Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/gssdp-1.2.3/examples/test-browser.c
Examining data/gssdp-1.2.3/examples/test-publish.c
Examining data/gssdp-1.2.3/libgssdp/gssdp-client-private.h
Examining data/gssdp-1.2.3/libgssdp/gssdp-client.c
Examining data/gssdp-1.2.3/libgssdp/gssdp-client.h
Examining data/gssdp-1.2.3/libgssdp/gssdp-error.c
Examining data/gssdp-1.2.3/libgssdp/gssdp-error.h
Examining data/gssdp-1.2.3/libgssdp/gssdp-net-bionic.c
Examining data/gssdp-1.2.3/libgssdp/gssdp-net-posix.c
Examining data/gssdp-1.2.3/libgssdp/gssdp-net-win32.c
Examining data/gssdp-1.2.3/libgssdp/gssdp-net.h
Examining data/gssdp-1.2.3/libgssdp/gssdp-pktinfo-message.c
Examining data/gssdp-1.2.3/libgssdp/gssdp-pktinfo-message.h
Examining data/gssdp-1.2.3/libgssdp/gssdp-pktinfo6-message.c
Examining data/gssdp-1.2.3/libgssdp/gssdp-pktinfo6-message.h
Examining data/gssdp-1.2.3/libgssdp/gssdp-protocol.h
Examining data/gssdp-1.2.3/libgssdp/gssdp-resource-browser.c
Examining data/gssdp-1.2.3/libgssdp/gssdp-resource-browser.h
Examining data/gssdp-1.2.3/libgssdp/gssdp-resource-group.c
Examining data/gssdp-1.2.3/libgssdp/gssdp-resource-group.h
Examining data/gssdp-1.2.3/libgssdp/gssdp-socket-functions.c
Examining data/gssdp-1.2.3/libgssdp/gssdp-socket-functions.h
Examining data/gssdp-1.2.3/libgssdp/gssdp-socket-source.c
Examining data/gssdp-1.2.3/libgssdp/gssdp-socket-source.h
Examining data/gssdp-1.2.3/libgssdp/gssdp.h
Examining data/gssdp-1.2.3/tests/test-functional.c
Examining data/gssdp-1.2.3/tests/test-regression.c
Examining data/gssdp-1.2.3/tests/test-util.c
Examining data/gssdp-1.2.3/tests/test-util.h
Examining data/gssdp-1.2.3/tools/gssdp-device-sniffer.c
FINAL RESULTS:
data/gssdp-1.2.3/libgssdp/gssdp-resource-browser.c:532:17: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (version + 1, version_pattern);
data/gssdp-1.2.3/libgssdp/gssdp-resource-group.c:1292:17: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (version_str, VERSION_PATTERN);
data/gssdp-1.2.3/libgssdp/gssdp-resource-group.c:931:35: [3] (random) g_random_int_range:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
timeout = g_random_int_range (0, mx * 1000);
data/gssdp-1.2.3/libgssdp/gssdp-client.c:1497:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUF_SIZE], *end;
data/gssdp-1.2.3/libgssdp/gssdp-net-bionic.c:201:17: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (&tmp_iface, &ifaces[i], sizeof (struct ifreq));
data/gssdp-1.2.3/libgssdp/gssdp-net-bionic.c:273:17: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (&device->mask, netmask, sizeof (struct sockaddr_in));
data/gssdp-1.2.3/libgssdp/gssdp-net-posix.c:112:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[8196];
data/gssdp-1.2.3/libgssdp/gssdp-net-posix.c:397:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char addr_string[INET6_ADDRSTRLEN] = {0};
data/gssdp-1.2.3/libgssdp/gssdp-net-win32.c:94:17: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy (network, "127.0.0.0");
data/gssdp-1.2.3/libgssdp/gssdp-net-win32.c:170:17: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ip[INET6_ADDRSTRLEN];
data/gssdp-1.2.3/libgssdp/gssdp-net-win32.c:171:17: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char prefix[INET6_ADDRSTRLEN];
data/gssdp-1.2.3/libgssdp/gssdp-resource-browser.c:531:33: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
priv->version = atoi (version + 1);
data/gssdp-1.2.3/libgssdp/gssdp-resource-browser.c:1072:19: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
version = atoi ((tmp = g_match_info_fetch (info, 1)));
data/gssdp-1.2.3/libgssdp/gssdp-resource-group.c:892:31: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
if (mx_str == NULL || atoi (mx_str) <= 0) {
data/gssdp-1.2.3/libgssdp/gssdp-resource-group.c:905:14: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
mx = atoi (mx_str);
data/gssdp-1.2.3/libgssdp/gssdp-resource-group.c:910:27: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
