Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/dfu-util-0.9/src/dfu_file.c Examining data/dfu-util-0.9/src/dfu_load.c Examining data/dfu-util-0.9/src/dfuse.c Examining data/dfu-util-0.9/src/usb_dfu.h Examining data/dfu-util-0.9/src/quirks.c Examining data/dfu-util-0.9/src/dfuse_mem.h Examining data/dfu-util-0.9/src/dfu.h Examining data/dfu-util-0.9/src/dfuse_mem.c Examining data/dfu-util-0.9/src/dfu_util.c Examining data/dfu-util-0.9/src/dfuse.h Examining data/dfu-util-0.9/src/dfu_file.h Examining data/dfu-util-0.9/src/dfu_util.h Examining data/dfu-util-0.9/src/prefix.c Examining data/dfu-util-0.9/src/main.c Examining data/dfu-util-0.9/src/suffix.c Examining data/dfu-util-0.9/src/dfu_load.h Examining data/dfu-util-0.9/src/dfu.c Examining data/dfu-util-0.9/src/quirks.h Examining data/dfu-util-0.9/src/portable.h FINAL RESULTS: data/dfu-util-0.9/src/main.c:194:2: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. printf(PACKAGE_STRING "\n\n"); data/dfu-util-0.9/src/portable.h:41:5: [4] (format) fprintf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. fprintf(stderr, __VA_ARGS__);\ data/dfu-util-0.9/src/main.c:251:7: [3] (buffer) getopt_long: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. c = getopt_long(argc, argv, "hVvleE:d:p:c:i:a:S:t:U:D:Rs:Z:", opts, data/dfu-util-0.9/src/prefix.c:96:7: [3] (buffer) getopt_long: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. c = getopt_long(argc, argv, "hVc:a:D:p:v:d:s:TL", opts, data/dfu-util-0.9/src/suffix.c:95:7: [3] (buffer) getopt_long: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. c = getopt_long(argc, argv, "hVc:a:D:p:v:d:S:s:T", opts, data/dfu-util-0.9/src/dfu.c:133:14: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char buffer[6]; data/dfu-util-0.9/src/dfu.c:204:14: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char buffer[1]; data/dfu-util-0.9/src/dfu_file.c:113:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static char buf[PROGRESS_BAR_WIDTH + 1]; data/dfu-util-0.9/src/dfu_file.c:217:7: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). f = open(file->name, O_RDONLY | O_BINARY); data/dfu-util-0.9/src/dfu_file.c:347:6: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). f = open(file->name, O_WRONLY | O_BINARY | O_TRUNC | O_CREAT, 0666); data/dfu-util-0.9/src/dfu_util.c:66:4: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(res_buf, &desc_list[p], desclen); data/dfu-util-0.9/src/dfu_util.c:82:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char alt_name[MAX_DESC_STR_LEN + 1]; data/dfu-util-0.9/src/dfu_util.c:83:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char serial_name[MAX_DESC_STR_LEN + 1]; data/dfu-util-0.9/src/dfu_util.c:228:6: [2] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). Risk is low because the source is a constant string. strcpy(alt_name, "UNKNOWN"); data/dfu-util-0.9/src/dfu_util.c:235:6: [2] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). Risk is low because the source is a constant string. strcpy(serial_name, "UNKNOWN"); data/dfu-util-0.9/src/dfu_util.c:290:1: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char path_buf[MAX_PATH_LEN]; data/dfu-util-0.9/src/dfu_util.c:298:3: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(path_buf,"%d-%d",libusb_get_bus_number(dev),path[0]); data/dfu-util-0.9/src/dfu_util.c:300:4: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(path_buf+strlen(path_buf),".%d",path[j]); data/dfu-util-0.9/src/dfuse.c:169:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char buf[5]; data/dfu-util-0.9/src/dfuse.c:469:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(dst, *src, size); data/dfu-util-0.9/src/main.c:616:8: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fd = open(file.name, O_WRONLY | O_BINARY | O_CREAT | O_EXCL | O_TRUNC, 0666); data/dfu-util-0.9/src/dfu_file.c:232:7: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). if (read(f, file->firmware, file->size.total) != file->size.total) { data/dfu-util-0.9/src/dfu_util.c:300:21: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). sprintf(path_buf+strlen(path_buf),".%d",path[j]); data/dfu-util-0.9/src/dfuse.c:64:24: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). endword = options + strlen(options); /* GNU strchrnul */ data/dfu-util-0.9/src/dfuse.c:82:24: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). endword = options + strlen(options); data/dfu-util-0.9/src/dfuse_mem.c:95:20: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). name = dfu_malloc(strlen(intf_desc)); data/dfu-util-0.9/src/dfuse_mem.c:106:26: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). typestring = dfu_malloc(strlen(intf_desc)); data/dfu-util-0.9/src/dfuse_mem.c:120:9: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(typestring) == 1 ANALYSIS SUMMARY: Hits = 28 Lines analyzed = 3814 in approximately 0.14 seconds (28059 lines/second) Physical Source Lines of Code (SLOC) = 2826 Hits@level = [0] 115 [1] 7 [2] 16 [3] 3 [4] 2 [5] 0 Hits@level+ = [0+] 143 [1+] 28 [2+] 21 [3+] 5 [4+] 2 [5+] 0 Hits/KSLOC@level+ = [0+] 50.6016 [1+] 9.908 [2+] 7.431 [3+] 1.76929 [4+] 0.707714 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.