Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/jose-10/lib/hsh.h
Examining data/jose-10/lib/hooks.c
Examining data/jose-10/lib/misc.c
Examining data/jose-10/lib/zlib/deflate.c
Examining data/jose-10/lib/b64.c
Examining data/jose-10/lib/jwe.c
Examining data/jose-10/lib/jwk.c
Examining data/jose-10/lib/openssl/ecdhes.c
Examining data/jose-10/lib/openssl/ecdsa.c
Examining data/jose-10/lib/openssl/misc.c
Examining data/jose-10/lib/openssl/jwk.c
Examining data/jose-10/lib/openssl/aesgcm.c
Examining data/jose-10/lib/openssl/dir.c
Examining data/jose-10/lib/openssl/oct.c
Examining data/jose-10/lib/openssl/aesgcmkw.c
Examining data/jose-10/lib/openssl/aescbch.c
Examining data/jose-10/lib/openssl/ecdh.c
Examining data/jose-10/lib/openssl/hash.c
Examining data/jose-10/lib/openssl/hmac.c
Examining data/jose-10/lib/openssl/aeskw.c
Examining data/jose-10/lib/openssl/rsa.c
Examining data/jose-10/lib/openssl/lock.c
Examining data/jose-10/lib/openssl/compat.c
Examining data/jose-10/lib/openssl/compat.h
Examining data/jose-10/lib/openssl/pbes2.c
Examining data/jose-10/lib/openssl/misc.h
Examining data/jose-10/lib/openssl/rsassa.c
Examining data/jose-10/lib/openssl/ec.c
Examining data/jose-10/lib/openssl/ecmr.c
Examining data/jose-10/lib/openssl/rsaes.c
Examining data/jose-10/lib/cfg.c
Examining data/jose-10/lib/hsh.c
Examining data/jose-10/lib/misc.h
Examining data/jose-10/lib/jws.c
Examining data/jose-10/lib/hooks.h
Examining data/jose-10/lib/io.c
Examining data/jose-10/cmd/jwe/dec.c
Examining data/jose-10/cmd/jwe/enc.c
Examining data/jose-10/cmd/jwe/jwe.h
Examining data/jose-10/cmd/jwe/fmt.c
Examining data/jose-10/cmd/jwe/pwd.h
Examining data/jose-10/cmd/jose.h
Examining data/jose-10/cmd/jose.c
Examining data/jose-10/cmd/jws/ver.c
Examining data/jose-10/cmd/jws/sig.c
Examining data/jose-10/cmd/jws/jws.h
Examining data/jose-10/cmd/jws/fmt.c
Examining data/jose-10/cmd/alg.c
Examining data/jose-10/cmd/jwk/use.c
Examining data/jose-10/cmd/jwk/eql.c
Examining data/jose-10/cmd/jwk/thp.c
Examining data/jose-10/cmd/jwk/jwk.h
Examining data/jose-10/cmd/jwk/exc.c
Examining data/jose-10/cmd/jwk/gen.c
Examining data/jose-10/cmd/jwk/pub.c
Examining data/jose-10/cmd/b64/b64.h
Examining data/jose-10/cmd/b64/dec.c
Examining data/jose-10/cmd/b64/enc.c
Examining data/jose-10/cmd/fmt.c
Examining data/jose-10/tests/alg_comp.c
Examining data/jose-10/tests/alg_sign.c
Examining data/jose-10/tests/api_jws.c
Examining data/jose-10/tests/alg_wrap.c
Examining data/jose-10/tests/api_jwe.c
Examining data/jose-10/tests/api_b64.c
Examining data/jose-10/tests/alg_encr.c
Examining data/jose-10/tests/alg_hash.c
Examining data/jose-10/jose/jose.h
Examining data/jose-10/jose/b64.h
Examining data/jose-10/jose/io.h
Examining data/jose-10/jose/jwk.h
Examining data/jose-10/jose/jws.h
Examining data/jose-10/jose/openssl.h
Examining data/jose-10/jose/cfg.h
Examining data/jose-10/jose/jwe.h
FINAL RESULTS:
data/jose-10/cmd/fmt.c:30:9: [4] (buffer) sscanf:
The scanf() family's %s operation, without a limit specification, permits
buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
different input function.
