeader + 2*16+8, CREATED, MIN(16,strlen(CREATED)) );
data/basemap-1.2.2+dfsg/nad2bin.c:289:58: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memcpy( achHeader + 3*16+8, UPDATED, MIN(16,strlen(UPDATED)) );
data/basemap-1.2.2+dfsg/src/_geoslib.c:613:87: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
#define __Pyx_PyByteArray_FromString(s) PyByteArray_FromStringAndSize((const char*)s, strlen((const char*)s))
data/basemap-1.2.2+dfsg/src/_geoslib.c:733:52: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
__PYX_DEFAULT_STRING_ENCODING = (char*) malloc(strlen(default_encoding_c));
data/basemap-1.2.2+dfsg/src/_geoslib.c:8196:65: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return __Pyx_PyUnicode_FromStringAndSize(c_str, (Py_ssize_t)strlen(c_str));
ANALYSIS SUMMARY:
Hits = 67
Lines analyzed = 8787 in approximately 0.29 seconds (30442 lines/second)
Physical Source Lines of Code (SLOC) = 6102
Hits@level = [0] 9 [1] 11 [2] 55 [3] 0 [4] 1 [5] 0
Hits@level+ = [0+] 76 [1+] 67 [2+] 56 [3+] 1 [4+] 1 [5+] 0
Hits/KSLOC@level+ = [0+] 12.4549 [1+] 10.98 [2+] 9.17732 [3+] 0.163881 [4+] 0.163881 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.