Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/pgbouncer-1.14.0/test/hba_test.c
Examining data/pgbouncer-1.14.0/test/asynctest.c
Examining data/pgbouncer-1.14.0/include/varcache.h
Examining data/pgbouncer-1.14.0/include/util.h
Examining data/pgbouncer-1.14.0/include/pktbuf.h
Examining data/pgbouncer-1.14.0/include/sbuf.h
Examining data/pgbouncer-1.14.0/include/bouncer.h
Examining data/pgbouncer-1.14.0/include/pam.h
Examining data/pgbouncer-1.14.0/include/system.h
Examining data/pgbouncer-1.14.0/include/hba.h
Examining data/pgbouncer-1.14.0/include/janitor.h
Examining data/pgbouncer-1.14.0/include/common/unicode_norm_table.h
Examining data/pgbouncer-1.14.0/include/common/postgres_compat.h
Examining data/pgbouncer-1.14.0/include/common/base64.h
Examining data/pgbouncer-1.14.0/include/common/scram-common.h
Examining data/pgbouncer-1.14.0/include/common/saslprep.h
Examining data/pgbouncer-1.14.0/include/common/pg_wchar.h
Examining data/pgbouncer-1.14.0/include/common/unicode_norm.h
Examining data/pgbouncer-1.14.0/include/stats.h
Examining data/pgbouncer-1.14.0/include/takeover.h
Examining data/pgbouncer-1.14.0/include/pooler.h
Examining data/pgbouncer-1.14.0/include/admin.h
Examining data/pgbouncer-1.14.0/include/proto.h
Examining data/pgbouncer-1.14.0/include/client.h
Examining data/pgbouncer-1.14.0/include/scram.h
Examining data/pgbouncer-1.14.0/include/objects.h
Examining data/pgbouncer-1.14.0/include/dnslookup.h
Examining data/pgbouncer-1.14.0/include/loader.h
Examining data/pgbouncer-1.14.0/include/server.h
Examining data/pgbouncer-1.14.0/include/iobuf.h
Examining data/pgbouncer-1.14.0/lib/usual/list.c
Examining data/pgbouncer-1.14.0/lib/usual/pthread.h
Examining data/pgbouncer-1.14.0/lib/usual/safeio.c
Examining data/pgbouncer-1.14.0/lib/usual/netdb.c
Examining data/pgbouncer-1.14.0/lib/usual/pgsocket.c
Examining data/pgbouncer-1.14.0/lib/usual/shlist.h
Examining data/pgbouncer-1.14.0/lib/usual/list.h
Examining data/pgbouncer-1.14.0/lib/usual/strpool.h
Examining data/pgbouncer-1.14.0/lib/usual/netdb.h
Examining data/pgbouncer-1.14.0/lib/usual/pgutil.c
Examining data/pgbouncer-1.14.0/lib/usual/dlfcn.h
Examining data/pgbouncer-1.14.0/lib/usual/time.h
Examining data/pgbouncer-1.14.0/lib/usual/base.h
Examining data/pgbouncer-1.14.0/lib/usual/talloc.c
Examining data/pgbouncer-1.14.0/lib/usual/base.c
Examining data/pgbouncer-1.14.0/lib/usual/pthread.c
Examining data/pgbouncer-1.14.0/lib/usual/mdict.c
Examining data/pgbouncer-1.14.0/lib/usual/socket_win32.h
Examining data/pgbouncer-1.14.0/lib/usual/wchar.c
Examining data/pgbouncer-1.14.0/lib/usual/wchar.h
Examining data/pgbouncer-1.14.0/lib/usual/slab.c
Examining data/pgbouncer-1.14.0/lib/usual/socket_ntop.c
Examining data/pgbouncer-1.14.0/lib/usual/utf8.h
Examining data/pgbouncer-1.14.0/lib/usual/safeio.h
Examining data/pgbouncer-1.14.0/lib/usual/logging.h
Examining data/pgbouncer-1.14.0/lib/usual/tls/tls_ocsp.c
Examining data/pgbouncer-1.14.0/lib/usual/tls/tls_internal.h
Examining data/pgbouncer-1.14.0/lib/usual/tls/tls.h
Examining data/pgbouncer-1.14.0/lib/usual/tls/tls_config.c
Examining data/pgbouncer-1.14.0/lib/usual/tls/tls.c
Examining data/pgbouncer-1.14.0/lib/usual/tls/tls_cert.h
Examining data/pgbouncer-1.14.0/lib/usual/tls/tls_server.c
Examining data/pgbouncer-1.14.0/lib/usual/tls/tls_verify.c
Examining data/pgbouncer-1.14.0/lib/usual/tls/tls_cert.c
Examining data/pgbouncer-1.14.0/lib/usual/tls/tls_compat.c
Examining data/pgbouncer-1.14.0/lib/usual/tls/tls_client.c
Examining data/pgbouncer-1.14.0/lib/usual/tls/tls_util.c
Examining data/pgbouncer-1.14.0/lib/usual/tls/tls_peer.c
Examining data/pgbouncer-1.14.0/lib/usual/tls/tls_conninfo.c
Examining data/pgbouncer-1.14.0/lib/usual/tls/tls_compat.h
Examining data/pgbouncer-1.14.0/lib/usual/cxalloc.h
Examining data/pgbouncer-1.14.0/lib/usual/mbuf.h
Examining data/pgbouncer-1.14.0/lib/usual/cbtree.c
Examining data/pgbouncer-1.14.0/lib/usual/json.h
Examining data/pgbouncer-1.14.0/lib/usual/talloc.h
Examining data/pgbouncer-1.14.0/lib/usual/socket_pton.c
Examining data/pgbouncer-1.14.0/lib/usual/fileutil.c
Examining data/pgbouncer-1.14.0/lib/usual/aatree.c
Examining data/pgbouncer-1.14.0/lib/usual/json.c
Examining data/pgbouncer-1.14.0/lib/usual/endian.h
Examining data/pgbouncer-1.14.0/lib/usual/mempool.h
Examining data/pgbouncer-1.14.0/lib/usual/err.h
Examining data/pgbouncer-1.14.0/lib/usual/string.h
Examining data/pgbouncer-1.14.0/lib/usual/regex.h
Examining data/pgbouncer-1.14.0/lib/usual/ctype.h
Examining data/pgbouncer-1.14.0/lib/usual/strpool.c
Examining data/pgbouncer-1.14.0/lib/usual/daemon.c
Examining data/pgbouncer-1.14.0/lib/usual/string.c
Examining data/pgbouncer-1.14.0/lib/usual/cxextra.c
Examining data/pgbouncer-1.14.0/lib/usual/err.c
Examining data/pgbouncer-1.14.0/lib/usual/getopt.c
Examining data/pgbouncer-1.14.0/lib/usual/psrandom.c
Examining data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h
Examining data/pgbouncer-1.14.0/lib/usual/signal.h
Examining data/pgbouncer-1.14.0/lib/usual/cfparser.c
Examining data/pgbouncer-1.14.0/lib/usual/mbuf.c
Examining data/pgbouncer-1.14.0/lib/usual/pgsocket.h
Examining data/pgbouncer-1.14.0/lib/usual/bits.h
Examining data/pgbouncer-1.14.0/lib/usual/misc.h
Examining data/pgbouncer-1.14.0/lib/usual/dlfcn.c
Examining data/pgbouncer-1.14.0/lib/usual/socket.h
Examining data/pgbouncer-1.14.0/lib/usual/fnmatch.c
Examining data/pgbouncer-1.14.0/lib/usual/psrandom.h
Examining data/pgbouncer-1.14.0/lib/usual/cbtree.h
Examining data/pgbouncer-1.14.0/lib/usual/crypto/csrandom.c
Examining data/pgbouncer-1.14.0/lib/usual/crypto/csrandom.h
Examining data/pgbouncer-1.14.0/lib/usual/crypto/keccak_prng.c
Examining data/pgbouncer-1.14.0/lib/usual/crypto/sha256.h
Examining data/pgbouncer-1.14.0/lib/usual/crypto/md5.c
Examining data/pgbouncer-1.14.0/lib/usual/crypto/entropy.h
Examining data/pgbouncer-1.14.0/lib/usual/crypto/sha1.h
Examining data/pgbouncer-1.14.0/lib/usual/crypto/keccak.c
Examining data/pgbouncer-1.14.0/lib/usual/crypto/chacha.h
Examining data/pgbouncer-1.14.0/lib/usual/crypto/sha3.h
Examining data/pgbouncer-1.14.0/lib/usual/crypto/chacha.c
Examining data/pgbouncer-1.14.0/lib/usual/crypto/digest.c
Examining data/pgbouncer-1.14.0/lib/usual/crypto/hmac.c
Examining data/pgbouncer-1.14.0/lib/usual/crypto/sha1.c
Examining data/pgbouncer-1.14.0/lib/usual/crypto/digest.h
Examining data/pgbouncer-1.14.0/lib/usual/crypto/entropy.c
Examining data/pgbouncer-1.14.0/lib/usual/crypto/hmac.h
Examining data/pgbouncer-1.14.0/lib/usual/crypto/keccak.h
Examining data/pgbouncer-1.14.0/lib/usual/crypto/sha512.h
Examining data/pgbouncer-1.14.0/lib/usual/crypto/sha512.c
Examining data/pgbouncer-1.14.0/lib/usual/crypto/sha256.c
Examining data/pgbouncer-1.14.0/lib/usual/crypto/keccak_prng.h
Examining data/pgbouncer-1.14.0/lib/usual/crypto/md5.h
Examining data/pgbouncer-1.14.0/lib/usual/crypto/sha3.c
Examining data/pgbouncer-1.14.0/lib/usual/mdict.h
Examining data/pgbouncer-1.14.0/lib/usual/heap.c
Examining data/pgbouncer-1.14.0/lib/usual/base_win32.h
Examining data/pgbouncer-1.14.0/lib/usual/fnmatch.h
Examining data/pgbouncer-1.14.0/lib/usual/time.c
Examining data/pgbouncer-1.14.0/lib/usual/cxalloc.c
Examining data/pgbouncer-1.14.0/lib/usual/signal.c
Examining data/pgbouncer-1.14.0/lib/usual/utf8.c
Examining data/pgbouncer-1.14.0/lib/usual/config_msvc.h
Examining data/pgbouncer-1.14.0/lib/usual/aatree.h
Examining data/pgbouncer-1.14.0/lib/usual/regex.c
Examining data/pgbouncer-1.14.0/lib/usual/logging.c
Examining data/pgbouncer-1.14.0/lib/usual/heap.h
Examining data/pgbouncer-1.14.0/lib/usual/pgutil.h
Examining data/pgbouncer-1.14.0/lib/usual/hashtab-impl.h
Examining data/pgbouncer-1.14.0/lib/usual/hashing/xxhash.h
Examining data/pgbouncer-1.14.0/lib/usual/hashing/xxhash.c
Examining data/pgbouncer-1.14.0/lib/usual/hashing/lookup3.h
Examining data/pgbouncer-1.14.0/lib/usual/hashing/siphash.c
Examining data/pgbouncer-1.14.0/lib/usual/hashing/siphash.h
Examining data/pgbouncer-1.14.0/lib/usual/hashing/crc32.h
Examining data/pgbouncer-1.14.0/lib/usual/hashing/crc32.c
Examining data/pgbouncer-1.14.0/lib/usual/hashing/spooky.h
Examining data/pgbouncer-1.14.0/lib/usual/hashing/memhash.h
Examining data/pgbouncer-1.14.0/lib/usual/hashing/memhash.c
Examining data/pgbouncer-1.14.0/lib/usual/hashing/spooky.c
Examining data/pgbouncer-1.14.0/lib/usual/hashing/lookup3.c
Examining data/pgbouncer-1.14.0/lib/usual/slab.h
