Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/fauhdlc-20180504/interpreter/signals.h
Examining data/fauhdlc-20180504/interpreter/signals.c
Examining data/fauhdlc-20180504/interpreter/glue/glue-log.c
Examining data/fauhdlc-20180504/interpreter/glue/glue-vhdl.c
Examining data/fauhdlc-20180504/interpreter/glue/glue-log.h
Examining data/fauhdlc-20180504/interpreter/glue/glue-main.h
Examining data/fauhdlc-20180504/interpreter/glue/glue-main.c
Examining data/fauhdlc-20180504/interpreter/glue/glue-vhdl.h
Examining data/fauhdlc-20180504/interpreter/fauhdli_private.h
Examining data/fauhdlc-20180504/interpreter/fauhdli.c
Examining data/fauhdlc-20180504/interpreter/lookup_symbols.c
Examining data/fauhdlc-20180504/interpreter/kernel.h
Examining data/fauhdlc-20180504/interpreter/vhdl_sched.h
Examining data/fauhdlc-20180504/interpreter/util/list.c
Examining data/fauhdlc-20180504/interpreter/util/fauhdlstring.h
Examining data/fauhdlc-20180504/interpreter/util/slset.h
Examining data/fauhdlc-20180504/interpreter/util/list.h
Examining data/fauhdlc-20180504/interpreter/util/slset.c
Examining data/fauhdlc-20180504/interpreter/util/fauhdlstring.c
Examining data/fauhdlc-20180504/interpreter/kernel.c
Examining data/fauhdlc-20180504/interpreter/trace.c
Examining data/fauhdlc-20180504/interpreter/lookup_symbols.h
Examining data/fauhdlc-20180504/interpreter/vhdl_sched.c
Examining data/fauhdlc-20180504/interpreter/interpreter.c
Examining data/fauhdlc-20180504/interpreter/fauhdli.h
Examining data/fauhdlc-20180504/interpreter/trace.h
Examining data/fauhdlc-20180504/interpreter/log.h
Examining data/fauhdlc-20180504/interpreter/log.c
Examining data/fauhdlc-20180504/frontend/newparser/FAUhdlScanner.hpp
Examining data/fauhdlc-20180504/frontend/newparser/ParserDriver.cpp
Examining data/fauhdlc-20180504/frontend/newparser/ParserDriver.hpp
Examining data/fauhdlc-20180504/frontend/visitor/ResolveAggregates.hpp
Examining data/fauhdlc-20180504/frontend/visitor/LookupTypes.hpp
Examining data/fauhdlc-20180504/frontend/visitor/UnconstraintBounds.hpp
Examining data/fauhdlc-20180504/frontend/visitor/GCTypes.cpp
Examining data/fauhdlc-20180504/frontend/visitor/ResolveTypes.cpp
Examining data/fauhdlc-20180504/frontend/visitor/CheckLoops.cpp
Examining data/fauhdlc-20180504/frontend/visitor/CheckAccessMode.cpp
Examining data/fauhdlc-20180504/frontend/visitor/SetPathName.cpp
Examining data/fauhdlc-20180504/frontend/visitor/ConstantPropagation.hpp
Examining data/fauhdlc-20180504/frontend/visitor/SetPathName.hpp
Examining data/fauhdlc-20180504/frontend/visitor/ResolveSymbols.cpp
Examining data/fauhdlc-20180504/frontend/visitor/WaitConditions.cpp
Examining data/fauhdlc-20180504/frontend/visitor/GenCode.cpp
Examining data/fauhdlc-20180504/frontend/visitor/TransformSigAssign.hpp
Examining data/fauhdlc-20180504/frontend/visitor/TransformSigAssign.cpp
Examining data/fauhdlc-20180504/frontend/visitor/DotVisitor.hpp
Examining data/fauhdlc-20180504/frontend/visitor/GCRegisterSet.hpp
Examining data/fauhdlc-20180504/frontend/visitor/WarnUnused.hpp
Examining data/fauhdlc-20180504/frontend/visitor/GCBuiltins.hpp
Examining data/fauhdlc-20180504/frontend/visitor/GCArrays.hpp
Examining data/fauhdlc-20180504/frontend/visitor/GatherImplicits.hpp
Examining data/fauhdlc-20180504/frontend/visitor/GenCode.hpp
Examining data/fauhdlc-20180504/frontend/visitor/SimplifyExpressions.cpp
Examining data/fauhdlc-20180504/frontend/visitor/GCLoops.cpp
Examining data/fauhdlc-20180504/frontend/visitor/ResolveSymbols.hpp
