Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/espctag-0.4/src/espctag.c
Examining data/espctag-0.4/src/constants.h
FINAL RESULTS:
data/espctag-0.4/src/espctag.c:323:4: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf( msgerror, "Unable to open file '%s'!", filename );
data/espctag-0.4/src/espctag.c:388:6: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf( msgerror, "Unable to open file '%s'!", dir_entry->d_name );
data/espctag-0.4/src/espctag.c:571:3: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy( new_filepath, dir_name );
data/espctag-0.4/src/espctag.c:573:3: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat( new_filepath, new_filename );
data/espctag-0.4/src/espctag.c:575:4: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf( msgerror, "Can not rename file '%s'", file );
data/espctag-0.4/src/espctag.c:704:2: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat( backup_filename, filename );
data/espctag-0.4/src/espctag.c:739:7: [4] (shell) execvp:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
if( execvp( "unrar-nonfree", unrar_args ) == -1 ) {
data/espctag-0.4/src/espctag.c:780:7: [4] (shell) execvp:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
if( execvp( "rar", rar_args ) == -1 ) {
data/espctag-0.4/src/espctag.c:319:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char msgerror[strlen( filename ) + 1024]; /* Error string */
data/espctag-0.4/src/espctag.c:322:17: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ( ( file = fopen( filename, "r+" ) ) == NULL ) {
data/espctag-0.4/src/espctag.c:387:23: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ( ( spc_file = fopen( dir_entry->d_name, "r+" ) ) == NULL ) {
data/espctag-0.4/src/espctag.c:555:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char msgerror[strlen( file ) + 1024]; /* Error string */
data/espctag-0.4/src/espctag.c:562:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char new_filename[MAX_FILENAME_LENGTH] = "\0";
data/espctag-0.4/src/espctag.c:570:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char new_filepath[strlen( dir_name ) + strlen( new_filename ) + 2];
data/espctag-0.4/src/espctag.c:588:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char msgerror[1024]; /* Error string */
data/espctag-0.4/src/espctag.c:596:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char slength[2] = "\0\0";
data/espctag-0.4/src/espctag.c:620:13: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
length = atoi( slength );
data/espctag-0.4/src/espctag.c:687:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char header[number_length];
data/espctag-0.4/src/espctag.c:703:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char backup_filename[strlen( filename + 4)];
data/espctag-0.4/src/espctag.c:705:2: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant string.
strcat( backup_filename, ".bak" );
data/espctag-0.4/src/espctag.c:319:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
char msgerror[strlen( filename ) + 1024]; /* Error string */
data/espctag-0.4/src/espctag.c:555:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
char msgerror[strlen( file ) + 1024]; /* Error string */
data/espctag-0.4/src/espctag.c:570:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
char new_filepath[strlen( dir_name ) + strlen( new_filename ) + 2];
data/espctag-0.4/src/espctag.c:570:42: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
char new_filepath[strlen( dir_name ) + strlen( new_filename ) + 2];
data/espctag-0.4/src/espctag.c:572:3: [1] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant character.
strcat( new_filepath, "/" );
data/espctag-0.4/src/espctag.c:591:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for( c=0; c<strlen( rename_format ); c++ ) {
data/espctag-0.4/src/espctag.c:634:10: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if( strlen( new_filename ) < MAX_FILENAME_LENGTH )
data/espctag-0.4/src/espctag.c:635:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
new_filename[strlen( new_filename )] = rename_format[c];
data/espctag-0.4/src/espctag.c:647:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for( i=0; i<strlen( tmp_tag ); i++ ) {
data/espctag-0.4/src/espctag.c:652:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for( i=0; i<strlen( tmp_tag ); i++ ) {
data/espctag-0.4/src/espctag.c:659:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int new_filename_length = strlen( new_filename );
data/espctag-0.4/src/espctag.c:660:54: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for( i=new_filename_length; i<new_filename_length+strlen( tmp_tag ); i++ ) {
data/espctag-0.4/src/espctag.c:675:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if( strlen( new_filename ) < MAX_FILENAME_LENGTH )
data/espctag-0.4/src/espctag.c:676:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
new_filename[strlen( new_filename )] = rename_format[c];
data/espctag-0.4/src/espctag.c:686:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int number_length = strlen( rar_number );
data/espctag-0.4/src/espctag.c:703:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
char backup_filename[strlen( filename + 4)];
ANALYSIS SUMMARY:
Hits = 36
Lines analyzed = 896 in approximately 0.05 seconds (17813 lines/second)
Physical Source Lines of Code (SLOC) = 671
Hits@level = [0] 20 [1] 16 [2] 12 [3] 0 [4] 8 [5] 0
Hits@level+ = [0+] 56 [1+] 36 [2+] 20 [3+] 8 [4+] 8 [5+] 0
Hits/KSLOC@level+ = [0+] 83.4575 [1+] 53.6513 [2+] 29.8063 [3+] 11.9225 [4+] 11.9225 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.