Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/php-luasandbox-3.0.3/alloc.c Examining data/php-luasandbox-3.0.3/data_conversion.c Examining data/php-luasandbox-3.0.3/library.c Examining data/php-luasandbox-3.0.3/luasandbox.c Examining data/php-luasandbox-3.0.3/luasandbox_lstrlib.c Examining data/php-luasandbox-3.0.3/luasandbox_timer.h Examining data/php-luasandbox-3.0.3/luasandbox_types.h Examining data/php-luasandbox-3.0.3/luasandbox_version.h Examining data/php-luasandbox-3.0.3/php_luasandbox.h Examining data/php-luasandbox-3.0.3/timer.c FINAL RESULTS: data/php-luasandbox-3.0.3/data_conversion.c:247:17: [4] (format) snprintf: If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134). Use a constant for the format specification. key_length = snprintf(buffer, sizeof(buffer), "%" PRId64, (int64_t)lkey); data/php-luasandbox-3.0.3/data_conversion.c:278:17: [4] (format) snprintf: If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134). Use a constant for the format specification. size_t len = snprintf(buffer, sizeof(buffer), "%" PRId64, (int64_t)lkey); data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:780:3: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(form + l - 1, LUA_INTFRMLEN); data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:807:11: [4] (format) sprintf: Potential format string problem (CWE-134). Make format string constant. sprintf(buff, form, (int)luaL_checknumber(L, arg)); data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:812:11: [4] (format) sprintf: Potential format string problem (CWE-134). Make format string constant. sprintf(buff, form, (LUA_INTFRM_T)luaL_checknumber(L, arg)); data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:817:11: [4] (format) sprintf: Potential format string problem (CWE-134). Make format string constant. sprintf(buff, form, (unsigned LUA_INTFRM_T)luaL_checknumber(L, arg)); data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:822:11: [4] (format) sprintf: Potential format string problem (CWE-134). Make format string constant. sprintf(buff, form, (double)luaL_checknumber(L, arg)); data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:840:13: [4] (format) sprintf: Potential format string problem (CWE-134). Make format string constant. sprintf(buff, form, s); data/php-luasandbox-3.0.3/data_conversion.c:215:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buffer[MAX_LENGTH_OF_LONG + 1]; data/php-luasandbox-3.0.3/luasandbox.c:307:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&luasandbox_object_handlers, zend_get_std_object_handlers(), sizeof(zend_object_handlers)); data/php-luasandbox-3.0.3/luasandbox.c:310:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&luasandboxfunction_object_handlers, zend_get_std_object_handlers(), sizeof(zend_object_handlers)); data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:800:7: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char form[MAX_FORMAT]; /* to store the format (`%...') */ data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:801:7: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buff[MAX_ITEM]; /* to store the formatted item */ data/php-luasandbox-3.0.3/timer.c:230:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static char buffer[1024]; data/php-luasandbox-3.0.3/timer.c:303:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char prof_name[prof_name_size]; data/php-luasandbox-3.0.3/library.c:252:35: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). luasandbox_allowed_globals[i], strlen(luasandbox_allowed_globals[i]) + 1, data/php-luasandbox-3.0.3/library.c:256:35: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). luasandbox_allowed_globals[i], strlen(luasandbox_allowed_globals[i]), &zv); data/php-luasandbox-3.0.3/luasandbox.c:671:7: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(p.chunkName) != chunkNameLength) { data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:770:3: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(form, strfrmt, p - strfrmt + 1); data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:778:14: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). size_t l = strlen(form); data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:849:33: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). luaL_addlstring(&b, buff, strlen(buff)); data/php-luasandbox-3.0.3/timer.c:296:26: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). size_t prof_name_size = strlen(ar->short_src) data/php-luasandbox-3.0.3/timer.c:299:21: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). prof_name_size += strlen(name); data/php-luasandbox-3.0.3/timer.c:313:4: [1] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). Risk is low because the source is a constant character. strcpy(prof_name, "?"); data/php-luasandbox-3.0.3/timer.c:329:26: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). uint key_length = (uint)strlen(prof_name) + 1; data/php-luasandbox-3.0.3/timer.c:339:19: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). ZSTR_LEN(zstr) = strlen(prof_name); ANALYSIS SUMMARY: Hits = 26 Lines analyzed = 5816 in approximately 0.14 seconds (42179 lines/second) Physical Source Lines of Code (SLOC) = 4141 Hits@level = [0] 5 [1] 11 [2] 7 [3] 0 [4] 8 [5] 0 Hits@level+ = [0+] 31 [1+] 26 [2+] 15 [3+] 8 [4+] 8 [5+] 0 Hits/KSLOC@level+ = [0+] 7.48611 [1+] 6.27868 [2+] 3.62231 [3+] 1.9319 [4+] 1.9319 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.