Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/oscpack-1.1.0/ip/PacketListener.h
Examining data/oscpack-1.1.0/ip/NetworkingUtils.h
Examining data/oscpack-1.1.0/ip/win32/NetworkingUtils.cpp
Examining data/oscpack-1.1.0/ip/win32/UdpSocket.cpp
Examining data/oscpack-1.1.0/ip/UdpSocket.h
Examining data/oscpack-1.1.0/ip/TimerListener.h
Examining data/oscpack-1.1.0/ip/IpEndpointName.h
Examining data/oscpack-1.1.0/ip/IpEndpointName.cpp
Examining data/oscpack-1.1.0/ip/posix/NetworkingUtils.cpp
Examining data/oscpack-1.1.0/ip/posix/UdpSocket.cpp
Examining data/oscpack-1.1.0/examples/SimpleReceive.cpp
Examining data/oscpack-1.1.0/examples/OscDump.cpp
Examining data/oscpack-1.1.0/examples/SimpleSend.cpp
Examining data/oscpack-1.1.0/osc/OscPacketListener.h
Examining data/oscpack-1.1.0/osc/OscPrintReceivedElements.cpp
Examining data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp
Examining data/oscpack-1.1.0/osc/OscTypes.h
Examining data/oscpack-1.1.0/osc/OscOutboundPacketStream.h
Examining data/oscpack-1.1.0/osc/OscTypes.cpp
Examining data/oscpack-1.1.0/osc/OscException.h
Examining data/oscpack-1.1.0/osc/MessageMappingOscPacketListener.h
Examining data/oscpack-1.1.0/osc/OscPrintReceivedElements.h
Examining data/oscpack-1.1.0/osc/OscReceivedElements.h
Examining data/oscpack-1.1.0/osc/OscHostEndianness.h
Examining data/oscpack-1.1.0/osc/OscReceivedElements.cpp
Examining data/oscpack-1.1.0/tests/OscSendTests.cpp
Examining data/oscpack-1.1.0/tests/OscReceiveTest.cpp
Examining data/oscpack-1.1.0/tests/OscReceiveTest.h
Examining data/oscpack-1.1.0/tests/OscUnitTests.h
Examining data/oscpack-1.1.0/tests/OscSendTests.h
Examining data/oscpack-1.1.0/tests/OscUnitTests.cpp
FINAL RESULTS:
data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:363:10: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
std::strcpy( messageCursor_, rhs.addressPattern );
data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:605:10: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
std::strcpy( argumentCurrent_, rhs );
data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:625:10: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
std::strcpy( argumentCurrent_, rhs );
data/oscpack-1.1.0/examples/OscDump.cpp:83:15: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
port = std::atoi( argv[1] );
data/oscpack-1.1.0/examples/SimpleSend.cpp:21:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[OUTPUT_BUFFER_SIZE];
data/oscpack-1.1.0/ip/IpEndpointName.cpp:53:8: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
std::sprintf( s, "<any>" );
data/oscpack-1.1.0/ip/IpEndpointName.cpp:55:8: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
std::sprintf( s, "%d.%d.%d.%d",
data/oscpack-1.1.0/ip/IpEndpointName.cpp:68:9: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
std::sprintf( s, "<any>:<any>" );
data/oscpack-1.1.0/ip/IpEndpointName.cpp:70:9: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
std::sprintf( s, "%d.%d.%d.%d:<any>",
data/oscpack-1.1.0/ip/IpEndpointName.cpp:78:9: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
std::sprintf( s, "<any>:%d", port );
data/oscpack-1.1.0/ip/IpEndpointName.cpp:80:9: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
std::sprintf( s, "%d.%d.%d.%d:%d",
data/oscpack-1.1.0/ip/posix/NetworkingUtils.cpp:59:14: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
std::memcpy( &a, h->h_addr_list[0], h->h_length );
data/oscpack-1.1.0/ip/win32/NetworkingUtils.cpp:90:14: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
std::memcpy( &a, h->h_addr_list[0], h->h_length );
data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:65:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char c[4];
data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:85:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char c[4];
data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:105:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char c[8];
data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:129:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char c[8];
data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:329:10: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
std::memcpy( messageCursor_, "#bundle\0", 8 );
data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:395:14: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
std::memcpy( tempTypeTags, typeTagsCurrent_, typeTagsCount );
data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:420:14: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
std::memcpy( messageCursor_, ",\0\0\0", 4 );
data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:489:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char c[4];
data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:577:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char c[8];
data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:648:10: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
std::memcpy( argumentCurrent_, rhs.data, rhs.size );
data/oscpack-1.1.0/osc/OscPrintReceivedElements.cpp:83:17: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char s[2] = {0};
data/oscpack-1.1.0/osc/OscReceivedElements.cpp:98:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char c[4];
data/oscpack-1.1.0/osc/OscReceivedElements.cpp:118:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char c[4];
data/oscpack-1.1.0/osc/OscReceivedElements.cpp:138:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char c[8];
data/oscpack-1.1.0/osc/OscReceivedElements.cpp:162:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char c[8];
data/oscpack-1.1.0/osc/OscReceivedElements.cpp:242:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char c[4];
data/oscpack-1.1.0/osc/OscReceivedElements.cpp:273:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char c[4];
data/oscpack-1.1.0/osc/OscReceivedElements.cpp:389:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char c[8];
data/oscpack-1.1.0/tests/OscReceiveTest.cpp:176:17: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char s[2] = {0};
data/oscpack-1.1.0/tests/OscReceiveTest.cpp:270:15: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
port = std::atoi( argv[1] );
data/oscpack-1.1.0/tests/OscSendTests.cpp:60:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[IP_MTU_SIZE];
data/oscpack-1.1.0/tests/OscSendTests.cpp:216:21: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
port = std::atoi( argv[2] );
data/oscpack-1.1.0/tests/OscSendTests.cpp:221:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char hostIpAddress[ IpEndpointName::ADDRESS_STRING_LENGTH ];
data/oscpack-1.1.0/tests/OscUnitTests.cpp:116:10: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
std::memcpy( p, s, length );
data/oscpack-1.1.0/ip/posix/UdpSocket.cpp:482:21: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
read( breakPipe_[0], &c, 1 );
data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:249:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
+ RoundUp4(std::strlen(addressPattern) + 1) + 4;
data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:364:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
std::size_t rhsLength = std::strlen(rhs.addressPattern);
data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:602:51: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
CheckForAvailableArgumentSpace( RoundUp4(std::strlen(rhs) + 1) );
data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:606:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
std::size_t rhsLength = std::strlen(rhs);
data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:622:51: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
CheckForAvailableArgumentSpace( RoundUp4(std::strlen(rhs) + 1) );
data/oscpack-1.1.0/osc/OscOutboundPacketStream.cpp:626:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
std::size_t rhsLength = std::strlen(rhs);
data/oscpack-1.1.0/osc/OscPrintReceivedElements.cpp:130:35: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t len = std::strlen( timeString );
ANALYSIS SUMMARY:
Hits = 45
Lines analyzed = 6272 in approximately 0.19 seconds (33359 lines/second)
Physical Source Lines of Code (SLOC) = 3675
Hits@level = [0] 2 [1] 8 [2] 34 [3] 0 [4] 3 [5] 0
Hits@level+ = [0+] 47 [1+] 45 [2+] 37 [3+] 3 [4+] 3 [5+] 0
Hits/KSLOC@level+ = [0+] 12.7891 [1+] 12.2449 [2+] 10.068 [3+] 0.816327 [4+] 0.816327 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.