Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/nginx-1.18.0/src/core/nginx.c
Examining data/nginx-1.18.0/src/core/nginx.h
Examining data/nginx-1.18.0/src/core/ngx_array.c
Examining data/nginx-1.18.0/src/core/ngx_array.h
Examining data/nginx-1.18.0/src/core/ngx_buf.c
Examining data/nginx-1.18.0/src/core/ngx_buf.h
Examining data/nginx-1.18.0/src/core/ngx_conf_file.c
Examining data/nginx-1.18.0/src/core/ngx_conf_file.h
Examining data/nginx-1.18.0/src/core/ngx_config.h
Examining data/nginx-1.18.0/src/core/ngx_connection.c
Examining data/nginx-1.18.0/src/core/ngx_connection.h
Examining data/nginx-1.18.0/src/core/ngx_core.h
Examining data/nginx-1.18.0/src/core/ngx_cpuinfo.c
Examining data/nginx-1.18.0/src/core/ngx_crc.h
Examining data/nginx-1.18.0/src/core/ngx_crc32.c
Examining data/nginx-1.18.0/src/core/ngx_crc32.h
Examining data/nginx-1.18.0/src/core/ngx_crypt.c
Examining data/nginx-1.18.0/src/core/ngx_crypt.h
Examining data/nginx-1.18.0/src/core/ngx_cycle.c
Examining data/nginx-1.18.0/src/core/ngx_cycle.h
Examining data/nginx-1.18.0/src/core/ngx_file.c
Examining data/nginx-1.18.0/src/core/ngx_file.h
Examining data/nginx-1.18.0/src/core/ngx_hash.c
Examining data/nginx-1.18.0/src/core/ngx_hash.h
Examining data/nginx-1.18.0/src/core/ngx_inet.c
Examining data/nginx-1.18.0/src/core/ngx_inet.h
Examining data/nginx-1.18.0/src/core/ngx_list.c
Examining data/nginx-1.18.0/src/core/ngx_list.h
Examining data/nginx-1.18.0/src/core/ngx_log.c
Examining data/nginx-1.18.0/src/core/ngx_log.h
Examining data/nginx-1.18.0/src/core/ngx_md5.c
Examining data/nginx-1.18.0/src/core/ngx_md5.h
Examining data/nginx-1.18.0/src/core/ngx_module.c
Examining data/nginx-1.18.0/src/core/ngx_module.h
Examining data/nginx-1.18.0/src/core/ngx_murmurhash.c
Examining data/nginx-1.18.0/src/core/ngx_murmurhash.h
Examining data/nginx-1.18.0/src/core/ngx_open_file_cache.c
Examining data/nginx-1.18.0/src/core/ngx_open_file_cache.h
Examining data/nginx-1.18.0/src/core/ngx_output_chain.c
Examining data/nginx-1.18.0/src/core/ngx_palloc.c
Examining data/nginx-1.18.0/src/core/ngx_palloc.h
Examining data/nginx-1.18.0/src/core/ngx_parse.c
Examining data/nginx-1.18.0/src/core/ngx_parse.h
Examining data/nginx-1.18.0/src/core/ngx_parse_time.c
Examining data/nginx-1.18.0/src/core/ngx_queue.c
Examining data/nginx-1.18.0/src/core/ngx_parse_time.h
Examining data/nginx-1.18.0/src/core/ngx_proxy_protocol.c
Examining data/nginx-1.18.0/src/core/ngx_proxy_protocol.h
Examining data/nginx-1.18.0/src/core/ngx_queue.h
Examining data/nginx-1.18.0/src/core/ngx_radix_tree.c
Examining data/nginx-1.18.0/src/core/ngx_radix_tree.h
Examining data/nginx-1.18.0/src/core/ngx_rbtree.c
Examining data/nginx-1.18.0/src/core/ngx_rbtree.h
Examining data/nginx-1.18.0/src/core/ngx_regex.c
Examining data/nginx-1.18.0/src/core/ngx_regex.h
Examining data/nginx-1.18.0/src/core/ngx_resolver.c
Examining data/nginx-1.18.0/src/core/ngx_resolver.h
Examining data/nginx-1.18.0/src/core/ngx_rwlock.c
Examining data/nginx-1.18.0/src/core/ngx_rwlock.h
Examining data/nginx-1.18.0/src/core/ngx_sha1.c
Examining data/nginx-1.18.0/src/core/ngx_sha1.h
Examining data/nginx-1.18.0/src/core/ngx_shmtx.c
Examining data/nginx-1.18.0/src/core/ngx_shmtx.h
Examining data/nginx-1.18.0/src/core/ngx_slab.c
Examining data/nginx-1.18.0/src/core/ngx_slab.h
Examining data/nginx-1.18.0/src/core/ngx_spinlock.c
Examining data/nginx-1.18.0/src/core/ngx_string.c
Examining data/nginx-1.18.0/src/core/ngx_string.h
Examining data/nginx-1.18.0/src/core/ngx_syslog.c
Examining data/nginx-1.18.0/src/core/ngx_syslog.h
Examining data/nginx-1.18.0/src/core/ngx_thread_pool.c
Examining data/nginx-1.18.0/src/core/ngx_thread_pool.h
Examining data/nginx-1.18.0/src/core/ngx_times.c
Examining data/nginx-1.18.0/src/core/ngx_times.h
Examining data/nginx-1.18.0/src/event/modules/ngx_devpoll_module.c
Examining data/nginx-1.18.0/src/event/modules/ngx_epoll_module.c
Examining data/nginx-1.18.0/src/event/modules/ngx_eventport_module.c
Examining data/nginx-1.18.0/src/event/modules/ngx_kqueue_module.c
Examining data/nginx-1.18.0/src/event/modules/ngx_poll_module.c
Examining data/nginx-1.18.0/src/event/modules/ngx_select_module.c
Examining data/nginx-1.18.0/src/event/modules/ngx_win32_poll_module.c
Examining data/nginx-1.18.0/src/event/modules/ngx_win32_select_module.c
Examining data/nginx-1.18.0/src/event/ngx_event.c
Examining data/nginx-1.18.0/src/event/ngx_event.h
Examining data/nginx-1.18.0/src/event/ngx_event_accept.c
Examining data/nginx-1.18.0/src/event/ngx_event_connect.c
Examining data/nginx-1.18.0/src/event/ngx_event_connect.h
Examining data/nginx-1.18.0/src/event/ngx_event_openssl.c
Examining data/nginx-1.18.0/src/event/ngx_event_openssl.h
Examining data/nginx-1.18.0/src/event/ngx_event_openssl_stapling.c
Examining data/nginx-1.18.0/src/event/ngx_event_pipe.c
Examining data/nginx-1.18.0/src/event/ngx_event_pipe.h
Examining data/nginx-1.18.0/src/event/ngx_event_posted.c
Examining data/nginx-1.18.0/src/event/ngx_event_posted.h
Examining data/nginx-1.18.0/src/event/ngx_event_timer.c
Examining data/nginx-1.18.0/src/event/ngx_event_timer.h
Examining data/nginx-1.18.0/src/event/ngx_event_udp.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_access_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_addition_filter_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_auth_basic_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_auth_request_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_autoindex_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_browser_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_charset_filter_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_chunked_filter_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_dav_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_degradation_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_empty_gif_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_fastcgi_module.c
Examining data/nginx-1.18.0/src/http/modules/perl/ngx_http_perl_module.c
Examining data/nginx-1.18.0/src/http/modules/perl/ngx_http_perl_module.h
Examining data/nginx-1.18.0/src/http/modules/ngx_http_flv_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_geo_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_geoip_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_grpc_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_gunzip_filter_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_gzip_filter_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_gzip_static_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_headers_filter_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_image_filter_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_index_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_limit_conn_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_limit_req_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_log_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_map_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_memcached_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_mirror_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_mp4_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_not_modified_filter_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_proxy_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_random_index_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_range_filter_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_realip_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_referer_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_rewrite_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_scgi_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_secure_link_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_slice_filter_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_split_clients_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_ssi_filter_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_ssi_filter_module.h
Examining data/nginx-1.18.0/src/http/modules/ngx_http_ssl_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_ssl_module.h
Examining data/nginx-1.18.0/src/http/modules/ngx_http_static_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_stub_status_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_sub_filter_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_try_files_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_upstream_hash_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_upstream_ip_hash_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_upstream_keepalive_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_upstream_random_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_upstream_least_conn_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_upstream_zone_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_userid_filter_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_uwsgi_module.c
Examining data/nginx-1.18.0/src/http/modules/ngx_http_xslt_filter_module.c
Examining data/nginx-1.18.0/src/http/ngx_http.c
Examining data/nginx-1.18.0/src/http/ngx_http.h
Examining data/nginx-1.18.0/src/http/ngx_http_cache.h
Examining data/nginx-1.18.0/src/http/ngx_http_config.h
Examining data/nginx-1.18.0/src/http/ngx_http_copy_filter_module.c
Examining data/nginx-1.18.0/src/http/ngx_http_core_module.c
Examining data/nginx-1.18.0/src/http/ngx_http_core_module.h
Examining data/nginx-1.18.0/src/http/ngx_http_file_cache.c
Examining data/nginx-1.18.0/src/http/ngx_http_header_filter_module.c
Examining data/nginx-1.18.0/src/http/ngx_http_parse.c
Examining data/nginx-1.18.0/src/http/ngx_http_postpone_filter_module.c
Examining data/nginx-1.18.0/src/http/ngx_http_request.c
Examining data/nginx-1.18.0/src/http/ngx_http_request.h
Examining data/nginx-1.18.0/src/http/ngx_http_request_body.c
Examining data/nginx-1.18.0/src/http/ngx_http_script.c
Examining data/nginx-1.18.0/src/http/v2/ngx_http_v2.c
Examining data/nginx-1.18.0/src/http/v2/ngx_http_v2.h
Examining data/nginx-1.18.0/src/http/v2/ngx_http_v2_encode.c
Examining data/nginx-1.18.0/src/http/v2/ngx_http_v2_filter_module.c
Examining data/nginx-1.18.0/src/http/v2/ngx_http_v2_huff_decode.c
Examining data/nginx-1.18.0/src/http/v2/ngx_http_v2_huff_encode.c
Examining data/nginx-1.18.0/src/http/v2/ngx_http_v2_module.c
Examining data/nginx-1.18.0/src/http/v2/ngx_http_v2_module.h
Examining data/nginx-1.18.0/src/http/v2/ngx_http_v2_table.c
Examining data/nginx-1.18.0/src/http/ngx_http_script.h
Examining data/nginx-1.18.0/src/http/ngx_http_upstream.c
Examining data/nginx-1.18.0/src/http/ngx_http_upstream.h
Examining data/nginx-1.18.0/src/http/ngx_http_upstream_round_robin.c
Examining data/nginx-1.18.0/src/http/ngx_http_upstream_round_robin.h
Examining data/nginx-1.18.0/src/http/ngx_http_variables.c
Examining data/nginx-1.18.0/src/http/ngx_http_variables.h
Examining data/nginx-1.18.0/src/http/ngx_http_write_filter_module.c
Examining data/nginx-1.18.0/src/http/ngx_http_special_response.c
Examining data/nginx-1.18.0/src/mail/ngx_mail.c
Examining data/nginx-1.18.0/src/mail/ngx_mail.h
Examining data/nginx-1.18.0/src/mail/ngx_mail_auth_http_module.c
Examining data/nginx-1.18.0/src/mail/ngx_mail_core_module.c
Examining data/nginx-1.18.0/src/mail/ngx_mail_handler.c
Examining data/nginx-1.18.0/src/mail/ngx_mail_imap_handler.c
Examining data/nginx-1.18.0/src/mail/ngx_mail_imap_module.c
Examining data/nginx-1.18.0/src/mail/ngx_mail_imap_module.h
Examining data/nginx-1.18.0/src/mail/ngx_mail_parse.c
Examining data/nginx-1.18.0/src/mail/ngx_mail_pop3_handler.c
Examining data/nginx-1.18.0/src/mail/ngx_mail_pop3_module.c
Examining data/nginx-1.18.0/src/mail/ngx_mail_pop3_module.h
Examining data/nginx-1.18.0/src/mail/ngx_mail_proxy_module.c
Examining data/nginx-1.18.0/src/mail/ngx_mail_smtp_handler.c
Examining data/nginx-1.18.0/src/mail/ngx_mail_smtp_module.c
Examining data/nginx-1.18.0/src/mail/ngx_mail_smtp_module.h
Examining data/nginx-1.18.0/src/mail/ngx_mail_ssl_module.c
Examining data/nginx-1.18.0/src/mail/ngx_mail_ssl_module.h
Examining data/nginx-1.18.0/src/misc/ngx_cpp_test_module.cpp
Examining data/nginx-1.18.0/src/misc/ngx_google_perftools_module.c
Examining data/nginx-1.18.0/src/os/unix/ngx_alloc.c
Examining data/nginx-1.18.0/src/os/unix/ngx_alloc.h
Examining data/nginx-1.18.0/src/os/unix/ngx_atomic.h
Examining data/nginx-1.18.0/src/os/unix/ngx_channel.c
Examining data/nginx-1.18.0/src/os/unix/ngx_channel.h
Examining data/nginx-1.18.0/src/os/unix/ngx_daemon.c
Examining data/nginx-1.18.0/src/os/unix/ngx_darwin.h
Examining data/nginx-1.18.0/src/os/unix/ngx_darwin_config.h
Examining data/nginx-1.18.0/src/os/unix/ngx_darwin_init.c
Examining data/nginx-1.18.0/src/os/unix/ngx_darwin_sendfile_chain.c
Examining data/nginx-1.18.0/src/os/unix/ngx_dlopen.c
Examining data/nginx-1.18.0/src/os/unix/ngx_dlopen.h
Examining data/nginx-1.18.0/src/os/unix/ngx_errno.c
Examining data/nginx-1.18.0/src/os/unix/ngx_errno.h
Examining data/nginx-1.18.0/src/os/unix/ngx_file_aio_read.c
Examining data/nginx-1.18.0/src/os/unix/ngx_files.c
Examining data/nginx-1.18.0/src/os/unix/ngx_files.h
Examining data/nginx-1.18.0/src/os/unix/ngx_freebsd.h
Examining data/nginx-1.18.0/src/os/unix/ngx_freebsd_config.h
Examining data/nginx-1.18.0/src/os/unix/ngx_linux.h
Examining data/nginx-1.18.0/src/os/unix/ngx_freebsd_init.c
Examining data/nginx-1.18.0/src/os/unix/ngx_freebsd_sendfile_chain.c
Examining data/nginx-1.18.0/src/os/unix/ngx_gcc_atomic_amd64.h
Examining data/nginx-1.18.0/src/os/unix/ngx_gcc_atomic_ppc.h
Examining data/nginx-1.18.0/src/os/unix/ngx_gcc_atomic_sparc64.h
Examining data/nginx-1.18.0/src/os/unix/ngx_gcc_atomic_x86.h
Examining data/nginx-1.18.0/src/os/unix/ngx_linux_aio_read.c
Examining data/nginx-1.18.0/src/os/unix/ngx_linux_config.h
Examining data/nginx-1.18.0/src/os/unix/ngx_linux_init.c
Examining data/nginx-1.18.0/src/os/unix/ngx_linux_sendfile_chain.c
Examining data/nginx-1.18.0/src/os/unix/ngx_os.h
Examining data/nginx-1.18.0/src/os/unix/ngx_posix_init.c
Examining data/nginx-1.18.0/src/os/unix/ngx_process.c
Examining data/nginx-1.18.0/src/os/unix/ngx_process.h
Examining data/nginx-1.18.0/src/os/unix/ngx_process_cycle.c
Examining data/nginx-1.18.0/src/os/unix/ngx_process_cycle.h
Examining data/nginx-1.18.0/src/os/unix/ngx_readv_chain.c
Examining data/nginx-1.18.0/src/os/unix/ngx_recv.c
Examining data/nginx-1.18.0/src/os/unix/ngx_send.c
Examining data/nginx-1.18.0/src/os/unix/ngx_setaffinity.c
Examining data/nginx-1.18.0/src/os/unix/ngx_setaffinity.h
Examining data/nginx-1.18.0/src/os/unix/ngx_setproctitle.c
Examining data/nginx-1.18.0/src/os/unix/ngx_setproctitle.h
Examining data/nginx-1.18.0/src/os/unix/ngx_shmem.c
Examining data/nginx-1.18.0/src/os/unix/ngx_shmem.h
Examining data/nginx-1.18.0/src/os/unix/ngx_socket.c
Examining data/nginx-1.18.0/src/os/unix/ngx_socket.h
Examining data/nginx-1.18.0/src/os/unix/ngx_solaris.h
Examining data/nginx-1.18.0/src/os/unix/ngx_solaris_config.h
Examining data/nginx-1.18.0/src/os/unix/ngx_solaris_init.c
Examining data/nginx-1.18.0/src/os/unix/ngx_solaris_sendfilev_chain.c
Examining data/nginx-1.18.0/src/os/unix/ngx_sunpro_atomic_sparc64.h
Examining data/nginx-1.18.0/src/os/unix/ngx_thread.h
Examining data/nginx-1.18.0/src/os/unix/ngx_thread_cond.c
Examining data/nginx-1.18.0/src/os/unix/ngx_thread_id.c
Examining data/nginx-1.18.0/src/os/unix/ngx_thread_mutex.c
Examining data/nginx-1.18.0/src/os/unix/ngx_time.c
Examining data/nginx-1.18.0/src/os/unix/ngx_time.h
Examining data/nginx-1.18.0/src/os/unix/ngx_udp_recv.c
Examining data/nginx-1.18.0/src/os/unix/ngx_udp_send.c
Examining data/nginx-1.18.0/src/os/unix/ngx_udp_sendmsg_chain.c
Examining data/nginx-1.18.0/src/os/unix/ngx_user.c
Examining data/nginx-1.18.0/src/os/unix/ngx_user.h
Examining data/nginx-1.18.0/src/os/unix/ngx_writev_chain.c
Examining data/nginx-1.18.0/src/os/unix/ngx_posix_config.h
Examining data/nginx-1.18.0/src/stream/ngx_stream.c
Examining data/nginx-1.18.0/src/stream/ngx_stream.h
Examining data/nginx-1.18.0/src/stream/ngx_stream_access_module.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_core_module.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_geo_module.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_geoip_module.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_handler.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_limit_conn_module.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_log_module.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_map_module.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_proxy_module.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_realip_module.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_return_module.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_script.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_script.h
