Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/libtcd-2.2.2/tide_db_default.h
Examining data/libtcd-2.2.2/tide_db_header.h
Examining data/libtcd-2.2.2/bit_pack.c
Examining data/libtcd-2.2.2/tide_db.c
FINAL RESULTS:
data/libtcd-2.2.2/tide_db.c:891:5: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (rec->name, tindex[num].name);
data/libtcd-2.2.2/tide_db.c:1245:5: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (last_search, search);
data/libtcd-2.2.2/tide_db.c:1851:5: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (hd.tzfile[hd.pub.tzfiles++], c_name);
data/libtcd-2.2.2/tide_db.c:1917:5: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (hd.country[hd.pub.countries++], c_name);
data/libtcd-2.2.2/tide_db.c:1983:5: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (hd.datum[hd.pub.datum_types++], c_name);
data/libtcd-2.2.2/tide_db.c:2034:5: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (hd.legalese[hd.pub.legaleses++], c_name);
data/libtcd-2.2.2/tide_db.c:2100:5: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (hd.restriction[hd.pub.restriction_types++], c_name);
data/libtcd-2.2.2/tide_db.c:2537:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy ((NV_CHAR *) &buf[pos], hd.level_unit[i]);
data/libtcd-2.2.2/tide_db.c:2560:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy ((NV_CHAR *) &buf[pos], hd.dir_unit[i]);
data/libtcd-2.2.2/tide_db.c:2584:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy ((NV_CHAR *) &buf[pos], hd.restriction[i]);
data/libtcd-2.2.2/tide_db.c:2609:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy ((NV_CHAR *) &buf[pos], hd.tzfile[i]);
data/libtcd-2.2.2/tide_db.c:2634:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy ((NV_CHAR *) &buf[pos], hd.country[i]);
data/libtcd-2.2.2/tide_db.c:2659:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy ((NV_CHAR *) &buf[pos], hd.datum[i]);
data/libtcd-2.2.2/tide_db.c:2684:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy ((NV_CHAR *) &buf[pos], hd.legalese[i]);
data/libtcd-2.2.2/tide_db.c:2708:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy ((NV_CHAR *) &buf[pos], hd.constituent[i]);
data/libtcd-2.2.2/tide_db.c:3043:15: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (keys[i].address.cstr, clip_string(info));
data/libtcd-2.2.2/tide_db.c:3168:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (hd.level_unit[i], (NV_CHAR *) buf);
data/libtcd-2.2.2/tide_db.c:3191:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (hd.dir_unit[i], (NV_CHAR *) buf);
data/libtcd-2.2.2/tide_db.c:3221:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (hd.restriction[i], (NV_CHAR *) buf);
data/libtcd-2.2.2/tide_db.c:3258:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (hd.tzfile[i], (NV_CHAR *) buf);
data/libtcd-2.2.2/tide_db.c:3287:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (hd.country[i], (NV_CHAR *) buf);
data/libtcd-2.2.2/tide_db.c:3315:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (hd.datum[i], (NV_CHAR *) buf);
data/libtcd-2.2.2/tide_db.c:3350:4: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (hd.legalese[i], (NV_CHAR *) buf);
data/libtcd-2.2.2/tide_db.c:3375:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (hd.constituent[i], (NV_CHAR *) buf);
data/libtcd-2.2.2/tide_db.c:3557:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (tindex[i].name, rec.header.name);
data/libtcd-2.2.2/tide_db.c:3598:5: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (filename, file);
data/libtcd-2.2.2/tide_db.c:3822:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (hd.constituent[i], constituent[i]);
data/libtcd-2.2.2/tide_db.c:3971:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (hd.level_unit[i], level_unit[i]);
data/libtcd-2.2.2/tide_db.c:3986:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (hd.dir_unit[i], dir_unit[i]);
data/libtcd-2.2.2/tide_db.c:4005:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (hd.restriction[i], restriction[i]);
data/libtcd-2.2.2/tide_db.c:4023:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (hd.legalese[i], legalese[i]);
data/libtcd-2.2.2/tide_db.c:4040:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (hd.tzfile[i], tzfile[i]);
data/libtcd-2.2.2/tide_db.c:4057:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (hd.country[i], country[i]);
data/libtcd-2.2.2/tide_db.c:4074:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (hd.datum[i], datum[i]);
data/libtcd-2.2.2/tide_db.c:5145:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (tindex[rec->header.record_number].name, rec->header.name);
data/libtcd-2.2.2/tide_db.c:5374:4: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(tindex[num].name, rec->header.name);
data/libtcd-2.2.2/tide_db.c:1043:9: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf (tname, "-%02d:%02d", hour, minute);
data/libtcd-2.2.2/tide_db.c:1047:9: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf (tname, "+%02d:%02d", hour, minute);