Examining data/fauhdlc-20180504/frontend/visitor/UnconstraintBounds.cpp
Examining data/fauhdlc-20180504/frontend/visitor/TopDownVisitor.hpp
Examining data/fauhdlc-20180504/frontend/visitor/CheckLoops.hpp
Examining data/fauhdlc-20180504/frontend/visitor/GCRegisterSet.cpp
Examining data/fauhdlc-20180504/frontend/visitor/NullVisitor.cpp
Examining data/fauhdlc-20180504/frontend/visitor/NullVisitor.hpp
Examining data/fauhdlc-20180504/frontend/visitor/NormalizeAssocLists.cpp
Examining data/fauhdlc-20180504/frontend/visitor/CheckAccessMode.hpp
Examining data/fauhdlc-20180504/frontend/visitor/GCArrays.cpp
Examining data/fauhdlc-20180504/frontend/visitor/DotVisitor.cpp
Examining data/fauhdlc-20180504/frontend/visitor/ConstantPropagation.cpp
Examining data/fauhdlc-20180504/frontend/visitor/ResolveTypes.hpp
Examining data/fauhdlc-20180504/frontend/visitor/TopDownVisitor.cpp
Examining data/fauhdlc-20180504/frontend/visitor/WaitConditions.hpp
Examining data/fauhdlc-20180504/frontend/visitor/GCLoops.hpp
Examining data/fauhdlc-20180504/frontend/visitor/GCBuiltins.cpp
Examining data/fauhdlc-20180504/frontend/visitor/SimplifyExpressions.hpp
Examining data/fauhdlc-20180504/frontend/visitor/WarnUnused.cpp
Examining data/fauhdlc-20180504/frontend/visitor/GCTypes.hpp
Examining data/fauhdlc-20180504/frontend/visitor/ResolveAggregates.cpp
Examining data/fauhdlc-20180504/frontend/visitor/GatherImplicits.cpp
Examining data/fauhdlc-20180504/frontend/visitor/NormalizeAssocLists.hpp
Examining data/fauhdlc-20180504/frontend/visitor/Visitor.hpp
Examining data/fauhdlc-20180504/frontend/reporting/TypeError.hpp
Examining data/fauhdlc-20180504/frontend/reporting/ErrorRegistry.hpp
Examining data/fauhdlc-20180504/frontend/reporting/AmbiguousTypes.cpp
Examining data/fauhdlc-20180504/frontend/reporting/ErrorRegistry.cpp
Examining data/fauhdlc-20180504/frontend/reporting/TypeMismatch.hpp
Examining data/fauhdlc-20180504/frontend/reporting/CompileError.cpp
Examining data/fauhdlc-20180504/frontend/reporting/TypeError.cpp
Examining data/fauhdlc-20180504/frontend/reporting/CompileError.hpp
Examining data/fauhdlc-20180504/frontend/reporting/DuplicateName.hpp
Examining data/fauhdlc-20180504/frontend/reporting/TypeMismatch.cpp
Examining data/fauhdlc-20180504/frontend/reporting/AmbiguousTypes.hpp
Examining data/fauhdlc-20180504/frontend/reporting/SyntaxError.hpp
Examining data/fauhdlc-20180504/frontend/reporting/UndefinedSymbol.cpp
Examining data/fauhdlc-20180504/frontend/reporting/UndefinedSymbol.hpp
Examining data/fauhdlc-20180504/frontend/reporting/DuplicateName.cpp
Examining data/fauhdlc-20180504/frontend/ast/SeqStat.hpp
Examining data/fauhdlc-20180504/frontend/ast/NodeFactory.hpp
Examining data/fauhdlc-20180504/frontend/ast/NullStat.hpp
Examining data/fauhdlc-20180504/frontend/ast/TypeConversion.hpp
Examining data/fauhdlc-20180504/frontend/ast/UnconstrainedArrayType.hpp
Examining data/fauhdlc-20180504/frontend/ast/SymbolDeclaration.hpp
Examining data/fauhdlc-20180504/frontend/ast/SignalDeclaration.hpp
Examining data/fauhdlc-20180504/frontend/ast/NodeFactory.cpp
Examining data/fauhdlc-20180504/frontend/ast/ValDeclaration.cpp
Examining data/fauhdlc-20180504/frontend/ast/IfStat.hpp
Examining data/fauhdlc-20180504/frontend/ast/CompInstStat.hpp
Examining data/fauhdlc-20180504/frontend/ast/WaveFormElem.hpp
Examining data/fauhdlc-20180504/frontend/ast/AttributeSpecification.hpp
Examining data/fauhdlc-20180504/frontend/ast/Library.hpp
Examining data/fauhdlc-20180504/frontend/ast/WhileLoopStat.hpp
