Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/lv2dynparam1-2/audiolock.c
Examining data/lv2dynparam1-2/audiolock.h
Examining data/lv2dynparam1-2/helpers.c
Examining data/lv2dynparam1-2/helpers.h
Examining data/lv2dynparam1-2/hint_set.c
Examining data/lv2dynparam1-2/hint_set.h
Examining data/lv2dynparam1-2/host/host.c
Examining data/lv2dynparam1-2/host/host.h
Examining data/lv2dynparam1-2/host/host_callbacks.c
Examining data/lv2dynparam1-2/host/host_callbacks.h
Examining data/lv2dynparam1-2/host/internal.h
Examining data/lv2dynparam1-2/list.h
Examining data/lv2dynparam1-2/log.c
Examining data/lv2dynparam1-2/log.h
Examining data/lv2dynparam1-2/lv2_rtmempool.h
Examining data/lv2dynparam1-2/lv2dynparam.h
Examining data/lv2dynparam1-2/memory_atomic.c
Examining data/lv2dynparam1-2/memory_atomic.h
Examining data/lv2dynparam1-2/plugin/group.c
Examining data/lv2dynparam1-2/plugin/internal.h
Examining data/lv2dynparam1-2/plugin/parameter.c
Examining data/lv2dynparam1-2/plugin/plugin.c
Examining data/lv2dynparam1-2/plugin/plugin.h
FINAL RESULTS:
data/lv2dynparam1-2/host/host.c:731:5: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(new_last_ptr, *last_ptr_ptr);
data/lv2dynparam1-2/host/host.c:870:5: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(value_str, "%c%s", SERIALIZE_TYPE_CHAR_BOOLEAN, parameter_ptr->value.boolean ? "true" : "false");
data/lv2dynparam1-2/host/host.c:890:5: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(value_buffer + 1, value_enum);
data/lv2dynparam1-2/log.c:35:3: [4] (format) vprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
vprintf(format, arglist);
data/lv2dynparam1-2/helpers.c:49:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dest, source, size);
data/lv2dynparam1-2/helpers.c:70:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dest, source, size);
data/lv2dynparam1-2/host/host.c:743:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(*last_ptr_ptr, string, len);
data/lv2dynparam1-2/host/host.c:806:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char separator[2] = {SERIALIZE_SEPARATOR_CHAR, '\0'};
data/lv2dynparam1-2/host/host.c:809:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char value_str[100];
data/lv2dynparam1-2/host/host.c:874:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(value_str, "%c%f", SERIALIZE_TYPE_CHAR_FLOAT, parameter_ptr->value.fpoint);
data/lv2dynparam1-2/host/host.c:894:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(value_str, "%c%i", SERIALIZE_TYPE_CHAR_INT, parameter_ptr->value.integer);
data/lv2dynparam1-2/host/internal.h:40:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[LV2DYNPARAM_MAX_STRING_SIZE];
data/lv2dynparam1-2/host/internal.h:55:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[LV2DYNPARAM_MAX_STRING_SIZE];
data/lv2dynparam1-2/host/internal.h:57:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char type_uri[LV2DYNPARAM_MAX_STRING_SIZE];
data/lv2dynparam1-2/host/internal.h:83:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[LV2DYNPARAM_MAX_STRING_SIZE];
data/lv2dynparam1-2/plugin/group.c:83:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(group_ptr->name, name, name_size);
data/lv2dynparam1-2/plugin/group.c:257:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buffer, group_ptr->name, s);
data/lv2dynparam1-2/plugin/internal.h:47:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[LV2DYNPARAM_MAX_STRING_SIZE];
data/lv2dynparam1-2/plugin/internal.h:64:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[LV2DYNPARAM_MAX_STRING_SIZE];
data/lv2dynparam1-2/plugin/parameter.c:102:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buffer, uri, s);
data/lv2dynparam1-2/plugin/parameter.c:116:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buffer, parameter_ptr->name, s);
data/lv2dynparam1-2/plugin/parameter.c:364:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(param_ptr->name, name, name_size);
data/lv2dynparam1-2/plugin/parameter.c:463:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(param_ptr->name, name, name_size);
data/lv2dynparam1-2/plugin/parameter.c:589:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(param_ptr->name, name, name_size);
data/lv2dynparam1-2/plugin/parameter.c:703:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(param_ptr->name, name, name_size);
data/lv2dynparam1-2/helpers.c:41:10: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size = strlen(source) + 1;
data/lv2dynparam1-2/helpers.c:62:10: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size = strlen(source) + 1;
data/lv2dynparam1-2/host/host.c:398:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
component = component + strlen(component) + 1;
data/lv2dynparam1-2/host/host.c:715:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(string);
data/lv2dynparam1-2/host/host.c:880:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
value_buffer = malloc(strlen(value_enum) + 2);
data/lv2dynparam1-2/host/host.c:983:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(component);
data/lv2dynparam1-2/plugin/group.c:51:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
name_size = strlen(name) + 1;
data/lv2dynparam1-2/plugin/group.c:251:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
s = strlen(group_ptr->name) + 1;
data/lv2dynparam1-2/plugin/parameter.c:98:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
s = strlen(uri) + 1;
data/lv2dynparam1-2/plugin/parameter.c:112:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
s = strlen(parameter_ptr->name) + 1;
data/lv2dynparam1-2/plugin/parameter.c:306:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
name_size = strlen(name) + 1;
data/lv2dynparam1-2/plugin/parameter.c:403:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
name_size = strlen(name) + 1;
data/lv2dynparam1-2/plugin/parameter.c:511:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
name_size = strlen(name) + 1;
data/lv2dynparam1-2/plugin/parameter.c:643:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
name_size = strlen(name) + 1;
ANALYSIS SUMMARY:
Hits = 39
Lines analyzed = 7177 in approximately 0.20 seconds (36566 lines/second)
Physical Source Lines of Code (SLOC) = 4352
Hits@level = [0] 2 [1] 14 [2] 21 [3] 0 [4] 4 [5] 0
Hits@level+ = [0+] 41 [1+] 39 [2+] 25 [3+] 4 [4+] 4 [5+] 0
Hits/KSLOC@level+ = [0+] 9.42096 [1+] 8.9614 [2+] 5.74449 [3+] 0.919118 [4+] 0.919118 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.