Examining data/pgbouncer-1.14.0/lib/usual/mempool.c
Examining data/pgbouncer-1.14.0/lib/usual/statlist.h
Examining data/pgbouncer-1.14.0/lib/usual/bytemap.h
Examining data/pgbouncer-1.14.0/lib/usual/getopt.h
Examining data/pgbouncer-1.14.0/lib/usual/fileutil.h
Examining data/pgbouncer-1.14.0/lib/usual/daemon.h
Examining data/pgbouncer-1.14.0/lib/usual/socket.c
Examining data/pgbouncer-1.14.0/lib/usual/cfparser.h
Examining data/pgbouncer-1.14.0/lib/usual/cxextra.h
Examining data/pgbouncer-1.14.0/src/util.c
Examining data/pgbouncer-1.14.0/src/varcache.c
Examining data/pgbouncer-1.14.0/src/dnslookup.c
Examining data/pgbouncer-1.14.0/src/admin.c
Examining data/pgbouncer-1.14.0/src/client.c
Examining data/pgbouncer-1.14.0/src/pam.c
Examining data/pgbouncer-1.14.0/src/pooler.c
Examining data/pgbouncer-1.14.0/src/stats.c
Examining data/pgbouncer-1.14.0/src/scram.c
Examining data/pgbouncer-1.14.0/src/pktbuf.c
Examining data/pgbouncer-1.14.0/src/server.c
Examining data/pgbouncer-1.14.0/src/proto.c
Examining data/pgbouncer-1.14.0/src/objects.c
Examining data/pgbouncer-1.14.0/src/system.c
Examining data/pgbouncer-1.14.0/src/common/scram-common.c
Examining data/pgbouncer-1.14.0/src/common/wchar.c
Examining data/pgbouncer-1.14.0/src/common/saslprep.c
Examining data/pgbouncer-1.14.0/src/common/unicode_norm.c
Examining data/pgbouncer-1.14.0/src/common/base64.c
Examining data/pgbouncer-1.14.0/src/loader.c
Examining data/pgbouncer-1.14.0/src/takeover.c
Examining data/pgbouncer-1.14.0/src/main.c
Examining data/pgbouncer-1.14.0/src/janitor.c
Examining data/pgbouncer-1.14.0/src/hba.c
Examining data/pgbouncer-1.14.0/src/sbuf.c
Examining data/pgbouncer-1.14.0/win32/pgbevent.c
Examining data/pgbouncer-1.14.0/win32/win32support.h
Examining data/pgbouncer-1.14.0/win32/win32support.c
FINAL RESULTS:
data/pgbouncer-1.14.0/lib/usual/base_win32.h:67:9: [5] (race) chown:
This accepts filename arguments; if an attacker can move those files, a
race condition results. (CWE-362). Use fchown( ) instead.
#define chown(f, u, g) (-1)
data/pgbouncer-1.14.0/src/system.c:110:9: [5] (race) chown:
This accepts filename arguments; if an attacker can move those files, a
race condition results. (CWE-362). Use fchown( ) instead.
res = chown(fn, uid, gid);
data/pgbouncer-1.14.0/src/system.c:118:8: [5] (race) chmod:
This accepts filename arguments; if an attacker can move those files, a
race condition results. (CWE-362). Use fchmod( ) instead.
res = chmod(fn, mode);
data/pgbouncer-1.14.0/lib/usual/base.h:243:44: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
#if _COMPILER_GNUC(4,0) || __has_attribute(printf)
data/pgbouncer-1.14.0/lib/usual/base.h:244:55: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
#define _PRINTF(fmtpos, argpos) __attribute__((format(printf, fmtpos, argpos)))
data/pgbouncer-1.14.0/lib/usual/base_win32.h:74:9: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
#define snprintf(fmt, ...) _snprintf(fmt, __VA_ARGS__)
data/pgbouncer-1.14.0/lib/usual/base_win32.h:74:28: [4] (format) _snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
#define snprintf(fmt, ...) _snprintf(fmt, __VA_ARGS__)
data/pgbouncer-1.14.0/lib/usual/cxalloc.c:122:8: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
res = vsnprintf(buf, sizeof buf, fmt, ap);
data/pgbouncer-1.14.0/lib/usual/cxalloc.c:132:10: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
res2 = vsnprintf(dst, res+1, fmt, ap);
data/pgbouncer-1.14.0/lib/usual/err.c:35:3: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
vsnprintf(buf, sizeof(buf), fmt, ap);
data/pgbouncer-1.14.0/lib/usual/err.c:52:3: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
vfprintf(stderr, fmt, ap);
data/pgbouncer-1.14.0/lib/usual/err.c:68:3: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
vsnprintf(buf, sizeof(buf), fmt, ap);
data/pgbouncer-1.14.0/lib/usual/err.c:85:3: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
vfprintf(stderr, fmt, ap);
data/pgbouncer-1.14.0/lib/usual/json.c:264:2: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
vsnprintf(buf, sizeof(buf), errmsg, ap);
data/pgbouncer-1.14.0/lib/usual/json.c:977:8: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
len = snprintf(buf, sizeof(buf), "%" PRIi64, jv->u.v_int);
data/pgbouncer-1.14.0/lib/usual/logging.c:44:9: [4] (format) syslog:
If syslog's format strings can be influenced by an attacker, they can be
exploited (CWE-134). Use a constant format string for syslog.
#define syslog win32_eventlog
data/pgbouncer-1.14.0/lib/usual/logging.c:165:2: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
vsnprintf(buf + pfxlen, sizeof(buf) - pfxlen, fmt, ap);
data/pgbouncer-1.14.0/lib/usual/logging.c:229:2: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
vsnprintf(buf, sizeof(buf), fmt, ap);
data/pgbouncer-1.14.0/lib/usual/logging.c:252:2: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
vsnprintf(buf, sizeof(buf), fmt, ap);
data/pgbouncer-1.14.0/lib/usual/socket_ntop.c:90:6: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
l = snprintf(tmp, sizeof(tmp), fmt, src[0], src[1], src[2], src[3]);
data/pgbouncer-1.14.0/lib/usual/talloc.c:1190:8: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
len = vsnprintf(buf, sizeof(buf), fmt, ap2);
data/pgbouncer-1.14.0/lib/usual/talloc.c:1205:3: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
vsnprintf(res + plen, len + 1, fmt, ap2);
data/pgbouncer-1.14.0/lib/usual/talloc.c:1323:2: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
vsnprintf(buf, sizeof(buf), fmt, ap);
data/pgbouncer-1.14.0/lib/usual/talloc.c:1338:2: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
vsnprintf(buf, sizeof(buf), fmt, ap);
data/pgbouncer-1.14.0/lib/usual/talloc.c:1351:2: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
vsnprintf(buf, sizeof(buf), fmt, ap);
data/pgbouncer-1.14.0/lib/usual/tls/tls_internal.h:178:32: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
__attribute__((__format__ (printf, 2, 3)))
data/pgbouncer-1.14.0/lib/usual/tls/tls_internal.h:181:32: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
__attribute__((__format__ (printf, 2, 3)))
data/pgbouncer-1.14.0/lib/usual/tls/tls_internal.h:184:32: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
__attribute__((__format__ (printf, 2, 3)))
data/pgbouncer-1.14.0/lib/usual/tls/tls_internal.h:187:32: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
__attribute__((__format__ (printf, 2, 3)))
data/pgbouncer-1.14.0/lib/usual/tls/tls_internal.h:190:32: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
__attribute__((__format__ (printf, 2, 3)))
data/pgbouncer-1.14.0/lib/usual/tls/tls_internal.h:193:32: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
__attribute__((__format__ (printf, 2, 3)))
data/pgbouncer-1.14.0/lib/usual/tls/tls_internal.h:196:32: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
__attribute__((__format__ (printf, 2, 3)))
data/pgbouncer-1.14.0/src/admin.c:103:2: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
vsnprintf(str, sizeof(str), fmt, ap);
data/pgbouncer-1.14.0/src/objects.c:823:2: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
vsnprintf(buf, sizeof(buf), reason, ap);
data/pgbouncer-1.14.0/src/objects.c:900:2: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
vsnprintf(buf, sizeof(buf), reason, ap);
data/pgbouncer-1.14.0/src/pktbuf.c:437:4: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
snprintf(tmp, sizeof(tmp), "%" PRIu64, va_arg(ap, uint64_t));
data/pgbouncer-1.14.0/test/asynctest.c:119:3: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
vsnprintf(buf, sizeof(buf), reason, ap);
data/pgbouncer-1.14.0/win32/win32support.c:54:2: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
printf(usage_str, basename(exe));
data/pgbouncer-1.14.0/lib/usual/base_win32.h:69:9: [3] (random) srandom:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
#define srandom(s) srand(s)
data/pgbouncer-1.14.0/lib/usual/base_win32.h:69:20: [3] (random) srand:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
#define srandom(s) srand(s)
data/pgbouncer-1.14.0/lib/usual/base_win32.h:70:9: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
#define random() rand()
data/pgbouncer-1.14.0/lib/usual/cfparser.c:484:10: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable can
be set more than once (CWE-807, CWE-20). Check environment variables
carefully before using them.