Examining data/fauhdlc-20180504/frontend/ast/SubtypeIndication.hpp
Examining data/fauhdlc-20180504/frontend/ast/Name.cpp
Examining data/fauhdlc-20180504/frontend/ast/AstNode.hpp
Examining data/fauhdlc-20180504/frontend/ast/ValDeclaration.hpp
Examining data/fauhdlc-20180504/frontend/ast/LibraryList.hpp
Examining data/fauhdlc-20180504/frontend/ast/ConstantDeclaration.hpp
Examining data/fauhdlc-20180504/frontend/ast/VarDeclaration.hpp
Examining data/fauhdlc-20180504/frontend/ast/ConditionedStat.hpp
Examining data/fauhdlc-20180504/frontend/ast/ConstInteger.hpp
Examining data/fauhdlc-20180504/frontend/ast/Slice.hpp
Examining data/fauhdlc-20180504/frontend/ast/Expression.cpp
Examining data/fauhdlc-20180504/frontend/ast/ExitStat.hpp
Examining data/fauhdlc-20180504/frontend/ast/AttributableDeclaration.cpp
Examining data/fauhdlc-20180504/frontend/ast/LoopStat.hpp
Examining data/fauhdlc-20180504/frontend/ast/RecordType.cpp
Examining data/fauhdlc-20180504/frontend/ast/ConstReal.hpp
Examining data/fauhdlc-20180504/frontend/ast/SimpleName.cpp
Examining data/fauhdlc-20180504/frontend/ast/RangeConstraintType.hpp
Examining data/fauhdlc-20180504/frontend/ast/ForLoopStat.hpp
Examining data/fauhdlc-20180504/frontend/ast/LibUnit.hpp
Examining data/fauhdlc-20180504/frontend/ast/AttributeSpecification.cpp
Examining data/fauhdlc-20180504/frontend/ast/AttributeDeclaration.hpp
Examining data/fauhdlc-20180504/frontend/ast/Types.cpp
Examining data/fauhdlc-20180504/frontend/ast/TypeDeclaration.hpp
Examining data/fauhdlc-20180504/frontend/ast/Aggregate.hpp
Examining data/fauhdlc-20180504/frontend/ast/ReturnStat.hpp
Examining data/fauhdlc-20180504/frontend/ast/DiscreteRange.hpp
Examining data/fauhdlc-20180504/frontend/ast/Package.hpp
Examining data/fauhdlc-20180504/frontend/ast/PrefixedName.hpp
Examining data/fauhdlc-20180504/frontend/ast/CaseAlternative.hpp
Examining data/fauhdlc-20180504/frontend/ast/VarAssignStat.hpp
Examining data/fauhdlc-20180504/frontend/ast/Location.cpp
Examining data/fauhdlc-20180504/frontend/ast/EnumerationType.hpp
Examining data/fauhdlc-20180504/frontend/ast/SimpleName.hpp
Examining data/fauhdlc-20180504/frontend/ast/SubtypeIndication.cpp
Examining data/fauhdlc-20180504/frontend/ast/Subscript.hpp
Examining data/fauhdlc-20180504/frontend/ast/Name.hpp
Examining data/fauhdlc-20180504/frontend/ast/RecordType.hpp
Examining data/fauhdlc-20180504/frontend/ast/Architecture.hpp
Examining data/fauhdlc-20180504/frontend/ast/CondalSigAssign.hpp
Examining data/fauhdlc-20180504/frontend/ast/RecordTypeElement.hpp
Examining data/fauhdlc-20180504/frontend/ast/ConcurrentStat.hpp
Examining data/fauhdlc-20180504/frontend/ast/AttributeDeclaration.cpp
Examining data/fauhdlc-20180504/frontend/ast/Process.hpp
Examining data/fauhdlc-20180504/frontend/ast/WaitStat.hpp
Examining data/fauhdlc-20180504/frontend/ast/SigAssignStat.hpp
Examining data/fauhdlc-20180504/frontend/ast/PhysicalTypeUnit.hpp
Examining data/fauhdlc-20180504/frontend/ast/Location.hpp
Examining data/fauhdlc-20180504/frontend/ast/Entity.hpp
Examining data/fauhdlc-20180504/frontend/ast/Others.hpp
Examining data/fauhdlc-20180504/frontend/ast/ConstInteger.cpp
Examining data/fauhdlc-20180504/frontend/ast/Expression.hpp
Examining data/fauhdlc-20180504/frontend/ast/ConstArray.hpp
Examining data/fauhdlc-20180504/frontend/ast/TemporaryName.hpp
Examining data/fauhdlc-20180504/frontend/ast/SelectedName.hpp
Examining data/fauhdlc-20180504/frontend/ast/ProcedureDeclaration.hpp
Examining data/fauhdlc-20180504/frontend/ast/ElementAssociation.hpp
