Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/bootpc-0.64/bootp.h Examining data/bootpc-0.64/bootpc.h Examining data/bootpc-0.64/bptypes.h Examining data/bootpc-0.64/bootpc.c Examining data/bootpc-0.64/log.h Examining data/bootpc-0.64/main.c FINAL RESULTS: data/bootpc-0.64/bootpc.c:615:5: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(lbuf, "%s_%d", name, i) ; data/bootpc-0.64/bootpc.c:758:5: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(envb, "BOOTP_%s=%s", name, lenv) ; data/bootpc-0.64/main.c:166:5: [4] (format) vfprintf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. vfprintf(logfile, s, args); data/bootpc-0.64/bootpc.c:153:3: [3] (random) srand: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. srand(rancopy) ; data/bootpc-0.64/main.c:63:14: [3] (buffer) getopt_long: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. option = getopt_long (argc, argv, "", long_options, &option_index); data/bootpc-0.64/bootp.h:54:14: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char bp_chaddr[BP_CHADDR_LEN]; /* client hardware address */ data/bootpc-0.64/bootp.h:55:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char bp_sname[BP_SNAME_LEN]; /* server host name */ data/bootpc-0.64/bootp.h:56:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char bp_file[BP_FILE_LEN]; /* boot file name */ data/bootpc-0.64/bootp.h:57:14: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char bp_vend[BP_VEND_LEN]; /* vendor-specific area */ data/bootpc-0.64/bootp.h:239:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char v_magic[4]; /* magic number */ data/bootpc-0.64/bootpc.c:120:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(ifr.ifr_name, device, strlen(device)+1); data/bootpc-0.64/bootpc.c:175:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(bootp_xmit->bp_chaddr+IFHWADDRLEN-1, (char *)(ifr.use_hwaddr), 1) ; data/bootpc-0.64/bootpc.c:184:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(bootp_xmit->bp_chaddr, data/bootpc-0.64/bootpc.c:193:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(bootp_xmit->bp_vend, mincookie, sizeof(mincookie)); data/bootpc-0.64/bootpc.c:196:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(bootp_xmit->bp_file, bootfile, strlen(bootfile)+1); data/bootpc-0.64/bootpc.c:399:7: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy((char *)&temp, cookie + i + 2, 4) ; data/bootpc-0.64/bootpc.c:540:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. { char name[30] ; data/bootpc-0.64/bootpc.c:547:2: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(name, "T%3.3d", tag) ; data/bootpc-0.64/bootpc.c:596:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char lenv[BUFSIZ], *ptr ; data/bootpc-0.64/bootpc.c:611:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char lbuf[BUFSIZ] ; data/bootpc-0.64/bootpc.c:612:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy((char *)&temp, cookie, 4) ; data/bootpc-0.64/bootpc.c:632:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char lenv[BUFSIZ]; data/bootpc-0.64/bootpc.c:649:12: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char buf[258] ; /* Max len is 255 */ data/bootpc-0.64/bootpc.c:650:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char lenv[BUFSIZ] ; data/bootpc-0.64/bootpc.c:757:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char envb[BUFSIZ], *envp ; data/bootpc-0.64/main.c:120:22: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). timeout_wait = atoi(optarg) ; data/bootpc-0.64/main.c:123:21: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). waitformore = atoi(optarg) ; data/bootpc-0.64/bootpc.c:120:34: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). memcpy(ifr.ifr_name, device, strlen(device)+1); data/bootpc-0.64/bootpc.c:196:41: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). memcpy(bootp_xmit->bp_file, bootfile, strlen(bootfile)+1); data/bootpc-0.64/bootpc.c:341:37: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). logMessage("bp_file len is %d", strlen(bootp_recv->bp_file)) ; data/bootpc-0.64/bootpc.c:614:9: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). c = strlen(ptr) ; data/bootpc-0.64/bootpc.c:617:5: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(lenv+n, ptr, c) ; data/bootpc-0.64/bootpc.c:634:11: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). len = strlen((char *)cookie) ; data/bootpc-0.64/bootpc.c:653:3: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy((char *)buf, (char *)(cookie), len) ; data/bootpc-0.64/bootpc.c:716:55: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). OutSearch("HOSTSEARCH", (unsigned char *)(c+1), strlen(c+1)) ; data/bootpc-0.64/main.c:71:11: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(bootfile) > 127) { /* buffer space for 128 only */ data/bootpc-0.64/main.c:79:11: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(device) > IFNAMSIZ-1) { /* only IFNAMSIZ space in struct */ ANALYSIS SUMMARY: Hits = 37 Lines analyzed = 1315 in approximately 0.05 seconds (26345 lines/second) Physical Source Lines of Code (SLOC) = 836 Hits@level = [0] 6 [1] 10 [2] 22 [3] 2 [4] 3 [5] 0 Hits@level+ = [0+] 43 [1+] 37 [2+] 27 [3+] 5 [4+] 3 [5+] 0 Hits/KSLOC@level+ = [0+] 51.4354 [1+] 44.2584 [2+] 32.2967 [3+] 5.98086 [4+] 3.58852 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.