Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/paulstretch-2.2-2/Mutex.cpp
Examining data/paulstretch-2.2-2/FreeEdit.cpp
Examining data/paulstretch-2.2-2/JAaudiooutput.h
Examining data/paulstretch-2.2-2/Control.cpp
Examining data/paulstretch-2.2-2/Control.h
Examining data/paulstretch-2.2-2/Mutex.h
Examining data/paulstretch-2.2-2/Thread.h
Examining data/paulstretch-2.2-2/PAaudiooutput.h
Examining data/paulstretch-2.2-2/Thread.cpp
Examining data/paulstretch-2.2-2/PAaudiooutput.cpp
Examining data/paulstretch-2.2-2/Stretch.h
Examining data/paulstretch-2.2-2/version.h
Examining data/paulstretch-2.2-2/XMLwrapper.cpp
Examining data/paulstretch-2.2-2/ProcessedStretch.h
Examining data/paulstretch-2.2-2/globals.cpp
Examining data/paulstretch-2.2-2/Input/MP3InputS.h
Examining data/paulstretch-2.2-2/Input/InputS.h
Examining data/paulstretch-2.2-2/Input/VorbisInputS.cpp
Examining data/paulstretch-2.2-2/Input/VorbisInputS.h
Examining data/paulstretch-2.2-2/Input/AInputS.cpp
Examining data/paulstretch-2.2-2/Input/MP3InputS.cpp
Examining data/paulstretch-2.2-2/Input/AInputS.h
Examining data/paulstretch-2.2-2/Output/AOutputS.h
Examining data/paulstretch-2.2-2/Output/VorbisOutputS.cpp
Examining data/paulstretch-2.2-2/Output/AOutputS.cpp
Examining data/paulstretch-2.2-2/Output/VorbisOutputS.h
Examining data/paulstretch-2.2-2/Player.h
Examining data/paulstretch-2.2-2/globals.h
Examining data/paulstretch-2.2-2/contrib/kiss_fft.c
Examining data/paulstretch-2.2-2/contrib/kiss_fft.h
Examining data/paulstretch-2.2-2/contrib/kiss_fftr.c
Examining data/paulstretch-2.2-2/contrib/_kiss_fft_guts.h
Examining data/paulstretch-2.2-2/contrib/kiss_fftr.h
Examining data/paulstretch-2.2-2/ProcessedStretch.cpp
Examining data/paulstretch-2.2-2/FreeEdit.h
Examining data/paulstretch-2.2-2/XMLwrapper.h
Examining data/paulstretch-2.2-2/Stretch.cpp
Examining data/paulstretch-2.2-2/BinauralBeats.cpp
Examining data/paulstretch-2.2-2/BinauralBeats.h
Examining data/paulstretch-2.2-2/Player.cpp
Examining data/paulstretch-2.2-2/JAaudiooutput.cpp
FINAL RESULTS:
data/paulstretch-2.2-2/JAaudiooutput.cpp:196:30: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable can
be set more than once (CWE-807, CWE-20). Check environment variables
carefully before using them.
char *jack_autoconnect = getenv("JACK_AUTOCONNECT");
data/paulstretch-2.2-2/Mutex.cpp:21:5: [3] (misc) InitializeCriticalSection:
Exceptions can be thrown in low-memory situations. Use
InitializeCriticalSectionAndSpinCount instead.
InitializeCriticalSection(&mutex);
data/paulstretch-2.2-2/Mutex.cpp:38:5: [3] (misc) EnterCriticalSection:
On some versions of Windows, exceptions can be thrown in low-memory
situations. Use InitializeCriticalSectionAndSpinCount instead.
