Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/bplay-0.991/shmbuf.c Examining data/bplay-0.991/bplay.c Examining data/bplay-0.991/fmtheaders.h Examining data/bplay-0.991/sndfunc.c FINAL RESULTS: data/bplay-0.991/bplay.c:145:17: [3] (buffer) getopt: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. while ((optc = getopt(argc, argv, "Ss:b:t:T:j:J:rvwd:B:D:q")) != -1) data/bplay-0.991/bplay.c:87:25: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. void playraw(int thefd, char hd_buf[20], int speed, int bits, int stereo, data/bplay-0.991/bplay.c:89:25: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. void playwav(int thefd, char hd_buf[20], int mods, int speed, int bits, data/bplay-0.991/bplay.c:91:25: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. void playvoc(int thefd, char hd_buf[20]); data/bplay-0.991/bplay.c:103:55: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. extern void diskread(int outfd, long long int bcount, char hd_buf[20], int terminate, data/bplay-0.991/bplay.c:150:12: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). speed = atoi(optarg); data/bplay-0.991/bplay.c:156:11: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). bits = atoi(optarg); data/bplay-0.991/bplay.c:166:14: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). timelim = atoi(optarg); data/bplay-0.991/bplay.c:169:14: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). samplim = atoi(optarg); data/bplay-0.991/bplay.c:172:14: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). timejmp = atoi(optarg); data/bplay-0.991/bplay.c:175:14: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). sampjmp = atoi(optarg); data/bplay-0.991/bplay.c:193:18: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). bigbuffsize = atoi(optarg); data/bplay-0.991/bplay.c:196:19: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). debug = atoi(optarg); data/bplay-0.991/bplay.c:237:16: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if ((thefd = open(argv[optind], O_CREAT | O_TRUNC | O_WRONLY | O_LARGEFILE, data/bplay-0.991/bplay.c:242:16: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if ((thefd = open(argv[optind], O_RDONLY | O_LARGEFILE)) == -1) data/bplay-0.991/bplay.c:294:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&(header.main_chunk), riff, 4); data/bplay-0.991/bplay.c:302:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&(header.chunk_type), wave, 4); data/bplay-0.991/bplay.c:304:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&(header.sub_chunk), fmt, 4); data/bplay-0.991/bplay.c:315:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&(header.data_chunk), data, 4); data/bplay-0.991/bplay.c:379:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char hd_buf[20]; /* Holds first 20 bytes */ data/bplay-0.991/bplay.c:467:25: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. void playraw(int thefd, char hd_buf[20], int speed, int bits, int stereo, int jump, int secs) data/bplay-0.991/bplay.c:480:25: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. void playwav(int thefd, char hd_buf[20], int mods, int speed, int bits, int stereo, int jump, int secs) data/bplay-0.991/bplay.c:485:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy((void*)&wavhd, (void*)hd_buf, 20); data/bplay-0.991/bplay.c:520:25: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. void playvoc(int thefd, char hd_buf[20]) data/bplay-0.991/bplay.c:532:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy((void*)&vochd, (void*)hd_buf, 20); data/bplay-0.991/bplay.c:661:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char junkbuf[BUFSIZ]; data/bplay-0.991/shmbuf.c:310:50: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. void diskread(int infd, long long int totalplay, char hd_buf[20], data/bplay-0.991/shmbuf.c:358:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tmppt, hd_buf, 20); data/bplay-0.991/sndfunc.c:39:13: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). audio = open(audev, (recorder)? O_RDONLY : O_WRONLY); data/bplay-0.991/bplay.c:235:13: [1] (access) umask: Ensure that umask is given most restrictive possible setting (e.g., 066 or 077) (CWE-732). themask = umask(0); data/bplay-0.991/bplay.c:236:3: [1] (access) umask: Ensure that umask is given most restrictive possible setting (e.g., 066 or 077) (CWE-732). umask(themask); data/bplay-0.991/bplay.c:381:11: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). count = read(thefd, hd_buf, 20); data/bplay-0.991/bplay.c:486:13: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). count = read(thefd, ((char*)&wavhd)+20, sizeof(wavhd) - 20); data/bplay-0.991/bplay.c:533:13: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). count = read(thefd, ((char*)&vochd)+20, sizeof(vochd) - 20); data/bplay-0.991/bplay.c:551:2: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). read(thefd, junk, off); data/bplay-0.991/bplay.c:555:10: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). if ((read(thefd, (char*)&ccblock, sizeof(ccblock))) == -1) data/bplay-0.991/bplay.c:572:2: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). read(thefd, (char*)&tblock, sizeof(tblock)); data/bplay-0.991/bplay.c:588:2: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). read(thefd, (char*)&tblock, sizeof(tblock)); data/bplay-0.991/bplay.c:603:2: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). read(thefd, (char*)&tblock, sizeof(tblock)); data/bplay-0.991/bplay.c:627:2: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). read(thefd, (char*)&loop_times, 2); data/bplay-0.991/bplay.c:669:14: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). count = read(thefd, junkbuf, trgt); data/bplay-0.991/shmbuf.c:283:13: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). ((count = read(audio, tmpptr, trgt - numrd)) > 0) ) data/bplay-0.991/shmbuf.c:364:16: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). ((count = read(infd, tmppt, trgt - numread)) != 0) ) ANALYSIS SUMMARY: Hits = 43 Lines analyzed = 1374 in approximately 0.33 seconds (4203 lines/second) Physical Source Lines of Code (SLOC) = 1078 Hits@level = [0] 41 [1] 14 [2] 28 [3] 1 [4] 0 [5] 0 Hits@level+ = [0+] 84 [1+] 43 [2+] 29 [3+] 1 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 77.9221 [1+] 39.8887 [2+] 26.9017 [3+] 0.927644 [4+] 0 [5+] 0 Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.