Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/mfoc-0.10.7+git20180724/src/mifare.h
Examining data/mfoc-0.10.7+git20180724/src/nfc-utils.h
Examining data/mfoc-0.10.7+git20180724/src/crapto1.c
Examining data/mfoc-0.10.7+git20180724/src/crapto1.h
Examining data/mfoc-0.10.7+git20180724/src/slre.c
Examining data/mfoc-0.10.7+git20180724/src/nfc-utils.c
Examining data/mfoc-0.10.7+git20180724/src/mfoc.c
Examining data/mfoc-0.10.7+git20180724/src/crypto1.c
Examining data/mfoc-0.10.7+git20180724/src/mfoc.h
Examining data/mfoc-0.10.7+git20180724/src/slre.h
Examining data/mfoc-0.10.7+git20180724/src/mifare.c
FINAL RESULTS:
data/mfoc-0.10.7+git20180724/src/slre.c:36:18: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
# define DBG(x) printf x
data/mfoc-0.10.7+git20180724/src/mfoc.c:142:16: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while ((ch = getopt(argc, argv, "hD:s:BP:T:S:O:k:t:f:")) != -1) {
data/mfoc-0.10.7+git20180724/src/mfoc.c:133:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char line[20];
data/mfoc-0.10.7+git20180724/src/mfoc.c:146:24: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
if (!(probes = atoi(optarg)) || probes < 1) {
data/mfoc-0.10.7+git20180724/src/mfoc.c:155:21: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
if (((res = atoi(optarg)) < 0)) {
data/mfoc-0.10.7+git20180724/src/mfoc.c:164:16: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!(fp = fopen(optarg, "r"))) {
data/mfoc-0.10.7+git20180724/src/mfoc.c:204:24: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!(pfDump = fopen(optarg, "wb"))) {
data/mfoc-0.10.7+git20180724/src/mfoc.c:212:23: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!(pfKey = fopen(optarg, "w"))) {
data/mfoc-0.10.7+git20180724/src/mfoc.c:376:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(t.sectors[i].KeyA, mp.mpa.abtKey, sizeof(mp.mpa.abtKey));
data/mfoc-0.10.7+git20180724/src/mfoc.c:423:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(t.sectors[i].KeyB, mp.mpa.abtKey, sizeof(mp.mpa.abtKey));
data/mfoc-0.10.7+git20180724/src/mfoc.c:448:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&knownKey, t.sectors[i].KeyA, 6);
data/mfoc-0.10.7+git20180724/src/mfoc.c:460:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&knownKey, t.sectors[i].KeyB, 6);
data/mfoc-0.10.7+git20180724/src/mfoc.c:498:15: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(t.sectors[j].KeyA, mp.mpa.abtKey, sizeof(mp.mpa.abtKey));
data/mfoc-0.10.7+git20180724/src/mfoc.c:527:15: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(t.sectors[j].KeyB, mp.mpa.abtKey, sizeof(mp.mpa.abtKey));
data/mfoc-0.10.7+git20180724/src/mfoc.c:595:19: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(t.sectors[j].KeyA, mp.mpa.abtKey, sizeof(mp.mpa.abtKey));
data/mfoc-0.10.7+git20180724/src/mfoc.c:599:19: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(t.sectors[j].KeyB, mp.mpa.abtKey, sizeof(mp.mpa.abtKey));
data/mfoc-0.10.7+git20180724/src/mfoc.c:669:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(mp.mpa.abtKey, t.sectors[i].KeyA, sizeof(t.sectors[i].KeyA));
data/mfoc-0.10.7+git20180724/src/mfoc.c:693:11: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(mp.mpa.abtKey, t.sectors[i].KeyB, sizeof(t.sectors[i].KeyB));
data/mfoc-0.10.7+git20180724/src/mfoc.c:722:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(mtDump.amb[block].mbt.abtKeyA, t.sectors[i].KeyA, 6);
data/mfoc-0.10.7+git20180724/src/mfoc.c:723:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(mtDump.amb[block].mbt.abtKeyB, t.sectors[i].KeyB, 6);
data/mfoc-0.10.7+git20180724/src/mfoc.c:724:23: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
if (!failure) memcpy(mtDump.amb[block].mbt.abtAccessBits, mp.mpd.abtData + 6, 4);
data/mfoc-0.10.7+git20180724/src/mfoc.c:725:28: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
} else if (!failure) memcpy(mtDump.amb[block].mbd.abtData, mp.mpd.abtData, 16);
data/mfoc-0.10.7+git20180724/src/mifare.c:119:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(abtCmd + 2, (uint8_t *) pmp, szParamLen);
data/mfoc-0.10.7+git20180724/src/mifare.c:134:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(pmp->mpd.abtData, abtRx, 16);
data/mfoc-0.10.7+git20180724/src/mfoc.c:135:10: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
char * read;
data/mfoc-0.10.7+git20180724/src/mfoc.c:169:37: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int i, j = 0, str_len = strlen(line);
data/mfoc-0.10.7+git20180724/src/slre.c:436:28: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return foo(regexp, (int) strlen(regexp), s, s_len, &info);
ANALYSIS SUMMARY:
Hits = 27
Lines analyzed = 3054 in approximately 0.11 seconds (28156 lines/second)
Physical Source Lines of Code (SLOC) = 2104
Hits@level = [0] 79 [1] 3 [2] 22 [3] 1 [4] 1 [5] 0
Hits@level+ = [0+] 106 [1+] 27 [2+] 24 [3+] 2 [4+] 1 [5+] 0
Hits/KSLOC@level+ = [0+] 50.3802 [1+] 12.8327 [2+] 11.4068 [3+] 0.95057 [4+] 0.475285 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.