Examining data/fauhdlc-20180504/frontend/ast/FunctionDeclaration.hpp
Examining data/fauhdlc-20180504/frontend/ast/Types.hpp
Examining data/fauhdlc-20180504/frontend/ast/AttributeName.hpp
Examining data/fauhdlc-20180504/frontend/ast/SubprogBody.hpp
Examining data/fauhdlc-20180504/frontend/ast/AssociationElement.hpp
Examining data/fauhdlc-20180504/frontend/ast/AssertStat.hpp
Examining data/fauhdlc-20180504/frontend/ast/AttributableDeclaration.hpp
Examining data/fauhdlc-20180504/frontend/ast/NextStat.hpp
Examining data/fauhdlc-20180504/frontend/ast/AstNode.cpp
Examining data/fauhdlc-20180504/frontend/ast/CaseStat.hpp
Examining data/fauhdlc-20180504/frontend/ast/SymbolDeclaration.cpp
Examining data/fauhdlc-20180504/frontend/ast/PackageBody.hpp
Examining data/fauhdlc-20180504/frontend/ast/PhysicalType.hpp
Examining data/fauhdlc-20180504/frontend/ast/ProcCallStat.hpp
Examining data/fauhdlc-20180504/frontend/ast/Callable.hpp
Examining data/fauhdlc-20180504/frontend/ast/PhysicalType.cpp
Examining data/fauhdlc-20180504/frontend/ast/FunctionCall.hpp
Examining data/fauhdlc-20180504/frontend/ast/DiscreteRange.cpp
Examining data/fauhdlc-20180504/frontend/misc/Driver.cpp
Examining data/fauhdlc-20180504/frontend/misc/NameLookup.hpp
Examining data/fauhdlc-20180504/frontend/misc/Symbol.hpp
Examining data/fauhdlc-20180504/frontend/misc/DeclarativeRegion.cpp
Examining data/fauhdlc-20180504/frontend/misc/RegisterBuiltins.cpp
Examining data/fauhdlc-20180504/frontend/misc/RangeSet.hpp
Examining data/fauhdlc-20180504/frontend/misc/StackTrace.cpp
Examining data/fauhdlc-20180504/frontend/misc/BuiltinSymbolTable.cpp
Examining data/fauhdlc-20180504/frontend/misc/RegisterBuiltins.hpp
Examining data/fauhdlc-20180504/frontend/misc/DeclarativeRegion.hpp
Examining data/fauhdlc-20180504/frontend/misc/BuiltinFunction.hpp
Examining data/fauhdlc-20180504/frontend/misc/Compiler.hpp
Examining data/fauhdlc-20180504/frontend/misc/Symbol.cpp
Examining data/fauhdlc-20180504/frontend/misc/SymbolTable.hpp
Examining data/fauhdlc-20180504/frontend/misc/NameLookup.cpp
Examining data/fauhdlc-20180504/frontend/misc/StackTrace.hpp
Examining data/fauhdlc-20180504/frontend/misc/Driver.hpp
Examining data/fauhdlc-20180504/frontend/misc/SymbolTable.cpp
Examining data/fauhdlc-20180504/frontend/misc/RangeSet.cpp
Examining data/fauhdlc-20180504/frontend/misc/BuiltinSymbolTable.hpp
Examining data/fauhdlc-20180504/util/mangle_names.c
Examining data/fauhdlc-20180504/util/basetypes.h
Examining data/fauhdlc-20180504/util/GarbageCollect.hpp
Examining data/fauhdlc-20180504/util/MiscUtil.hpp
Examining data/fauhdlc-20180504/util/mangle_names.h
Examining data/fauhdlc-20180504/intermediate/container/CodeContainer.hpp
Examining data/fauhdlc-20180504/intermediate/container/TypeElement.hpp
Examining data/fauhdlc-20180504/intermediate/container/TypeFactory.hpp
Examining data/fauhdlc-20180504/intermediate/container/LabelFactory.hpp
Examining data/fauhdlc-20180504/intermediate/container/Data.hpp
Examining data/fauhdlc-20180504/intermediate/container/LabelFactory.cpp
Examining data/fauhdlc-20180504/intermediate/container/Label.hpp
Examining data/fauhdlc-20180504/intermediate/container/TypeFactory.cpp
Examining data/fauhdlc-20180504/intermediate/container/Type.hpp
Examining data/fauhdlc-20180504/intermediate/visitor/StandardTraversal.cpp
Examining data/fauhdlc-20180504/intermediate/visitor/LookupSymbols.hpp
Examining data/fauhdlc-20180504/intermediate/visitor/GenCCode.hpp
Examining data/fauhdlc-20180504/intermediate/visitor/LookupSymbols.cpp