Examining data/nginx-1.18.0/src/stream/ngx_stream_split_clients_module.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_ssl_module.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_ssl_module.h
Examining data/nginx-1.18.0/src/stream/ngx_stream_ssl_preread_module.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_upstream.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_upstream.h
Examining data/nginx-1.18.0/src/stream/ngx_stream_upstream_hash_module.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_upstream_least_conn_module.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_upstream_random_module.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_upstream_round_robin.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_upstream_round_robin.h
Examining data/nginx-1.18.0/src/stream/ngx_stream_upstream_zone_module.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_variables.c
Examining data/nginx-1.18.0/src/stream/ngx_stream_variables.h
Examining data/nginx-1.18.0/src/stream/ngx_stream_write_filter_module.c
Examining data/nginx-1.18.0/debian/modules/http-auth-pam/ngx_http_auth_pam_module.c
Examining data/nginx-1.18.0/debian/modules/http-cache-purge/ngx_cache_purge_module.c
Examining data/nginx-1.18.0/debian/modules/http-dav-ext/ngx_http_dav_ext_module.c
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ddebug.h
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_echo.c
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_echo.h
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_filter.c
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_filter.h
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_foreach.c
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_foreach.h
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_handler.c
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_handler.h
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_location.c
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_location.h
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_module.c
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_module.h
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_request_info.c
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_request_info.h
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_sleep.c
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_sleep.h
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_subrequest.c
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_subrequest.h
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_timer.c
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_timer.h
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_util.c
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_util.h
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_var.c
Examining data/nginx-1.18.0/debian/modules/http-echo/src/ngx_http_echo_var.h
Examining data/nginx-1.18.0/debian/modules/http-fancyindex/ngx_http_fancyindex_module.c
Examining data/nginx-1.18.0/debian/modules/http-fancyindex/template.h
Examining data/nginx-1.18.0/debian/modules/http-geoip2/ngx_http_geoip2_module.c
Examining data/nginx-1.18.0/debian/modules/http-geoip2/ngx_stream_geoip2_module.c
Examining data/nginx-1.18.0/debian/modules/http-headers-more-filter/src/ddebug.h
Examining data/nginx-1.18.0/debian/modules/http-headers-more-filter/src/ngx_http_headers_more_filter_module.c
Examining data/nginx-1.18.0/debian/modules/http-headers-more-filter/src/ngx_http_headers_more_filter_module.h
Examining data/nginx-1.18.0/debian/modules/http-headers-more-filter/src/ngx_http_headers_more_headers_in.c
Examining data/nginx-1.18.0/debian/modules/http-headers-more-filter/src/ngx_http_headers_more_headers_in.h
Examining data/nginx-1.18.0/debian/modules/http-headers-more-filter/src/ngx_http_headers_more_headers_out.c
Examining data/nginx-1.18.0/debian/modules/http-headers-more-filter/src/ngx_http_headers_more_headers_out.h
Examining data/nginx-1.18.0/debian/modules/http-headers-more-filter/src/ngx_http_headers_more_util.c
Examining data/nginx-1.18.0/debian/modules/http-headers-more-filter/src/ngx_http_headers_more_util.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/api/ngx_http_lua_api.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ddebug.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_accessby.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_accessby.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_api.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_args.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_args.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_balancer.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_balancer.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_bodyfilterby.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_bodyfilterby.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_cache.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_cache.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_capturefilter.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_capturefilter.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_clfactory.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_clfactory.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_common.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_config.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_config.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_consts.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_consts.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_contentby.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_contentby.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_control.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_control.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_coroutine.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_coroutine.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_ctx.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_ctx.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_directive.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_directive.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_exception.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_exception.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_headerfilterby.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_headerfilterby.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_headers.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_headers.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_headers_in.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_headers_in.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_headers_out.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_headers_out.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_initby.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_initby.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_initworkerby.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_initworkerby.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_lex.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_lex.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_log.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_log.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_log_ringbuf.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_log_ringbuf.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_logby.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_logby.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_misc.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_misc.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_module.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_ndk.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_ndk.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_output.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_output.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_pcrefix.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_pcrefix.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_phase.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_phase.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_probe.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_regex.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_regex.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_req_body.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_req_body.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_req_method.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_req_method.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_rewriteby.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_rewriteby.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_script.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_script.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_semaphore.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_semaphore.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_setby.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_setby.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_shdict.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_shdict.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_sleep.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_sleep.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_udp.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_udp.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_ssl.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_ssl.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_ssl_certby.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_ssl_certby.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_ssl_ocsp.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_ssl_session_fetchby.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_ssl_session_fetchby.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_ssl_session_storeby.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_ssl_session_storeby.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_string.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_string.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_subrequest.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_subrequest.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_time.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_time.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_timer.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_timer.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_uri.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_uri.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_uthread.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_uthread.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_util.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_util.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_variable.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_variable.h
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_worker.c
Examining data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_worker.h
Examining data/nginx-1.18.0/debian/modules/http-lua/t/data/fake-delayed-load-module/ngx_http_lua_fake_delayed_load_module.c
Examining data/nginx-1.18.0/debian/modules/http-lua/t/data/fake-module/ngx_http_fake_module.c
Examining data/nginx-1.18.0/debian/modules/http-lua/t/data/fake-shm-module/ngx_http_lua_fake_shm_module.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/auto/src/array.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/auto/src/conf_cmd_basic.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/auto/src/conf_merge.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/auto/src/palloc.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/examples/http/set_var/ngx_http_set_var_examples_module.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/objs/ndk_array.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/objs/ndk_conf_cmd_basic.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/objs/ndk_conf_cmd_extra.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/objs/ndk_conf_merge.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/objs/ndk_config.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/objs/ndk_config.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/objs/ndk_includes.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/objs/ndk_palloc.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/hash/md5.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/hash/murmurhash2.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/hash/sha.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_buf.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_buf.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_complex_path.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_complex_path.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_complex_value.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_complex_value.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_conf_file.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_conf_file.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_debug.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_debug.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_encoding.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_encoding.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_hash.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_hash.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_http.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_http.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_http_headers.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_log.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_log.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_parse.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_path.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_path.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_process.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_process.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_regex.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_regex.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_rewrite.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_rewrite.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_set_var.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_set_var.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_string.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_string.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_string_util.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_upstream_list.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_upstream_list.h
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_uri.c
Examining data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_uri.h
Examining data/nginx-1.18.0/debian/modules/http-subs-filter/ngx_http_subs_filter_module.c
Examining data/nginx-1.18.0/debian/modules/http-uploadprogress/ngx_http_uploadprogress_module.c
