Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/dablin-1.13.0/fec/char.h
Examining data/dablin-1.13.0/fec/decode_rs.h
Examining data/dablin-1.13.0/fec/decode_rs_char.c
Examining data/dablin-1.13.0/fec/encode_rs.h
Examining data/dablin-1.13.0/fec/encode_rs_char.c
Examining data/dablin-1.13.0/fec/fec.h
Examining data/dablin-1.13.0/fec/init_rs.h
Examining data/dablin-1.13.0/fec/init_rs_char.c
Examining data/dablin-1.13.0/fec/rs-common.h
Examining data/dablin-1.13.0/fec/test/rs_speedtest.c
Examining data/dablin-1.13.0/fec/test/rstest.c
Examining data/dablin-1.13.0/src/audio_output.h
Examining data/dablin-1.13.0/src/dab_decoder.cpp
Examining data/dablin-1.13.0/src/dab_decoder.h
Examining data/dablin-1.13.0/src/dablin.cpp
Examining data/dablin-1.13.0/src/dablin.h
Examining data/dablin-1.13.0/src/dablin_gtk.cpp
Examining data/dablin-1.13.0/src/dablin_gtk.h
Examining data/dablin-1.13.0/src/dablin_gtk_sls.cpp
Examining data/dablin-1.13.0/src/dablin_gtk_sls.h
Examining data/dablin-1.13.0/src/dabplus_decoder.cpp
Examining data/dablin-1.13.0/src/dabplus_decoder.h
Examining data/dablin-1.13.0/src/edi_player.cpp
Examining data/dablin-1.13.0/src/edi_player.h
Examining data/dablin-1.13.0/src/edi_source.cpp
Examining data/dablin-1.13.0/src/edi_source.h
Examining data/dablin-1.13.0/src/ensemble_player.cpp
Examining data/dablin-1.13.0/src/ensemble_player.h
Examining data/dablin-1.13.0/src/ensemble_source.cpp
Examining data/dablin-1.13.0/src/ensemble_source.h
Examining data/dablin-1.13.0/src/eti_player.cpp
Examining data/dablin-1.13.0/src/eti_player.h
Examining data/dablin-1.13.0/src/eti_source.cpp
Examining data/dablin-1.13.0/src/eti_source.h
Examining data/dablin-1.13.0/src/fic_decoder.cpp
Examining data/dablin-1.13.0/src/fic_decoder.h
Examining data/dablin-1.13.0/src/mot_manager.cpp
Examining data/dablin-1.13.0/src/mot_manager.h
Examining data/dablin-1.13.0/src/pad_decoder.cpp
Examining data/dablin-1.13.0/src/pad_decoder.h
Examining data/dablin-1.13.0/src/pcm_output.cpp
Examining data/dablin-1.13.0/src/pcm_output.h
Examining data/dablin-1.13.0/src/sdl_output.cpp
Examining data/dablin-1.13.0/src/sdl_output.h
Examining data/dablin-1.13.0/src/subchannel_sink.h
Examining data/dablin-1.13.0/src/tools.cpp
Examining data/dablin-1.13.0/src/tools.h
Examining data/dablin-1.13.0/src/version.cpp
Examining data/dablin-1.13.0/src/version.h
FINAL RESULTS:
data/dablin-1.13.0/src/dablin.cpp:277:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(stderr, format.c_str(), progress.text.c_str());
data/dablin-1.13.0/src/eti_source.cpp:38:15: [4] (shell) popen:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
input_file = popen(cmdline.c_str(), "r");
data/dablin-1.13.0/src/eti_source.cpp:52:16: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
int result = system(cmd_killall.c_str());
data/dablin-1.13.0/src/tools.cpp:85:2: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
snprintf(result, sizeof(result), format.c_str(), value);
data/dablin-1.13.0/fec/test/rstest.c:39:3: [3] (random) srandom:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
srandom(time(NULL));
data/dablin-1.13.0/fec/test/rstest.c:80:18: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
block[i] = random() & nn;
data/dablin-1.13.0/fec/test/rstest.c:91:11: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
errval = random() & nn;
data/dablin-1.13.0/fec/test/rstest.c:95:11: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
errloc = random() % nn;
data/dablin-1.13.0/fec/test/rstest.c:101:10: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
if(random() & 1) /* 50-50 chance */
data/dablin-1.13.0/src/dablin.cpp:77:13: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while((c = getopt(argc, argv, "hf:c:l:d:D:g:Gs:x:1puIFr:R:")) != -1) {
data/dablin-1.13.0/src/dablin_gtk.cpp:85:13: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while((c = getopt(argc, argv, "hf:d:D:C:c:l:g:Gr:P:s:x:1puISLF")) != -1) {
data/dablin-1.13.0/fec/decode_rs.h:204:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(lambda,t,(NROOTS+1)*sizeof(t[0]));
data/dablin-1.13.0/fec/decode_rs.h:216:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(®[1],&lambda[1],NROOTS*sizeof(reg[0]));
data/dablin-1.13.0/fec/test/rs_speedtest.c:10:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char block[255];
data/dablin-1.13.0/fec/test/rstest.c:54:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char block[nn],tblock[nn];