Examining data/fauhdlc-20180504/intermediate/visitor/PrintCode.hpp
Examining data/fauhdlc-20180504/intermediate/visitor/PrintCode.cpp
Examining data/fauhdlc-20180504/intermediate/visitor/GenCCode.cpp
Examining data/fauhdlc-20180504/intermediate/visitor/StandardTraversal.hpp
Examining data/fauhdlc-20180504/intermediate/visitor/Visitor.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/Sub.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/Je.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/GetParam.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/Mov.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/OpCode.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/Log.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/GetSig.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/Proc.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/IMul.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/AOffset.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/Return.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/Suspend.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/Call.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/Abort.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/Div.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/SetParam.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/BeginTransfer.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/Add.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/ROffset.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/Jne.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/EndTransfer.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/Jb.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/Update.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/WakeAt.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/Connect.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/Jbe.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/GetSimTime.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/Jmp.hpp
Examining data/fauhdlc-20180504/intermediate/opcodes/WakeOn.hpp
Examining data/fauhdlc-20180504/intermediate/operands/ImmediateOperand.cpp
Examining data/fauhdlc-20180504/intermediate/operands/Register.hpp
Examining data/fauhdlc-20180504/intermediate/operands/RegisterFactory.hpp
Examining data/fauhdlc-20180504/intermediate/operands/ImmediateOperand.hpp
Examining data/fauhdlc-20180504/intermediate/operands/Reference.hpp
Examining data/fauhdlc-20180504/intermediate/operands/IndirectOperand.hpp
Examining data/fauhdlc-20180504/intermediate/operands/Operand.hpp
Examining data/fauhdlc-20180504/intermediate/operands/RegisterFactory.cpp
Examining data/fauhdlc-20180504/intermediate/Node.hpp
Examining data/fauhdlc-20180504/lib/ckernel.c
Examining data/fauhdlc-20180504/lib/runtime.h
Examining data/fauhdlc-20180504/compiler/FAUhdlc.hpp
Examining data/fauhdlc-20180504/compiler/FAUhdlc.cpp
FINAL RESULTS:
data/fauhdlc-20180504/frontend/misc/StackTrace.cpp:99:7: [4] (shell) popen:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
fp = popen(cmd, "r");
data/fauhdlc-20180504/interpreter/glue/glue-log.c:61:2: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(buf, type);
data/fauhdlc-20180504/interpreter/glue/glue-log.c:64:3: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(buf, name);
data/fauhdlc-20180504/interpreter/glue/glue-log.c:69:2: [4] (format) vsprintf:
Potential format string problem (CWE-134). Make format string constant.