Examining data/nginx-1.18.0/debian/modules/http-upstream-fair/ngx_http_upstream_fair_module.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/nchan_config_commands.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/nchan_defs.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/nchan_defs.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/nchan_module.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/nchan_module.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/nchan_setup.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/nchan_types.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/nchan_variables.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/nchan_variables.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/nchan_version.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/nchan_websocket_publisher.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/nchan_websocket_publisher.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/memory/groups.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/memory/groups.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/memory/ipc-handlers.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/memory/ipc-handlers.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/memory/ipc.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/memory/ipc.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/memory/memstore.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/memory/recycloc.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/memory/store-private.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/memory/store.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/ngx_rwlock.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/ngx_rwlock.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/adapters/ae.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/adapters/libev.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/adapters/libevent.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/adapters/libuv.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/async.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/async.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/dict.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/dict.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/examples/example-ae.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/examples/example-libev.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/examples/example-libevent.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/examples/example-libuv.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/examples/example.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/fmacros.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/net.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/net.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/read.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/read.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/sds.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/sds.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/test.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/win32.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/rdsstore.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_lua_commands.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_lua_commands.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_nginx_adapter.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_nginx_adapter.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_nodeset.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_nodeset.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_nodeset_parser.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_nodeset_parser.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/store-private.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/redis/store.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/spool.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/spool.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/store_common.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/store/store_common.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/benchmark.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/benchmark.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/common.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/common.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/eventsource.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/eventsource.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/getmsg_proxy.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/getmsg_proxy.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/http-chunked.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/http-chunked.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/http-multipart-mixed.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/http-multipart-mixed.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/http-raw-stream.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/http-raw-stream.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/internal.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/internal.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/intervalpoll.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/intervalpoll.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/longpoll-private.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/longpoll.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/longpoll.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/memstore_ipc.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/memstore_ipc.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/memstore_multi.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/memstore_multi.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/memstore_redis.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/memstore_redis.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/websocket.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/subscribers/websocket.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/uthash.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/hdr_histogram.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/hdr_histogram.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_benchmark.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_benchmark.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_bufchainpool.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_bufchainpool.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_channel_id.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_channel_id.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_debug.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_debug.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_fake_request.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_fake_request.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_list.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_list.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_msg.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_msg.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_output.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_output.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_output_info.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_output_info.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_rbtree.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_rbtree.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_reaper.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_reaper.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_reuse_queue.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_reuse_queue.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_slist.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_slist.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_subrequest.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_subrequest.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_thingcache.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_thingcache.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_util.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_util.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/ngx_nchan_hacked_slab.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/ngx_nchan_hacked_slab.h
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/shmem.c
Examining data/nginx-1.18.0/debian/modules/nchan/src/util/shmem.h
Examining data/nginx-1.18.0/debian/modules/rtmp/dash/ngx_rtmp_dash_module.c
Examining data/nginx-1.18.0/debian/modules/rtmp/dash/ngx_rtmp_mp4.c
Examining data/nginx-1.18.0/debian/modules/rtmp/dash/ngx_rtmp_mp4.h
Examining data/nginx-1.18.0/debian/modules/rtmp/hls/ngx_rtmp_hls_module.c
Examining data/nginx-1.18.0/debian/modules/rtmp/hls/ngx_rtmp_mpegts.c
Examining data/nginx-1.18.0/debian/modules/rtmp/hls/ngx_rtmp_mpegts.h
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp.h
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_access_module.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_amf.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_amf.h
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_auto_push_module.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_bandwidth.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_bandwidth.h
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_bitop.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_bitop.h
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_cmd_module.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_cmd_module.h
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_codec_module.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_codec_module.h
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_control_module.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_core_module.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_eval.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_eval.h
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_exec_module.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_flv_module.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_handler.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_handshake.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_init.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_limit_module.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_live_module.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_live_module.h
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_log_module.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_mp4_module.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_netcall_module.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_netcall_module.h
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_notify_module.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_play_module.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_play_module.h
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_proxy_protocol.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_proxy_protocol.h
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_receive.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_record_module.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_record_module.h
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_relay_module.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_relay_module.h
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_send.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_shared.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_stat_module.c
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_streams.h
Examining data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_version.h
FINAL RESULTS:
data/nginx-1.18.0/src/core/ngx_connection.c:635:21: [5] (race) chmod:
This accepts filename arguments; if an attacker can move those files, a
race condition results. (CWE-362). Use fchmod( ) instead.
if (chmod((char *) name, mode) == -1) {
data/nginx-1.18.0/src/core/ngx_cycle.c:1216:21: [5] (race) chown:
This accepts filename arguments; if an attacker can move those files, a
race condition results. (CWE-362). Use fchown( ) instead.
if (chown((const char *) file[i].name.data, user, -1) == -1) {
data/nginx-1.18.0/src/core/ngx_cycle.c:1235:21: [5] (race) chmod:
This accepts filename arguments; if an attacker can move those files, a
race condition results. (CWE-362). Use fchmod( ) instead.
if (chmod((const char *) file[i].name.data, fi.st_mode) == -1) {
data/nginx-1.18.0/src/core/ngx_file.c:632:17: [5] (race) chown:
This accepts filename arguments; if an attacker can move those files, a
race condition results. (CWE-362). Use fchown( ) instead.
if (chown((const char *) path[i]->name.data, user, -1) == -1) {
data/nginx-1.18.0/src/core/ngx_file.c:645:17: [5] (race) chmod:
This accepts filename arguments; if an attacker can move those files, a
race condition results. (CWE-362). Use fchmod( ) instead.
if (chmod((const char *) path[i]->name.data, fi.st_mode) == -1) {
data/nginx-1.18.0/src/os/unix/ngx_files.h:165:38: [5] (race) chmod:
This accepts filename arguments; if an attacker can move those files, a
race condition results. (CWE-362). Use fchmod( ) instead.
#define ngx_change_file_access(n, a) chmod((const char *) n, a)
data/nginx-1.18.0/debian/modules/http-auth-pam/ngx_http_auth_pam_module.c:246:17: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(key_value_pair, "%s=%s", key, value);
data/nginx-1.18.0/debian/modules/http-cache-purge/ngx_cache_purge_module.c:46:35: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_array_t *access; /* array of ngx_in_cidr_t */
data/nginx-1.18.0/debian/modules/http-cache-purge/ngx_cache_purge_module.c:1161:23: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if ((cplcf->conf->access || cplcf->conf->access6)
data/nginx-1.18.0/debian/modules/http-cache-purge/ngx_cache_purge_module.c:1162:54: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
&& ngx_http_cache_purge_access(cplcf->conf->access,
data/nginx-1.18.0/debian/modules/http-cache-purge/ngx_cache_purge_module.c:1177:42: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_http_cache_purge_access(ngx_array_t *access, ngx_array_t *access6,
data/nginx-1.18.0/debian/modules/http-cache-purge/ngx_cache_purge_module.c:1216:13: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (access && IN6_IS_ADDR_V4MAPPED(inaddr6)) {
data/nginx-1.18.0/debian/modules/http-cache-purge/ngx_cache_purge_module.c:1506:22: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_in_cidr_t *access;
data/nginx-1.18.0/debian/modules/http-cache-purge/ngx_cache_purge_module.c:1570:43: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
access = ngx_array_push(cpcf->access);
data/nginx-1.18.0/debian/modules/http-cache-purge/ngx_cache_purge_module.c:1616:34: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
conf->access = prev->access;
data/nginx-1.18.0/debian/modules/http-echo/src/ddebug.h:13:13: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(stderr, __VA_ARGS__); \
data/nginx-1.18.0/debian/modules/http-headers-more-filter/src/ddebug.h:16:13: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(stderr, __VA_ARGS__); \
data/nginx-1.18.0/debian/modules/http-lua/src/ddebug.h:21:13: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(stderr, __VA_ARGS__); \
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_req_body.c:1099:69: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
tf->persistent, tf->clean, tf->access)
data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_debug.c:41:5: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
vfprintf (stderr, const char *format, va_list ap)
data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_debug.h:25:13: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(stderr, (const char *)__VA_ARGS__); \
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/sds.c:370:9: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
vsnprintf(buf, buflen, fmt, cpy);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/sds.h:77:27: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
__attribute__((format(printf, 2, 3)));
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/test.c:38:47: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
#define test(_s) { printf("#%02d ", ++tests); printf(_s); }
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/win32.h:13:9: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
#ifndef snprintf
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/win32.h:14:9: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
#define snprintf c99_snprintf
data/nginx-1.18.0/debian/modules/nchan/src/uthash.h:505:29: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
#define HASH_OOPS(...) do { fprintf(stderr,__VA_ARGS__); exit(-1); } while (0)
data/nginx-1.18.0/debian/modules/nchan/src/util/hdr_histogram.c:768:9: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
#define snprintf _snprintf
data/nginx-1.18.0/debian/modules/nchan/src/util/hdr_histogram.c:768:18: [4] (format) _snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
#define snprintf _snprintf
data/nginx-1.18.0/debian/modules/nchan/src/util/hdr_histogram.c:777:13: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
snprintf(str, len, format_str, "%.", significant_figures, "f,%f,%d,%.2f\n");
data/nginx-1.18.0/debian/modules/nchan/src/util/hdr_histogram.c:780:13: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
snprintf(str, len, format_str, "%12.", significant_figures, "f %12f %12d %12.2f\n");
data/nginx-1.18.0/debian/modules/nchan/src/util/hdr_histogram.c:783:13: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
snprintf(str, len, format_str, "%12.", significant_figures, "f %12f %12d %12.2f\n");
data/nginx-1.18.0/debian/modules/nchan/src/util/hdr_histogram.c:786:8: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
#undef snprintf
data/nginx-1.18.0/debian/modules/nchan/src/util/hdr_histogram.c:974:9: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
if (fprintf(
data/nginx-1.18.0/debian/modules/nchan/src/util/hdr_histogram.c:990:13: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
if (fprintf(
data/nginx-1.18.0/debian/modules/nchan/src/util/hdr_histogram.c:1004:13: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
if (fprintf(
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_output.c:421:16: [4] (format) sprintf:
Potential format string problem (CWE-134). Make format string constant.
