Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/libdbd-mysql-perl-4.050/constants.h
Examining data/libdbd-mysql-perl-4.050/dbdimp.h
Examining data/libdbd-mysql-perl-4.050/socket.c
Examining data/libdbd-mysql-perl-4.050/dbdimp.c
FINAL RESULTS:
data/libdbd-mysql-perl-4.050/dbdimp.c:1501:3: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(sock->net.sqlstate, "HY000");
data/libdbd-mysql-perl-4.050/dbdimp.c:1506:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sock->net.last_error, prefix, prefix_len);
data/libdbd-mysql-perl-4.050/dbdimp.c:1513:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sock->net.last_error + prefix_len, error, error_len);
data/libdbd-mysql-perl-4.050/dbdimp.c:1563:29: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
portNr= (port && *port) ? atoi(port) : 0;
data/libdbd-mysql-perl-4.050/dbdimp.c:2732:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[64];
data/libdbd-mysql-perl-4.050/dbdimp.c:3808:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char actual_row_num[64];
data/libdbd-mysql-perl-4.050/dbdimp.c:3931:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(actual_row_num, "%llu", imp_sth->row_num);
data/libdbd-mysql-perl-4.050/dbdimp.c:4932:13: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char key[100];
data/libdbd-mysql-perl-4.050/dbdimp.c:4936:25: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
keylen= sprintf(key, "%d", n);
data/libdbd-mysql-perl-4.050/dbdimp.c:5363:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (imp_dbh->pmysql, &save_socket, sizeof(save_socket));
data/libdbd-mysql-perl-4.050/dbdimp.c:506:7: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(options_list[ind], options, len);
data/libdbd-mysql-perl-4.050/dbdimp.c:1503:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
prefix_len = strlen(prefix);
data/libdbd-mysql-perl-4.050/dbdimp.c:1508:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
error_len = strlen(error);
data/libdbd-mysql-perl-4.050/dbdimp.c:2766:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (kl == strlen("auto_reconnect") && strEQ(key, "auto_reconnect"))
data/libdbd-mysql-perl-4.050/dbdimp.c:2770:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (kl == strlen("bind_type_guessing") &&
data/libdbd-mysql-perl-4.050/dbdimp.c:2775:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
else if (kl == strlen("bind_comment_placeholders") &&
data/libdbd-mysql-perl-4.050/dbdimp.c:2786:41: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
sv_2mortal(newSVpvn(clientinfo, strlen(clientinfo))) : &PL_sv_undef;
data/libdbd-mysql-perl-4.050/dbdimp.c:2800:40: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
result= sv_2mortal(newSVpvn(msg, strlen(msg)));
data/libdbd-mysql-perl-4.050/dbdimp.c:2802:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
else if (kl == strlen("enable_utf8mb4") && strEQ(key, "enable_utf8mb4"))
data/libdbd-mysql-perl-4.050/dbdimp.c:2804:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
else if (kl == strlen("enable_utf8") && strEQ(key, "enable_utf8"))
data/libdbd-mysql-perl-4.050/dbdimp.c:2815:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen("auto_reconnects_ok"),
data/libdbd-mysql-perl-4.050/dbdimp.c:2822:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen("auto_reconnects_failed"),
data/libdbd-mysql-perl-4.050/dbdimp.c:2857:39: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
sv_2mortal(newSVpvn(hostinfo, strlen(hostinfo))) : &PL_sv_undef;
data/libdbd-mysql-perl-4.050/dbdimp.c:2865:48: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
result= info ? sv_2mortal(newSVpvn(info, strlen(info))) : &PL_sv_undef;
data/libdbd-mysql-perl-4.050/dbdimp.c:2872:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (kl == strlen("no_autocommit_cmd") &&
data/libdbd-mysql-perl-4.050/dbdimp.c:2886:41: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
sv_2mortal(newSVpvn(serverinfo, strlen(serverinfo))) : &PL_sv_undef;
data/libdbd-mysql-perl-4.050/dbdimp.c:2899:36: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
sv_2mortal(newSVpvn(stats, strlen(stats))) : &PL_sv_undef;
data/libdbd-mysql-perl-4.050/dbdimp.c:2906:36: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
sv_2mortal(newSVpvn(stats, strlen(stats))) : &PL_sv_undef;
data/libdbd-mysql-perl-4.050/dbdimp.c:3055:32: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
str_last_ptr = statement + strlen(statement);
data/libdbd-mysql-perl-4.050/dbdimp.c:3151:40: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(statement));
data/libdbd-mysql-perl-4.050/dbdimp.c:3582:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(table, sbuf, slen);
data/libdbd-mysql-perl-4.050/dbdimp.c:4789:38: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
sv= newSVpvn(curField->name, strlen(curField->name));
data/libdbd-mysql-perl-4.050/dbdimp.c:4793:39: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
sv= newSVpvn(curField->table, strlen(curField->table));
data/libdbd-mysql-perl-4.050/dbdimp.c:5441:40: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!hv_store(hv, (char*) cols[i], strlen(cols[i]), newSViv(i), 0))
data/libdbd-mysql-perl-4.050/dbdimp.c:5701:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len= strlen(string);
ANALYSIS SUMMARY:
Hits = 35
Lines analyzed = 6336 in approximately 0.17 seconds (36235 lines/second)
Physical Source Lines of Code (SLOC) = 4761
Hits@level = [0] 1 [1] 25 [2] 10 [3] 0 [4] 0 [5] 0
Hits@level+ = [0+] 36 [1+] 35 [2+] 10 [3+] 0 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 7.56144 [1+] 7.3514 [2+] 2.1004 [3+] 0 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.