vsprintf(buf + strlen(buf), fmt, args);
data/fauhdlc-20180504/interpreter/glue/glue-log.h:38:26: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
__attribute__ ((format (printf, 4, 5)));
data/fauhdlc-20180504/interpreter/kernel.c:471:8: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
n = snprintf(buf, sizeof(buf), "%s__%" PRIi64, name,
data/fauhdlc-20180504/interpreter/kernel.c:497:7: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
n = snprintf(buf, sizeof(buf), "%s__%" PRIi64, name, cnt);
data/fauhdlc-20180504/compiler/FAUhdlc.cpp:101:7: [3] (buffer) getopt_long:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
c = getopt_long(argc, argv, "-pd:c:l:o:hW:C:f", l_opts, NULL);
data/fauhdlc-20180504/interpreter/interpreter.c:127:7: [3] (buffer) getopt_long:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
c = getopt_long(argc, argv, "s:o:dt:", l_opts, NULL);
data/fauhdlc-20180504/lib/ckernel.c:98:7: [3] (buffer) getopt_long:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
c = getopt_long(argc, argv, "s:o:t:h", l_opts, NULL);
data/fauhdlc-20180504/compiler/FAUhdlc.cpp:284:10: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
stream.open(this->dotParseFile, std::ofstream::out);
data/fauhdlc-20180504/compiler/FAUhdlc.cpp:347:10: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
stream.open(this->dotConstFile, std::ofstream::out);
data/fauhdlc-20180504/compiler/FAUhdlc.cpp:455:6: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
out.open(this->outputFile, std::ofstream::out);
data/fauhdlc-20180504/compiler/FAUhdlc.cpp:477:6: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
out.open(this->cFile, std::ofstream::out);
data/fauhdlc-20180504/frontend/ast/SymbolDeclaration.cpp:18:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[2048];
data/fauhdlc-20180504/frontend/misc/StackTrace.cpp:91:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char cmd[4096];
data/fauhdlc-20180504/frontend/newparser/ParserDriver.cpp:98:11: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
inStream.open(filename.c_str(), std::ifstream::in);
data/fauhdlc-20180504/frontend/newparser/ParserDriver.cpp:292:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char lookupHex[16][5] = {
data/fauhdlc-20180504/frontend/newparser/ParserDriver.cpp:329:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char lookupOctal[8][4] = {
data/fauhdlc-20180504/interpreter/fauhdli.c:308:9: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
yyin = fopen(file_name, "r");
data/fauhdlc-20180504/interpreter/glue/glue-log.c:36:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[1024];
data/fauhdlc-20180504/interpreter/glue/glue-log.c:52:26: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
case FAUHDLI_LOG_FATAL: strcpy(buf, "FATAL:"); break;
data/fauhdlc-20180504/interpreter/glue/glue-log.c:53:29: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
case FAUHDLI_LOG_CRITICAL: strcpy(buf, "CRITICAL:"); break;
data/fauhdlc-20180504/interpreter/glue/glue-log.c:54:26: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
case FAUHDLI_LOG_ERROR: strcpy(buf, "ERROR:"); break;
data/fauhdlc-20180504/interpreter/glue/glue-log.c:55:28: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
case FAUHDLI_LOG_WARNING: strcpy(buf, "WARNING:"); break;
data/fauhdlc-20180504/interpreter/glue/glue-log.c:56:25: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
case FAUHDLI_LOG_INFO: strcpy(buf, "INFO:"); break;
data/fauhdlc-20180504/interpreter/glue/glue-log.c:57:26: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
case FAUHDLI_LOG_DEBUG: strcpy(buf, "DEBUG:"); break;
data/fauhdlc-20180504/interpreter/glue/glue-log.c:66:2: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant string.
