Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/pptp-linux-1.10.0/util.h
Examining data/pptp-linux-1.10.0/routing.h
Examining data/pptp-linux-1.10.0/vector.c
Examining data/pptp-linux-1.10.0/pptp_ctrl.h
Examining data/pptp-linux-1.10.0/pptp_ctrl.c
Examining data/pptp-linux-1.10.0/pptp_quirks.h
Examining data/pptp-linux-1.10.0/ppp_fcs.h
Examining data/pptp-linux-1.10.0/dirutil.c
Examining data/pptp-linux-1.10.0/pptp_compat.c
Examining data/pptp-linux-1.10.0/routing.c
Examining data/pptp-linux-1.10.0/orckit_quirks.c
Examining data/pptp-linux-1.10.0/version.h
Examining data/pptp-linux-1.10.0/pptp_quirks.c
Examining data/pptp-linux-1.10.0/pptp_compat.h
Examining data/pptp-linux-1.10.0/orckit_quirks.h
Examining data/pptp-linux-1.10.0/pqueue.c
Examining data/pptp-linux-1.10.0/pptp_gre.h
Examining data/pptp-linux-1.10.0/test-redirections.h
Examining data/pptp-linux-1.10.0/pptp_callmgr.c
Examining data/pptp-linux-1.10.0/util.c
Examining data/pptp-linux-1.10.0/vector.h
Examining data/pptp-linux-1.10.0/pptp_msg.h
Examining data/pptp-linux-1.10.0/pptp_options.h
Examining data/pptp-linux-1.10.0/test-redirections.c
Examining data/pptp-linux-1.10.0/pqueue.h
Examining data/pptp-linux-1.10.0/pptp.c
Examining data/pptp-linux-1.10.0/version.c
Examining data/pptp-linux-1.10.0/ppp_fcs.c
Examining data/pptp-linux-1.10.0/pptp_callmgr.h
Examining data/pptp-linux-1.10.0/pptp_gre.c
Examining data/pptp-linux-1.10.0/dirutil.h
Examining data/pptp-linux-1.10.0/vector_test.c
FINAL RESULTS:
data/pptp-linux-1.10.0/pptp_callmgr.c:386:5: [5] (race) chmod:
This accepts filename arguments; if an attacker can move those files, a
race condition results. (CWE-362). Use fchmod( ) instead.
chmod(where.u.sun_path, 0777);
data/pptp-linux-1.10.0/pptp.c:165:25: [4] (format) syslog:
If syslog's format strings can be influenced by an attacker, they can be
exploited (CWE-134). Use a constant format string for syslog.
#define LOG(name,value) syslog(LOG_NOTICE, name "\n", stats .value)
data/pptp-linux-1.10.0/pptp.c:613:5: [4] (shell) execvp:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
execvp(new_argv[0], new_argv);
data/pptp-linux-1.10.0/pptp_callmgr.c:413:5: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(localaddr, inet_ntoa(localbind));
data/pptp-linux-1.10.0/pptp_callmgr.c:414:5: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
snprintf(where->sun_path, sizeof(where->sun_path),
data/pptp-linux-1.10.0/pptp_compat.c:84:3: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(name,slavename);
data/pptp-linux-1.10.0/routing.c:120:7: [4] (shell) popen:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
p = popen(buf, "r");
data/pptp-linux-1.10.0/routing.c:161:7: [4] (shell) popen:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
p = popen(buf, "r");
data/pptp-linux-1.10.0/routing.c:192:7: [4] (shell) popen:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
p = popen(buf, "r");
data/pptp-linux-1.10.0/util.c:28:1: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
vsnprintf(buf, sizeof(buf), format, ap); \
data/pptp-linux-1.10.0/util.h:20:30: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
__attribute__ ((format (printf, 4, 5)));
data/pptp-linux-1.10.0/util.h:22:30: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
__attribute__ ((format (printf, 4, 5)));
data/pptp-linux-1.10.0/util.h:24:30: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
__attribute__ ((format (printf, 4, 5))) __attribute__ ((noreturn));
data/pptp-linux-1.10.0/pptp.c:231:13: [3] (buffer) getopt_long:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
c = getopt_long (argc, argv, "", long_options, &option_index);
data/pptp-linux-1.10.0/pptp_ctrl.c:343:3: [3] (random) srand:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
srand(time(NULL));
data/pptp-linux-1.10.0/vector_test.c:61:18: [3] (random) random:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
int k = (random() % MAX) + 1;
data/pptp-linux-1.10.0/orckit_quirks.c:36:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(packet, &fixed_packet, sizeof(*packet));
data/pptp-linux-1.10.0/orckit_quirks.c:56:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(packet, &fixed_packet, sizeof(*packet));
data/pptp-linux-1.10.0/orckit_quirks.c:79:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&fixed_packet.header, &packet->header, sizeof(struct pptp_header));
data/pptp-linux-1.10.0/orckit_quirks.c:82:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(packet, &fixed_packet, sizeof(*packet));
data/pptp-linux-1.10.0/pptp.c:193:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ttydev[PATH_MAX];
data/pptp-linux-1.10.0/pptp.c:198:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/pptp-linux-1.10.0/pptp.c:201:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char phonenrbuf[65]; /* maximum length of field plus one for the trailing
data/pptp-linux-1.10.0/pptp.c:272:33: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
log_level = atoi(optarg);
data/pptp-linux-1.10.0/pptp.c:278:29: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
int x = atoi(optarg);
data/pptp-linux-1.10.0/pptp.c:287:29: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
int x = atoi(optarg);
data/pptp-linux-1.10.0/pptp.c:300:19: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
test_type = atoi(optarg);
data/pptp-linux-1.10.0/pptp.c:302:19: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
test_rate = atoi(optarg);
data/pptp-linux-1.10.0/pptp.c:305:16: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
rtmark = atoi(optarg);
data/pptp-linux-1.10.0/pptp.c:314:15: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
int x = atoi(optarg);
