Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/duff-0.5.2/src/sha256.h
Examining data/duff-0.5.2/src/sha256.c
Examining data/duff-0.5.2/src/sha512.h
Examining data/duff-0.5.2/src/duff.c
Examining data/duff-0.5.2/src/sha1.h
Examining data/duff-0.5.2/src/duff.h
Examining data/duff-0.5.2/src/sha384.h
Examining data/duff-0.5.2/src/duffstring.h
Examining data/duff-0.5.2/src/duffdriver.c
Examining data/duff-0.5.2/src/duffstring.c
Examining data/duff-0.5.2/src/sha384.c
Examining data/duff-0.5.2/src/dufffile.c
Examining data/duff-0.5.2/src/duffutil.c
Examining data/duff-0.5.2/src/sha1.c
Examining data/duff-0.5.2/src/sha512.c
Examining data/duff-0.5.2/lib/gettext.h
FINAL RESULTS:
data/duff-0.5.2/src/duff.h:146:59: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
void error(const char* format, ...) __attribute__((format(printf, 1, 2))) __attribute__((noreturn));
data/duff-0.5.2/src/duff.h:147:61: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
void warning(const char* format, ...) __attribute__((format(printf, 1, 2)));
data/duff-0.5.2/src/duffstring.c:43:7: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
if (vsnprintf(buffer, sizeof(buffer), format, vl) < 0)
data/duff-0.5.2/src/duffstring.c:48:3: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(*result, buffer);
data/duff-0.5.2/src/duffutil.c:375:4: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
printf("%" PRIi64, size);
data/duff-0.5.2/src/duff.c:201:16: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while ((ch = getopt(argc, argv, "0HLPad:ef:hl:pqrtvz")) != -1)
data/duff-0.5.2/lib/gettext.h:210:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char msg_ctxt_id[msgctxt_len + msgid_len];
data/duff-0.5.2/lib/gettext.h:212:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1024];
data/duff-0.5.2/lib/gettext.h:220:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (msg_ctxt_id, msgctxt, msgctxt_len - 1);
data/duff-0.5.2/lib/gettext.h:222:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (msg_ctxt_id + msgctxt_len, msgid, msgid_len);
data/duff-0.5.2/lib/gettext.h:256:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char msg_ctxt_id[msgctxt_len + msgid_len];
data/duff-0.5.2/lib/gettext.h:258:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1024];
data/duff-0.5.2/lib/gettext.h:266:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (msg_ctxt_id, msgctxt, msgctxt_len - 1);
data/duff-0.5.2/lib/gettext.h:268:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (msg_ctxt_id + msgctxt_len, msgid, msgid_len);
data/duff-0.5.2/src/dufffile.c:160:12: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
stream = fopen(file->path, "rb");
data/duff-0.5.2/src/dufffile.c:201:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[BUFFER_SIZE];
data/duff-0.5.2/src/dufffile.c:212:14: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
stream = fopen(file->path, "rb");
data/duff-0.5.2/src/dufffile.c:302:18: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
first_stream = fopen(first->path, "rb");
data/duff-0.5.2/src/dufffile.c:312:19: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
second_stream = fopen(second->path, "rb");
data/duff-0.5.2/src/duffstring.c:41:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[8192];
data/duff-0.5.2/src/sha1.c:180:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/duff-0.5.2/src/sha1.c:481:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (&sc->buffer.bytes[sc->bufferLength], data, bytesToCopy);
data/duff-0.5.2/src/sha1.c:507:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (&sc->buffer.bytes[sc->bufferLength], data, len);
data/duff-0.5.2/src/sha1.c:521:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (&sc->buffer.bytes[sc->bufferLength], data, bytesToCopy);
data/duff-0.5.2/src/sha1.c:583:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1000];
data/duff-0.5.2/src/sha256.c:203:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/duff-0.5.2/src/sha256.c:336:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (&sc->buffer.bytes[sc->bufferLength], data, bytesToCopy);
data/duff-0.5.2/src/sha256.c:362:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (&sc->buffer.bytes[sc->bufferLength], data, len);
data/duff-0.5.2/src/sha256.c:376:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (&sc->buffer.bytes[sc->bufferLength], data, bytesToCopy);
data/duff-0.5.2/src/sha256.c:438:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1000];
data/duff-0.5.2/src/sha384.c:241:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/duff-0.5.2/src/sha384.c:319:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (&sc->buffer.bytes[sc->bufferLength], data, bytesToCopy);
data/duff-0.5.2/src/sha384.c:351:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (&sc->buffer.bytes[sc->bufferLength], data, len);
data/duff-0.5.2/src/sha384.c:368:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (&sc->buffer.bytes[sc->bufferLength], data, bytesToCopy);
data/duff-0.5.2/src/sha384.c:438:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1000];
data/duff-0.5.2/src/sha512.c:241:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/duff-0.5.2/src/sha512.c:319:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (&sc->buffer.bytes[sc->bufferLength], data, bytesToCopy);
data/duff-0.5.2/src/sha512.c:351:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (&sc->buffer.bytes[sc->bufferLength], data, len);
data/duff-0.5.2/src/sha512.c:368:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (&sc->buffer.bytes[sc->bufferLength], data, bytesToCopy);
data/duff-0.5.2/src/sha512.c:438:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1000];
data/duff-0.5.2/lib/gettext.h:206:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t msgctxt_len = strlen (msgctxt) + 1;
data/duff-0.5.2/lib/gettext.h:207:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t msgid_len = strlen (msgid) + 1;
data/duff-0.5.2/lib/gettext.h:252:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t msgctxt_len = strlen (msgctxt) + 1;
data/duff-0.5.2/lib/gettext.h:253:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t msgid_len = strlen (msgid) + 1;
data/duff-0.5.2/src/duffdriver.c:69:26: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
#define NAMLEN(dirent) strlen((dirent)->d_name)
data/duff-0.5.2/src/dufffile.c:326:10: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
fc = fgetc(first_stream);
data/duff-0.5.2/src/dufffile.c:327:10: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
sc = fgetc(second_stream);
data/duff-0.5.2/src/duffstring.c:46:19: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t length = strlen(buffer);
data/duff-0.5.2/src/duffutil.c:151:19: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
const int c = fgetc(stream);
ANALYSIS SUMMARY:
Hits = 49
Lines analyzed = 4494 in approximately 0.18 seconds (25572 lines/second)
Physical Source Lines of Code (SLOC) = 3132
Hits@level = [0] 73 [1] 9 [2] 34 [3] 1 [4] 5 [5] 0
Hits@level+ = [0+] 122 [1+] 49 [2+] 40 [3+] 6 [4+] 5 [5+] 0
Hits/KSLOC@level+ = [0+] 38.9527 [1+] 15.645 [2+] 12.7714 [3+] 1.91571 [4+] 1.59642 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.