cur += sprintf(cur, id->tagactive != i ? inactive : active, t[i]);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_util.c:861:89: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if(ngx_create_temp_file(&tf->file, tf->path, tf->pool, tf->persistent, tf->clean, tf->access) != NGX_OK) {
data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_exec_module.c:835:17: [4] (shell) execvp:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
if (execvp((char *) ec->cmd.data, args) == -1) {
data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_send.c:612:12: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
&access, 0 },
data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_send.c:616:12: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
&access, 0 },
data/nginx-1.18.0/src/core/ngx_file.c:115:66: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
tf->persistent, tf->clean, tf->access);
data/nginx-1.18.0/src/core/ngx_file.c:142:57: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_uint_t persistent, ngx_uint_t clean, ngx_uint_t access)
data/nginx-1.18.0/src/core/ngx_file.c:202:67: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
file->fd = ngx_open_tempfile(file->name.data, persistent, access);
data/nginx-1.18.0/src/core/ngx_file.c:304:46: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_create_full_path(u_char *dir, ngx_uint_t access)
data/nginx-1.18.0/src/core/ngx_file.c:326:33: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (ngx_create_dir(dir, access) == NGX_FILE_ERROR) {
data/nginx-1.18.0/src/core/ngx_file.c:466:36: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_uint_t i, right, shift, *access, user;
data/nginx-1.18.0/src/core/ngx_file.c:470:10: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (*access != NGX_CONF_UNSET_UINT) {
data/nginx-1.18.0/src/core/ngx_file.c:510:10: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
*access |= right << shift;
data/nginx-1.18.0/src/core/ngx_file.c:513:6: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
*access |= user;
data/nginx-1.18.0/src/core/ngx_file.c:668:14: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (ext->access) {
data/nginx-1.18.0/src/core/ngx_file.c:669:52: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (ngx_change_file_access(src->data, ext->access) == NGX_FILE_ERROR) {
data/nginx-1.18.0/src/core/ngx_file.c:732:26: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
cf.access = ext->access;
data/nginx-1.18.0/src/core/ngx_file.c:804:23: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_uint_t access;
data/nginx-1.18.0/src/core/ngx_file.c:819:31: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (cf->size != -1 && cf->access != 0 && cf->time != -1) {
data/nginx-1.18.0/src/core/ngx_file.c:821:22: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
access = cf->access;
data/nginx-1.18.0/src/core/ngx_file.c:833:22: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
access = cf->access ? cf->access : ngx_file_access(&fi);
data/nginx-1.18.0/src/core/ngx_file.c:833:35: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
access = cf->access ? cf->access : ngx_file_access(&fi);
data/nginx-1.18.0/src/core/ngx_file.c:848:65: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
nfd = ngx_open_file(to, NGX_FILE_WRONLY, NGX_FILE_TRUNCATE, access);
data/nginx-1.18.0/src/core/ngx_file.h:78:32: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_uint_t access;
data/nginx-1.18.0/src/core/ngx_file.h:88:32: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_uint_t access;
data/nginx-1.18.0/src/core/ngx_file.h:104:32: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_uint_t access;
data/nginx-1.18.0/src/core/ngx_file.h:119:32: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_uint_t access;
data/nginx-1.18.0/src/core/ngx_file.h:141:16: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_uint_t access);
data/nginx-1.18.0/src/core/ngx_file.h:144:56: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_err_t ngx_create_full_path(u_char *dir, ngx_uint_t access);
data/nginx-1.18.0/src/core/ngx_open_file_cache.c:27:49: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_int_t mode, ngx_int_t create, ngx_int_t access, ngx_log_t *log);
data/nginx-1.18.0/src/core/ngx_open_file_cache.c:35:15: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_int_t access, ngx_log_t *log);
data/nginx-1.18.0/src/core/ngx_open_file_cache.c:493:49: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_int_t mode, ngx_int_t create, ngx_int_t access, ngx_log_t *log)
data/nginx-1.18.0/src/core/ngx_open_file_cache.c:511:53: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fd = ngx_openat_file(at_fd, name, mode, create, access);
data/nginx-1.18.0/src/core/ngx_open_file_cache.c:615:49: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_int_t mode, ngx_int_t create, ngx_int_t access, ngx_log_t *log)
data/nginx-1.18.0/src/core/ngx_open_file_cache.c:621:50: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fd = ngx_open_file(name->data, mode, create, access);
data/nginx-1.18.0/src/core/ngx_open_file_cache.c:638:54: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fd = ngx_open_file(name->data, mode, create, access);
data/nginx-1.18.0/src/core/ngx_open_file_cache.c:748:56: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fd = ngx_openat_file(at_fd, ".", mode, create, access);
data/nginx-1.18.0/src/core/ngx_open_file_cache.c:755:60: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fd = ngx_openat_file_owner(at_fd, p, mode, create, access, log);
data/nginx-1.18.0/src/core/ngx_open_file_cache.c:758:72: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
fd = ngx_openat_file(at_fd, p, mode|NGX_FILE_NOFOLLOW, create, access);
data/nginx-1.18.0/src/http/modules/ngx_http_dav_module.c:23:17: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_uint_t access;
data/nginx-1.18.0/src/http/modules/ngx_http_dav_module.c:104:41: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
offsetof(ngx_http_dav_loc_conf_t, access),
data/nginx-1.18.0/src/http/modules/ngx_http_dav_module.c:265:24: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ext.access = dlcf->access;
data/nginx-1.18.0/src/http/modules/ngx_http_dav_module.c:266:29: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ext.path_access = dlcf->access;
data/nginx-1.18.0/src/http/modules/ngx_http_dav_module.c:520:56: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (ngx_create_dir(path.data, ngx_dir_access(dlcf->access))
data/nginx-1.18.0/src/http/modules/ngx_http_dav_module.c:832:37: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ext.path_access = dlcf->access;
data/nginx-1.18.0/src/http/modules/ngx_http_dav_module.c:885:49: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
if (ngx_create_dir(dir, ngx_dir_access(ctx->access)) == NGX_FILE_ERROR) {
data/nginx-1.18.0/src/http/modules/ngx_http_dav_module.c:988:22: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
cf.access = ctx->access;
data/nginx-1.18.0/src/http/modules/ngx_http_dav_module.c:1124:37: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_conf_merge_uint_value(conf->access, prev->access, 0600);
data/nginx-1.18.0/src/http/modules/ngx_http_dav_module.c:1124:51: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_conf_merge_uint_value(conf->access, prev->access, 0600);
data/nginx-1.18.0/src/http/modules/ngx_http_xslt_filter_module.c:477:18: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
n = (size_t) vsnprintf((char *) buf, NGX_MAX_ERROR_STR, msg, args);
data/nginx-1.18.0/src/http/ngx_http_request_body.c:469:69: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
tf->persistent, tf->clean, tf->access)
data/nginx-1.18.0/src/http/ngx_http_upstream.c:4090:65: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
tf->persistent, tf->clean, tf->access)
data/nginx-1.18.0/src/os/unix/ngx_files.c:277:67: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_open_tempfile(u_char *name, ngx_uint_t persistent, ngx_uint_t access)
data/nginx-1.18.0/src/os/unix/ngx_files.c:282:15: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
access ? access : 0600);
data/nginx-1.18.0/src/os/unix/ngx_files.c:282:24: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
access ? access : 0600);
data/nginx-1.18.0/src/os/unix/ngx_files.h:60:43: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
#define ngx_open_file(name, mode, create, access) \
data/nginx-1.18.0/src/os/unix/ngx_files.h:61:53: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
open((const char *) name, mode|create|O_BINARY, access)
data/nginx-1.18.0/src/os/unix/ngx_files.h:65:43: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
#define ngx_open_file(name, mode, create, access) \
data/nginx-1.18.0/src/os/unix/ngx_files.h:66:44: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
open((const char *) name, mode|create, access)
data/nginx-1.18.0/src/os/unix/ngx_files.h:118:16: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
ngx_uint_t access);
data/nginx-1.18.0/src/os/unix/ngx_files.h:228:30: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
#define ngx_create_dir(name, access) mkdir((const char *) name, access)
data/nginx-1.18.0/src/os/unix/ngx_files.h:228:65: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
#define ngx_create_dir(name, access) mkdir((const char *) name, access)
data/nginx-1.18.0/src/os/unix/ngx_files.h:353:49: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
#define ngx_openat_file(fd, name, mode, create, access) \
data/nginx-1.18.0/src/os/unix/ngx_files.h:354:50: [4] (race) access:
This usually indicates a security flaw. If an attacker can change anything
along the path between the call to access() and the file's actual use
(e.g., by moving files), the attacker can exploit the race condition
(CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
and try to open the file directly.
openat(fd, (const char *) name, mode|create, access)
data/nginx-1.18.0/src/os/unix/ngx_user.c:25:13: [4] (crypto) crypt_r:
The crypt functions use a poor one-way hashing algorithm; since they only
accept passwords of 8 characters or fewer and only a two-byte salt, they
are excessively vulnerable to dictionary attacks given today's faster
computing equipment (CWE-327). Use a different algorithm, such as SHA-256,
with a larger, non-repeating salt.
value = crypt_r((char *) key, (char *) salt, &cd);
data/nginx-1.18.0/src/os/unix/ngx_user.c:53:13: [4] (crypto) crypt:
The crypt functions use a poor one-way hashing algorithm; since they only
accept passwords of 8 characters or fewer and only a two-byte salt, they
are excessively vulnerable to dictionary attacks given today's faster
computing equipment (CWE-327). Use a different algorithm, such as SHA-256,
with a larger, non-repeating salt.
value = crypt((char *) key, (char *) salt);
data/nginx-1.18.0/src/core/nginx.c:458:28: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable can
be set more than once (CWE-807, CWE-20). Check environment variables
carefully before using them.
inherited = (u_char *) getenv(NGINX_VAR);
data/nginx-1.18.0/src/core/ngx_config.h:57:34: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
#define ngx_random random
data/nginx-1.18.0/src/misc/ngx_google_perftools_module.c:104:9: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable can
be set more than once (CWE-807, CWE-20). Check environment variables
carefully before using them.
if (getenv("CPUPROFILE")) {
data/nginx-1.18.0/src/os/unix/ngx_darwin_init.c:83:9: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable can
be set more than once (CWE-807, CWE-20). Check environment variables
carefully before using them.
if (getenv("MallocScribble")) {
data/nginx-1.18.0/src/os/unix/ngx_files.h:197:45: [3] (buffer) realpath:
This function does not protect against buffer overflows, and some
implementations can overflow internally (CWE-120/CWE-785!). Ensure that the
destination buffer is at least of size MAXPATHLEN, andto protect against
implementation problems, the input argument should also be checked to
ensure it is no larger than MAXPATHLEN.