data/libtcd-2.2.2/tide_db.c:1067:7: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf (tname, "-%d:%02d", hour, minute);
data/libtcd-2.2.2/tide_db.c:1069:7: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf (tname, "+%d:%02d", hour, minute);
data/libtcd-2.2.2/tide_db.c:1071:7: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy (tname, "0:00");
data/libtcd-2.2.2/tide_db.c:1083:5: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy (tname, "NULL");
data/libtcd-2.2.2/tide_db.c:1090:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf (tname, "%4u-%02u-%02u", y, m, d);
data/libtcd-2.2.2/tide_db.c:2587:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (&buf[pos], "__END__", 7);
data/libtcd-2.2.2/tide_db.c:2612:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (&buf[pos], "__END__", 7);
data/libtcd-2.2.2/tide_db.c:2637:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (&buf[pos], "__END__", 7);
data/libtcd-2.2.2/tide_db.c:2662:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (&buf[pos], "__END__", 7);
data/libtcd-2.2.2/tide_db.c:2687:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (&buf[pos], "__END__", 7);
data/libtcd-2.2.2/tide_db.c:3004:5: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy (hd.pub.version, "NO VERSION");
data/libtcd-2.2.2/tide_db.c:3327:7: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy (hd.legalese[0], "NULL");
data/libtcd-2.2.2/tide_db.c:3594:15: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((fp = fopen (file, "rb+")) == NULL) {
data/libtcd-2.2.2/tide_db.c:3595:19: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((fp = fopen (file, "rb")) == NULL) return (NVFalse);
data/libtcd-2.2.2/tide_db.c:3796:15: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((fp = fopen (file, "wb+")) == NULL) return (NVFalse);
data/libtcd-2.2.2/tide_db.c:1128:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(string) >= MONOLOGUE_LENGTH) {
data/libtcd-2.2.2/tide_db.c:1132:47: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
fprintf (stderr, "String is length %u\n", strlen(string));
data/libtcd-2.2.2/tide_db.c:1145:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(string) >= ONELINER_LENGTH) {
data/libtcd-2.2.2/tide_db.c:1149:47: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
fprintf (stderr, "String is length %u\n", strlen(string));
data/libtcd-2.2.2/tide_db.c:1182:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
l = (int)strlen(string);
data/libtcd-2.2.2/tide_db.c:1197:7: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy (new_string, string+start, end-start+1);
data/libtcd-2.2.2/tide_db.c:1240:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for (i = 0 ; i < strlen(string) + 1 ; ++i)
data/libtcd-2.2.2/tide_db.c:1249:26: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for (i = 0 ; i < strlen(tindex[j].name) + 1 ; ++i)
data/libtcd-2.2.2/tide_db.c:1822:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(name) + 1 > hd.tzfile_size) {
data/libtcd-2.2.2/tide_db.c:1842:53: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hd.tzfile[hd.pub.tzfiles] = (NV_CHAR *) calloc (strlen (c_name) + 1,
data/libtcd-2.2.2/tide_db.c:1888:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(name) + 1 > hd.country_size) {
data/libtcd-2.2.2/tide_db.c:1908:56: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hd.country[hd.pub.countries] = (NV_CHAR *) calloc (strlen (c_name) + 1,
data/libtcd-2.2.2/tide_db.c:1954:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(name) + 1 > hd.datum_size) {
data/libtcd-2.2.2/tide_db.c:1974:56: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hd.datum[hd.pub.datum_types] = (NV_CHAR *) calloc (strlen (c_name) + 1,
data/libtcd-2.2.2/tide_db.c:2005:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(name) + 1 > hd.legalese_size) {
data/libtcd-2.2.2/tide_db.c:2025:57: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hd.legalese[hd.pub.legaleses] = (NV_CHAR *) calloc (strlen (c_name) + 1,
data/libtcd-2.2.2/tide_db.c:2071:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(name) + 1 > hd.restriction_size) {
data/libtcd-2.2.2/tide_db.c:2092:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(NV_CHAR *) calloc (strlen (c_name) + 1, sizeof (NV_CHAR));
data/libtcd-2.2.2/tide_db.c:2536:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
assert (strlen(hd.level_unit[i]) + 1 <= hd.level_unit_size);
data/libtcd-2.2.2/tide_db.c:2559:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
assert (strlen(hd.dir_unit[i]) + 1 <= hd.dir_unit_size);
data/libtcd-2.2.2/tide_db.c:2583:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
assert (strlen(hd.restriction[i]) + 1 <= hd.restriction_size);
data/libtcd-2.2.2/tide_db.c:2608:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
assert (strlen(hd.tzfile[i]) + 1 <= hd.tzfile_size);
data/libtcd-2.2.2/tide_db.c:2633:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
assert (strlen(hd.country[i]) + 1 <= hd.country_size);