home = getenv("HOME");
data/pgbouncer-1.14.0/lib/usual/crypto/entropy.c:64:8: [3] (misc) LoadLibrary:
Ensure that the full path to the library is specified, or current directory
may be used (CWE-829, CWE-20). Use registry entry or GetWindowsDirectory to
find library path, if you aren't already.
lib = LoadLibrary("advapi32.dll");
data/pgbouncer-1.14.0/lib/usual/dlfcn.c:29:14: [3] (misc) LoadLibraryEx:
Ensure that the full path to the library is specified, or current directory
may be used (CWE-829, CWE-20). Use registry entry or GetWindowsDirectory to
find library path, if you aren't already.
HMODULE h = LoadLibraryEx(fn, NULL, 0);
data/pgbouncer-1.14.0/lib/usual/getopt.c:286:22: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable can
be set more than once (CWE-807, CWE-20). Check environment variables
carefully before using them.
posixly_correct = (getenv("POSIXLY_CORRECT") != NULL);
data/pgbouncer-1.14.0/lib/usual/getopt.c:464:1: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
getopt(int nargc, char *nargv[], const char *options)
data/pgbouncer-1.14.0/lib/usual/getopt.c:475:1: [3] (buffer) getopt_long:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
getopt_long(int nargc, char *nargv[], const char *options,
data/pgbouncer-1.14.0/lib/usual/getopt.h:60:9: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
#define getopt(a,b,c) usual_getopt(a,b,c)
data/pgbouncer-1.14.0/lib/usual/getopt.h:61:9: [3] (buffer) getopt_long:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
#define getopt_long(a,b,c,d,e) usual_getopt_long(a,b,c,d,e)
data/pgbouncer-1.14.0/lib/usual/getopt.h:99:5: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
int getopt(int argc, char *argv[], const char *options);
data/pgbouncer-1.14.0/lib/usual/getopt.h:102:5: [3] (buffer) getopt_long:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
int getopt_long(int argc, char *argv[], const char *options,
data/pgbouncer-1.14.0/lib/usual/time.c:197:7: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable can
be set more than once (CWE-807, CWE-20). Check environment variables
carefully before using them.
tz = getenv("TZ");
data/pgbouncer-1.14.0/src/main.c:862:14: [3] (buffer) getopt_long:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while ((c = getopt_long(argc, argv, "qvhdVRu:", long_options, &long_idx)) != -1) {
data/pgbouncer-1.14.0/src/main.c:950:2: [3] (random) srandom:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
srandom(time(NULL) ^ getpid());
data/pgbouncer-1.14.0/test/asynctest.c:235:11: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
arglen = random() % bulk_data_max;
data/pgbouncer-1.14.0/test/asynctest.c:454:14: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while ((c = getopt(argc, argv, "S:d:n:s:t:hvC:Q:q:")) != EOF) {
data/pgbouncer-1.14.0/test/asynctest.c:510:2: [3] (random) srandom:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
srandom(seed);
data/pgbouncer-1.14.0/include/bouncer.h:313:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[MAX_USERNAME];
data/pgbouncer-1.14.0/include/bouncer.h:314:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char passwd[MAX_PASSWORD];
data/pgbouncer-1.14.0/include/bouncer.h:328:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[MAX_DBNAME]; /* db name for clients */
data/pgbouncer-1.14.0/lib/usual/cfparser.c:476:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(p, value + 1, usr_len);
data/pgbouncer-1.14.0/lib/usual/cfparser.c:499:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(tmp, home, home_len);
data/pgbouncer-1.14.0/lib/usual/cfparser.c:500:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(tmp + home_len, value + usr_len + 1, v_len - usr_len - 1);
data/pgbouncer-1.14.0/lib/usual/crypto/chacha.c:91:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&ctx->state[0], "expand 32-byte k", 16);
data/pgbouncer-1.14.0/lib/usual/crypto/chacha.c:92:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&ctx->state[4], key, 32);
data/pgbouncer-1.14.0/lib/usual/crypto/chacha.c:103:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&ctx->state[0], "expand 16-byte k", 16);
data/pgbouncer-1.14.0/lib/usual/crypto/chacha.c:104:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&ctx->state[4], key, 16);
data/pgbouncer-1.14.0/lib/usual/crypto/chacha.c:105:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&ctx->state[8], key, 16);
data/pgbouncer-1.14.0/lib/usual/crypto/chacha.c:139:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dst, ks + ctx->pos, n);
data/pgbouncer-1.14.0/lib/usual/crypto/csrandom.c:62:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[32];
data/pgbouncer-1.14.0/lib/usual/crypto/entropy.c:134:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd = open(dev, oflags);
data/pgbouncer-1.14.0/lib/usual/crypto/hmac.c:61:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(hmac->opad, hmac->ipad, digest_result_len(hash));
data/pgbouncer-1.14.0/lib/usual/crypto/hmac.c:63:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(hmac->ipad, key, key_len);
data/pgbouncer-1.14.0/lib/usual/crypto/hmac.c:64:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(hmac->opad, key, key_len);
data/pgbouncer-1.14.0/lib/usual/crypto/keccak.c:1237:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dst, lanebuf + ofs%8, n);
data/pgbouncer-1.14.0/lib/usual/crypto/keccak.c:1253:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dst, lanebuf, count);
data/pgbouncer-1.14.0/lib/usual/crypto/md5.c:161:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf + bufpos(ctx), ptr, n);
data/pgbouncer-1.14.0/lib/usual/crypto/sha1.c:112:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dst + bufpos(ctx), src, n);
data/pgbouncer-1.14.0/lib/usual/crypto/sha256.c:125:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->state, H256, sizeof(H256));
data/pgbouncer-1.14.0/lib/usual/crypto/sha256.c:139:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dst + bufpos(ctx), src, n);
data/pgbouncer-1.14.0/lib/usual/crypto/sha256.c:179:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->state, H224, sizeof(H224));
data/pgbouncer-1.14.0/lib/usual/crypto/sha256.c:191:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dst, buf, SHA224_DIGEST_LENGTH);
data/pgbouncer-1.14.0/lib/usual/crypto/sha512.c:143:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->state, H512, sizeof(H512));
data/pgbouncer-1.14.0/lib/usual/crypto/sha512.c:157:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dst + bufpos(ctx), src, n);
data/pgbouncer-1.14.0/lib/usual/crypto/sha512.c:196:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->state, H384, sizeof(H384));
data/pgbouncer-1.14.0/lib/usual/crypto/sha512.c:208:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dst, buf, SHA384_DIGEST_LENGTH);
data/pgbouncer-1.14.0/lib/usual/cxalloc.c:79:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(p, src, len);
data/pgbouncer-1.14.0/lib/usual/cxalloc.c:117:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128], *dst;
data/pgbouncer-1.14.0/lib/usual/cxalloc.c:130:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dst, buf, res+1);
data/pgbouncer-1.14.0/lib/usual/cxextra.c:174:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(p, ptr, olen);
data/pgbouncer-1.14.0/lib/usual/cxextra.c:186:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(p, ptr, olen);
data/pgbouncer-1.14.0/lib/usual/daemon.c:55:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128 + 1];
data/pgbouncer-1.14.0/lib/usual/daemon.c:69:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd = open(pidfile, O_RDONLY);
data/pgbouncer-1.14.0/lib/usual/daemon.c:113:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[64];
data/pgbouncer-1.14.0/lib/usual/daemon.c:135:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd = open(pidfile, flags, 0644);
data/pgbouncer-1.14.0/lib/usual/daemon.c:186:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd = open("/dev/null", O_RDWR);
data/pgbouncer-1.14.0/lib/usual/endian.h:325:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(p, &tmp, sizeof(tmp));
data/pgbouncer-1.14.0/lib/usual/endian.h:332:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(p, &tmp, sizeof(tmp));
data/pgbouncer-1.14.0/lib/usual/endian.h:339:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(p, &tmp, sizeof(tmp));
data/pgbouncer-1.14.0/lib/usual/endian.h:346:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(p, &tmp, sizeof(tmp));
data/pgbouncer-1.14.0/lib/usual/endian.h:353:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(p, &tmp, sizeof(tmp));
data/pgbouncer-1.14.0/lib/usual/endian.h:360:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(p, &tmp, sizeof(tmp));
data/pgbouncer-1.14.0/lib/usual/endian.h:366:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(p, &x, sizeof(x));
data/pgbouncer-1.14.0/lib/usual/endian.h:372:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(p, &x, sizeof(x));
data/pgbouncer-1.14.0/lib/usual/endian.h:378:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(p, &x, sizeof(x));
data/pgbouncer-1.14.0/lib/usual/err.c:30:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1024], ebuf[256];
data/pgbouncer-1.14.0/lib/usual/err.c:63:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1024], ebuf[256];
data/pgbouncer-1.14.0/lib/usual/fileutil.c:40:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen(fn, "r");
data/pgbouncer-1.14.0/lib/usual/fileutil.c:79:12: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *f = fopen(fn, "rb");
data/pgbouncer-1.14.0/lib/usual/fileutil.c:119:10: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
m->fd = open(fname, rw ? O_RDWR : O_RDONLY);
data/pgbouncer-1.14.0/lib/usual/fnmatch.c:241:2: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t pbuf[128];
data/pgbouncer-1.14.0/lib/usual/fnmatch.c:242:2: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t sbuf[128];
data/pgbouncer-1.14.0/lib/usual/getopt.c:139:6: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
((char **) nargv)[pos] = nargv[cstart];
data/pgbouncer-1.14.0/lib/usual/getopt.c:141:6: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
((char **)nargv)[cstart] = swap;
data/pgbouncer-1.14.0/lib/usual/hashing/lookup3.c:56:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf, p, 12);
data/pgbouncer-1.14.0/lib/usual/hashing/spooky.c:213:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf, message, length);
data/pgbouncer-1.14.0/lib/usual/hashing/spooky.c:313:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf, u.p64, sc_blockSize);
data/pgbouncer-1.14.0/lib/usual/hashing/spooky.c:321:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf, end, remainder);
data/pgbouncer-1.14.0/lib/usual/json.c:97:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char errbuf[128];
data/pgbouncer-1.14.0/lib/usual/json.c:251:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dst, src, endptr - src);
data/pgbouncer-1.14.0/lib/usual/json.c:261:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[119];
data/pgbouncer-1.14.0/lib/usual/json.c:469:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&t_got, src, 4);
data/pgbouncer-1.14.0/lib/usual/json.c:488:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[NUMBER_BUF];
data/pgbouncer-1.14.0/lib/usual/json.c:508:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf, start, len);
data/pgbouncer-1.14.0/lib/usual/json.c:801:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char STATE_STEPS[MAX_STATES][MAX_TOKENS] = {
data/pgbouncer-1.14.0/lib/usual/json.c:974:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[NUMBER_BUF];
data/pgbouncer-1.14.0/lib/usual/json.c:985:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[NUMBER_BUF + 2];
data/pgbouncer-1.14.0/lib/usual/json.c:1001:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[10];
data/pgbouncer-1.14.0/lib/usual/json.c:1605:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(get_cstring(jv), val, len + 1);
data/pgbouncer-1.14.0/lib/usual/logging.c:147:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[2048], buf2[2048];
data/pgbouncer-1.14.0/lib/usual/logging.c:148:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ebuf[256];
data/pgbouncer-1.14.0/lib/usual/logging.c:149:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char timebuf[64];
data/pgbouncer-1.14.0/lib/usual/logging.c:185:14: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
log_file = fopen(cf_logfile, "a");
data/pgbouncer-1.14.0/lib/usual/logging.c:218:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[2048], ebuf[256];
data/pgbouncer-1.14.0/lib/usual/logging.c:247:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1024];
data/pgbouncer-1.14.0/lib/usual/logging.c:248:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char *strlist[1] = { buf };
data/pgbouncer-1.14.0/lib/usual/mbuf.h:269:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf->data + buf->write_pos, ptr, len);
data/pgbouncer-1.14.0/lib/usual/mdict.c:86:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(vptr, val, vlen);
data/pgbouncer-1.14.0/lib/usual/mdict.c:97:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(kptr, key, klen);
data/pgbouncer-1.14.0/lib/usual/netdb.c:134:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(rq->list, list, sizeof(struct gaicb *));
data/pgbouncer-1.14.0/lib/usual/pgsocket.c:361:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char * args[MAX_QRY_ARGS];
data/pgbouncer-1.14.0/lib/usual/pgutil.c:26:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(_dst, "NULL", 5);
data/pgbouncer-1.14.0/lib/usual/pgutil.c:116:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char scmbuf[128];
data/pgbouncer-1.14.0/lib/usual/pgutil.c:123:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(scmbuf, _src, scmlen);
