Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/minimodem-0.24/src/minimodem.c Examining data/minimodem-0.24/src/simpleaudio-alsa.c Examining data/minimodem-0.24/src/databits.h Examining data/minimodem-0.24/src/fsk.h Examining data/minimodem-0.24/src/baudot.c Examining data/minimodem-0.24/src/baudot.h Examining data/minimodem-0.24/src/fsk.c Examining data/minimodem-0.24/src/simpleaudio.c Examining data/minimodem-0.24/src/simpleaudio-sndfile.c Examining data/minimodem-0.24/src/simple-tone-generator.c Examining data/minimodem-0.24/src/databits_ascii.c Examining data/minimodem-0.24/src/uic_codes.c Examining data/minimodem-0.24/src/databits_uic.c Examining data/minimodem-0.24/src/uic_codes.h Examining data/minimodem-0.24/src/databits_binary.c Examining data/minimodem-0.24/src/simpleaudio-benchmark.c Examining data/minimodem-0.24/src/databits_baudot.c Examining data/minimodem-0.24/src/simpleaudio_internal.h Examining data/minimodem-0.24/src/simpleaudio.h Examining data/minimodem-0.24/src/databits_callerid.c Examining data/minimodem-0.24/src/simpleaudio-pulse.c FINAL RESULTS: data/minimodem-0.24/src/baudot.c:27:38: [4] (format) fprintf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. # define debug_log(format, args...) fprintf(stderr, format, ## args) data/minimodem-0.24/src/databits_callerid.c:74:15: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. dataout_n += sprintf(dataout_p+dataout_n, "%-6s ", data/minimodem-0.24/src/databits_callerid.c:129:18: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. dataout_n += sprintf(dataout_p+dataout_n, "%-6s ", data/minimodem-0.24/src/databits_callerid.c:135:18: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. dataout_n += sprintf(dataout_p+dataout_n, "%-6s ", data/minimodem-0.24/src/databits_uic.c:40:12: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. written = sprintf(output, "Train ID: %X%X%X%X%X%X - Message: %02X (%s)\n", data/minimodem-0.24/src/fsk.h:84:38: [4] (format) fprintf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. # define debug_log(format, args...) fprintf(stderr, format, ## args) data/minimodem-0.24/src/minimodem.c:307:11: [4] (shell) system: This causes a new program to execute and is difficult to use safely (CWE-78). try using a library call that implements the same functionality if available. ret = system("sed -n -e '/^model name/{p;q}' -e '/^cpu model/{p;q}' /proc/cpuinfo"); data/minimodem-0.24/src/minimodem.c:623:6: [3] (buffer) getopt_long: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. c = getopt_long(argc, argv, "Vtrc:l:ai875f:b:v:M:S:T:qA::R:", data/minimodem-0.24/src/baudot.c:33:8: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static char data/minimodem-0.24/src/baudot.c:73:8: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static char data/minimodem-0.24/src/databits_callerid.c:47:17: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static unsigned char cid_buf[256]; data/minimodem-0.24/src/databits_callerid.c:81:16: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. dataout_n += sprintf(dataout_p+dataout_n, data/minimodem-0.24/src/databits_callerid.c:86:20: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. dataout_n += sprintf(dataout_p+dataout_n, data/minimodem-0.24/src/databits_callerid.c:111:19: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. dataout_n += sprintf(dataout_p+dataout_n, "%.*s\n", prlen, prdata); data/minimodem-0.24/src/databits_callerid.c:131:18: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. dataout_n += sprintf(dataout_p+dataout_n, "%.2s/%.2s %.2s:%.2s\n", data/minimodem-0.24/src/databits_callerid.c:139:15: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. dataout_n += sprintf(dataout_p+dataout_n, "%.3s-%.3s-%.4s\n", data/minimodem-0.24/src/databits_callerid.c:142:15: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. dataout_n += sprintf(dataout_p+dataout_n, "%.*s\n", data/minimodem-0.24/src/databits_callerid.c:196:18: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. dataout_n += sprintf(dataout_p+dataout_n, "CALLER-ID\n"); data/minimodem-0.24/src/fsk.c:130:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(fskp->fftin, samples, bit_nsamples * sizeof(float)); data/minimodem-0.24/src/fsk.c:549:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(fskp->fftin, samples, nsamples * sizeof(float)); data/minimodem-0.24/src/minimodem.c:690:22: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). bfsk_nstartbits = atoi(optarg); data/minimodem-0.24/src/minimodem.c:711:18: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). sample_rate = atoi(optarg); data/minimodem-0.24/src/minimodem.c:725:23: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). tx_sin_table_len = atoi(optarg); data/minimodem-0.24/src/minimodem.c:741:28: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). output_mode_raw_nbits = atoi(optarg); data/minimodem-0.24/src/minimodem.c:1078:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char expect_data_string_buffer[64]; data/minimodem-0.24/src/minimodem.c:1085:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char expect_sync_string_buffer[64]; data/minimodem-0.24/src/minimodem.c:1395:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char dataoutbuf[4096]; data/minimodem-0.24/src/fsk.c:461:25: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). int expect_n_bits = strlen(expect_bits_string); data/minimodem-0.24/src/minimodem.c:180:15: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). n_read = read(fd, &buf, sizeof(buf)); data/minimodem-0.24/src/minimodem.c:1083:57: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). debug_log("eds = '%s' (%lu)\n", expect_data_string, strlen(expect_data_string)); data/minimodem-0.24/src/minimodem.c:1092:57: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). debug_log("ess = '%s' (%lu)\n", expect_sync_string, strlen(expect_sync_string)); ANALYSIS SUMMARY: Hits = 31 Lines analyzed = 4310 in approximately 0.11 seconds (38985 lines/second) Physical Source Lines of Code (SLOC) = 2962 Hits@level = [0] 56 [1] 4 [2] 19 [3] 1 [4] 7 [5] 0 Hits@level+ = [0+] 87 [1+] 31 [2+] 27 [3+] 8 [4+] 7 [5+] 0 Hits/KSLOC@level+ = [0+] 29.372 [1+] 10.4659 [2+] 9.11546 [3+] 2.70088 [4+] 2.36327 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.