#define ngx_realpath(p, r) (u_char *) realpath((char *) p, (char *) r)
data/nginx-1.18.0/src/os/unix/ngx_freebsd_init.c:92:10: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable can
be set more than once (CWE-807, CWE-20). Check environment variables
carefully before using them.
mo = getenv("MALLOC_OPTIONS");
data/nginx-1.18.0/src/os/unix/ngx_posix_init.c:92:5: [3] (random) srandom:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
srandom(((unsigned) ngx_pid << 16) ^ tp->sec ^ tp->msec);
data/nginx-1.18.0/src/os/unix/ngx_process_cycle.c:918:5: [3] (random) srandom:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
srandom(((unsigned) ngx_pid << 16) ^ tp->sec ^ tp->msec);
data/nginx-1.18.0/src/os/unix/ngx_time.c:29:9: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable can
be set more than once (CWE-807, CWE-20). Check environment variables
carefully before using them.
if (getenv("TZ")) {
data/nginx-1.18.0/debian/modules/http-geoip2/ngx_http_geoip2_module.c:206:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&database->address, &address, sizeof(address));
data/nginx-1.18.0/debian/modules/http-geoip2/ngx_http_geoip2_module.c:399:25: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
status = MMDB_open((char *) value[1].data, MMDB_MODE_MMAP, &database->mmdb);
data/nginx-1.18.0/debian/modules/http-geoip2/ngx_http_geoip2_module.c:606:36: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
geoip2->lookup[i - idx] = (char *) value[i].data;
data/nginx-1.18.0/debian/modules/http-geoip2/ngx_stream_geoip2_module.c:174:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&database->address, &address, sizeof(address));
data/nginx-1.18.0/debian/modules/http-geoip2/ngx_stream_geoip2_module.c:368:25: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
status = MMDB_open((char *) value[1].data, MMDB_MODE_MMAP, &database->mmdb);
data/nginx-1.18.0/debian/modules/http-geoip2/ngx_stream_geoip2_module.c:577:36: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
geoip2->lookup[i - idx] = (char *) value[i].data;
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_clfactory.c:304:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[MAX_BEGIN_CODE_SIZE];
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_clfactory.c:308:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[MAX_END_CODE_SIZE];
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_clfactory.c:310:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buff[NGX_LUA_READER_BUFSIZE];
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_clfactory.c:622:12: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
lf.f = fopen(filename, "r");
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_coroutine.c:373:35: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
lua_pushlstring(L, (const char *)
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_coroutine.c:381:31: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
lua_pushlstring(L, (const char *)
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_headers.c:468:33: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
lua_pushlstring(L, (char *) header[i].key.data, header[i].key.len);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_headers.c:471:33: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
lua_pushlstring(L, (char *) header[i].lowcase_key,
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_headers.c:477:29: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
lua_pushlstring(L, (char *) header[i].value.data,
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_headers.c:643:33: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
lua_pushlstring(L, (char *) header[i].key.data, header[i].key.len);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_headers.c:658:33: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
lua_pushlstring(L, (char *) lowcase_key, header[i].key.len);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_headers.c:663:29: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
lua_pushlstring(L, (char *) header[i].value.data,
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_headers_out.c:612:38: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
lua_pushlstring(L, (char *) h[i].value.data, h[i].value.len);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_headers_out.c:624:34: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
lua_pushlstring(L, (char *) h[i].value.data, h[i].value.len);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_setby.c:66:39: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
lua_pushlstring(L, (const char *) args[i].data, args[i].len);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_setby.c:159:35: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
lua_pushlstring(L, (const char *) (v[idx].data), v[idx].len);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:4971:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1];
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_string.c:638:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char md[EVP_MAX_MD_SIZE];
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_subrequest.c:1324:34: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
lua_pushlstring(co, (char *) header[i].key.data,
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_subrequest.c:1334:38: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
lua_pushlstring(co, (char *) header[i].value.data,
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_subrequest.c:1349:42: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
lua_pushlstring(co, (char *) header[i].value.data,
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_subrequest.c:1359:42: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
lua_pushlstring(co, (char *) header[i].value.data,
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_util.c:3288:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1];
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_util.c:3795:34: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
lua_setfield(L, -2, (char *) hook[i].package);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_variable.c:101:35: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
lua_pushlstring(L, (const char *) val, (size_t) (cap[n + 1] - cap[n]));
data/nginx-1.18.0/debian/modules/http-lua/t/data/fake-shm-module/ngx_http_lua_fake_shm_module.c:238:33: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
lua_pushlstring(L, (char *) zone[i]->shm.name.data,
data/nginx-1.18.0/debian/modules/http-ndk/src/hash/sha.h:178:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char p[SHA512_CBLOCK];
data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_debug.c:22:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char func_name [len + flen + 1];
data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_debug.c:27:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (s, func, len);
data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_encoding.c:23:19: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
ep->to = (char *) value[1].data;
data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_encoding.c:28:21: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
ep->from = (char *) value[1].data;
data/nginx-1.18.0/debian/modules/nchan/src/store/memory/ipc.h:8:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char data[IPC_DATA_SIZE];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:101:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char *cmp_error_messages[ERROR_MAX + 1] = {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:644:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char bytes[4];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:655:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char bytes[8];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:914:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char swapped[sizeof(float)];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:933:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char swapped[sizeof(double)];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/async.c:72:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dup,src,sizeof(*dup));
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/async.c:236:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(cb,source,sizeof(*cb));
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/async.c:258:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(target,cb,sizeof(*cb));
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/async.c:390:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dstcb,dictGetEntryVal(de),sizeof(*dstcb));
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/examples/example.c:12:29: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
int port = (argc > 2) ? atoi(argv[2]) : 6379;
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/examples/example.c:58:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[64];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.c:121:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf,str,len);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.c:280:21: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char _format[16];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.c:359:25: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(_format,c,_l);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.c:403:11: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
pos = sprintf(cmd,"*%d\r\n",argc);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.c:405:16: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
pos += sprintf(cmd+pos,"$%zu\r\n",sdslen(curargv[j]));
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.c:406:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(cmd+pos,curargv[j],sdslen(curargv[j]));
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.c:552:11: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
pos = sprintf(cmd,"*%d\r\n",argc);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.c:555:16: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
pos += sprintf(cmd+pos,"$%zu\r\n",len);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.c:556:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(cmd+pos,argv[j],len);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.c:579:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(c->errstr,str,len);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.c:795:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1024*16];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.h:144:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char errstr[128]; /* String representation of error when applicable */
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/net.c:68:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128] = { 0 };
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/net.c:263:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char _port[6]; /* strlen("65535"); */
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/net.c:291:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(c->timeout, timeout, sizeof(struct timeval));
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/net.c:337:17: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/net.c:359:17: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/net.c:394:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/net.c:436:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(c->timeout, timeout, sizeof(struct timeval));
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/read.c:68:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(r->errstr,str,len);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/read.c:97:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cbuf[8], sbuf[128];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/read.h:82:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char errstr[128]; /* String representation of error when applicable */
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/sds.c:63:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sh->buf, init, initlen);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/sds.c:244:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(s+curlen, t, len);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/sds.c:279:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(s, t, len);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/sds.c:460:17: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(s+i,str,l);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/sds.c:472:21: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[SDS_LLSTR_SIZE];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/sds.c:478:21: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(s+i,buf,l);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/sds.c:494:21: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[SDS_LLSTR_SIZE];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/sds.c:500:21: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(s+i,buf,l);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/sds.c:720:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[32], *p;
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/test.c:209:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char *argv[3];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/test.c:757:28: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
cfg.tcp.port = atoi(argv[0]);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/rdsstore.c:2303:14: [2] (integer) atol:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
return atol(reply->str);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_nodeset.c:158:10: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char buf[512];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_nodeset.c:357:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
d1 = &((char *)node)[match->offset];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_nodeset.c:359:13: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
d2 = &((char *)cur)[match->offset];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_nodeset.c:384:13: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
d2 = &((char *)cur)[match->offset];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_nodeset.c:1054:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char errstr[512];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_nodeset.c:1123:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char errstr[1024];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_nodeset.c:1598:10: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char str[1024];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_nodeset.c:1627:10: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char buf[512];
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_nodeset_parser.c:164:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char slavebuf[20]="slave0:";
data/nginx-1.18.0/debian/modules/nchan/src/util/hdr_histogram.c:966:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char line_format[25];
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_benchmark.c:300:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char stats[2048];
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_benchmark.c:492:12: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
then = atoi((char *)msg->buf.start);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_benchmark.c:507:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char throwaway_buf[128];
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_benchmark.c:511:11: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
*cur += sprintf(buf, "%" PRId64 " ", val);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_benchmark.c:516:11: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
*cur += sprintf(buf, "%" PRId32 " ", val);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_benchmark.c:521:11: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
*cur += sprintf(buf, "%lf ", val);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_benchmark.c:529:13: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
*cur += sprintf(buf, "%i ", num);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_benchmark.c:532:13: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
*cur += sprintf(buf, "%c%i ", numrun[num], runcount);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_benchmark.c:615:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ready_reply[512];
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_output.c:399:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char msgtag_str_buf[10*255 + 30];
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_output.c:412:12: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
return sprintf(ch, "%i", t[0]);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_output.c:445:8: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
l1 = sprintf(msgtag_str_buf, "%li:", id->time);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_slist.c:29:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
return (void **)&(((char *)el)[list->offset.next]);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_slist.c:32:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
return (void **)&(((char *)el)[list->offset.prev]);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_util.c:356:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dst->data, src->data, len);
data/nginx-1.18.0/debian/modules/rtmp/dash/ngx_rtmp_mp4.c:107:38: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
ngx_rtmp_mp4_box(ngx_buf_t *b, const char box[4])
data/nginx-1.18.0/debian/modules/rtmp/dash/ngx_rtmp_mp4.c:120:44: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
ngx_rtmp_mp4_start_box(ngx_buf_t *b, const char box[4])
data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_amf.c:192:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[maxlen];
data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_amf.c:194:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[1024];
data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_exec_module.c:789:18: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd = open("/dev/null", O_RDWR);
data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_netcall_module.c:503:18: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const char *methods[2] = { "GET", "POST" };
data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_play_module.c:684:16: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
return atoi((char *) p + (sizeof(name) - 1));
data/nginx-1.18.0/src/core/nginx.c:595:25: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
env[n++] = (char *) var[i].data;
data/nginx-1.18.0/src/core/nginx.c:1214:22: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
ccf->username = (char *) value[1].data;
data/nginx-1.18.0/src/core/nginx.c:1217:27: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
pwd = getpwnam((const char *) value[1].data);
data/nginx-1.18.0/src/core/ngx_connection.h:59:25: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
unsigned open:1;
data/nginx-1.18.0/src/core/ngx_cycle.c:55:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char hostname[NGX_MAXHOSTNAMELEN];
data/nginx-1.18.0/src/core/ngx_cycle.c:916:53: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (ls[i].fd == (ngx_socket_t) -1 || !ls[i].open) {
data/nginx-1.18.0/src/core/ngx_cycle.c:1216:34: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
if (chown((const char *) file[i].name.data, user, -1) == -1) {
data/nginx-1.18.0/src/core/ngx_cycle.c:1235:34: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
if (chmod((const char *) file[i].name.data, fi.st_mode) == -1) {
data/nginx-1.18.0/src/core/ngx_file.c:632:30: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
if (chown((const char *) path[i]->name.data, user, -1) == -1) {
data/nginx-1.18.0/src/core/ngx_file.c:645:30: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
if (chmod((const char *) path[i]->name.data, fi.st_mode) == -1) {
data/nginx-1.18.0/src/core/ngx_proxy_protocol.c:343:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&src_sockaddr.sockaddr_in.sin_addr, in->src_addr, 4);
data/nginx-1.18.0/src/core/ngx_proxy_protocol.c:347:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&dst_sockaddr.sockaddr_in.sin_addr, in->dst_addr, 4);
data/nginx-1.18.0/src/core/ngx_proxy_protocol.c:370:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&src_sockaddr.sockaddr_in6.sin6_addr, in6->src_addr, 16);
data/nginx-1.18.0/src/core/ngx_proxy_protocol.c:374:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&dst_sockaddr.sockaddr_in6.sin6_addr, in6->dst_addr, 16);
data/nginx-1.18.0/src/core/ngx_string.c:2034:12: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
return memcpy(dst, src, n);
data/nginx-1.18.0/src/core/ngx_string.h:106:42: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
#define ngx_memcpy(dst, src, n) (void) memcpy(dst, src, n)
data/nginx-1.18.0/src/core/ngx_string.h:107:48: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
#define ngx_cpymem(dst, src, n) (((u_char *) memcpy(dst, src, n)) + (n))
