Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/cdck-0.7.0+dfsg/src/config.h
Examining data/cdck-0.7.0+dfsg/src/defines.h
Examining data/cdck-0.7.0+dfsg/src/lib_main.h
Examining data/cdck-0.7.0+dfsg/src/debugging.h
Examining data/cdck-0.7.0+dfsg/src/lib_time.h
Examining data/cdck-0.7.0+dfsg/src/cdck_main.h
Examining data/cdck-0.7.0+dfsg/src/lib_cdinfo.h
Examining data/cdck-0.7.0+dfsg/src/lib_time.c
Examining data/cdck-0.7.0+dfsg/src/cdck_main.cpp
Examining data/cdck-0.7.0+dfsg/src/lib_cdinfo.cpp
Examining data/cdck-0.7.0+dfsg/src/lib_main.cpp
FINAL RESULTS:
data/cdck-0.7.0+dfsg/src/cdck_main.cpp:36:15: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while ((ch = getopt(argc, argv, "?hitvd:po:V"))!=-1) {
data/cdck-0.7.0+dfsg/src/cdck_main.cpp:30:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char devname[FILE_MAX];
data/cdck-0.7.0+dfsg/src/cdck_main.cpp:31:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char plotname[FILE_MAX];
data/cdck-0.7.0+dfsg/src/lib_cdinfo.cpp:72:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (sbuffer, buffer6 + PUBLISHER_OFFSET, PUBLISHER_LEN);
data/cdck-0.7.0+dfsg/src/lib_cdinfo.cpp:73:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (sbuffer2, buffer6 + PREPARER_OFFSET , PREPARER_LEN);
data/cdck-0.7.0+dfsg/src/lib_cdinfo.cpp:74:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (sbuffer3, buffer6 + SOFTWARE_OFFSET, SOFTWARE_LEN);
data/cdck-0.7.0+dfsg/src/lib_main.cpp:91:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd = open (cdrom_dev, O_RDONLY|O_LARGEFILE);
data/cdck-0.7.0+dfsg/src/lib_main.cpp:131:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (&tocs[i], &toc, sizeof (struct cdrom_tocentry));
data/cdck-0.7.0+dfsg/src/lib_main.cpp:406:7: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
pf = fopen (plotfile, "w+");
data/cdck-0.7.0+dfsg/src/lib_main.cpp:450:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[ SECTOR_SIZE];
data/cdck-0.7.0+dfsg/src/lib_main.h:44:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cdrom_dev[FILE_MAX];
data/cdck-0.7.0+dfsg/src/lib_main.h:45:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char last_err[ERR_STR_MAX];
data/cdck-0.7.0+dfsg/src/lib_main.h:47:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char toc_header[2];
data/cdck-0.7.0+dfsg/src/lib_main.h:84:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[2048];
data/cdck-0.7.0+dfsg/src/lib_main.h:85:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer2[2048];
data/cdck-0.7.0+dfsg/src/lib_main.h:86:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer3[2048];
data/cdck-0.7.0+dfsg/src/lib_main.h:87:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer4[2048];
data/cdck-0.7.0+dfsg/src/lib_main.h:88:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer5[2048];
data/cdck-0.7.0+dfsg/src/lib_main.h:89:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer6[2048];
data/cdck-0.7.0+dfsg/src/lib_main.h:91:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char sbuffer[256];
data/cdck-0.7.0+dfsg/src/lib_main.h:92:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char sbuffer2[256];
data/cdck-0.7.0+dfsg/src/lib_main.h:93:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char sbuffer3[256];
data/cdck-0.7.0+dfsg/src/cdck_main.cpp:58:4: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy (devname, optarg, FILE_MAX-1);
data/cdck-0.7.0+dfsg/src/cdck_main.cpp:62:4: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy (plotname, optarg, FILE_MAX-1);
data/cdck-0.7.0+dfsg/src/cdck_main.cpp:84:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strlen (devname))
data/cdck-0.7.0+dfsg/src/cdck_main.cpp:126:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (! strlen (plotname) )
data/cdck-0.7.0+dfsg/src/lib_cdinfo.cpp:44:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int len = strlen(buff);
data/cdck-0.7.0+dfsg/src/lib_cdinfo.cpp:70:2: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
read (fd, buffer6, 2048);
data/cdck-0.7.0+dfsg/src/lib_cdinfo.cpp:86:5: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
read(fd,buffer,2048);
data/cdck-0.7.0+dfsg/src/lib_cdinfo.cpp:94:5: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
read(fd,buffer2,2048);
data/cdck-0.7.0+dfsg/src/lib_cdinfo.cpp:102:5: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
read(fd,buffer3,2048);
data/cdck-0.7.0+dfsg/src/lib_cdinfo.cpp:110:5: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
read(fd,buffer4,2048);
data/cdck-0.7.0+dfsg/src/lib_cdinfo.cpp:119:5: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
read(fd,buffer5,2048);
data/cdck-0.7.0+dfsg/src/lib_main.cpp:41:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy (cdrom_dev, DEFAULT_CDROM_DEV, FILE_MAX);
data/cdck-0.7.0+dfsg/src/lib_main.cpp:51:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy (cdrom_dev, a_cdrom_dev, FILE_MAX);
data/cdck-0.7.0+dfsg/src/lib_main.cpp:53:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy (cdrom_dev, DEFAULT_CDROM_DEV, FILE_MAX);
data/cdck-0.7.0+dfsg/src/lib_main.cpp:363:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(sbuffer3)>1)
data/cdck-0.7.0+dfsg/src/lib_main.cpp:366:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(sbuffer)>1)
data/cdck-0.7.0+dfsg/src/lib_main.cpp:369:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(sbuffer2)>1)
data/cdck-0.7.0+dfsg/src/lib_main.cpp:458:4: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
read (fd, buf, SECTOR_SIZE);
data/cdck-0.7.0+dfsg/src/lib_main.cpp:481:8: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rv = read (fd, buf, SECTOR_SIZE);
ANALYSIS SUMMARY:
Hits = 41
Lines analyzed = 1530 in approximately 0.42 seconds (3657 lines/second)
Physical Source Lines of Code (SLOC) = 996
Hits@level = [0] 110 [1] 19 [2] 21 [3] 1 [4] 0 [5] 0
Hits@level+ = [0+] 151 [1+] 41 [2+] 22 [3+] 1 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 151.606 [1+] 41.1647 [2+] 22.0884 [3+] 1.00402 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.