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:118:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str16[sizeof("treat")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:119:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str22[sizeof("true")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:120:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str24[sizeof("or")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:121:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str27[sizeof("order")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:122:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str28[sizeof("not")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:123:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str29[sizeof("to")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:124:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str30[sizeof("left")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:125:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str31[sizeof("least")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:126:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str32[sizeof("real")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:127:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str33[sizeof("join")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:128:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str34[sizeof("on")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:129:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str36[sizeof("none")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:130:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str37[sizeof("else")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:131:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str39[sizeof("right")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:132:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str41[sizeof("select")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:133:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str42[sizeof("int")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:134:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str43[sizeof("time")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:135:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str44[sizeof("inout")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:136:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str45[sizeof("some")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:137:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str46[sizeof("inner")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:138:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str47[sizeof("limit")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:139:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str48[sizeof("in")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:140:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str51[sizeof("nchar")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:141:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str52[sizeof("into")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:142:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str53[sizeof("like")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:143:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str54[sizeof("ilike")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:144:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str55[sizeof("notnull")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:145:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str56[sizeof("table")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:146:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str57[sizeof("localtime")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:147:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str58[sizeof("integer")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:148:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str60[sizeof("cross")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:149:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str62[sizeof("create")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:150:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str63[sizeof("collate")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:151:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str64[sizeof("references")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:152:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str66[sizeof("is")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:153:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str67[sizeof("all")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:154:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str68[sizeof("analyze")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:155:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str69[sizeof("column")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:156:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str70[sizeof("intersect")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:157:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str71[sizeof("constraint")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:158:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str72[sizeof("except")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:159:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str73[sizeof("grant")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:160:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str75[sizeof("trim")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:161:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str76[sizeof("cast")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:162:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str77[sizeof("isnull")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:163:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str78[sizeof("as")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:164:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str79[sizeof("national")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:165:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str80[sizeof("coalesce")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:166:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str83[sizeof("case")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:167:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str84[sizeof("analyse")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:168:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str85[sizeof("row")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:169:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str86[sizeof("greatest")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:170:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str87[sizeof("end")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:171:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str88[sizeof("new")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:172:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str89[sizeof("out")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:173:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str90[sizeof("do")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:174:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str91[sizeof("asc")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:175:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str92[sizeof("old")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:176:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str93[sizeof("outer")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:177:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str95[sizeof("similar")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:178:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str96[sizeof("union")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:179:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str97[sizeof("default")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:180:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str98[sizeof("null")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:181:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str99[sizeof("user")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:182:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str100[sizeof("leading")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:183:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str101[sizeof("extract")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:184:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str102[sizeof("trailing")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:185:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str103[sizeof("only")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:186:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str104[sizeof("exists")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:187:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str106[sizeof("natural")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:188:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str107[sizeof("unique")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:189:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str108[sizeof("dec")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:190:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str109[sizeof("desc")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:191:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str111[sizeof("distinct")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:192:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str112[sizeof("deferrable")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:193:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str115[sizeof("and")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:194:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str116[sizeof("for")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:195:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str117[sizeof("float")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:196:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str119[sizeof("smallint")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:197:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str120[sizeof("offset")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:198:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str122[sizeof("localtimestamp")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:199:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str123[sizeof("precision")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:200:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str125[sizeof("array")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:201:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str126[sizeof("position")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:202:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str127[sizeof("freeze")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:203:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str128[sizeof("any")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:204:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str129[sizeof("session_user")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:205:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str130[sizeof("setof")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:206:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str132[sizeof("decimal")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:207:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str133[sizeof("xmlforest")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:208:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str134[sizeof("asymmetric")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:209:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str135[sizeof("xmlroot")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:210:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str136[sizeof("xmlparse")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:211:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str137[sizeof("current_time")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:212:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str138[sizeof("xmlconcat")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:213:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str139[sizeof("current_role")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:214:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str140[sizeof("group")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:215:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str142[sizeof("then")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:216:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str144[sizeof("xmlpi")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:217:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str145[sizeof("numeric")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:218:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str146[sizeof("xmlelement")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:219:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str147[sizeof("concurrently")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:220:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str149[sizeof("false")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:221:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str152[sizeof("over")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:222:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