data/nginx-1.18.0/src/event/modules/ngx_devpoll_module.c:126:14: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
dp = open("/dev/poll", O_RDWR);
data/nginx-1.18.0/src/event/ngx_event_openssl.c:1824:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[129], *s, *d;
data/nginx-1.18.0/src/event/ngx_event_openssl.c:5124:28: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
engine = ENGINE_by_id((char *) value[1].data);
data/nginx-1.18.0/src/http/modules/ngx_http_fastcgi_module.c:1752:47: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
if (ngx_strnstr(msg, (char *) pattern[i].data,
data/nginx-1.18.0/src/http/modules/ngx_http_geoip_module.c:689:32: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
gcf->country = GeoIP_open((char *) value[1].data, GEOIP_MEMORY_CACHE);
data/nginx-1.18.0/src/http/modules/ngx_http_geoip_module.c:744:28: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
gcf->org = GeoIP_open((char *) value[1].data, GEOIP_MEMORY_CACHE);
data/nginx-1.18.0/src/http/modules/ngx_http_geoip_module.c:805:29: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
gcf->city = GeoIP_open((char *) value[1].data, GEOIP_MEMORY_CACHE);
data/nginx-1.18.0/src/http/modules/ngx_http_ssi_filter_module.c:2732:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[NGX_HTTP_SSI_DATE_LEN];
data/nginx-1.18.0/src/http/modules/ngx_http_upstream_keepalive_module.c:415:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1];
data/nginx-1.18.0/src/http/modules/perl/ngx_http_perl_module.c:458:36: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
asv[i + 1] = newSVpvn((char *) args[i]->data, args[i]->len);
data/nginx-1.18.0/src/http/modules/perl/ngx_http_perl_module.c:623:37: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
embedding[2 * i + 2] = (char *) m[i].data;
data/nginx-1.18.0/src/http/modules/perl/ngx_http_perl_module.c:682:21: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
require_pv((char *) script[i].data);
data/nginx-1.18.0/src/http/modules/perl/ngx_http_perl_module.c:1005:31: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
plcf->sub = newSVpvn((char *) value[1].data, value[1].len);
data/nginx-1.18.0/src/http/modules/perl/ngx_http_perl_module.c:1077:29: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
pv->sub = newSVpvn((char *) value[2].data, value[2].len);
data/nginx-1.18.0/src/http/ngx_http_request.c:2869:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1];
data/nginx-1.18.0/src/http/ngx_http_upstream.c:1312:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1];
data/nginx-1.18.0/src/os/unix/ngx_channel.c:26:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char space[CMSG_SPACE(sizeof(int))];
data/nginx-1.18.0/src/os/unix/ngx_channel.c:106:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char space[CMSG_SPACE(sizeof(int))];
data/nginx-1.18.0/src/os/unix/ngx_daemon.c:39:10: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd = open("/dev/null", O_RDWR);
data/nginx-1.18.0/src/os/unix/ngx_darwin_init.c:12:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ngx_darwin_kern_ostype[16];
data/nginx-1.18.0/src/os/unix/ngx_darwin_init.c:13:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ngx_darwin_kern_osrelease[128];
data/nginx-1.18.0/src/os/unix/ngx_files.c:281:10: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd = open((const char *) name, O_CREAT|O_EXCL|O_RDWR,
data/nginx-1.18.0/src/os/unix/ngx_files.h:61:5: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
open((const char *) name, mode|create|O_BINARY, access)
data/nginx-1.18.0/src/os/unix/ngx_files.h:66:5: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
open((const char *) name, mode|create, access)
data/nginx-1.18.0/src/os/unix/ngx_freebsd_init.c:13:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ngx_freebsd_kern_ostype[16];
data/nginx-1.18.0/src/os/unix/ngx_freebsd_init.c:14:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ngx_freebsd_kern_osrelease[128];
data/nginx-1.18.0/src/os/unix/ngx_shmem.c:47:10: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd = open("/dev/zero", O_RDWR);
data/nginx-1.18.0/src/os/unix/ngx_solaris_init.c:12:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ngx_solaris_sysname[20];
data/nginx-1.18.0/src/os/unix/ngx_solaris_init.c:13:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ngx_solaris_release[10];
data/nginx-1.18.0/src/os/unix/ngx_solaris_init.c:14:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ngx_solaris_version[50];
data/nginx-1.18.0/src/os/unix/ngx_time.c:44:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[4];
data/nginx-1.18.0/src/stream/ngx_stream_geoip_module.c:638:32: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
gcf->country = GeoIP_open((char *) value[1].data, GEOIP_MEMORY_CACHE);
data/nginx-1.18.0/src/stream/ngx_stream_geoip_module.c:693:28: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
gcf->org = GeoIP_open((char *) value[1].data, GEOIP_MEMORY_CACHE);
data/nginx-1.18.0/src/stream/ngx_stream_geoip_module.c:754:29: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
gcf->city = GeoIP_open((char *) value[1].data, GEOIP_MEMORY_CACHE);
data/nginx-1.18.0/debian/modules/http-auth-pam/ngx_http_auth_pam_module.c:135:37: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
bzero(response[i].resp, strlen(response[i].resp));
data/nginx-1.18.0/debian/modules/http-auth-pam/ngx_http_auth_pam_module.c:244:31: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t size = strlen(key) + strlen(value) + 1 * sizeof(char);
data/nginx-1.18.0/debian/modules/http-auth-pam/ngx_http_auth_pam_module.c:244:45: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t size = strlen(key) + strlen(value) + 1 * sizeof(char);
data/nginx-1.18.0/debian/modules/http-auth-pam/ngx_http_auth_pam_module.c:262:9: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(destination, (char *) source.data, source.len);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_accessby.c:317:30: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = r->connection->read;
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_clfactory.c:627:9: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c = getc(lf.f);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_clfactory.c:632:21: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while ((c = getc(lf.f)) != EOF && c != '\n') {
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_clfactory.c:637:17: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c = getc(lf.f);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_clfactory.c:682:21: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while ((c = getc(lf.f)) != EOF && c != LUA_SIGNATURE[0]) {
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_contentby.c:104:30: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = r->connection->read;
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_req_body.c:1176:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(r->connection->read);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_rewriteby.c:317:30: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = r->connection->read;
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:1190:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:1475:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(c->read, u->connect_timeout);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:1539:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:2114:34: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
unsigned read;
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:2119:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:2202:13: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (read && !rev->ready) {
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:2664:33: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ev = r->connection->read;
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:2964:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:3395:34: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:3458:42: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(r->connection->read);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:3467:30: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:3471:30: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_event(c->read, NGX_READ_EVENT, NGX_CLOSE_EVENT);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:3479:40: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_delete_posted_event(c->read);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:3648:15: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c->read, c->read->pending_eof);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:3654:21: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ev = c->read;
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:4501:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:4666:34: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:4785:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:4810:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(c->read, timeout);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:4828:61: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rc = ngx_http_lua_socket_keepalive_close_handler(c->read);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:4909:30: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_tcp.c:4997:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_udp.c:1189:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_udp.c:1263:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_socket_udp.c:1435:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_util.c:3402:65: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rc = ngx_http_lua_check_broken_connection(r, r->connection->read);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_util.c:3426:30: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = r->connection->read;
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_util.c:3615:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/debian/modules/http-lua/src/ngx_http_lua_util.c:3702:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_complex_value.c:39:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
value.len = strlen (*s);
data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_debug.c:12:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
flen = strlen (fmt);
data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_debug.c:16:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen (func);
data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_encoding.c:24:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen (ep->from);
data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_encoding.c:29:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen (ep->to);
data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_string.c:85:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
str->len = strlen (*s);
data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_string.c:100:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
argc = strlen (fmt);
data/nginx-1.18.0/debian/modules/http-ndk/src/ndk_string.h:36:24: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
return (u_char *) strncpy ((char *) d, (char *) s, n);
data/nginx-1.18.0/debian/modules/nchan/src/nchan_setup.c:737:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
value->len = strlen(val);
data/nginx-1.18.0/debian/modules/nchan/src/nchan_variables.c:175:42: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
set_varval(v, (u_char *)NCHAN_VERSION, strlen(NCHAN_VERSION));
data/nginx-1.18.0/debian/modules/nchan/src/store/memory/ipc.c:323:24: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_event(c->read, NGX_READ_EVENT, 0);
data/nginx-1.18.0/debian/modules/nchan/src/store/memory/ipc.c:349:7: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
n = read(s, alert, sizeof(ipc_alert_t));
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:217:15: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
return ctx->read(ctx, x, sizeof(uint8_t));
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:233:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &floor, sizeof(uint8_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:419:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &u8temp, sizeof(uint8_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:426:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &u16temp, sizeof(uint16_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:433:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &u32temp, sizeof(uint32_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:440:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &u8temp, sizeof(uint8_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:447:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &u16temp, sizeof(uint16_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:454:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &u32temp, sizeof(uint32_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:506:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &u8temp, sizeof(uint8_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:513:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &u16temp, sizeof(uint16_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:520:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &u32temp, sizeof(uint32_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:527:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &u16temp, sizeof(uint16_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:534:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &u32temp, sizeof(uint32_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:541:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &u16temp, sizeof(uint16_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:548:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &u32temp, sizeof(uint32_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:589:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &obj->as.u8, sizeof(uint8_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:595:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &obj->as.u16, sizeof(uint16_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:602:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &obj->as.u32, sizeof(uint32_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:609:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &obj->as.u64, sizeof(uint64_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:616:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &obj->as.s8, sizeof(int8_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:622:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &obj->as.s16, sizeof(int16_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:629:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &obj->as.s32, sizeof(int32_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:636:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &obj->as.s64, sizeof(int64_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:646:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, bytes, 4)) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:657:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, bytes, 8)) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:682:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &obj->as.ext.type, sizeof(int8_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:689:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &obj->as.ext.type, sizeof(int8_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:696:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &obj->as.ext.type, sizeof(int8_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:703:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &obj->as.ext.type, sizeof(int8_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:710:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &obj->as.ext.type, sizeof(int8_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:720:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &obj->as.ext.type, sizeof(int8_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:729:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &obj->as.ext.type, sizeof(int8_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:739:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, &obj->as.ext.type, sizeof(int8_t))) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:753:53: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
void cmp_init(cmp_ctx_t *ctx, void *buf, cmp_reader read,
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:758:15: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ctx->read = read;
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:2307:13: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, data, str_size)) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:2347:13: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, data, bin_size)) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:2411:12: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ctx->read(ctx, data, 1))
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:2437:12: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ctx->read(ctx, data, 2))
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:2463:12: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ctx->read(ctx, data, 4))
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:2489:12: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ctx->read(ctx, data, 8))
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:2515:12: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ctx->read(ctx, data, 16))
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:2543:12: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ctx->read(ctx, data, *size))
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:2571:12: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ctx->read(ctx, data, *size))
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:2599:12: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ctx->read(ctx, data, *size))
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:2634:12: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ctx->read(ctx, data, *size))
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:3315:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, data, str_size)) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.c:3341:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!ctx->read(ctx, data, bin_size)) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.h:100:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
cmp_reader read;
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/cmp.h:131:53: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
void cmp_init(cmp_ctx_t *ctx, void *buf, cmp_reader read,
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/examples/example-ae.c:57:66: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
redisAsyncCommand(c, NULL, NULL, "SET key %b", argv[argc-1], strlen(argv[argc-1]));
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/examples/example-libev.c:48:66: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
redisAsyncCommand(c, NULL, NULL, "SET key %b", argv[argc-1], strlen(argv[argc-1]));
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/examples/example-libevent.c:49:66: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
redisAsyncCommand(c, NULL, NULL, "SET key %b", argv[argc-1], strlen(argv[argc-1]));
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/examples/example-libuv.c:49:66: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
redisAsyncCommand(c, NULL, NULL, "SET key %b", argv[argc-1], strlen(argv[argc-1]));
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.c:262:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size = strlen(arg);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.c:492:38: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = argvlen ? argvlen[j] : strlen(argv[j]);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.c:509:38: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = argvlen ? argvlen[j] : strlen(argv[j]);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.c:543:38: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = argvlen ? argvlen[j] : strlen(argv[j]);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.c:554:38: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = argvlen ? argvlen[j] : strlen(argv[j]);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.c:577:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(str);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.c:645:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memset(c->errstr, '\0', strlen(c->errstr));
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.c:802:13: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
nread = read(c->fd,buf,sizeof(buf));
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/hiredis.h:104:13: [1] (buffer) strncat:
Easily used incorrectly (e.g., incorrectly computing the correct maximum
size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf,
or automatically resizing strings.
