Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/lm4tools-0.1.3/lm4flash/lm4flash.c
Examining data/lm4tools-0.1.3/lmicdiusb/gdb.c
Examining data/lm4tools-0.1.3/lmicdiusb/lmicdi.c
Examining data/lm4tools-0.1.3/lmicdiusb/lmicdi.h
Examining data/lm4tools-0.1.3/lmicdiusb/socket.c
FINAL RESULTS:
data/lm4tools-0.1.3/lm4flash/lm4flash.c:70:9: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
#define snprintf _snprintf
data/lm4tools-0.1.3/lm4flash/lm4flash.c:70:18: [4] (format) _snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
#define snprintf _snprintf
data/lm4tools-0.1.3/lm4flash/lm4flash.c:222:9: [4] (format) sprintf:
Potential format string problem (CWE-134). Make format string constant.
idx += sprintf(buf.c + idx, END "%02x", sum);
data/lm4tools-0.1.3/lm4flash/lm4flash.c:254:8: [4] (format) sprintf:
Potential format string problem (CWE-134). Make format string constant.
idx = sprintf(buf.c, START "%s", prefix);
data/lm4tools-0.1.3/lm4flash/lm4flash.c:272:8: [4] (format) sprintf:
Potential format string problem (CWE-134). Make format string constant.
idx = sprintf(buf.c, START "%s", prefix);
data/lm4tools-0.1.3/lm4flash/lm4flash.c:282:15: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
size_t idx = snprintf(buf.c, BUF_SIZE, START "%s%08x%s",
data/lm4tools-0.1.3/lm4flash/lm4flash.c:291:15: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
size_t idx = snprintf(buf.c, BUF_SIZE, START "%s%08x%s%08x%s",
data/lm4tools-0.1.3/lm4flash/lm4flash.c:383:15: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
size_t idx = snprintf(buf.c, BUF_SIZE, START "x%x,%x", addr, (uint32_t)len);
data/lm4tools-0.1.3/lm4flash/lm4flash.c:411:8: [4] (format) sprintf:
Potential format string problem (CWE-134). Make format string constant.
idx = sprintf(buf.c, START "qRcmd,");
data/lm4tools-0.1.3/lmicdiusb/lmicdi.h:80:33: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(stderr, __VA_ARGS__);} \
data/lm4tools-0.1.3/lm4flash/lm4flash.c:795:16: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while ((opt = getopt(argc, argv, "VES:hvs:")) != -1) {
data/lm4tools-0.1.3/lm4flash/lm4flash.c:87:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char c[BUF_SIZE];
data/lm4tools-0.1.3/lm4flash/lm4flash.c:132:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char linebuf[PP_LINESIZE];
data/lm4tools-0.1.3/lm4flash/lm4flash.c:143:4: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(linebuf, "%04x : ", i);
data/lm4tools-0.1.3/lm4flash/lm4flash.c:148:3: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(linebuf + pos, "%02x", b[i]);
data/lm4tools-0.1.3/lm4flash/lm4flash.c:257:10: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
idx += sprintf(buf.c + idx, "%02x", bytes[i]);
data/lm4tools-0.1.3/lm4flash/lm4flash.c:274:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf.c + idx, bytes, num_bytes);
data/lm4tools-0.1.3/lm4flash/lm4flash.c:331:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char by, rawbuf[1024], *buf = rawbuf;
data/lm4tools-0.1.3/lm4flash/lm4flash.c:333:2: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(strchr(prefix, ':') + 1, "%08x:", addr);
data/lm4tools-0.1.3/lm4flash/lm4flash.c:380:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char rawbuf[1024];
data/lm4tools-0.1.3/lm4flash/lm4flash.c:406:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char rawbuf[32];
data/lm4tools-0.1.3/lm4flash/lm4flash.c:414:10: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
idx += sprintf(buf.c + idx, "%02x", cmd[i]);
data/lm4tools-0.1.3/lm4flash/lm4flash.c:598:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char descriptor_buffer[256];
data/lm4tools-0.1.3/lm4flash/lm4flash.c:766:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen(rom_name, "rb");
data/lm4tools-0.1.3/lmicdiusb/lmicdi.c:54:10: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char pResp[MSGSIZE];
data/lm4tools-0.1.3/lmicdiusb/lmicdi.c:62:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char pStr[256];
data/lm4tools-0.1.3/lmicdiusb/lmicdi.c:91:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char pStr[256];
data/lm4tools-0.1.3/lmicdiusb/lmicdi.c:109:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char pStr[256];
data/lm4tools-0.1.3/lmicdiusb/lmicdi.c:124:10: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char pUsbResp[MSGSIZE];
data/lm4tools-0.1.3/lmicdiusb/socket.c:47:17: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static unsigned char pGdbReq[MSGSIZE];
data/lm4tools-0.1.3/lmicdiusb/socket.c:230:21: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static unsigned char pMsg[MSGSIZE];
data/lm4tools-0.1.3/lm4flash/lm4flash.c:76:19: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
#define START_LEN strlen(START)
data/lm4tools-0.1.3/lm4flash/lm4flash.c:77:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
#define END_LEN (strlen(END) + 2)
data/lm4tools-0.1.3/lm4flash/lm4flash.c:251:28: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (START_LEN + (prefix ? strlen(prefix) : 0) + (2 * num_bytes) + END_LEN + 1 > BUF_SIZE)
data/lm4tools-0.1.3/lm4flash/lm4flash.c:269:28: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (START_LEN + (prefix ? strlen(prefix) : 0) + num_bytes + END_LEN + 1 > BUF_SIZE)
data/lm4tools-0.1.3/lm4flash/lm4flash.c:394:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for (i = 0, j = strlen("+$OK:"); i < len; i++, j++) {
data/lm4tools-0.1.3/lm4flash/lm4flash.c:413:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for (i = 0; i < strlen(cmd); i++)
data/lm4tools-0.1.3/lm4flash/lm4flash.c:426:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for (i = strlen("+$"); rawbuf[i] != '#'; i += 2) {
ANALYSIS SUMMARY:
Hits = 38
Lines analyzed = 1983 in approximately 0.06 seconds (30656 lines/second)
Physical Source Lines of Code (SLOC) = 1229
Hits@level = [0] 40 [1] 7 [2] 20 [3] 1 [4] 10 [5] 0
Hits@level+ = [0+] 78 [1+] 38 [2+] 31 [3+] 11 [4+] 10 [5+] 0
Hits/KSLOC@level+ = [0+] 63.4662 [1+] 30.9194 [2+] 25.2238 [3+] 8.95037 [4+] 8.1367 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.