str153[sizeof("xmlserialize")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:223:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str154[sizeof("returning")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:224:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str155[sizeof("using")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:225:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str157[sizeof("bit")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:226:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str160[sizeof("placing")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:227:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str162[sizeof("between")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:228:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str163[sizeof("bigint")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:229:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str164[sizeof("primary")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:230:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str165[sizeof("char")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:231:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str166[sizeof("check")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:232:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str168[sizeof("from")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:233:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str170[sizeof("symmetric")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:234:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str175[sizeof("authorization")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:235:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str177[sizeof("verbose")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:236:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str181[sizeof("timestamp")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:237:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str183[sizeof("current_schema")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:238:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str184[sizeof("full")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:239:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str185[sizeof("foreign")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:240:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str186[sizeof("xmlexists")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:241:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str188[sizeof("interval")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:242:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str192[sizeof("boolean")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:243:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str198[sizeof("current_date")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:244:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str200[sizeof("current_user")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:245:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str202[sizeof("current_timestamp")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:246:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str204[sizeof("when")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:247:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str205[sizeof("where")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:248:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str206[sizeof("character")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:249:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str207[sizeof("off")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:250:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str208[sizeof("overlaps")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:251:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str213[sizeof("values")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:252:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str218[sizeof("current_catalog")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:253:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str219[sizeof("varchar")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:254:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str220[sizeof("with")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:255:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str224[sizeof("substring")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:256:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str227[sizeof("window")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:257:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str236[sizeof("fetch")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:258:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str237[sizeof("initially")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:259:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str265[sizeof("overlay")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:260:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str266[sizeof("both")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:261:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str272[sizeof("variadic")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:262:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str273[sizeof("xmlattributes")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:263:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str279[sizeof("nullif")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:264:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str289[sizeof("having")];
data/pgbouncer-1.14.0/lib/usual/pgutil_kwlookup.h:265:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pgkw_str311[sizeof("binary")];
data/pgbouncer-1.14.0/lib/usual/regex.c:417:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char name[7];
data/pgbouncer-1.14.0/lib/usual/safeio.c:54:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ebuf[128];
data/pgbouncer-1.14.0/lib/usual/safeio.c:70:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ebuf[128];
data/pgbouncer-1.14.0/lib/usual/safeio.c:103:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ebuf[128];
data/pgbouncer-1.14.0/lib/usual/safeio.c:120:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ebuf[128];
data/pgbouncer-1.14.0/lib/usual/safeio.c:137:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ebuf[128];
data/pgbouncer-1.14.0/lib/usual/safeio.c:166:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/pgbouncer-1.14.0/lib/usual/safeio.c:167:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ebuf[128];
data/pgbouncer-1.14.0/lib/usual/safeio.c:184:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/pgbouncer-1.14.0/lib/usual/safeio.c:185:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ebuf[128];
data/pgbouncer-1.14.0/lib/usual/slab.c:34:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[32];
data/pgbouncer-1.14.0/lib/usual/slab.c:82:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(slab->name, name, slen);
data/pgbouncer-1.14.0/lib/usual/socket.c:158:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/pgbouncer-1.14.0/lib/usual/socket_ntop.c:87:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmp[sizeof "255.255.255.255"];
data/pgbouncer-1.14.0/lib/usual/socket_ntop.c:115:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmp[sizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"];
data/pgbouncer-1.14.0/lib/usual/socket_pton.c:116:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dst, tmp, INADDRSZ);
data/pgbouncer-1.14.0/lib/usual/socket_pton.c:220:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dst, tmp, IN6ADDRSZ);
data/pgbouncer-1.14.0/lib/usual/socket_win32.h:140:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char sun_path[128];
data/pgbouncer-1.14.0/lib/usual/string.c:200:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dst, src, len + 1);
data/pgbouncer-1.14.0/lib/usual/string.c:202:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dst, src, n - 1);
data/pgbouncer-1.14.0/lib/usual/string.c:242:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dst, src, n);
data/pgbouncer-1.14.0/lib/usual/string.c:325:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char buf[256];
data/pgbouncer-1.14.0/lib/usual/string.c:329:10: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
return memcpy(buf, ".", 2);
data/pgbouncer-1.14.0/lib/usual/string.c:341:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf, p2 - len, len);
data/pgbouncer-1.14.0/lib/usual/string.c:356:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char buf[1024];
data/pgbouncer-1.14.0/lib/usual/string.c:359:10: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
return memcpy(buf, ".", 2);
data/pgbouncer-1.14.0/lib/usual/string.c:366:10: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
return memcpy(buf, "/", 2);
data/pgbouncer-1.14.0/lib/usual/string.c:370:10: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
return memcpy(buf, ".", 2);
data/pgbouncer-1.14.0/lib/usual/string.c:375:10: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
return memcpy(buf, "/", 2);
data/pgbouncer-1.14.0/lib/usual/string.c:382:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf, path, len);
data/pgbouncer-1.14.0/lib/usual/string.c:391:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char buf[1024];
data/pgbouncer-1.14.0/lib/usual/string.c:480:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/pgbouncer-1.14.0/lib/usual/string.c:517:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dst, dp, dplen);
data/pgbouncer-1.14.0/lib/usual/strpool.c:109:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(cstr->str, str, len + 1);
data/pgbouncer-1.14.0/lib/usual/strpool.h:45:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[FLEX_ARRAY];
data/pgbouncer-1.14.0/lib/usual/talloc.c:1088:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(res, src, len);
data/pgbouncer-1.14.0/lib/usual/talloc.c:1110:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(res, s, len);
data/pgbouncer-1.14.0/lib/usual/talloc.c:1150:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ptr + plen, s, slen + 1);
data/pgbouncer-1.14.0/lib/usual/talloc.c:1183:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/pgbouncer-1.14.0/lib/usual/talloc.c:1202:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(res + plen, buf, len + 1);
data/pgbouncer-1.14.0/lib/usual/talloc.c:1317:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/pgbouncer-1.14.0/lib/usual/talloc.c:1332:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/pgbouncer-1.14.0/lib/usual/talloc.c:1347:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/pgbouncer-1.14.0/lib/usual/talloc.c:1515:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char limitbuf[128];
data/pgbouncer-1.14.0/lib/usual/time.c:194:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128], *tz, *old = NULL;
data/pgbouncer-1.14.0/lib/usual/tls/tls_cert.c:54:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *tmp, buf[64];
data/pgbouncer-1.14.0/lib/usual/tls/tls_cert.c:211:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(cstr, data, len);
data/pgbouncer-1.14.0/lib/usual/tls/tls_cert.c:308:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((void *)slot->name_value, data, len);
data/pgbouncer-1.14.0/lib/usual/tls/tls_compat.c:355:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[16];
data/pgbouncer-1.14.0/lib/usual/tls/tls_compat.c:376:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf, src, len);
data/pgbouncer-1.14.0/lib/usual/tls/tls_config.c:44:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(out, in, len);
data/pgbouncer-1.14.0/lib/usual/tls/tls_conninfo.c:60:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char d[EVP_MAX_MD_SIZE];
data/pgbouncer-1.14.0/lib/usual/tls/tls_ocsp.c:421:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(xmem, mem, len);
data/pgbouncer-1.14.0/lib/usual/tls/tls_ocsp.c:529:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(q->request_data, data, q->request_size);
data/pgbouncer-1.14.0/lib/usual/tls/tls_server.c:59:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char sid[SSL_MAX_SSL_SESSION_ID_LENGTH];
data/pgbouncer-1.14.0/lib/usual/tls/tls_util.c:124:12: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((fd = open(name, O_RDONLY)) == -1)
data/pgbouncer-1.14.0/lib/usual/tls/tls_util.c:159:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf, data, size);
data/pgbouncer-1.14.0/lib/usual/tls/tls_util.c:186:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char dh[64];
data/pgbouncer-1.14.0/lib/usual/wchar.c:101:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[10];
data/pgbouncer-1.14.0/src/admin.c:98:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[1024];
data/pgbouncer-1.14.0/src/admin.c:228:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmp[512];
data/pgbouncer-1.14.0/src/admin.c:296:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(CMSG_DATA(cmsg), &fd, sizeof(int));
data/pgbouncer-1.14.0/src/admin.c:328:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char addrbuf[PGADDR_BUF];
data/pgbouncer-1.14.0/src/admin.c:371:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[PGADDR_BUF];
data/pgbouncer-1.14.0/src/admin.c:608:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ptrbuf[128], linkbuf[128];
data/pgbouncer-1.14.0/src/admin.c:609:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char l_addr[PGADDR_BUF], r_addr[PGADDR_BUF];
data/pgbouncer-1.14.0/src/admin.c:611:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char infobuf[96] = "";
data/pgbouncer-1.14.0/src/admin.c:876:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char adrs[1024];