#define sscanf __mingw_sscanf
data/jose-10/cmd/jose.c:507:13: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(cmd, name);
data/jose-10/jose/cfg.h:129:28: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
void __attribute__((format(printf, 5, 6)))
data/jose-10/lib/cfg.c:71:5: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
vfprintf(stderr, fmt, ap);
data/jose-10/tests/alg_hash.c:23:9: [4] (buffer) sscanf:
The scanf() family's %s operation, without a limit specification, permits
buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
different input function.
#define sscanf __mingw_sscanf
data/jose-10/tests/api_b64.c:26:9: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
#define fprintf __mingw_fprintf
data/jose-10/cmd/jose.c:128:22: [3] (buffer) getopt_long:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
for (int c; (c = getopt_long(argc, argv, sopts, lopts, NULL)) >= 0; ) {
data/jose-10/cmd/alg.c:136:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char *names[len];
data/jose-10/cmd/fmt.c:73:16: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
file = fopen(s, "w");
data/jose-10/cmd/fmt.c:105:16: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
file = fopen(s, "w");
data/jose-10/cmd/fmt.c:151:12: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
file = fopen(s, "w");
data/jose-10/cmd/jose.c:106:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char sopts[ncfgs * 3 + 3];
data/jose-10/cmd/jose.c:116:5: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(sopts, "hv");
data/jose-10/cmd/jose.c:237:25: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
io->input = fopen(arg, "r");
data/jose-10/cmd/jose.c:268:17: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
*file = fopen(arg, "r");
data/jose-10/cmd/jose.c:281:17: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
*file = fopen(arg, "w");
data/jose-10/cmd/jose.c:313:31: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE_AUTO *file = fopen(arg, "r");
data/jose-10/cmd/jose.c:336:31: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE_AUTO *file = fopen(arg, "r");
data/jose-10/cmd/jose.c:366:27: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE_AUTO *file = fopen(arg, "r");
data/jose-10/cmd/jose.c:482:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char full[40] = {};
data/jose-10/cmd/jose.c:488:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cmd[len];
data/jose-10/cmd/jose.c:492:9: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(cmd, "jose");
data/jose-10/cmd/jose.c:524:9: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(full, "jose");
data/jose-10/cmd/jwe/pwd.h:27:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char pwd[4096];
data/jose-10/cmd/jwe/pwd.h:47:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char pwd[4096];
data/jose-10/cmd/jwe/pwd.h:51:11: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
tty = fopen("/dev/tty", "r+");
data/jose-10/cmd/jwk/thp.c:148:13: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char enc[elen];
data/jose-10/lib/b64.c:33:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char eb[16 * JOSE_B64_ENC_BLK];
data/jose-10/lib/b64.c:89:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&i->eb[i->len], enc, el);
data/jose-10/lib/b64.c:141:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&i->db[i->len], dec, dl);
data/jose-10/lib/hsh.c:31:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char b[1024] = {};
data/jose-10/lib/io.c:90:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&tmp[*i->len], in, len);
data/jose-10/lib/io.c:159:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&i->buf[*i->len], in, len);
data/jose-10/lib/openssl/ecdhes.c:106:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&dk[c * hshl], hsh, c == reps ? left : hshl);
data/jose-10/lib/openssl/pbes2.c:57:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ky[KEYMAX];
data/jose-10/lib/openssl/pbes2.c:59:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(slt, alg, pfx);
data/jose-10/lib/openssl/pbes2.c:60:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&slt[pfx], st, stl);
data/jose-10/cmd/b64/dec.c:79:18: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
for (int c = fgetc(opt.input); c != EOF; c = fgetc(opt.input)) {
data/jose-10/cmd/b64/dec.c:79:50: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
for (int c = fgetc(opt.input); c != EOF; c = fgetc(opt.input)) {
data/jose-10/cmd/b64/enc.c:78:18: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
for (int c = fgetc(opt.input); c != EOF; c = fgetc(opt.input)) {
data/jose-10/cmd/b64/enc.c:78:50: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
for (int c = fgetc(opt.input); c != EOF; c = fgetc(opt.input)) {
data/jose-10/cmd/jose.c:38:13: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c = fgetc(file);
data/jose-10/cmd/jose.c:88:19: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(cfg->doc[i].arg);
data/jose-10/cmd/jose.c:92:19: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(cfg->opt.name) + len;
data/jose-10/cmd/jose.c:119:9: [1] (buffer) strncat:
Easily used incorrectly (e.g., incorrectly computing the correct maximum
size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf,
or automatically resizing strings.
