Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/orcania-2.1.1/include/orcania.h
Examining data/orcania-2.1.1/src/base64.c
Examining data/orcania-2.1.1/src/memory.c
Examining data/orcania-2.1.1/src/orcania.c
Examining data/orcania-2.1.1/test/memory_test.c
Examining data/orcania-2.1.1/test/pointer_list_test.c
Examining data/orcania-2.1.1/test/split_test.c
Examining data/orcania-2.1.1/test/str_test.c
FINAL RESULTS:
data/orcania-2.1.1/src/orcania.c:114:15: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
out_len = vsnprintf(NULL, 0, message, argp);
data/orcania-2.1.1/src/orcania.c:121:5: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
vsnprintf(out, (out_len+sizeof(char)), message, argp_cpy);
data/orcania-2.1.1/src/orcania.c:145:31: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
message_formatted_len = vsnprintf(NULL, 0, message, argp);
data/orcania-2.1.1/src/orcania.c:149:9: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
vsnprintf(message_formatted, (message_formatted_len+sizeof(char)), message, argp_cpy);
data/orcania-2.1.1/src/orcania.c:159:17: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
out_len = vsnprintf(NULL, 0, message, argp);
data/orcania-2.1.1/src/orcania.c:162:9: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
vsnprintf(out, (out_len+sizeof(char)), message, argp_cpy);
data/orcania-2.1.1/src/orcania.c:242:12: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
return strcpy(p1, p2);
data/orcania-2.1.1/test/str_test.c:216:3: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(tmp, "target1 str1 42 %ptarget2 %s 42 %p", NULL, "str2", NULL);
data/orcania-2.1.1/test/str_test.c:222:3: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(tmp, "target2 %s 42 %p", "str2", NULL);
data/orcania-2.1.1/src/base64.c:13:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char base64_table[65] =
data/orcania-2.1.1/src/base64.c:100:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char dtable[256], *pos = out, block[4], tmp;
data/orcania-2.1.1/src/base64.c:128:26: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
if (!o_strchr((const char *)base64_table, src[i]) && src[i] != '=' && src[i] != '\n' && src[i] != '\t' && src[i] != ' ') {
data/orcania-2.1.1/src/base64.c:264:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(out, src, len);
data/orcania-2.1.1/src/base64.c:302:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(out, src, len);
data/orcania-2.1.1/src/orcania.c:74:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(pre, source, pre_len);
data/orcania-2.1.1/src/orcania.c:196:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(new_str, source, len);
data/orcania-2.1.1/test/str_test.c:201:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmp[100];
data/orcania-2.1.1/test/str_test.c:203:3: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(tmp, "target1 str1 42 %p", NULL);
data/orcania-2.1.1/test/str_test.c:213:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmp[200];
data/orcania-2.1.1/test/str_test.c:316:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char src[10] = {0x6f, 0x5b, 0x70, 0x29, 0x27, 0x2d, 0x3d, 0x40, 0x7e, 0x0}, encoded[21] = {0}, encoded_url[21] = {0}, encoded_new[19] = {0};
data/orcania-2.1.1/test/str_test.c:333:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char src[10] = {0x6f, 0x5b, 0x70, 0x29, 0x27, 0x2d, 0x3d, 0x40, 0x7e, 0x0}, encoded[21] = {0}, encoded_url[21] = {0}, encoded_new[19] = {0};
data/orcania-2.1.1/src/orcania.c:77:31: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
next = str_replace(source+strlen(pre)+strlen(str_old), str_old, str_new);
data/orcania-2.1.1/src/orcania.c:77:43: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
next = str_replace(source+strlen(pre)+strlen(str_old), str_old, str_new);
data/orcania-2.1.1/src/orcania.c:82:25: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = ((ptr-source)+strlen(str_new)+strlen(next));
data/orcania-2.1.1/src/orcania.c:82:41: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = ((ptr-source)+strlen(str_new)+strlen(next));
data/orcania-2.1.1/src/orcania.c:177:47: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return (source==NULL?NULL:o_strndup(source, strlen(source)));
data/orcania-2.1.1/src/orcania.c:254:12: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
return strncpy(p1, p2, n);
data/orcania-2.1.1/src/orcania.c:364:26: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (0 == (needle_len = strlen(needle)))
data/orcania-2.1.1/src/orcania.c:425:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return strlen(s);
data/orcania-2.1.1/src/orcania.c:457:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
begin = token+strlen(separator);
data/orcania-2.1.1/test/str_test.c:43:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
target = o_strndup(str, strlen(str));
data/orcania-2.1.1/test/str_test.c:46:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
target = o_strndup(str, strlen(str)-2);
data/orcania-2.1.1/test/str_test.c:70:44: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(o_strncmp(str_1, str_3, strlen(str_3)), 0);
data/orcania-2.1.1/test/str_test.c:71:44: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(o_strncmp(str_1, str_2, strlen(str_2)), 0);
data/orcania-2.1.1/test/str_test.c:72:44: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_ne(o_strncmp(str_1, str_2, strlen(str_1)), 0);
data/orcania-2.1.1/test/str_test.c:73:43: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_ne(o_strncmp(str_1, NULL, strlen(str_1)), 0);
data/orcania-2.1.1/test/str_test.c:74:43: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_ne(o_strncmp(NULL, str_1, strlen(str_1)), 0);
data/orcania-2.1.1/test/str_test.c:94:48: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(o_strncasecmp(str_1, str_3, strlen(str_3)), 0);
data/orcania-2.1.1/test/str_test.c:95:48: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_eq(o_strncasecmp(str_1, str_2, strlen(str_2)), 0);
data/orcania-2.1.1/test/str_test.c:96:48: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_ne(o_strncasecmp(str_1, str_2, strlen(str_1)), 0);
data/orcania-2.1.1/test/str_test.c:97:47: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_ne(o_strncasecmp(str_1, NULL, strlen(str_1)), 0);
data/orcania-2.1.1/test/str_test.c:98:47: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_int_ne(o_strncasecmp(NULL, str_1, strlen(str_1)), 0);
data/orcania-2.1.1/test/str_test.c:140:44: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_ptr_ne(o_strnstr(str_1, str_2, strlen(str_1)), NULL);
data/orcania-2.1.1/test/str_test.c:141:44: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_ptr_eq(o_strnstr(str_1, str_3, strlen(str_1)), NULL);
data/orcania-2.1.1/test/str_test.c:143:43: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_ptr_eq(o_strnstr(NULL, str_3, strlen(str_3)), NULL);
data/orcania-2.1.1/test/str_test.c:144:43: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_ptr_eq(o_strnstr(str_1, NULL, strlen(str_1)), NULL);
data/orcania-2.1.1/test/str_test.c:145:42: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ck_assert_ptr_eq(o_strnstr(NULL, NULL, strlen(str_3)), NULL);
ANALYSIS SUMMARY:
Hits = 47
Lines analyzed = 2705 in approximately 0.10 seconds (26876 lines/second)
Physical Source Lines of Code (SLOC) = 1684
Hits@level = [0] 1 [1] 26 [2] 12 [3] 0 [4] 9 [5] 0
Hits@level+ = [0+] 48 [1+] 47 [2+] 21 [3+] 9 [4+] 9 [5+] 0
Hits/KSLOC@level+ = [0+] 28.5036 [1+] 27.9097 [2+] 12.4703 [3+] 5.34442 [4+] 5.34442 [5+] 0
Dot directories skipped = 2 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.