Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/libpam-ccreds-10/acconfig.h
Examining data/libpam-ccreds-10/cc.h
Examining data/libpam-ccreds-10/cc_dump.c
Examining data/libpam-ccreds-10/cc_lib.c
Examining data/libpam-ccreds-10/cc_private.h
Examining data/libpam-ccreds-10/cc_test.c
Examining data/libpam-ccreds-10/ccreds_chkpwd.c
Examining data/libpam-ccreds-10/cc_db.c
Examining data/libpam-ccreds-10/cc_pam.c
FINAL RESULTS:
data/libpam-ccreds-10/cc_db.c:70:11: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
rc = db->open(db, NULL, filename, NULL,
data/libpam-ccreds-10/cc_db.c:73:11: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
rc = db->open(db, filename, NULL,
data/libpam-ccreds-10/cc_db.c:206:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, val.data, val.size);
data/libpam-ccreds-10/cc_lib.c:43:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char T[4];
data/libpam-ccreds-10/cc_lib.c:87:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(*derived_key_p, gcry_md_read(handle, 0), *derived_key_length_p);
data/libpam-ccreds-10/cc_lib.c:253:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char type_buf[32];
data/libpam-ccreds-10/cc_lib.c:277:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(p, type_buf, type_buf_len);
data/libpam-ccreds-10/cc_lib.c:281:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(p, pamcch->user, user_len);
data/libpam-ccreds-10/cc_lib.c:286:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(p, pamcch->service, service_len);
data/libpam-ccreds-10/cc_lib.c:570:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char sz_key_type_buf[32];
data/libpam-ccreds-10/cc_lib.c:576:6: [2] (integer) atol:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
T = atol(type);
data/libpam-ccreds-10/cc_pam.c:331:18: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
minimum_uid = atoi(argv[i] + sizeof("minimum_uid=") - 1);
data/libpam-ccreds-10/ccreds_chkpwd.c:116:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char username[32];
data/libpam-ccreds-10/ccreds_chkpwd.c:130:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pass[MAXPASS + 1];
data/libpam-ccreds-10/cc_lib.c:74:42: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
SHA1_Update(&sha_ctx, pamcch->service, strlen(pamcch->service));
data/libpam-ccreds-10/cc_lib.c:76:42: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
gcry_md_write(handle, pamcch->service, strlen(pamcch->service));
data/libpam-ccreds-10/cc_lib.c:81:38: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
SHA1_Update(&sha_ctx, pamcch->user, strlen(pamcch->user));
data/libpam-ccreds-10/cc_lib.c:85:38: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
gcry_md_write(handle, pamcch->user, strlen(pamcch->user));
data/libpam-ccreds-10/cc_lib.c:257:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
type_buf_len = strlen(type_buf);
data/libpam-ccreds-10/cc_lib.c:260:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
service_len = strlen(pamcch->service);
data/libpam-ccreds-10/cc_lib.c:265:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
user_len = strlen(pamcch->user);
data/libpam-ccreds-10/cc_lib.c:687:26: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
write(fds[1], passwd, strlen(passwd) + 1);
data/libpam-ccreds-10/cc_pam.c:198:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
authtok, strlen(authtok));
data/libpam-ccreds-10/cc_pam.c:245:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
authtok, strlen(authtok));
data/libpam-ccreds-10/cc_pam.c:286:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
authtok, strlen(authtok));
data/libpam-ccreds-10/cc_test.c:65:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
password, strlen(password));
data/libpam-ccreds-10/cc_test.c:69:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
password, strlen(password));
data/libpam-ccreds-10/cc_test.c:74:38: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(password == NULL) ? 0 : strlen(password));
data/libpam-ccreds-10/ccreds_chkpwd.c:98:35: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(p));
data/libpam-ccreds-10/ccreds_chkpwd.c:122:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(username, pw->pw_name, sizeof(username));
data/libpam-ccreds-10/ccreds_chkpwd.c:189:10: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
npass = read(STDIN_FILENO, pass, MAXPASS);
ANALYSIS SUMMARY:
Hits = 31
Lines analyzed = 2062 in approximately 0.06 seconds (35833 lines/second)
Physical Source Lines of Code (SLOC) = 1498
Hits@level = [0] 34 [1] 17 [2] 14 [3] 0 [4] 0 [5] 0
Hits@level+ = [0+] 65 [1+] 31 [2+] 14 [3+] 0 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 43.3912 [1+] 20.6943 [2+] 9.34579 [3+] 0 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.