strncat(sopts, &(char) { cfgs[i].opt.val }, 1);
data/jose-10/cmd/jose.c:122:33: [1] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant character.
case optional_argument: strcat(sopts, ":"); /* fallthrough */
data/jose-10/cmd/jose.c:123:33: [1] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant character.
case required_argument: strcat(sopts, ":"); /* fallthrough */
data/jose-10/cmd/jose.c:168:40: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
n, d, maxl - (int) strlen(n), a,
data/jose-10/cmd/jose.c:202:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t len = strlen(&arg[i]);
data/jose-10/cmd/jose.c:407:18: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
for (int c = fgetc(file); c != EOF && c != '.'; c = fgetc(file)) {
data/jose-10/cmd/jose.c:407:57: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
for (int c = fgetc(file); c != EOF && c != '.'; c = fgetc(file)) {
data/jose-10/cmd/jose.c:486:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len += strlen(argv[i]) + 1;
data/jose-10/cmd/jose.c:506:13: [1] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant character.
strcat(cmd, " ");
data/jose-10/cmd/jose.c:526:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
snprintf(full + strlen(full),
data/jose-10/cmd/jose.c:527:37: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
sizeof(full) - strlen(full) - 1,
data/jose-10/cmd/jwe/dec.c:94:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return strncmp(alg, "PBES2", strlen("PBES2")) == 0;
data/jose-10/cmd/jwe/dec.c:182:22: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
for (int c = fgetc(f); c != EOF; c = fgetc(f)) {
data/jose-10/cmd/jwe/dec.c:182:46: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
for (int c = fgetc(f); c != EOF; c = fgetc(f)) {
data/jose-10/cmd/jwe/dec.c:193:17: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c = fgetc(opt.io.input);
data/jose-10/cmd/jwe/enc.c:47:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(p) < 8) {
data/jose-10/cmd/jwe/enc.c:287:22: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
for (int c = fgetc(f); c != EOF; c = fgetc(f)) {
data/jose-10/cmd/jwe/enc.c:287:46: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
for (int c = fgetc(f); c != EOF; c = fgetc(f)) {
data/jose-10/cmd/jwe/enc.c:298:17: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c = fgetc(opt.io.input);
data/jose-10/cmd/jwe/fmt.c:121:22: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
for (int c = fgetc(f); c != EOF; c = fgetc(f)) {
data/jose-10/cmd/jwe/fmt.c:121:46: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
for (int c = fgetc(f); c != EOF; c = fgetc(f)) {
data/jose-10/cmd/jwe/fmt.c:132:17: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c = fgetc(opt.input);
data/jose-10/cmd/jwe/pwd.h:33:17: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
int c = fgetc(stdin);
data/jose-10/cmd/jwe/pwd.h:69:17: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
int c = fgetc(tty);
data/jose-10/cmd/jwk/thp.c:173:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
} else if (strlen(opt.find) == elen &&
data/jose-10/cmd/jws/fmt.c:95:22: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
for (int c = fgetc(f); c != EOF; c = fgetc(f)) {
data/jose-10/cmd/jws/fmt.c:95:46: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
for (int c = fgetc(f); c != EOF; c = fgetc(f)) {
data/jose-10/cmd/jws/fmt.c:106:17: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c = fgetc(opt.input);
data/jose-10/cmd/jws/sig.c:187:22: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
for (int c = fgetc(f); c != EOF; c = fgetc(f)) {
data/jose-10/cmd/jws/sig.c:187:46: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
for (int c = fgetc(f); c != EOF; c = fgetc(f)) {
data/jose-10/cmd/jws/sig.c:198:17: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c = fgetc(opt.io.input);
data/jose-10/cmd/jws/ver.c:133:22: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
for (int c = fgetc(f); c != EOF; c = fgetc(f)) {
data/jose-10/cmd/jws/ver.c:133:46: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