strcat(buf, ": ");
data/fauhdlc-20180504/interpreter/kernel.c:231:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[2048];
data/fauhdlc-20180504/interpreter/kernel.c:451:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[8192];
data/fauhdlc-20180504/interpreter/kernel.c:533:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[8192];
data/fauhdlc-20180504/interpreter/kernel.c:642:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char buf[8192];
data/fauhdlc-20180504/interpreter/kernel.c:1395:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char demangled[2048];
data/fauhdlc-20180504/interpreter/kernel.c:1447:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[8192];
data/fauhdlc-20180504/interpreter/kernel.c:1471:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[8192];
data/fauhdlc-20180504/interpreter/kernel.c:2393:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[2048];
data/fauhdlc-20180504/interpreter/kernel.c:2662:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[2048];
data/fauhdlc-20180504/interpreter/log.c:36:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char demangled[2048];
data/fauhdlc-20180504/interpreter/trace.c:42:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char ret[65] = { '\0' };
data/fauhdlc-20180504/interpreter/trace.c:97:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[4096];
data/fauhdlc-20180504/interpreter/trace.c:281:16: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
ret->output = fopen(trace_file, "w");
data/fauhdlc-20180504/interpreter/util/fauhdlstring.c:24:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ret, src, len);
data/fauhdlc-20180504/lib/ckernel.c:51:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[2048];
data/fauhdlc-20180504/util/mangle_names.c:49:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(s, rep, rep_len);
data/fauhdlc-20180504/interpreter/glue/glue-log.c:60:2: [1] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant character.
strcat(buf, " ");
data/fauhdlc-20180504/interpreter/glue/glue-log.c:63:3: [1] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant character.
strcat(buf, " ");
data/fauhdlc-20180504/interpreter/glue/glue-log.c:69:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
vsprintf(buf + strlen(buf), fmt, args);
data/fauhdlc-20180504/interpreter/kernel.c:631:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(s->name) == 0) {
data/fauhdlc-20180504/interpreter/kernel.c:1474:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(buf, n, sizeof(buf));
data/fauhdlc-20180504/interpreter/kernel.c:1483:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
sz = strlen(buf);
data/fauhdlc-20180504/interpreter/trace.c:167:32: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
assert(sig->value.univ_int < strlen(std_logic_vals));
data/fauhdlc-20180504/interpreter/util/fauhdlstring.c:19:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t len = strlen(src) + 1;
data/fauhdlc-20180504/util/mangle_names.c:28:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
tok_len = strlen(tok);
data/fauhdlc-20180504/util/mangle_names.c:29:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
rep_len = strlen(rep);
data/fauhdlc-20180504/util/mangle_names.c:41:10: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
cnt = strlen(remainder) + 1;
data/fauhdlc-20180504/util/mangle_names.c:69:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return strlen(dst);
ANALYSIS SUMMARY:
Hits = 56
Lines analyzed = 49420 in approximately 1.11 seconds (44479 lines/second)
Physical Source Lines of Code (SLOC) = 29265
Hits@level = [0] 48 [1] 12 [2] 34 [3] 3 [4] 7 [5] 0
Hits@level+ = [0+] 104 [1+] 56 [2+] 44 [3+] 10 [4+] 7 [5+] 0
Hits/KSLOC@level+ = [0+] 3.55373 [1+] 1.91355 [2+] 1.5035 [3+] 0.341705 [4+] 0.239194 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.