data/pgbouncer-1.14.0/src/admin.c:1280:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dst, s, len);
data/pgbouncer-1.14.0/src/admin.c:1402:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cmd[16];
data/pgbouncer-1.14.0/src/admin.c:1403:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char arg[64];
data/pgbouncer-1.14.0/src/admin.c:1404:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char val[256];
data/pgbouncer-1.14.0/src/client.c:40:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char md5[MD5_PASSWD_LEN + 1];
data/pgbouncer-1.14.0/src/client.c:184:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char infobuf[96] = "";
data/pgbouncer-1.14.0/src/client.c:376:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(user.name, username, length);
data/pgbouncer-1.14.0/src/client.c:396:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(user.passwd, password, length);
data/pgbouncer-1.14.0/src/client.c:443:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[400], abuf[300];
data/pgbouncer-1.14.0/src/client.c:533:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ibuf, data, datalen);
data/pgbouncer-1.14.0/src/client.c:582:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ibuf, data, datalen);
data/pgbouncer-1.14.0/src/client.c:747:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(client->pool->user->scram_ClientKey,
data/pgbouncer-1.14.0/src/client.c:750:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(client->pool->user->scram_ServerKey,
data/pgbouncer-1.14.0/src/client.c:793:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(client->cancel_key, key, BACKENDKEY_LEN);
data/pgbouncer-1.14.0/src/client.c:932:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char hex[8*2 + 1];
data/pgbouncer-1.14.0/src/common/saslprep.c:1242:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char buf[4];
data/pgbouncer-1.14.0/src/common/scram-common.c:131:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(result, Ui_prev, SCRAM_KEY_LEN);
data/pgbouncer-1.14.0/src/common/scram-common.c:141:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(Ui_prev, Ui, SCRAM_KEY_LEN);
data/pgbouncer-1.14.0/src/common/scram-common.c:236:15: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
p = result + sprintf(result, "SCRAM-SHA-256$%d:", iterations);
data/pgbouncer-1.14.0/src/common/wchar.c:2048:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[8 * 5 + 1];
data/pgbouncer-1.14.0/src/common/wchar.c:2058:8: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
p += sprintf(p, "0x%02x", (unsigned char) mbstr[j]);
data/pgbouncer-1.14.0/src/common/wchar.c:2081:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[8 * 5 + 1];
data/pgbouncer-1.14.0/src/common/wchar.c:2091:8: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
p += sprintf(p, "0x%02x", (unsigned char) mbstr[j]);
data/pgbouncer-1.14.0/src/dnslookup.c:145:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&sa4->sin_addr, adr, 4);
data/pgbouncer-1.14.0/src/dnslookup.c:1200:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char sabuf[128];
data/pgbouncer-1.14.0/src/dnslookup.c:1407:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/pgbouncer-1.14.0/src/hba.c:66:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char s_val[FLEX_ARRAY];
data/pgbouncer-1.14.0/src/hba.c:125:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(node->s_val, str, len);
data/pgbouncer-1.14.0/src/hba.c:255:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(p->buf, p->pos, s - p->pos);
data/pgbouncer-1.14.0/src/hba.c:303:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(res, p1, len1);
data/pgbouncer-1.14.0/src/hba.c:307:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(pos, p2, len2 + 1);
data/pgbouncer-1.14.0/src/hba.c:360:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen(fn, "r");
data/pgbouncer-1.14.0/src/hba.c:572:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf1[128], buf2[128];
data/pgbouncer-1.14.0/src/hba.c:628:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen(fn, "r");
data/pgbouncer-1.14.0/src/loader.c:242:16: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
pool_size = atoi(val);
data/pgbouncer-1.14.0/src/loader.c:244:20: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
res_pool_size = atoi(val);
data/pgbouncer-1.14.0/src/loader.c:246:25: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
max_db_connections = atoi(val);
data/pgbouncer-1.14.0/src/loader.c:265:11: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
v_port = atoi(port);
data/pgbouncer-1.14.0/src/loader.c:428:27: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
max_user_connections = atoi(val);
data/pgbouncer-1.14.0/src/loader.c:485:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char real_user[MAX_USERNAME];
data/pgbouncer-1.14.0/src/loader.c:486:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char real_passwd[MAX_PASSWORD];
data/pgbouncer-1.14.0/src/main.c:338:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[256];
data/pgbouncer-1.14.0/src/main.c:557:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd = open("/dev/null", O_RDWR);
data/pgbouncer-1.14.0/src/main.c:602:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128 + 1];
data/pgbouncer-1.14.0/src/main.c:610:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd = open(cf_pidfile, O_RDONLY);
data/pgbouncer-1.14.0/src/main.c:623:8: [2] (integer) atol:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
pid = atol(buf);
data/pgbouncer-1.14.0/src/main.c:646:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[64];
data/pgbouncer-1.14.0/src/main.c:656:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd = open(cf_pidfile, O_WRONLY | O_CREAT | O_EXCL, 0644);
data/pgbouncer-1.14.0/src/objects.c:359:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(cs, cf_autodb_connstr, len + 1);
data/pgbouncer-1.14.0/src/objects.c:819:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/pgbouncer-1.14.0/src/objects.c:895:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/pgbouncer-1.14.0/src/objects.c:985:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[64];
data/pgbouncer-1.14.0/src/objects.c:993:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[64];
data/pgbouncer-1.14.0/src/objects.c:1342:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(req->cancel_key, server->cancel_key, 8);
data/pgbouncer-1.14.0/src/pam.c:67:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char username[MAX_USERNAME];
data/pgbouncer-1.14.0/src/pam.c:70:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char password[MAX_PASSWORD];
data/pgbouncer-1.14.0/src/pam.c:173:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&request->remote_addr, &client->remote_addr, sizeof(client->remote_addr));
data/pgbouncer-1.14.0/src/pam.c:360:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char raddr[PGADDR_BUF];
data/pgbouncer-1.14.0/src/pktbuf.c:249:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf->buf + buf->write_pos, data, len);
data/pgbouncer-1.14.0/src/pktbuf.c:430:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmp[100]; /* XXX good enough in practice */
data/pgbouncer-1.14.0/src/pktbuf.c:449:5: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(tmp, "\\x");
data/pgbouncer-1.14.0/src/pktbuf.c:451:6: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(tmp + (2 + j * 2), "%02x", bval[j]);
data/pgbouncer-1.14.0/src/pooler.c:73:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[sizeof(struct sockaddr_un) + 20];
data/pgbouncer-1.14.0/src/pooler.c:89:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/pgbouncer-1.14.0/src/pooler.c:203:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char lockfile[sizeof(struct sockaddr_un) + 10];
data/pgbouncer-1.14.0/src/pooler.c:251:2: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(af.af_name, "dataready");
data/pgbouncer-1.14.0/src/pooler.c:281:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char ip1buf[PGADDR_BUF], ip2buf[PGADDR_BUF],
data/pgbouncer-1.14.0/src/pooler.c:363:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[PGADDR_BUF];
data/pgbouncer-1.14.0/src/pooler.c:441:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char service[64];
data/pgbouncer-1.14.0/src/proto.c:283:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char txt[MD5_PASSWD_LEN + 1], *src;
data/pgbouncer-1.14.0/src/proto.c:375:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ibuf, data, datalen);
data/pgbouncer-1.14.0/src/proto.c:409:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ServerSignature[SHA256_DIGEST_LENGTH];
data/pgbouncer-1.14.0/src/proto.c:420:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ibuf, data, datalen);
data/pgbouncer-1.14.0/src/proto.c:604:19: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
*int_p = val ? atoi(val) : 0;
data/pgbouncer-1.14.0/src/scram.c:74:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char buf[5];
data/pgbouncer-1.14.0/src/scram.c:240:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(stored_key, decoded_stored_buf, SCRAM_KEY_LEN);
data/pgbouncer-1.14.0/src/scram.c:247:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(server_key, decoded_server_buf, SCRAM_KEY_LEN);
data/pgbouncer-1.14.0/src/scram.c:334:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[512];
data/pgbouncer-1.14.0/src/scram.c:462:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ServerSignature, decoded_server_signature, SCRAM_KEY_LEN);
data/pgbouncer-1.14.0/src/scram.c:488:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ClientKey, user->scram_ClientKey, SCRAM_KEY_LEN);
data/pgbouncer-1.14.0/src/scram.c:547:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ServerKey, user->scram_ServerKey, SCRAM_KEY_LEN);
data/pgbouncer-1.14.0/src/scram.c:728:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(client->scram_state.client_final_message_without_proof, raw_input, proof_start - input_start);
data/pgbouncer-1.14.0/src/scram.c:748:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char saltbuf[SCRAM_DEFAULT_SALT_LEN];
data/pgbouncer-1.14.0/src/server.c:178:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(server->cancel_key, ckey, BACKENDKEY_LEN);
data/pgbouncer-1.14.0/src/server.c:394:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[PGADDR_BUF + 32];
data/pgbouncer-1.14.0/src/server.c:470:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char infobuf[96];
data/pgbouncer-1.14.0/src/takeover.c:110:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&fd, CMSG_DATA(cmsg), sizeof(int));
data/pgbouncer-1.14.0/src/util.c:32:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char host6[PGADDR_BUF];
data/pgbouncer-1.14.0/src/util.c:103:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dest, "md5", 3);
data/pgbouncer-1.14.0/src/util.c:385:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[PGADDR_BUF];
data/pgbouncer-1.14.0/src/util.c:432:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[PGADDR_BUF];
data/pgbouncer-1.14.0/src/util.c:446:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char cache[256];
data/pgbouncer-1.14.0/src/util.c:459:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[PGADDR_BUF];
data/pgbouncer-1.14.0/src/varcache.c:86:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/pgbouncer-1.14.0/src/varcache.c:87:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char qbuf[128];
data/pgbouncer-1.14.0/test/asynctest.c:109:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1024];
data/pgbouncer-1.14.0/test/asynctest.c:229:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char *values[1];
data/pgbouncer-1.14.0/test/asynctest.c:467:24: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
throttle_connects = atoi(optarg);
data/pgbouncer-1.14.0/test/asynctest.c:470:23: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
throttle_queries = atoi(optarg);
data/pgbouncer-1.14.0/test/asynctest.c:473:13: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
numcon = atoi(optarg);
data/pgbouncer-1.14.0/test/asynctest.c:476:11: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
seed = atoi(optarg);
data/pgbouncer-1.14.0/test/asynctest.c:482:23: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
per_conn_queries = atoi(optarg);
data/pgbouncer-1.14.0/test/hba_test.c:111:6: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen("hba_test.eval", "r");
data/pgbouncer-1.14.0/win32/pgbevent.c:31:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[_MAX_PATH];
data/pgbouncer-1.14.0/win32/win32support.c:183:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char buf[PATH_MAX];
data/pgbouncer-1.14.0/win32/win32support.c:197:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char self[1024];
data/pgbouncer-1.14.0/win32/win32support.c:198:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cmdline[2048];
data/pgbouncer-1.14.0/include/pktbuf.h:107:46: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
pktbuf_write_generic(buf, 'p', "sib", mech, strlen(cir), cir, strlen(cir))
data/pgbouncer-1.14.0/include/pktbuf.h:107:64: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
pktbuf_write_generic(buf, 'p', "sib", mech, strlen(cir), cir, strlen(cir))
data/pgbouncer-1.14.0/include/pktbuf.h:110:42: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
pktbuf_write_generic(buf, 'p', "b", cr, strlen(cr))
data/pgbouncer-1.14.0/lib/usual/base.c:36:6: [1] (free) memalign:
On some systems (though not Linux-based systems) an attempt to free()
results from memalign() may fail. This may, on a few systems, be
exploitable. Also note that memalign() may not check that the boundary
parameter is correct (CWE-676). Use posix_memalign instead (defined in
POSIX's 1003.1d). Don't switch to valloc(); it is marked as obsolete in BSD
4.3, as legacy in SUSv2, and is no longer defined in SUSv3. In some cases,
malloc()'s alignment may be sufficient.