version = atoi (version_str);
data/gssdp-1.2.3/libgssdp/gssdp-resource-group.c:1291:28: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
*version = atoi (version_str);
data/gssdp-1.2.3/tools/gssdp-device-sniffer.c:562:15: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char *headers[2][7] = { {"Time",
data/gssdp-1.2.3/libgssdp/gssdp-client.c:1308:33: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen (extended_message),
data/gssdp-1.2.3/libgssdp/gssdp-client.c:1438:42: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen (SSDP_SEARCH_METHOD)) == 0)
data/gssdp-1.2.3/libgssdp/gssdp-client.c:1442:47: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen (GENA_NOTIFY_METHOD)) == 0)
data/gssdp-1.2.3/libgssdp/gssdp-net-bionic.c:69:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy (ifr.ifr_ifrn.ifrn_name, device->iface_name, IFNAMSIZ);
data/gssdp-1.2.3/libgssdp/gssdp-net-bionic.c:99:9: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy (req.arp_dev, device->iface_name, sizeof (req.arp_dev) - 1);
data/gssdp-1.2.3/libgssdp/gssdp-net-posix.c:73:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy (ifr.ifr_ifrn.ifrn_name, device->iface_name, IFNAMSIZ);
data/gssdp-1.2.3/libgssdp/gssdp-net-posix.c:205:46: [1] (buffer) equal:
Function does not check the second iterator for over-read conditions
(CWE-126). This function is often discouraged by most C++ coding standards
in favor of its safer alternatives provided since C++14. Consider using a
form of this function that checks the second iterator before potentially
overflowing it.
if (!equal) {
data/gssdp-1.2.3/libgssdp/gssdp-net-posix.c:527:22: [1] (buffer) equal:
Function does not check the second iterator for over-read conditions
(CWE-126). This function is often discouraged by most C++ coding standards
in favor of its safer alternatives provided since C++14. Consider using a
form of this function that checks the second iterator before potentially
overflowing it.
if (!equal)
data/gssdp-1.2.3/libgssdp/gssdp-resource-browser.c:521:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen (target) + strlen (version_pattern));
data/gssdp-1.2.3/libgssdp/gssdp-resource-browser.c:521:48: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen (target) + strlen (version_pattern));
data/gssdp-1.2.3/libgssdp/gssdp-resource-browser.c:1119:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen (SSDP_ALIVE_NTS)) == 0)
data/gssdp-1.2.3/libgssdp/gssdp-resource-browser.c:1123:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen (SSDP_BYEBYE_NTS)) == 0)
data/gssdp-1.2.3/libgssdp/gssdp-resource-browser.c:1127:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen (SSDP_UPDATE_NTS)) == 0)
data/gssdp-1.2.3/libgssdp/gssdp-resource-group.c:1284:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen (target) + strlen (VERSION_PATTERN));
data/gssdp-1.2.3/libgssdp/gssdp-resource-group.c:1284:48: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen (target) + strlen (VERSION_PATTERN));
data/gssdp-1.2.3/tests/test-functional.c:155:51: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
g_socket_send_to (socket, sock_addr, msg, strlen (msg), NULL, &error);
data/gssdp-1.2.3/tests/test-regression.c:104:51: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
g_socket_send_to (socket, sock_addr, msg, strlen (msg), NULL, &error);
data/gssdp-1.2.3/tools/gssdp-device-sniffer.c:377:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (usn_tokens[1] && strlen(usn_tokens[1]) != 0) {
ANALYSIS SUMMARY:
Hits = 36
Lines analyzed = 9855 in approximately 0.21 seconds (46288 lines/second)
Physical Source Lines of Code (SLOC) = 6689
Hits@level = [0] 2 [1] 18 [2] 15 [3] 1 [4] 2 [5] 0
Hits@level+ = [0+] 38 [1+] 36 [2+] 18 [3+] 3 [4+] 2 [5+] 0
Hits/KSLOC@level+ = [0+] 5.68097 [1+] 5.38197 [2+] 2.69099 [3+] 0.448498 [4+] 0.298998 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.