Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/libbtbb-2018.12.R1/lib/src/bluetooth_le_packet.c Examining data/libbtbb-2018.12.R1/lib/src/bluetooth_le_packet.h Examining data/libbtbb-2018.12.R1/lib/src/bluetooth_packet.c Examining data/libbtbb-2018.12.R1/lib/src/bluetooth_packet.h Examining data/libbtbb-2018.12.R1/lib/src/bluetooth_piconet.c Examining data/libbtbb-2018.12.R1/lib/src/bluetooth_piconet.h Examining data/libbtbb-2018.12.R1/lib/src/btbb.h Examining data/libbtbb-2018.12.R1/lib/src/companies.c Examining data/libbtbb-2018.12.R1/lib/src/pcap-common.h Examining data/libbtbb-2018.12.R1/lib/src/pcap.c Examining data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c Examining data/libbtbb-2018.12.R1/lib/src/pcapng-bt.h Examining data/libbtbb-2018.12.R1/lib/src/pcapng.c Examining data/libbtbb-2018.12.R1/lib/src/pcapng.h Examining data/libbtbb-2018.12.R1/lib/src/sw_check_tables.h Examining data/libbtbb-2018.12.R1/lib/src/uthash.h Examining data/libbtbb-2018.12.R1/tests/test_fec23.c Examining data/libbtbb-2018.12.R1/tests/test_header.c Examining data/libbtbb-2018.12.R1/tests/test_syndromes.c Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btatt/moduleinfo.h Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btatt/packet-btatt.c Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btbb/moduleinfo.h Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btbb/packet-btbb.c Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btbb/packet-btbrlmp.c Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btbredr/moduleinfo.h Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btbredr/packet-btbredr.c Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btbredr/packet-btlmp.c Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btle/moduleinfo.h Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btle/packet-btle.c Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btsm/moduleinfo.h Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btsm/packet-btsm.c Examining data/libbtbb-2018.12.R1/wireshark/plugins/btbb/moduleinfo.h Examining data/libbtbb-2018.12.R1/wireshark/plugins/btbb/packet-btbb.c Examining data/libbtbb-2018.12.R1/wireshark/plugins/btbb/packet-btbrlmp.c Examining data/libbtbb-2018.12.R1/wireshark/plugins/btbredr/moduleinfo.h Examining data/libbtbb-2018.12.R1/wireshark/plugins/btbredr/packet-btbredr.c Examining data/libbtbb-2018.12.R1/wireshark/plugins/btbredr/packet-btlmp.c FINAL RESULTS: data/libbtbb-2018.12.R1/lib/src/uthash.h:286:29: [4] (format) fprintf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. #define HASH_OOPS(...) do { fprintf(stderr,__VA_ARGS__); exit(-1); } while (0) data/libbtbb-2018.12.R1/lib/src/bluetooth_le_packet.c:348:78: [3] (random) random: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. static void _dump_addr(const char *name, const uint8_t *buf, int offset, int random) { data/libbtbb-2018.12.R1/lib/src/bluetooth_le_packet.c:353:20: [3] (random) random: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. printf(" (%s)\n", random ? "random" : "public"); data/libbtbb-2018.12.R1/lib/src/bluetooth_le_packet.c:285:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy((*pkt)->symbols, stream, MAX_LE_SYMBOLS); data/libbtbb-2018.12.R1/lib/src/bluetooth_packet.c:1147:4: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char corrected[80]; data/libbtbb-2018.12.R1/lib/src/bluetooth_packet.c:1183:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char header[18]; data/libbtbb-2018.12.R1/lib/src/bluetooth_packet.c:1184:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char unwhitened[18]; data/libbtbb-2018.12.R1/lib/src/bluetooth_packet.c:1203:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char header[18]; data/libbtbb-2018.12.R1/lib/src/bluetooth_packet.h:71:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char packet_header[18]; data/libbtbb-2018.12.R1/lib/src/bluetooth_packet.h:76:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char payload_header[16]; data/libbtbb-2018.12.R1/lib/src/bluetooth_packet.h:99:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char payload[MAX_PAYLOAD_LENGTH]; data/libbtbb-2018.12.R1/lib/src/bluetooth_packet.h:110:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char symbols[MAX_SYMBOLS]; data/libbtbb-2018.12.R1/lib/src/bluetooth_piconet.c:30:1: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char perm_table[0x20][0x20][0x200]; data/libbtbb-2018.12.R1/lib/src/pcap.c:59:20: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). FILE *pcap_file = fopen(filename, "w"); data/libbtbb-2018.12.R1/lib/src/pcap.c:163:10: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. (void) memcpy( &pkt->bredr_bb_header.bredr_payload[0], payload, caplen ); data/libbtbb-2018.12.R1/lib/src/pcap.c:308:9: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. (void) memcpy( &pkt->le_packet[0], lepkt, incl_len ); data/libbtbb-2018.12.R1/lib/src/pcap.c:412:10: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. (void) memcpy( &pcap_pkt.le_packet[0], &pkt->symbols[0], incl_len); data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:38:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char libname[8]; data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:139:4: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char desc[256]; data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:222:10: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. (void) memcpy( &pkt->bredr_bb_header.bredr_payload[0], payload, caplen ); data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:242:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char payload_bytes[caplen]; data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:383:4: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char desc[256]; data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:456:9: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. (void) memcpy( &pkt->le_packet[0], lepkt, caplen ); data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:508:9: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. (void) memcpy( &cropt.connection_info.pdu.bytes[0], pdu, 34 ); data/libbtbb-2018.12.R1/lib/src/pcapng.c:57:15: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). handle->fd = open( filename, O_RDWR|O_CREAT|O_EXCL, S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP ); data/libbtbb-2018.12.R1/lib/src/pcapng.c:201:11: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. (void) memcpy( dest, &padopt, sizeof( padopt ) ); data/libbtbb-2018.12.R1/lib/src/pcapng.c:210:11: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. (void) memcpy( dest, &padopt, sizeof( padopt ) ); data/libbtbb-2018.12.R1/lib/src/pcapng.c:238:11: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. (void) memcpy( dest, section_option, copysz ); data/libbtbb-2018.12.R1/lib/src/pcapng.c:245:11: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. (void) memcpy( dest, &padopt, sizeof( padopt ) ); data/libbtbb-2018.12.R1/lib/src/pcapng.c:268:11: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. (void) memcpy( dest, interface_option, copysz ); data/libbtbb-2018.12.R1/lib/src/pcapng.c:275:11: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. (void) memcpy( dest, &padopt, sizeof( padopt ) ); data/libbtbb-2018.12.R1/tests/test_fec23.c:38:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char input[20][15] = { data/libbtbb-2018.12.R1/tests/test_fec23.c:63:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char output[20][15] = { data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:146:11: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). (void) strncpy( &ifopt.desc[0], interface_desc, 256 ); data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:148:33: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). ifopt.header.option_length = strlen( ifopt.desc ); data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:390:11: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). (void) strncpy( &ifopt.desc[0], interface_desc, 256 ); data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:392:33: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). ifopt.header.option_length = strlen( ifopt.desc ); data/libbtbb-2018.12.R1/lib/src/uthash.h:262:41: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). HASH_FIND(hh,head,findstr,(unsigned)strlen(findstr),out) data/libbtbb-2018.12.R1/lib/src/uthash.h:264:34: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). HASH_ADD(hh,head,strfield[0],strlen(add->strfield),add) data/libbtbb-2018.12.R1/lib/src/uthash.h:266:48: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). HASH_REPLACE(hh,head,strfield[0],(unsigned)strlen(add->strfield),add,replaced) ANALYSIS SUMMARY: Hits = 40 Lines analyzed = 24723 in approximately 0.67 seconds (36864 lines/second) Physical Source Lines of Code (SLOC) = 20112 Hits@level = [0] 145 [1] 7 [2] 30 [3] 2 [4] 1 [5] 0 Hits@level+ = [0+] 185 [1+] 40 [2+] 33 [3+] 3 [4+] 1 [5+] 0 Hits/KSLOC@level+ = [0+] 9.19849 [1+] 1.98886 [2+] 1.64081 [3+] 0.149165 [4+] 0.0497216 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.