p = memalign(align, len);
data/pgbouncer-1.14.0/lib/usual/cfparser.c:466:10: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
v_len = strlen(value);
data/pgbouncer-1.14.0/lib/usual/cfparser.c:495:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
home_len = strlen(home);
data/pgbouncer-1.14.0/lib/usual/crypto/entropy.c:199:10: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
res = read(fd, d, need);
data/pgbouncer-1.14.0/lib/usual/cxalloc.c:85:26: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return cx_memdup(cx, s, strlen(s) + 1);
data/pgbouncer-1.14.0/lib/usual/daemon.c:72:8: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
res = read(fd, buf, sizeof(buf) - 1);
data/pgbouncer-1.14.0/lib/usual/daemon.c:138:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(buf);
data/pgbouncer-1.14.0/lib/usual/fileutil.c:168:10: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len += strlen(p);
data/pgbouncer-1.14.0/lib/usual/fnmatch.c:243:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int plen = strlen(pat);
data/pgbouncer-1.14.0/lib/usual/fnmatch.c:244:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int slen = strlen(str);
data/pgbouncer-1.14.0/lib/usual/getopt.c:169:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
current_argv_len = strlen(current_argv);
data/pgbouncer-1.14.0/lib/usual/getopt.c:177:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(long_options[i].name) == current_argv_len) {
data/pgbouncer-1.14.0/lib/usual/hashing/memhash.c:54:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return memhash(s, strlen(s));
data/pgbouncer-1.14.0/lib/usual/json.c:1274:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
klen = strlen(key);
data/pgbouncer-1.14.0/lib/usual/json.c:1294:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!dict_getter(dict, key, strlen(key), &val, JSON_BOOL, true))
data/pgbouncer-1.14.0/lib/usual/json.c:1303:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!dict_getter(dict, key, strlen(key), &val, JSON_INT, true))
data/pgbouncer-1.14.0/lib/usual/json.c:1312:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!dict_getter(dict, key, strlen(key), &val, JSON_FLOAT, true))
data/pgbouncer-1.14.0/lib/usual/json.c:1321:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!dict_getter(dict, key, strlen(key), &val, JSON_STRING, true))
data/pgbouncer-1.14.0/lib/usual/json.c:1328:32: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return dict_getter(dict, key, strlen(key), dst_p, JSON_LIST, true);
data/pgbouncer-1.14.0/lib/usual/json.c:1333:32: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return dict_getter(dict, key, strlen(key), dst_p, JSON_DICT, true);
data/pgbouncer-1.14.0/lib/usual/json.c:1344:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!dict_getter(dict, key, strlen(key), &val, JSON_BOOL, false))
data/pgbouncer-1.14.0/lib/usual/json.c:1353:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!dict_getter(dict, key, strlen(key), &val, JSON_INT, false))
data/pgbouncer-1.14.0/lib/usual/json.c:1362:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!dict_getter(dict, key, strlen(key), &val, JSON_FLOAT, false))
data/pgbouncer-1.14.0/lib/usual/json.c:1371:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!dict_getter(dict, key, strlen(key), &val, JSON_STRING, false))
data/pgbouncer-1.14.0/lib/usual/json.c:1380:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!dict_getter(dict, key, strlen(key), &val, JSON_LIST, false))
data/pgbouncer-1.14.0/lib/usual/json.c:1391:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!dict_getter(dict, key, strlen(key), &val, JSON_DICT, false))
data/pgbouncer-1.14.0/lib/usual/json.c:1599:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(val);
data/pgbouncer-1.14.0/lib/usual/mbuf.h:143:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
mbuf_init_fixed_reader(&tmp, s, strlen(s));
data/pgbouncer-1.14.0/lib/usual/mdict.h:62:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return mdict_get_str(dict, key, strlen(key));
data/pgbouncer-1.14.0/lib/usual/mdict.h:68:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
unsigned klen = strlen(key);
data/pgbouncer-1.14.0/lib/usual/mdict.h:69:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
unsigned vlen = val ? strlen(val) : 0;
data/pgbouncer-1.14.0/lib/usual/mdict.h:76:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
unsigned klen = strlen(key);
data/pgbouncer-1.14.0/lib/usual/mdict.h:85:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return mdict_del_key(dict, key, strlen(key));
data/pgbouncer-1.14.0/lib/usual/pgutil.c:133:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
scmlen = strlen(_dst);
data/pgbouncer-1.14.0/lib/usual/pgutil.c:286:47: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
const char *kw = pg_keyword_lookup_real(str, strlen(str));
data/pgbouncer-1.14.0/lib/usual/safeio.c:35:8: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
res = read(fd, buf, len);
data/pgbouncer-1.14.0/lib/usual/slab.c:71:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
unsigned slen = strlen(name);
data/pgbouncer-1.14.0/lib/usual/socket_ntop.c:180:10: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
tp += strlen(tp);
data/pgbouncer-1.14.0/lib/usual/string.c:198:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t len = strlen(src);
data/pgbouncer-1.14.0/lib/usual/string.c:362:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(path);
data/pgbouncer-1.14.0/lib/usual/string.c:511:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
dplen = dp[1] ? strlen(dp) : 1;
data/pgbouncer-1.14.0/lib/usual/string.c:566:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
dplen = dp[1] ? strlen(dp) : 1;
data/pgbouncer-1.14.0/lib/usual/string.c:571:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memmove(p + 1, p + dplen, strlen(p + dplen) + 1);
data/pgbouncer-1.14.0/lib/usual/strpool.c:93:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(str);
data/pgbouncer-1.14.0/lib/usual/time.h:80:9: [1] (obsolete) usleep:
This C routine is considered obsolete (as opposed to the shell command by
the same name). The interaction of this function with SIGALRM and other
timer functions such as sleep(), alarm(), setitimer(), and nanosleep() is
unspecified (CWE-676). Use nanosleep(2) or setitimer(2) instead.
#define usleep(x) usual_usleep(x)
data/pgbouncer-1.14.0/lib/usual/time.h:83:20: [1] (obsolete) usleep:
This C routine is considered obsolete (as opposed to the shell command by
the same name). The interaction of this function with SIGALRM and other
timer functions such as sleep(), alarm(), setitimer(), and nanosleep() is
unspecified (CWE-676). Use nanosleep(2) or setitimer(2) instead.
static inline void usleep(long usec) { Sleep(usec / 1000); }
data/pgbouncer-1.14.0/lib/usual/tls/tls_compat.c:87:38: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
bio = BIO_new_mem_buf((char *)buf, strlen(buf));
data/pgbouncer-1.14.0/lib/usual/tls/tls_util.c:134:7: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (read(fd, buf, size) != (ssize_t)size)
data/pgbouncer-1.14.0/lib/usual/tls/tls_verify.c:73:25: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (domain == NULL || strlen(domain) == 1)
data/pgbouncer-1.14.0/lib/usual/tls/tls_verify.c:127:32: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (len < 0 || len != (int)strlen(data)) {
data/pgbouncer-1.14.0/lib/usual/tls/tls_verify.c:220:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (common_name_len != (int)strlen(common_name)) {
data/pgbouncer-1.14.0/lib/usual/wchar.c:34:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
str_len = strlen(str);
data/pgbouncer-1.14.0/src/admin.c:884:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
s += strlen(s);
data/pgbouncer-1.14.0/src/client.c:54:39: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
pg_md5_encrypt(passwd, user->name, strlen(user->name), md5);
data/pgbouncer-1.14.0/src/client.c:62:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(passwd) != MD5_PASSWD_LEN)
data/pgbouncer-1.14.0/src/client.c:65:45: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
pg_md5_encrypt(user->passwd, user->name, strlen(user->name), user->passwd);
data/pgbouncer-1.14.0/src/client.c:278:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(username) >= MAX_USERNAME) {
data/pgbouncer-1.14.0/src/client.c:284:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (password && strlen(password) >= MAX_PASSWORD) {
data/pgbouncer-1.14.0/src/client.c:561:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(client->scram_state.server_first_message));
data/pgbouncer-1.14.0/src/client.c:612:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(server_final_message));
data/pgbouncer-1.14.0/src/common/saslprep.c:1090:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(input) > MAX_PASSWORD_LENGTH)
data/pgbouncer-1.14.0/src/common/scram-common.c:112:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int password_len = strlen(password);
data/pgbouncer-1.14.0/src/common/scram-common.c:169:40: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
scram_HMAC_update(&ctx, "Client Key", strlen("Client Key"));
data/pgbouncer-1.14.0/src/common/scram-common.c:182:40: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
scram_HMAC_update(&ctx, "Server Key", strlen("Server Key"));
data/pgbouncer-1.14.0/src/common/scram-common.c:222:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
maxlen = strlen("SCRAM-SHA-256") + 1
data/pgbouncer-1.14.0/src/common/wchar.c:2060:9: [1] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source is a constant character.