for (int c = fgetc(f); c != EOF; c = fgetc(f)) {
data/jose-10/cmd/jws/ver.c:144:17: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c = fgetc(opt.io.input);
data/jose-10/lib/b64.c:217:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
const size_t len = strlen(map);
data/jose-10/lib/b64.c:386:47: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
out = jose_b64_enc((const uint8_t *) buf, strlen(buf));
data/jose-10/lib/b64.c:387:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
zero(buf, strlen(buf));
data/jose-10/lib/jwk.c:356:31: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
thp = hsh(cfg, hash, str, strlen(str));
data/jose-10/lib/jwk.c:357:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
zero(str, strlen(str));
data/jose-10/lib/jwk.c:375:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = hsh_buf(cfg, alg, str, strlen(str), thp, len);
data/jose-10/lib/jwk.c:376:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
zero(str, strlen(str));
data/jose-10/lib/openssl/aescbch.c:296:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
i->al += strlen(prt);
data/jose-10/lib/openssl/aescbch.c:297:44: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (HMAC_Update(i->hctx, (void *) prt, strlen(prt)) <= 0)
data/jose-10/lib/openssl/aescbch.c:305:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
i->al += strlen(aad);
data/jose-10/lib/openssl/aescbch.c:306:48: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (HMAC_Update(i->hctx, (void *) aad, strlen(aad)) <= 0)
data/jose-10/lib/openssl/ecdhes.c:225:26: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
name, strlen(name),
data/jose-10/lib/openssl/hmac.c:148:53: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (prot && HMAC_Update(hctx, (uint8_t *) prot, strlen(prot)) <= 0)
data/jose-10/lib/openssl/pbes2.c:54:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
const size_t pfx = strlen(alg) + 1;
data/jose-10/lib/openssl/rsassa.c:163:45: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (prot && EVP_DigestUpdate(emc, prot, strlen(prot)) <= 0)
data/jose-10/tests/alg_comp.c:79:52: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
const size_t ilen = jose_b64_dec_buf(NULL, strlen(tests[i].inf), NULL, 0);
data/jose-10/tests/alg_comp.c:80:52: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
const size_t dlen = jose_b64_dec_buf(NULL, strlen(tests[i].def), NULL, 0);
data/jose-10/tests/alg_comp.c:91:47: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
assert(jose_b64_dec_buf(tests[i].inf, strlen(tests[i].inf),
data/jose-10/tests/alg_comp.c:93:47: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
assert(jose_b64_dec_buf(tests[i].def, strlen(tests[i].def),
data/jose-10/tests/alg_encr.c:52:31: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
assert(e->feed(e, pt, strlen(pt)));
data/jose-10/tests/alg_encr.c:75:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
assert(dlen == strlen(pt));
data/jose-10/tests/alg_hash.c:73:32: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for (size_t i = 0; i < strlen(msg); i++)
data/jose-10/tests/alg_hash.c:76:36: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
assert(hsh->feed(hsh, msg, strlen(msg)));
data/jose-10/tests/alg_hash.c:95:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
assert(strlen(v[i].hsh) == sizeof(a) * 2);
data/jose-10/tests/alg_sign.c:41:36: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
assert(sio->feed(sio, pay, strlen(pay)));
data/jose-10/tests/alg_sign.c:53:36: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
assert(vio->feed(vio, pay, strlen(pay)));
data/jose-10/tests/api_b64.c:50:24: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
#pragma omp atomic read
ANALYSIS SUMMARY:
Hits = 105
Lines analyzed = 14489 in approximately 0.44 seconds (33129 lines/second)
Physical Source Lines of Code (SLOC) = 9735
Hits@level = [0] 121 [1] 68 [2] 30 [3] 1 [4] 6 [5] 0
Hits@level+ = [0+] 226 [1+] 105 [2+] 37 [3+] 7 [4+] 6 [5+] 0
Hits/KSLOC@level+ = [0+] 23.2152 [1+] 10.7858 [2+] 3.80072 [3+] 0.719055 [4+] 0.616333 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.