data/pptp-linux-1.10.0/pptp.c:541:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *my_argv[3] = { argv[0], inet_ntoa(inetaddr), phonenr };
data/pptp-linux-1.10.0/pptp.c:542:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[128];
data/pptp-linux-1.10.0/pptp.c:592:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *new_argv[argc + 4];/* XXX if not using GCC, hard code a limit here. */
data/pptp-linux-1.10.0/pptp.c:601:14: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((j = open(ttydev, O_RDWR)) == -1)
data/pptp-linux-1.10.0/pptp_callmgr.c:411:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char localaddr[16];
data/pptp-linux-1.10.0/pptp_compat.c:42:24: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!noclose && (fd = open("/dev/null", O_RDWR, 0)) != -1) {
data/pptp-linux-1.10.0/pptp_compat.c:60:14: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ( (fdm = open("/dev/ptmx", O_RDWR)) == -1 )
data/pptp-linux-1.10.0/pptp_compat.c:75:14: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ( (fds = open(slavename, O_RDWR)) == -1 ) {
data/pptp-linux-1.10.0/pptp_ctrl.c:334:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd = open("/dev/random", O_RDONLY);
data/pptp-linux-1.10.0/pptp_ctrl.c:631:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(*buf, conn->read_buffer + bad_bytes, *size);
data/pptp-linux-1.10.0/pptp_ctrl.c:683:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(conn->write_buffer + conn->write_size, buffer, size);
data/pptp-linux-1.10.0/pptp_gre.c:57:10: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char dest[2 * PACKET_MAX + 2]; /* largest expansion possible */
data/pptp-linux-1.10.0/pptp_gre.c:216:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char buffer[PACKET_MAX];
data/pptp-linux-1.10.0/pptp_gre.c:220:21: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static unsigned char copy[PACKET_MAX];
data/pptp-linux-1.10.0/pptp_gre.c:343:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char buffer[PACKET_MAX + 64 /*ip header*/];
data/pptp-linux-1.10.0/pptp_gre.c:490:18: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char buffer[PACKET_MAX + sizeof(struct pptp_gre_header)];
data/pptp-linux-1.10.0/pptp_gre.c:539:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(u.buffer + header_len, pack, len);
data/pptp-linux-1.10.0/pqueue.c:123:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(newent->packet, packet, packlen);
data/pptp-linux-1.10.0/routing.c:114:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[256];
data/pptp-linux-1.10.0/routing.c:115:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tbuf[256];
data/pptp-linux-1.10.0/routing.c:157:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[256];
data/pptp-linux-1.10.0/routing.c:188:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[256];
data/pptp-linux-1.10.0/test-redirections.c:45:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(pocket_buf, buf, count);
data/pptp-linux-1.10.0/test-redirections.c:89:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(pocket_buf[n], buf, count);
data/pptp-linux-1.10.0/test-redirections.c:135:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(pocket_buf[n], buf, count);
data/pptp-linux-1.10.0/util.c:26:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[256], string[256]; \
data/pptp-linux-1.10.0/util.c:73:12: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
file = fopen(path, mode);
data/pptp-linux-1.10.0/dirutil.c:40:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int len = strlen(pathname);
data/pptp-linux-1.10.0/pptp.c:236:21: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(phonenrbuf,optarg,sizeof(phonenrbuf));
data/pptp-linux-1.10.0/pptp.c:569:10: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rc = read(sock, &m_call_id, sizeof(m_call_id));
data/pptp-linux-1.10.0/pptp.c:572:10: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rc = read(sock, &m_peer_call_id, sizeof(m_peer_call_id));
data/pptp-linux-1.10.0/pptp_callmgr.c:225:13: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
read(s, &lci->pid[0], sizeof(lci->pid[0]));
data/pptp-linux-1.10.0/pptp_callmgr.c:226:13: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
read(s, &lci->pid[1], sizeof(lci->pid[1]));
data/pptp-linux-1.10.0/pptp_ctrl.c:336:3: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
read(fd, &i, 2);
data/pptp-linux-1.10.0/pptp_ctrl.c:393:9: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy((char *)packet.phone_num, phonenr, sizeof(packet.phone_num));
data/pptp-linux-1.10.0/pptp_ctrl.c:394:28: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
packet.phone_len = strlen(phonenr);
data/pptp-linux-1.10.0/pptp_ctrl.c:583:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
retval = read(conn->inet_sock, conn->read_buffer + conn->read_size,
data/pptp-linux-1.10.0/pptp_gre.c:224:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if ((end = read (fd, buffer, sizeof(buffer))) <= 0) {
data/pptp-linux-1.10.0/pptp_gre.c:351:19: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if ((status = read (fd, buffer, sizeof(buffer))) <= 0) {
data/pptp-linux-1.10.0/routing.c:103:11: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while ( read(rts, &rtm, sizeof(struct rt_msg)) > 0 )
data/pptp-linux-1.10.0/util.c:145:3: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
read(sigpipe[0], &signum, sizeof(signum));
ANALYSIS SUMMARY:
Hits = 71
Lines analyzed = 4981 in approximately 0.17 seconds (28561 lines/second)
Physical Source Lines of Code (SLOC) = 3676
Hits@level = [0] 30 [1] 14 [2] 41 [3] 3 [4] 12 [5] 1
Hits@level+ = [0+] 101 [1+] 71 [2+] 57 [3+] 16 [4+] 13 [5+] 1
Hits/KSLOC@level+ = [0+] 27.4755 [1+] 19.3145 [2+] 15.506 [3+] 4.35256 [4+] 3.53645 [5+] 0.272035
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.