Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/cookietool-2.5/compress.h
Examining data/cookietool-2.5/cookio.h
Examining data/cookietool-2.5/cookio.c
Examining data/cookietool-2.5/strstuff.h
Examining data/cookietool-2.5/strstuff.c
Examining data/cookietool-2.5/cookietool.c
Examining data/cookietool-2.5/compress.c
Examining data/cookietool-2.5/cdbdiff.c
Examining data/cookietool-2.5/cdbsplit.c
FINAL RESULTS:
data/cookietool-2.5/cdbdiff.c:81:17: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy( name1, s );
data/cookietool-2.5/cdbdiff.c:83:17: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy( name2, s );
data/cookietool-2.5/cdbdiff.c:85:17: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy( name3, s );
data/cookietool-2.5/cdbsplit.c:123:13: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy( cbak, cptr );
data/cookietool-2.5/compress.c:99:17: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy( clist[ listed ].text, cptr );
data/cookietool-2.5/cookietool.c:96:17: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy( name1, s );
data/cookietool-2.5/cookietool.c:98:17: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy( name3, s );
data/cookietool-2.5/cookietool.c:178:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy( name2, name1 );
data/cookietool-2.5/cookio.c:58:17: [4] (buffer) fscanf:
The scanf() family's %s operation, without a limit specification, permits
buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
different input function.
if( fscanf( fp, "%s", cbuf ) != 1 )
data/cookietool-2.5/cookio.c:91:13: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat( cbuf, line );
data/cookietool-2.5/cookio.c:141:13: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
return (fprintf( fp, fmts, cookie ) > 0) ? 1 : 0;
data/cookietool-2.5/cdbdiff.c:94:38: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
bordermode = atoi( s );
data/cookietool-2.5/cdbdiff.c:100:31: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
fmt = atoi( s );
data/cookietool-2.5/cdbdiff.c:127:20: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if( !(infile = fopen( name1, "r" ) ) )
data/cookietool-2.5/cdbdiff.c:132:21: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if( !(infile2 = fopen( name2, "r" ) ) )
data/cookietool-2.5/cdbdiff.c:137:31: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if( !append && (logfile = fopen( name3, "r" )) )
data/cookietool-2.5/cdbdiff.c:142:21: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if( !(logfile = fopen( name3, "a" ) ) )
data/cookietool-2.5/cdbsplit.c:50:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *rtarget[NTARGET]; /* required keywords */
data/cookietool-2.5/cdbsplit.c:51:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *otarget[NTARGET]; /* optional keywords */
data/cookietool-2.5/cdbsplit.c:105:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char cbak[ CBUFSIZE ]; /* backup of the last cookie, to find groups */
data/cookietool-2.5/cdbsplit.c:258:32: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
matchlen = atoi( s );
data/cookietool-2.5/cdbsplit.c:261:29: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
l_min = atoi( s );
data/cookietool-2.5/cdbsplit.c:264:29: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
l_max = atoi( s );
data/cookietool-2.5/cdbsplit.c:267:29: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
w_min = atoi( s );
data/cookietool-2.5/cdbsplit.c:270:29: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
w_max = atoi( s );
data/cookietool-2.5/cdbsplit.c:273:29: [2] (integer) atol:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
n_min = atol( s );
data/cookietool-2.5/cdbsplit.c:276:29: [2] (integer) atol:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
n_max = atol( s );
data/cookietool-2.5/cdbsplit.c:289:38: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
bordermode = atoi( s );
data/cookietool-2.5/cdbsplit.c:295:33: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
c_fmt = atoi( s );
data/cookietool-2.5/cdbsplit.c:310:20: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if( !(infile = fopen( name1, "r" ) ) )
data/cookietool-2.5/cdbsplit.c:316:31: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if( !append && (hitfile = fopen( name2, "r" )) )
data/cookietool-2.5/cdbsplit.c:321:21: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if( !(hitfile = fopen( name2, "a" )) )
data/cookietool-2.5/cdbsplit.c:329:26: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if( !(dumpfile = fopen( name3, "w" ) ) )
data/cookietool-2.5/cookietool.c:132:38: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
bordermode = atoi( s );
data/cookietool-2.5/cookietool.c:138:33: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
i_fmt = atoi( s );
data/cookietool-2.5/cookietool.c:144:37: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
force_fmt = atoi( s );
data/cookietool-2.5/cookietool.c:184:9: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy( name2, "ct_temp_crunchfile" );
data/cookietool-2.5/cookietool.c:199:20: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if( !(infile = fopen( name1, "r" ) ) )
data/cookietool-2.5/cookietool.c:207:35: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if( !append && (logfile = fopen( name3, "r" )) )
data/cookietool-2.5/cookietool.c:212:25: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if( !(logfile = fopen( name3, "a" ) ) )
data/cookietool-2.5/cookietool.c:225:21: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if( !(outfile = fopen( name2, "w" ) ) )
data/cookietool-2.5/cookio.c:36:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char line[LBUFSIZE]; /* large enough to hold the longest line */
data/cookietool-2.5/cookio.c:37:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cbuf[CBUFSIZE]; /* large enough to hold one complete cookie */
data/cookietool-2.5/cdbsplit.c:111:5: [1] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant character.
strcpy( cbak, "" );
data/cookietool-2.5/cookio.c:60:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
cbuflen = strlen( cbuf );
data/cookietool-2.5/cookio.c:67:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
cbuflen = strlen( cbuf );
data/cookietool-2.5/cookio.c:75:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
delimlen = strlen( delim );
data/cookietool-2.5/cookio.c:77:5: [1] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant character.
strcpy( cbuf, "" );
data/cookietool-2.5/cookio.c:85:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
w = strlen( line );
data/cookietool-2.5/cookio.c:126:19: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen( cookie );
data/cookietool-2.5/strstuff.c:49:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy( t, s, n );
ANALYSIS SUMMARY:
Hits = 51
Lines analyzed = 1679 in approximately 0.09 seconds (19606 lines/second)
Physical Source Lines of Code (SLOC) = 1179
Hits@level = [0] 115 [1] 8 [2] 32 [3] 0 [4] 11 [5] 0
Hits@level+ = [0+] 166 [1+] 51 [2+] 43 [3+] 11 [4+] 11 [5+] 0
Hits/KSLOC@level+ = [0+] 140.797 [1+] 43.257 [2+] 36.4716 [3+] 9.32994 [4+] 9.32994 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.