EnterCriticalSection(&mutex);
data/paulstretch-2.2-2/Control.cpp:68:18: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
bool result=ai->open(wavinfo.filename);
data/paulstretch-2.2-2/Control.cpp:92:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmp[size];tmp[size-1]=0;
data/paulstretch-2.2-2/Control.cpp:108:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmp[size];tmp[size-1]=0;
data/paulstretch-2.2-2/Control.cpp:135:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char stryears[size];stryears[0]=0;
data/paulstretch-2.2-2/Control.cpp:149:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char stryears[size];stryears[0]=0;
data/paulstretch-2.2-2/Control.cpp:153:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char strdays[size];strdays[0]=0;
data/paulstretch-2.2-2/Control.cpp:159:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char strhours[size];strhours[0]=0;
data/paulstretch-2.2-2/Control.cpp:169:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char strdays[size];strdays[0]=0;
data/paulstretch-2.2-2/Control.cpp:188:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmp[size];tmp[size-1]=0;
data/paulstretch-2.2-2/Control.cpp:206:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmp[100];
data/paulstretch-2.2-2/Control.cpp:377:11: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!ai->open(inaudio)){
data/paulstretch-2.2-2/Control.cpp:486:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmp[size];tmp[size-1]=0;
data/paulstretch-2.2-2/Input/AInputS.cpp:38:15: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
bool AInputS::open(string filename){
data/paulstretch-2.2-2/Input/AInputS.h:31:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
bool open(std::string filename);
data/paulstretch-2.2-2/Input/InputS.h:33:16: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
virtual bool open(std::string filename)=0;
data/paulstretch-2.2-2/Input/MP3InputS.cpp:43:17: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
bool MP3InputS::open(string filename){
data/paulstretch-2.2-2/Input/MP3InputS.cpp:47:4: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f=fopen(filename.c_str(),"rb");
data/paulstretch-2.2-2/Input/MP3InputS.h:32:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
bool open(std::string filename);
data/paulstretch-2.2-2/Input/VorbisInputS.cpp:45:20: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
bool VorbisInputS::open(string filename){
data/paulstretch-2.2-2/Input/VorbisInputS.cpp:48:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *f=fopen(filename.c_str(),"rb");
data/paulstretch-2.2-2/Input/VorbisInputS.h:31:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
bool open(std::string filename);
data/paulstretch-2.2-2/JAaudiooutput.cpp:166:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char channelid[16];
data/paulstretch-2.2-2/Output/VorbisOutputS.cpp:37:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
outfile=fopen(filename.c_str(),"wb");
data/paulstretch-2.2-2/Player.cpp:257:11: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (ai->open(task.filename)){
data/paulstretch-2.2-2/XMLwrapper.cpp:29:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tabs[STACKSIZE+2];
data/paulstretch-2.2-2/XMLwrapper.cpp:185:7: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
file=fopen(filename,"w");
data/paulstretch-2.2-2/XMLwrapper.cpp:192:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char options[10];
data/paulstretch-2.2-2/XMLwrapper.cpp:303:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *file=fopen(filename,"rb");
data/paulstretch-2.2-2/XMLwrapper.h:146:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmpstr[TMPSTR_SIZE];
data/paulstretch-2.2-2/contrib/kiss_fft.c:362:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(fout,tmpbuf,sizeof(kiss_fft_cpx)*st->nfft);
data/paulstretch-2.2-2/Control.cpp:424:31: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (readsize!=0) readed=ai->read(readsize,inbuf_i);
data/paulstretch-2.2-2/Input/AInputS.cpp:69:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
int AInputS::read(int nsmps,short int *smps){
data/paulstretch-2.2-2/Input/AInputS.h:34:6: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
int read(int nsmps,short int *smps);
data/paulstretch-2.2-2/Input/InputS.h:36:15: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
virtual int read(int nsmps,short int *smps)=0;
data/paulstretch-2.2-2/Input/InputS.h:40:5: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
read(readsize,skipbuf);
data/paulstretch-2.2-2/Input/MP3InputS.cpp:67:3: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
read(n,tmpsmp);//read just a sample (and ignore it) to fill info.samplerate
data/paulstretch-2.2-2/Input/MP3InputS.cpp:98:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
int MP3InputS::read(int nsmps,short int *smps){
data/paulstretch-2.2-2/Input/MP3InputS.h:35:6: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
int read(int nsmps,short int *smps);
data/paulstretch-2.2-2/Input/VorbisInputS.cpp:83:19: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
int VorbisInputS::read(int nsmps,short int *smps){
data/paulstretch-2.2-2/Input/VorbisInputS.h:34:6: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
int read(int nsmps,short int *smps);
data/paulstretch-2.2-2/Player.cpp:394:28: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (readsize) result=(ai->read(readsize,inbuf_i)==(readsize));
data/paulstretch-2.2-2/XMLwrapper.cpp:116:10: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
end+=strlen("</INFORMATION>");
data/paulstretch-2.2-2/XMLwrapper.cpp:155:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int fnsize=strlen(filename)+100;
data/paulstretch-2.2-2/contrib/kiss_fft.h:30:33: [1] (free) memalign:
On some systems (though not Linux-based systems) an attempt to free()
results from memalign() may fail. This may, on a few systems, be
exploitable. Also note that memalign() may not check that the boundary
parameter is correct (CWE-676). Use posix_memalign instead (defined in
POSIX's 1003.1d). Don't switch to valloc(); it is marked as obsolete in BSD
4.3, as legacy in SUSv2, and is no longer defined in SUSv3. In some cases,
malloc()'s alignment may be sufficient.
#define KISS_FFT_MALLOC(nbytes) memalign(16,nbytes)
data/paulstretch-2.2-2/globals.cpp:30:5: [1] (obsolete) usleep:
This C routine is considered obsolete (as opposed to the shell command by
the same name). The interaction of this function with SIGALRM and other
timer functions such as sleep(), alarm(), setitimer(), and nanosleep() is
unspecified (CWE-676). Use nanosleep(2) or setitimer(2) instead.
usleep(ms*1000);
ANALYSIS SUMMARY:
Hits = 48
Lines analyzed = 6296 in approximately 0.17 seconds (36054 lines/second)
Physical Source Lines of Code (SLOC) = 4293
Hits@level = [0] 51 [1] 15 [2] 30 [3] 3 [4] 0 [5] 0
Hits@level+ = [0+] 99 [1+] 48 [2+] 33 [3+] 3 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 23.0608 [1+] 11.181 [2+] 7.68693 [3+] 0.698812 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.