strncat((buf), err_str, ((len) - 1)); \
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/net.c:445:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(sa.sun_path,path,sizeof(sa.sun_path)-1);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/read.c:66:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(str);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/sds.c:76:43: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t initlen = (init == NULL) ? 0 : strlen(init);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/sds.c:107:19: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int reallen = strlen(s);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/sds.c:256:28: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return sdscatlen(s, t, strlen(t));
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/sds.c:289:28: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return sdscpylen(s, t, strlen(t));
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/sds.c:455:37: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
l = (next == 's') ? strlen(str) : sdslen(str);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/test.c:469:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
s = write(c->fd, cmd, strlen(cmd));
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/hiredis/test.c:509:26: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
major = strtol(p+strlen(field),&eptr,10);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/rdsstore.c:1177:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
errstr.len = strlen(reply->str);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/rdsstore.c:2451:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
errstr.len = strlen(reply->str);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_nginx_adapter.c:173:35: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_add_event(connection->read, NGX_READ_EVENT, flags) == NGX_ERROR) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_nginx_adapter.c:183:35: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_del_event(connection->read, NGX_READ_EVENT, flags) == NGX_ERROR) {
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_nginx_adapter.c:188:115: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "redis_nginx_adapter: didn't delete read event %p", connection->read);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_nodeset.c:1955:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
dst->len = strlen(ipstr);
data/nginx-1.18.0/debian/modules/nchan/src/store/redis/redis_nodeset_parser.c:103:33: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
nchan_scan_split_by_chr(&max, strlen((char *)max), &rest_line, '\n');
data/nginx-1.18.0/debian/modules/nchan/src/subscribers/websocket.c:860:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ltmp += strlen(setting_name); //strlen
data/nginx-1.18.0/debian/modules/nchan/src/subscribers/websocket.c:1311:12: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/debian/modules/nchan/src/subscribers/websocket.c:1559:36: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/debian/modules/nchan/src/uthash.h:95:26: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
#define uthash_strlen(s) strlen(s)
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_benchmark.c:35:65: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ngx_init_set_membuf(&msg.buf, (u_char *)cstr, (u_char *)&cstr[strlen(cstr)]);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_benchmark.c:371:10: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
sz = strlen(stats) + strlen(fmt);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_benchmark.c:371:26: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
sz = strlen(stats) + strlen(fmt);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_benchmark.c:396:31: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
str = ngx_palloc(r->pool, strlen(stats) + strlen(fmt));
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_benchmark.c:396:47: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
str = ngx_palloc(r->pool, strlen(stats) + strlen(fmt));
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_benchmark.c:526:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
assert((size_t)num < strlen(numrun));
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_benchmark.c:663:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
find.len = strlen(config);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_bufchainpool.c:135:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
str.len = strlen(cstr);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_fake_request.c:75:22: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_fake_request.c:247:22: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_output.c:361:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
str.len=strlen(body);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_util.c:268:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
str.len = strlen(cstr);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_util.c:283:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t sz = strlen(match);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_util.c:295:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t sz = strlen(match);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_util.c:590:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
const char *end = cur + strlen(cur);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_util.c:608:36: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
rest->len = last - first - strlen(line_start);
data/nginx-1.18.0/debian/modules/nchan/src/util/nchan_util.c:609:40: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
rest->data = (u_char *)first + strlen(line_start);
data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_exec_module.c:827:53: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ngx_write_fd(STDERR_FILENO, *p, strlen(*p));
data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_exec_module.c:841:50: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ngx_write_fd(STDERR_FILENO, msg, strlen(msg));
data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_handler.c:97:22: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_rtmp_recv(c->read);
data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_handler.c:264:46: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_handshake.c:414:42: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_handshake.c:474:40: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_rtmp_handshake_recv(c->read);
data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_handshake.c:564:40: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_rtmp_handshake_recv(c->read);
data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_handshake.c:569:40: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_rtmp_handshake_recv(c->read);
data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_handshake.c:594:32: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_rtmp_handshake_recv(c->read);
data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_netcall_module.c:490:31: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_rtmp_netcall_recv(cc->read);
data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_proxy_protocol.c:23:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/debian/modules/rtmp/ngx_rtmp_proxy_protocol.c:92:42: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/core/ngx_connection.c:1049:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_event(c->read, NGX_READ_EVENT, 0);
data/nginx-1.18.0/src/core/ngx_connection.c:1052:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_event(c->read, NGX_READ_EVENT, NGX_CLOSE_EVENT);
data/nginx-1.18.0/src/core/ngx_connection.c:1131:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/core/ngx_connection.c:1187:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/src/core/ngx_connection.c:1200:34: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_event(c->read, NGX_READ_EVENT, NGX_CLOSE_EVENT);
data/nginx-1.18.0/src/core/ngx_connection.c:1210:36: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_delete_posted_event(c->read);
data/nginx-1.18.0/src/core/ngx_connection.c:1314:29: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c->read->handler(c->read);
data/nginx-1.18.0/src/core/ngx_connection.c:1333:37: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c[i].read->handler(c[i].read);
data/nginx-1.18.0/src/core/ngx_connection.h:126:25: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_event_t *read;
data/nginx-1.18.0/src/core/ngx_cycle.c:1455:33: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c[i].read->handler(c[i].read);
data/nginx-1.18.0/src/core/ngx_open_file_cache.h:114:30: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_event_t *read;
data/nginx-1.18.0/src/core/ngx_resolver.c:4437:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/core/ngx_resolver.c:4523:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/core/ngx_string.h:61:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
#define ngx_strlen(s) strlen((const char *) s)
data/nginx-1.18.0/src/event/modules/ngx_devpoll_module.c:262:47: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
e = (event == POLLIN) ? c->write : c->read;
data/nginx-1.18.0/src/event/modules/ngx_devpoll_module.c:278:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
e = c->read;
data/nginx-1.18.0/src/event/modules/ngx_devpoll_module.c:494:18: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/event/modules/ngx_epoll_module.c:442:13: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
n = read(notify_fd, &count, sizeof(uint64_t));
data/nginx-1.18.0/src/event/modules/ngx_epoll_module.c:599:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
e = c->read;
data/nginx-1.18.0/src/event/modules/ngx_epoll_module.c:669:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
e = c->read;
data/nginx-1.18.0/src/event/modules/ngx_epoll_module.c:842:18: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/event/modules/ngx_epoll_module.c:955:9: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
n = read(ngx_eventfd, &ready, 8);
data/nginx-1.18.0/src/event/modules/ngx_eventport_module.c:330:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
e = c->read;
data/nginx-1.18.0/src/event/modules/ngx_eventport_module.c:385:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
e = c->read;
data/nginx-1.18.0/src/event/modules/ngx_eventport_module.c:554:22: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/event/modules/ngx_poll_module.c:136:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
e = c->read;
data/nginx-1.18.0/src/event/modules/ngx_poll_module.c:189:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
e = c->read;
data/nginx-1.18.0/src/event/modules/ngx_poll_module.c:371:21: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ev = c->read;
data/nginx-1.18.0/src/event/modules/ngx_win32_poll_module.c:155:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
e = c->read;
data/nginx-1.18.0/src/event/modules/ngx_win32_poll_module.c:211:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
e = c->read;
data/nginx-1.18.0/src/event/modules/ngx_win32_poll_module.c:381:21: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ev = c->read;
data/nginx-1.18.0/src/event/ngx_event.c:800:18: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/event/ngx_event.c:819:40: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_del_event(old->read, NGX_READ_EVENT, NGX_CLOSE_EVENT)
data/nginx-1.18.0/src/event/ngx_event_accept.c:229:18: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/event/ngx_event_accept.c:372:30: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_add_event(c->read, NGX_READ_EVENT, 0) == NGX_ERROR) {
data/nginx-1.18.0/src/event/ngx_event_accept.c:410:30: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_del_event(c->read, NGX_READ_EVENT, NGX_DISABLE_EVENT)
data/nginx-1.18.0/src/event/ngx_event_connect.c:186:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/event/ngx_event_openssl.c:1612:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/event/ngx_event_openssl.c:1656:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/event/ngx_event_openssl.c:1672:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/event/ngx_event_openssl.c:1730:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/event/ngx_event_openssl.c:1769:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/event/ngx_event_openssl.c:1785:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/event/ngx_event_openssl.c:2021:56: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_delete_posted_event(c->read);
data/nginx-1.18.0/src/event/ngx_event_openssl.c:2024:43: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_post_event(c->read, &ngx_posted_next_events);
data/nginx-1.18.0/src/event/ngx_event_openssl.c:2325:25: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c->read->handler(c->read);
data/nginx-1.18.0/src/event/ngx_event_openssl.c:2520:42: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/event/ngx_event_openssl.c:2524:31: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_post_event(c->read, &ngx_posted_events);
data/nginx-1.18.0/src/event/ngx_event_openssl.c:2546:42: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/event/ngx_event_openssl.c:2550:31: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_post_event(c->read, &ngx_posted_events);
data/nginx-1.18.0/src/event/ngx_event_openssl.c:2564:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/event/ngx_event_openssl.c:2619:42: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/event/ngx_event_openssl.c:2623:31: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_post_event(c->read, &ngx_posted_events);
data/nginx-1.18.0/src/event/ngx_event_openssl.c:2628:31: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_post_event(c->read, &ngx_posted_events);
data/nginx-1.18.0/src/event/ngx_event_openssl.c:2653:42: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/event/ngx_event_openssl.c:2657:31: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_post_event(c->read, &ngx_posted_events);
data/nginx-1.18.0/src/event/ngx_event_openssl.c:2679:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/event/ngx_event_openssl.c:2801:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/event/ngx_event_openssl.c:2810:30: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(c->read, 30000);
data/nginx-1.18.0/src/event/ngx_event_openssl_stapling.c:1057:41: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(ctx->peer.connection->read, ctx->timeout);
data/nginx-1.18.0/src/event/ngx_event_pipe.c:53:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!p->read && !p->upstream_blocked) {
data/nginx-1.18.0/src/event/ngx_event_pipe.c:61:28: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = p->upstream->read;
data/nginx-1.18.0/src/event/ngx_event_pipe.c:212:48: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(p->upstream->read, delay);
data/nginx-1.18.0/src/event/ngx_event_pipe.c:380:40: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(p->upstream->read, delay);
data/nginx-1.18.0/src/event/ngx_event_pipe.h:57:24: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
unsigned read:1;
data/nginx-1.18.0/src/event/ngx_event_udp.c:256:22: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/event/ngx_event_udp.c:346:18: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/http/modules/ngx_http_grpc_module.c:1568:44: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_post_event(u->peer.connection->read, &ngx_posted_events);
data/nginx-1.18.0/src/http/modules/ngx_http_limit_req_module.c:324:46: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(r->connection->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/http/modules/ngx_http_limit_req_module.c:357:46: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(r->connection->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/http/modules/ngx_http_upstream_keepalive_module.c:285:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/src/http/modules/ngx_http_upstream_keepalive_module.c:341:34: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/http/modules/ngx_http_upstream_keepalive_module.c:371:22: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(c->read, kp->conf->timeout);
data/nginx-1.18.0/src/http/modules/ngx_http_upstream_keepalive_module.c:391:54: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_http_upstream_keepalive_close_handler(c->read);
data/nginx-1.18.0/src/http/modules/ngx_http_upstream_keepalive_module.c:432:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/http/ngx_http_core_module.c:1193:46: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(r->connection->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/http/ngx_http_core_module.c:2217:18: [1] (buffer) equal:
Function does not check the second iterator for over-read conditions
(CWE-126). This function is often discouraged by most C++ coding standards
in favor of its safer alternatives provided since C++14. Consider using a
form of this function that checks the second iterator before potentially
overflowing it.
goto equal;
data/nginx-1.18.0/src/http/ngx_http_core_module.c:2227:1: [1] (buffer) equal:
Function does not check the second iterator for over-read conditions
(CWE-126). This function is often discouraged by most C++ coding standards
in favor of its safer alternatives provided since C++14. Consider using a
form of this function that checks the second iterator before potentially
overflowing it.