p += sprintf(p, " ");
data/pgbouncer-1.14.0/src/common/wchar.c:2093:9: [1] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source is a constant character.
p += sprintf(p, " ");
data/pgbouncer-1.14.0/src/dnslookup.c:1300:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int namelen = strlen(name);
data/pgbouncer-1.14.0/src/hba.c:36:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t strlen;
data/pgbouncer-1.14.0/src/hba.c:299:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len1 = strlen(p1);
data/pgbouncer-1.14.0/src/hba.c:300:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len2 = strlen(p2);
data/pgbouncer-1.14.0/src/hba.c:441:41: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strset_add(hname->name_set, tok, strlen(tok)))
data/pgbouncer-1.14.0/src/hba.c:706:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
unsigned int dbnamelen = strlen(dbname);
data/pgbouncer-1.14.0/src/hba.c:707:26: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
unsigned int unamelen = strlen(username);
data/pgbouncer-1.14.0/src/main.c:616:8: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
res = read(fd, buf, sizeof(buf) - 1);
data/pgbouncer-1.14.0/src/main.c:659:28: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
res = safe_write(fd, buf, strlen(buf));
data/pgbouncer-1.14.0/src/objects.c:355:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(cf_autodb_connstr);
data/pgbouncer-1.14.0/src/pam.c:162:4: [1] (obsolete) usleep:
This C routine is considered obsolete (as opposed to the shell command by
the same name). The interaction of this function with SIGALRM and other
timer functions such as sleep(), alarm(), setitimer(), and nanosleep() is
unspecified (CWE-676). Use nanosleep(2) or setitimer(2) instead.
usleep(PAM_QUEUE_WAIT_SLEEP_MCS);
data/pgbouncer-1.14.0/src/pktbuf.c:255:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int len = strlen(str);
data/pgbouncer-1.14.0/src/pktbuf.c:363:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int i, ncol = strlen(tupdesc);
data/pgbouncer-1.14.0/src/pktbuf.c:422:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int ncol = strlen(tupdesc);
data/pgbouncer-1.14.0/src/pktbuf.c:466:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int len = strlen(val);
data/pgbouncer-1.14.0/src/pktbuf.c:501:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(val);
data/pgbouncer-1.14.0/src/proto.c:290:44: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
pg_md5_encrypt(user->passwd, user->name, strlen(user->name), txt);
data/pgbouncer-1.14.0/src/proto.c:563:10: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
asked = strlen(tupdesc);
data/pgbouncer-1.14.0/src/scram.c:220:43: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
decoded_salt_buf = malloc(pg_b64_dec_len(strlen(salt_str)));
data/pgbouncer-1.14.0/src/scram.c:223:40: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
decoded_len = pg_b64_decode(salt_str, strlen(salt_str), decoded_salt_buf);
data/pgbouncer-1.14.0/src/scram.c:234:45: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
decoded_stored_buf = malloc(pg_b64_dec_len(strlen(storedkey_str)));
data/pgbouncer-1.14.0/src/scram.c:237:45: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
decoded_len = pg_b64_decode(storedkey_str, strlen(storedkey_str), decoded_stored_buf);
data/pgbouncer-1.14.0/src/scram.c:242:45: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
decoded_server_buf = malloc(pg_b64_dec_len(strlen(serverkey_str)));
data/pgbouncer-1.14.0/src/scram.c:243:45: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
decoded_len = pg_b64_decode(serverkey_str, strlen(serverkey_str),
data/pgbouncer-1.14.0/src/scram.c:277:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(shadow_pass) == MD5_PASSWD_LEN &&
data/pgbouncer-1.14.0/src/scram.c:308:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = 8 + strlen(scram_state->client_nonce) + 1;
data/pgbouncer-1.14.0/src/scram.c:379:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(server_nonce) < strlen(server->scram_state.client_nonce) ||
data/pgbouncer-1.14.0/src/scram.c:379:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen(server_nonce) < strlen(server->scram_state.client_nonce) ||
data/pgbouncer-1.14.0/src/scram.c:380:61: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memcmp(server_nonce, server->scram_state.client_nonce, strlen(server->scram_state.client_nonce)) != 0)
data/pgbouncer-1.14.0/src/scram.c:389:31: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
salt = malloc(pg_b64_dec_len(strlen(encoded_salt)));
data/pgbouncer-1.14.0/src/scram.c:393:5: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(encoded_salt),
data/pgbouncer-1.14.0/src/scram.c:449:40: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
server_signature_len = pg_b64_dec_len(strlen(encoded_server_signature));
data/pgbouncer-1.14.0/src/scram.c:455:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(encoded_server_signature),
data/pgbouncer-1.14.0/src/scram.c:519:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(scram_state->client_first_message_bare));
data/pgbouncer-1.14.0/src/scram.c:523:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(scram_state->server_first_message));
data/pgbouncer-1.14.0/src/scram.c:527:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(client_final_message_without_proof));
data/pgbouncer-1.14.0/src/scram.c:554:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(scram_state->client_first_message_bare));
data/pgbouncer-1.14.0/src/scram.c:558:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(scram_state->server_first_message));
data/pgbouncer-1.14.0/src/scram.c:562:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(scram_state->client_final_message_without_proof));
data/pgbouncer-1.14.0/src/scram.c:710:32: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
proof = malloc(pg_b64_dec_len(strlen(encoded_proof)));
data/pgbouncer-1.14.0/src/scram.c:716:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(encoded_proof),
data/pgbouncer-1.14.0/src/scram.c:822:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
+ strlen(scram_state->client_nonce)
data/pgbouncer-1.14.0/src/scram.c:823:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
+ strlen(scram_state->server_nonce)
data/pgbouncer-1.14.0/src/scram.c:825:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
+ strlen(scram_state->salt)
data/pgbouncer-1.14.0/src/scram.c:858:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(state->client_first_message_bare));
data/pgbouncer-1.14.0/src/scram.c:862:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(state->server_first_message));
data/pgbouncer-1.14.0/src/scram.c:866:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(state->client_final_message_without_proof));
data/pgbouncer-1.14.0/src/scram.c:889:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = 2 + strlen(server_signature) + 1;
data/pgbouncer-1.14.0/src/scram.c:904:28: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t client_nonce_len = strlen(scram_state->client_nonce);
data/pgbouncer-1.14.0/src/scram.c:905:28: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t server_nonce_len = strlen(scram_state->server_nonce);
data/pgbouncer-1.14.0/src/scram.c:906:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t final_nonce_len = strlen(client_final_nonce);
data/pgbouncer-1.14.0/src/scram.c:929:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(state->client_first_message_bare));
data/pgbouncer-1.14.0/src/scram.c:933:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(state->server_first_message));
data/pgbouncer-1.14.0/src/scram.c:937:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(state->client_final_message_without_proof));
data/pgbouncer-1.14.0/src/scram.c:983:31: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
salt = malloc(pg_b64_dec_len(strlen(encoded_salt)));
data/pgbouncer-1.14.0/src/scram.c:986:40: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
saltlen = pg_b64_decode(encoded_salt, strlen(encoded_salt), salt);
data/pgbouncer-1.14.0/src/takeover.c:69:4: [1] (obsolete) usleep:
This C routine is considered obsolete (as opposed to the shell command by
the same name). The interaction of this function with SIGALRM and other
timer functions such as sleep(), alarm(), setitimer(), and nanosleep() is
unspecified (CWE-676). Use nanosleep(2) or setitimer(2) instead.
usleep(USEC/10);
data/pgbouncer-1.14.0/src/util.c:99:26: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
md5_update(&ctx, part1, strlen(part1));
data/pgbouncer-1.14.0/src/util.c:197:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int c, len = strlen(str);
data/pgbouncer-1.14.0/src/varcache.c:75:35: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
pstr = strpool_get(vpool, value, strlen(value));
data/pgbouncer-1.14.0/test/asynctest.c:165:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int curlen = strlen(PQgetvalue(res, 0, 0));
data/pgbouncer-1.14.0/win32/pgbevent.c:49:79: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (RegSetValueEx(key, "EventMessageFile", 0, REG_EXPAND_SZ, (LPBYTE)buffer, strlen(buffer) + 1)) {
ANALYSIS SUMMARY:
Hits = 599
Lines analyzed = 63477 in approximately 1.63 seconds (38946 lines/second)
Physical Source Lines of Code (SLOC) = 45847
Hits@level = [0] 116 [1] 132 [2] 410 [3] 19 [4] 35 [5] 3
Hits@level+ = [0+] 715 [1+] 599 [2+] 467 [3+] 57 [4+] 38 [5+] 3
Hits/KSLOC@level+ = [0+] 15.5953 [1+] 13.0652 [2+] 10.1861 [3+] 1.24327 [4+] 0.828844 [5+] 0.065435
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.