Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/madwimax-0.1.1/src/protocol.c Examining data/madwimax-0.1.1/src/protocol.h Examining data/madwimax-0.1.1/src/logging.c Examining data/madwimax-0.1.1/src/logging.h Examining data/madwimax-0.1.1/src/tap_dev.c Examining data/madwimax-0.1.1/src/tap_dev.h Examining data/madwimax-0.1.1/src/wimax.c Examining data/madwimax-0.1.1/src/wimax.h FINAL RESULTS: data/madwimax-0.1.1/src/logging.c:61:2: [4] (format) vfprintf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. vfprintf(logfile, fmt, va); data/madwimax-0.1.1/src/tap_dev.c:49:3: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(tunname, "/dev/%s", dev); data/madwimax-0.1.1/src/tap_dev.c:53:2: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(tunname, "/dev/%s", istun ? "tun" : "tap"); data/madwimax-0.1.1/src/tap_dev.c:59:4: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(dev, tunname + 5); data/madwimax-0.1.1/src/tap_dev.c:103:2: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(dev, ifr.ifr_name); data/madwimax-0.1.1/src/wimax.c:685:7: [3] (buffer) getopt_long: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. c = getopt_long(argc, argv, "vqdl:ofVe:h", long_options, &option_index); data/madwimax-0.1.1/src/logging.c:128:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char hex[49]; data/madwimax-0.1.1/src/logging.c:129:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char ascii[17]; data/madwimax-0.1.1/src/logging.c:132:4: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(hex + ((j - i) * 3), " %02x", ((unsigned char*)buf)[j]); data/madwimax-0.1.1/src/protocol.c:38:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(dev->chip, buf + 0x1a, 0x40); data/madwimax-0.1.1/src/protocol.c:39:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(dev->firmware, buf + 0x5a, 0x40); data/madwimax-0.1.1/src/protocol.c:48:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(dev->mac, buf + 0x1a, 0x6); data/madwimax-0.1.1/src/protocol.c:75:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(dev->bsid, buf + 0x1e, 0x6); data/madwimax-0.1.1/src/protocol.c:240:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(buf + 0x14, param, param_len); data/madwimax-0.1.1/src/protocol.c:264:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char param[0x2] = {0x0, turn_on ? 0x1 : 0x0}; data/madwimax-0.1.1/src/protocol.c:286:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char param[netid_len + 4]; data/madwimax-0.1.1/src/protocol.c:291:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(param + 4, netid, netid_len); data/madwimax-0.1.1/src/protocol.c:297:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char param[0x2] = {level >> 8, level & 0xff}; data/madwimax-0.1.1/src/protocol.c:303:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char param[0x2] = {0x00, 0x00}; data/madwimax-0.1.1/src/protocol.c:314:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char param[0x2] = {0x00, 0x00}; data/madwimax-0.1.1/src/tap_dev.c:45:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char tunname[14]; data/madwimax-0.1.1/src/tap_dev.c:50:10: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). return open(tunname, O_RDWR); data/madwimax-0.1.1/src/tap_dev.c:56:3: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(tunname + 8, "%d", i); data/madwimax-0.1.1/src/tap_dev.c:58:11: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if( (fd=open(tunname, O_RDWR)) > 0 ) { data/madwimax-0.1.1/src/tap_dev.c:86:12: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if ((fd = open("/dev/net/tun", O_RDWR)) < 0) data/madwimax-0.1.1/src/tap_dev.c:139:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&ifr.ifr_hwaddr.sa_data, hwaddr, ETH_ALEN); data/madwimax-0.1.1/src/wimax.c:103:17: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static unsigned char read_buffer[MAX_PACKET_LEN]; data/madwimax-0.1.1/src/wimax.c:106:8: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static char tap_dev[20] = "wimax%d"; data/madwimax-0.1.1/src/wimax.c:257:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char *env[1] = {NULL}; data/madwimax-0.1.1/src/wimax.c:369:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char buf[MAX_PACKET_LEN]; data/madwimax-0.1.1/src/wimax.c:524:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char req_data[MAX_PACKET_LEN]; data/madwimax-0.1.1/src/wimax.c:589:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char req_data[MAX_PACKET_LEN]; data/madwimax-0.1.1/src/wimax.c:706:16: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). logfile = fopen(optarg, "a"); data/madwimax-0.1.1/src/wimax.h:42:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char chip[0x40]; data/madwimax-0.1.1/src/wimax.h:43:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char firmware[0x40]; data/madwimax-0.1.1/src/wimax.h:44:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char mac[6]; data/madwimax-0.1.1/src/wimax.h:48:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char bsid[6]; data/madwimax-0.1.1/src/protocol.c:285:20: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). short netid_len = strlen(netid) + 1; data/madwimax-0.1.1/src/tap_dev.c:92:3: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(ifr.ifr_name, dev, IFNAMSIZ); data/madwimax-0.1.1/src/tap_dev.c:119:51: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). int tap_read(int fd, void *buf, int len) { return read(fd, buf, len); } data/madwimax-0.1.1/src/tap_dev.c:126:9: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). return strncpy(dst,src,size-1); ANALYSIS SUMMARY: Hits = 41 Lines analyzed = 1887 in approximately 0.06 seconds (31403 lines/second) Physical Source Lines of Code (SLOC) = 1336 Hits@level = [0] 24 [1] 4 [2] 31 [3] 1 [4] 5 [5] 0 Hits@level+ = [0+] 65 [1+] 41 [2+] 37 [3+] 6 [4+] 5 [5+] 0 Hits/KSLOC@level+ = [0+] 48.6527 [1+] 30.6886 [2+] 27.6946 [3+] 4.49102 [4+] 3.74251 [5+] 0 Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.