data/libtcd-2.2.2/tide_db.c:2658:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
assert (strlen(hd.datum[i]) + 1 <= hd.datum_size);
data/libtcd-2.2.2/tide_db.c:2683:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
assert (strlen(hd.legalese[i]) + 1 <= hd.legalese_size);
data/libtcd-2.2.2/tide_db.c:2707:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
assert (strlen(hd.constituent[i]) + 1 <= hd.constituent_size);
data/libtcd-2.2.2/tide_db.c:3015:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen (varin) == ONELINER_LENGTH-1) {
data/libtcd-2.2.2/tide_db.c:3166:48: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hd.level_unit[i] = (NV_CHAR *) calloc (strlen((char*)buf) + 1,
data/libtcd-2.2.2/tide_db.c:3189:46: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hd.dir_unit[i] = (NV_CHAR *) calloc (strlen((char*)buf) + 1,
data/libtcd-2.2.2/tide_db.c:3219:49: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hd.restriction[i] = (NV_CHAR *) calloc (strlen((char*)buf) + 1,
data/libtcd-2.2.2/tide_db.c:3257:44: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hd.tzfile[i] = (NV_CHAR *) calloc (strlen((char*)buf) + 1, sizeof (NV_CHAR));
data/libtcd-2.2.2/tide_db.c:3285:45: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hd.country[i] = (NV_CHAR *) calloc (strlen((char*)buf) + 1,
data/libtcd-2.2.2/tide_db.c:3314:43: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hd.datum[i] = (NV_CHAR *) calloc (strlen((char*)buf) + 1, sizeof (NV_CHAR));
data/libtcd-2.2.2/tide_db.c:3349:41: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hd.legalese[i] = (NV_CHAR *) calloc (strlen((char*)buf) + 1, sizeof (NV_CHAR));
data/libtcd-2.2.2/tide_db.c:3373:49: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hd.constituent[i] = (NV_CHAR *) calloc (strlen((char*)buf) + 1,
data/libtcd-2.2.2/tide_db.c:3550:33: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(NV_CHAR *) calloc (strlen (rec.header.name) + 1,
data/libtcd-2.2.2/tide_db.c:3820:49: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hd.constituent[i] = (NV_CHAR *) calloc (strlen (constituent[i]) + 1,
data/libtcd-2.2.2/tide_db.c:3969:48: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hd.level_unit[i] = (NV_CHAR *) calloc (strlen (level_unit[i]) + 1,
data/libtcd-2.2.2/tide_db.c:3984:46: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hd.dir_unit[i] = (NV_CHAR *) calloc (strlen (dir_unit[i]) + 1,
data/libtcd-2.2.2/tide_db.c:4003:49: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hd.restriction[i] = (NV_CHAR *) calloc (strlen (restriction[i]) + 1,
data/libtcd-2.2.2/tide_db.c:4021:46: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hd.legalese[i] = (NV_CHAR *) calloc (strlen (legalese[i]) + 1,
data/libtcd-2.2.2/tide_db.c:4038:44: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hd.tzfile[i] = (NV_CHAR *) calloc (strlen (tzfile[i]) + 1,
data/libtcd-2.2.2/tide_db.c:4055:45: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hd.country[i] = (NV_CHAR *) calloc (strlen (country[i]) + 1,
data/libtcd-2.2.2/tide_db.c:4072:43: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hd.datum[i] = (NV_CHAR *) calloc (strlen (datum[i]) + 1,
data/libtcd-2.2.2/tide_db.c:4346:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
name_size = strlen(clip_string(rec->header.name))+1;
data/libtcd-2.2.2/tide_db.c:4347:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
source_size = strlen(clip_string(rec->source))+1;
data/libtcd-2.2.2/tide_db.c:4348:19: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
comments_size = strlen(clip_string(rec->comments))+1;
data/libtcd-2.2.2/tide_db.c:4349:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
notes_size = strlen(clip_string(rec->notes))+1;
data/libtcd-2.2.2/tide_db.c:4350:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
station_id_context_size = strlen(clip_string(rec->station_id_context))+1;
data/libtcd-2.2.2/tide_db.c:4351:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
station_id_size = strlen(clip_string(rec->station_id))+1;
data/libtcd-2.2.2/tide_db.c:4353:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
xfields_size = strlen(rec->xfields)+1;
data/libtcd-2.2.2/tide_db.c:4433:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
temp_size = strlen(s)+1;
data/libtcd-2.2.2/tide_db.c:5137:33: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
(NV_CHAR *) calloc (strlen (rec->header.name) + 1,
data/libtcd-2.2.2/tide_db.c:5373:43: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
tindex[num].name = (NV_CHAR *) calloc (strlen (rec->header.name) + 1, sizeof (NV_CHAR));
ANALYSIS SUMMARY:
Hits = 107
Lines analyzed = 6678 in approximately 0.25 seconds (26388 lines/second)
Physical Source Lines of Code (SLOC) = 3791
Hits@level = [0] 268 [1] 54 [2] 17 [3] 0 [4] 36 [5] 0
Hits@level+ = [0+] 375 [1+] 107 [2+] 53 [3+] 36 [4+] 36 [5+] 0
Hits/KSLOC@level+ = [0+] 98.9185 [1+] 28.2247 [2+] 13.9805 [3+] 9.49618 [4+] 9.49618 [5+] 0
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.