data/dablin-1.13.0/fec/test/rstest.c:81:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(tblock,block,sizeof(block));
data/dablin-1.13.0/fec/test/rstest.c:85:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(tblock,block,sizeof(block));
data/dablin-1.13.0/src/dab_decoder.cpp:188:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&frame[4], body_data, body_bytes);
data/dablin-1.13.0/src/dablin_gtk.cpp:651:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cid_string[5];
data/dablin-1.13.0/src/dablin_gtk.cpp:692:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char start_string[22];
data/dablin-1.13.0/src/dablin_gtk.cpp:711:24: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE* new_rec_file = fopen(new_rec_filename.c_str(), "wb");
data/dablin-1.13.0/src/dablin_gtk.h:150:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&this->data[0], data, len);
data/dablin-1.13.0/src/dabplus_decoder.cpp:76:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sf_raw + i * frame_len, sf_raw + (i + 1) * frame_len, frame_len);
data/dablin-1.13.0/src/dabplus_decoder.cpp:82:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sf_raw + (frame_count - 1) * frame_len, data, frame_len);
data/dablin-1.13.0/src/dabplus_decoder.cpp:92:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sf, sf_raw, sf_len);
data/dablin-1.13.0/src/ensemble_source.cpp:59:16: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
input_file = fopen(filename.c_str(), "rb");
data/dablin-1.13.0/src/fic_decoder.cpp:422:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&sls_ua_data[0], data + offset, ua_data_length);
data/dablin-1.13.0/src/fic_decoder.cpp:500:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cid_string[5];
data/dablin-1.13.0/src/fic_decoder.cpp:595:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(label.label, data + len_id, 16);
data/dablin-1.13.0/src/fic_decoder.cpp:872:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char lto_string[7];
data/dablin-1.13.0/src/fic_decoder.cpp:900:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char s[11];
data/dablin-1.13.0/src/mot_manager.cpp:32:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&segs[seg_number][0], data, len);
data/dablin-1.13.0/src/mot_manager.cpp:54:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&result[offset], &seg[0], seg.size());
data/dablin-1.13.0/src/pad_decoder.cpp:236:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&dg_raw[dg_size], data, copy_len);
data/dablin-1.13.0/src/pad_decoder.cpp:340:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dl_seg.prefix, &dg_raw[0], 2);
data/dablin-1.13.0/src/pad_decoder.cpp:443:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&result[0], &dg_raw[0], mot_len);
data/dablin-1.13.0/src/tools.cpp:47:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char digits[3];
data/dablin-1.13.0/src/tools.cpp:84:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char result[2 + nibbles + 1];
data/dablin-1.13.0/src/tools.cpp:140:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char input_bytes[input_len];
data/dablin-1.13.0/src/tools.cpp:142:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(input_bytes, &cleaned_data[0], cleaned_data.size());
data/dablin-1.13.0/src/tools.cpp:146:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char output_bytes[output_len];
data/dablin-1.13.0/src/tools.cpp:282:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buffer + index_end, data, real_bytes);
data/dablin-1.13.0/src/tools.cpp:285:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buffer + index_end, data, first_bytes);
data/dablin-1.13.0/src/tools.cpp:286:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buffer, data + first_bytes, real_bytes - first_bytes);
data/dablin-1.13.0/src/tools.cpp:300:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, buffer + index_start, real_bytes);
data/dablin-1.13.0/src/tools.cpp:303:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, buffer + index_start, first_bytes);
data/dablin-1.13.0/src/tools.cpp:304:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data + first_bytes, buffer, real_bytes - first_bytes);
ANALYSIS SUMMARY:
Hits = 47
Lines analyzed = 8937 in approximately 0.28 seconds (32240 lines/second)
Physical Source Lines of Code (SLOC) = 5969
Hits@level = [0] 136 [1] 0 [2] 36 [3] 7 [4] 4 [5] 0
Hits@level+ = [0+] 183 [1+] 47 [2+] 47 [3+] 11 [4+] 4 [5+] 0
Hits/KSLOC@level+ = [0+] 30.6584 [1+] 7.87402 [2+] 7.87402 [3+] 1.84285 [4+] 0.670129 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.