equal:
data/nginx-1.18.0/src/http/ngx_http_request.c:323:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/http/ngx_http_request.c:826:37: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_http_v2_init(c->read);
data/nginx-1.18.0/src/http/ngx_http_request.c:840:42: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_http_wait_request_handler(c->read);
data/nginx-1.18.0/src/http/ngx_http_request.c:1514:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/http/ngx_http_request.c:2046:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/src/http/ngx_http_request.c:2475:34: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/src/http/ngx_http_request.c:2592:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/src/http/ngx_http_request.c:2689:42: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(r->connection->read, clcf->lingering_timeout);
data/nginx-1.18.0/src/http/ngx_http_request.c:2858:42: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_del_event(r->connection->read, NGX_READ_EVENT, 0) != NGX_OK) {
data/nginx-1.18.0/src/http/ngx_http_request.c:2875:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/http/ngx_http_request.c:2996:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/http/ngx_http_request.c:3348:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/http/ngx_http_request_body.c:312:46: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/src/http/ngx_http_request_body.c:315:54: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/http/ngx_http_request_body.c:405:30: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(c->read, clcf->client_body_timeout);
data/nginx-1.18.0/src/http/ngx_http_request_body.c:407:42: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/http/ngx_http_request_body.c:416:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/src/http/ngx_http_request_body.c:532:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = r->connection->read;
data/nginx-1.18.0/src/http/ngx_http_request_body.c:594:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/http/ngx_http_upstream.c:530:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/src/http/ngx_http_upstream.c:1296:65: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_http_upstream_check_broken_connection(r, r->connection->read);
data/nginx-1.18.0/src/http/ngx_http_upstream.c:2094:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(c->read, u->conf->read_timeout);
data/nginx-1.18.0/src/http/ngx_http_upstream.c:2358:42: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/http/ngx_http_upstream.c:3291:27: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_post_event(c->read, &ngx_posted_events);
data/nginx-1.18.0/src/http/ngx_http_upstream.c:3483:41: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(upstream->read, flags) != NGX_OK) {
data/nginx-1.18.0/src/http/ngx_http_upstream.c:3489:33: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(upstream->read, u->conf->read_timeout);
data/nginx-1.18.0/src/http/ngx_http_upstream.c:3492:33: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(upstream->read);
data/nginx-1.18.0/src/http/ngx_http_upstream.c:3509:43: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(downstream->read, flags) != NGX_OK) {
data/nginx-1.18.0/src/http/ngx_http_upstream.c:3692:41: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(upstream->read, flags) != NGX_OK) {
data/nginx-1.18.0/src/http/ngx_http_upstream.c:3698:33: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(upstream->read, u->conf->read_timeout);
data/nginx-1.18.0/src/http/ngx_http_upstream.c:3701:33: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(upstream->read);
data/nginx-1.18.0/src/http/ngx_http_upstream.c:3918:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/http/v2/ngx_http_v2.c:671:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(c->read, h2scf->recv_timeout);
data/nginx-1.18.0/src/http/v2/ngx_http_v2.c:698:22: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(c->read, h2scf->idle_timeout);
data/nginx-1.18.0/src/http/v2/ngx_http_v2.c:1979:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ev = fc->read;
data/nginx-1.18.0/src/http/v2/ngx_http_v2.c:2455:30: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = r->connection->read;
data/nginx-1.18.0/src/http/v2/ngx_http_v2.c:2980:19: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = fc->read;
data/nginx-1.18.0/src/http/v2/ngx_http_v2.c:3930:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(r->connection->read, clcf->client_body_timeout);
data/nginx-1.18.0/src/http/v2/ngx_http_v2.c:3978:31: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(fc->read);
data/nginx-1.18.0/src/http/v2/ngx_http_v2.c:3982:32: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_post_event(fc->read, &ngx_posted_events);
data/nginx-1.18.0/src/http/v2/ngx_http_v2.c:4012:23: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(fc->read, clcf->client_body_timeout);
data/nginx-1.18.0/src/http/v2/ngx_http_v2.c:4015:28: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_post_event(fc->read, &ngx_posted_events);
data/nginx-1.18.0/src/http/v2/ngx_http_v2.c:4233:27: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(fc->read, clcf->client_body_timeout);
data/nginx-1.18.0/src/http/v2/ngx_http_v2.c:4265:15: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = fc->read;
data/nginx-1.18.0/src/http/v2/ngx_http_v2.c:4351:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ev = fc->read;
data/nginx-1.18.0/src/http/v2/ngx_http_v2.c:4385:27: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ev = h2c->connection->read;
data/nginx-1.18.0/src/http/v2/ngx_http_v2.c:4592:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ev = fc->read;
data/nginx-1.18.0/src/mail/ngx_mail_auth_http_module.c:225:41: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(ctx->peer.connection->read, ahcf->timeout);
data/nginx-1.18.0/src/mail/ngx_mail_auth_http_module.c:731:46: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(s->connection->read, (ngx_msec_t) (timer * 1000));
data/nginx-1.18.0/src/mail/ngx_mail_auth_http_module.c:748:46: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(s->connection->read, (ngx_msec_t) (timer * 1000));
data/nginx-1.18.0/src/mail/ngx_mail_handler.c:220:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(c->read, cscf->timeout);
data/nginx-1.18.0/src/mail/ngx_mail_handler.c:251:46: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
cscf->protocol->init_protocol(c->read);
data/nginx-1.18.0/src/mail/ngx_mail_handler.c:679:33: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c->read->handler(c->read);
data/nginx-1.18.0/src/mail/ngx_mail_handler.c:725:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/mail/ngx_mail_handler.c:782:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/src/mail/ngx_mail_imap_handler.c:47:22: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(c->read, cscf->timeout);
data/nginx-1.18.0/src/mail/ngx_mail_imap_handler.c:49:34: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/mail/ngx_mail_pop3_handler.c:68:22: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(c->read, cscf->timeout);
data/nginx-1.18.0/src/mail/ngx_mail_pop3_handler.c:70:34: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/mail/ngx_mail_proxy_module.c:145:43: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(p->upstream.connection->read, cscf->timeout);
data/nginx-1.18.0/src/mail/ngx_mail_proxy_module.c:283:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(s->connection->read, pcf->timeout);
data/nginx-1.18.0/src/mail/ngx_mail_proxy_module.c:284:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/src/mail/ngx_mail_proxy_module.c:417:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(s->connection->read, pcf->timeout);
data/nginx-1.18.0/src/mail/ngx_mail_proxy_module.c:418:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/src/mail/ngx_mail_proxy_module.c:664:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(s->connection->read, pcf->timeout);
data/nginx-1.18.0/src/mail/ngx_mail_proxy_module.c:665:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/src/mail/ngx_mail_proxy_module.c:1019:36: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(dst->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/mail/ngx_mail_proxy_module.c:1029:36: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(src->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/mail/ngx_mail_proxy_module.c:1036:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(c->read, pcf->timeout);
data/nginx-1.18.0/src/mail/ngx_mail_smtp_handler.c:148:23: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_post_event(c->read, &ngx_posted_events);
data/nginx-1.18.0/src/mail/ngx_mail_smtp_handler.c:294:22: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(c->read, timeout);
data/nginx-1.18.0/src/mail/ngx_mail_smtp_handler.c:296:34: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/mail/ngx_mail_smtp_handler.c:301:27: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_post_event(c->read, &ngx_posted_events);
data/nginx-1.18.0/src/mail/ngx_mail_smtp_handler.c:340:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(c->read, cscf->timeout);
data/nginx-1.18.0/src/mail/ngx_mail_smtp_handler.c:342:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/mail/ngx_mail_smtp_handler.c:870:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/os/unix/ngx_alloc.c:78:9: [1] (free) memalign:
On some systems (though not Linux-based systems) an attempt to free()
results from memalign() may fail. This may, on a few systems, be
exploitable. Also note that memalign() may not check that the boundary
parameter is correct (CWE-676). Use posix_memalign instead (defined in
POSIX's 1003.1d). Don't switch to valloc(); it is marked as obsolete in BSD
4.3, as legacy in SUSv2, and is no longer defined in SUSv3. In some cases,
malloc()'s alignment may be sufficient.
p = memalign(alignment, size);
data/nginx-1.18.0/src/os/unix/ngx_channel.c:213:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/os/unix/ngx_daemon.c:37:5: [1] (access) umask:
Ensure that umask is given most restrictive possible setting (e.g., 066 or
077) (CWE-732).
umask(0);
data/nginx-1.18.0/src/os/unix/ngx_files.c:60:9: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
n = read(file->fd, buf, size);
data/nginx-1.18.0/src/os/unix/ngx_files.h:136:34: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
#define ngx_read_fd read
data/nginx-1.18.0/src/os/unix/ngx_process.h:74:28: [1] (obsolete) usleep:
This C routine is considered obsolete (as opposed to the shell command by
the same name). The interaction of this function with SIGALRM and other
timer functions such as sleep(), alarm(), setitimer(), and nanosleep() is
unspecified (CWE-676). Use nanosleep(2) or setitimer(2) instead.
#define ngx_sched_yield() usleep(1)
data/nginx-1.18.0/src/os/unix/ngx_process_cycle.c:993:25: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
&& c[i].read
data/nginx-1.18.0/src/os/unix/ngx_readv_chain.c:23:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/os/unix/ngx_recv.c:20:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/os/unix/ngx_time.h:62:38: [1] (obsolete) usleep:
This C routine is considered obsolete (as opposed to the shell command by
the same name). The interaction of this function with SIGALRM and other
timer functions such as sleep(), alarm(), setitimer(), and nanosleep() is
unspecified (CWE-676). Use nanosleep(2) or setitimer(2) instead.
#define ngx_msleep(ms) (void) usleep(ms * 1000)
data/nginx-1.18.0/src/os/unix/ngx_udp_recv.c:20:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/stream/ngx_stream_core_module.c:272:38: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
data/nginx-1.18.0/src/stream/ngx_stream_core_module.c:278:30: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(c->read, cscf->preread_timeout);
data/nginx-1.18.0/src/stream/ngx_stream_core_module.c:287:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
data/nginx-1.18.0/src/stream/ngx_stream_handler.c:176:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rev = c->read;
data/nginx-1.18.0/src/stream/ngx_stream_proxy_module.c:438:27: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_post_event(c->read, &ngx_posted_events);
data/nginx-1.18.0/src/stream/ngx_stream_proxy_module.c:907:28: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_post_event(pc->read, &ngx_posted_events);
data/nginx-1.18.0/src/stream/ngx_stream_proxy_module.c:1595:40: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(src->read, delay);
data/nginx-1.18.0/src/stream/ngx_stream_proxy_module.c:1623:44: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(src->read, delay);
data/nginx-1.18.0/src/stream/ngx_stream_proxy_module.c:1673:36: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (ngx_handle_read_event(src->read, flags) != NGX_OK) {
data/nginx-1.18.0/src/stream/ngx_stream_ssl_module.c:387:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_add_timer(c->read, sslcf->handshake_timeout);
data/nginx-1.18.0/src/stream/ngx_stream_ssl_module.c:413:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ngx_del_timer(c->read);
ANALYSIS SUMMARY:
Hits = 618
Lines analyzed = 356725 in approximately 6.49 seconds (54948 lines/second)
Physical Source Lines of Code (SLOC) = 257488
Hits@level = [0] 136 [1] 341 [2] 166 [3] 9 [4] 96 [5] 6
Hits@level+ = [0+] 754 [1+] 618 [2+] 277 [3+] 111 [4+] 102 [5+] 6
Hits/KSLOC@level+ = [0+] 2.92829 [1+] 2.40011 [2+] 1.07578 [3+] 0.431088 [4+] 0.396135 [5+] 0.0233021
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.