Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/prosody-0.11.7/util-src/compat.c Examining data/prosody-0.11.7/util-src/encodings.c Examining data/prosody-0.11.7/util-src/net.c Examining data/prosody-0.11.7/util-src/poll.c Examining data/prosody-0.11.7/util-src/table.c Examining data/prosody-0.11.7/util-src/signal.c Examining data/prosody-0.11.7/util-src/windows.c Examining data/prosody-0.11.7/util-src/time.c Examining data/prosody-0.11.7/util-src/ringbuffer.c Examining data/prosody-0.11.7/util-src/pposix.c Examining data/prosody-0.11.7/util-src/hashes.c Examining data/prosody-0.11.7/util-src/crand.c FINAL RESULTS: data/prosody-0.11.7/util-src/encodings.c:378:2: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(string, s); data/prosody-0.11.7/util-src/crand.c:62:38: [3] (random) random: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. #error util.crand compiled without a random source data/prosody-0.11.7/util-src/crand.c:70:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char smallbuf[SMALLBUFSIZ]; data/prosody-0.11.7/util-src/encodings.c:36:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char s[4]; data/prosody-0.11.7/util-src/encodings.c:77:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char s[3]; data/prosody-0.11.7/util-src/encodings.c:100:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char t[4]; data/prosody-0.11.7/util-src/encodings.c:276:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char output[1024]; data/prosody-0.11.7/util-src/encodings.c:363:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char string[1024]; data/prosody-0.11.7/util-src/encodings.c:419:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char output[1024]; data/prosody-0.11.7/util-src/encodings.c:453:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char output[1024]; data/prosody-0.11.7/util-src/hashes.c:52:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char hash[size], result[size*2]; \ data/prosody-0.11.7/util-src/hashes.c:81:12: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char bytes[64]; data/prosody-0.11.7/util-src/hashes.c:86:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char hashedKey[64]; /* Maximum used digest length */ data/prosody-0.11.7/util-src/hashes.c:97:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(k_ipad.bytes, key, key_len); data/prosody-0.11.7/util-src/hashes.c:99:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(k_opad.bytes, k_ipad.bytes, 64); data/prosody-0.11.7/util-src/hashes.c:118:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char hash[size], result[2*size]; \ data/prosody-0.11.7/util-src/hashes.c:141:12: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char bytes[SHA_DIGEST_LENGTH]; data/prosody-0.11.7/util-src/hashes.c:146:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char Ust[SHA_DIGEST_LENGTH]; data/prosody-0.11.7/util-src/hashes.c:169:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(salt2, salt, salt_len); data/prosody-0.11.7/util-src/hashes.c:170:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(salt2 + salt_len, "\0\0\0\1", 4); data/prosody-0.11.7/util-src/hashes.c:174:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(res.bytes, Ust, sizeof(res)); data/prosody-0.11.7/util-src/net.c:75:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char ipaddr[INET6_ADDRSTRLEN]; data/prosody-0.11.7/util-src/net.c:132:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[16]; data/prosody-0.11.7/util-src/net.c:160:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[INET6_ADDRSTRLEN]; data/prosody-0.11.7/util-src/poll.c:303:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&state->readable, &state->wantread, sizeof(fd_set)); data/prosody-0.11.7/util-src/poll.c:304:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&state->writable, &state->wantwrite, sizeof(fd_set)); data/prosody-0.11.7/util-src/poll.c:305:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&state->err, &state->all, sizeof(fd_set)); data/prosody-0.11.7/util-src/pposix.c:468:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char old_mode_string[7]; data/prosody-0.11.7/util-src/windows.c:27:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char stack_buffer[1024]; // stack allocated buffer data/prosody-0.11.7/util-src/windows.c:40:4: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char ip_str[16] = ""; data/prosody-0.11.7/util-src/encodings.c:373:40: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if(s == NULL || len >= 1024 || len != strlen(s)) { data/prosody-0.11.7/util-src/encodings.c:492:25: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if(s == NULL || len != strlen(s)) { data/prosody-0.11.7/util-src/pposix.c:469:20: [1] (access) umask: Ensure that umask is given most restrictive possible setting (e.g., 066 or 077) (CWE-732). mode_t old_mode = umask(strtoul(luaL_checkstring(L, 1), NULL, 8)); ANALYSIS SUMMARY: Hits = 33 Lines analyzed = 3349 in approximately 0.10 seconds (32506 lines/second) Physical Source Lines of Code (SLOC) = 2421 Hits@level = [0] 4 [1] 3 [2] 28 [3] 1 [4] 1 [5] 0 Hits@level+ = [0+] 37 [1+] 33 [2+] 30 [3+] 2 [4+] 1 [5+] 0 Hits/KSLOC@level+ = [0+] 15.2829 [1+] 13.6307 [2+] 12.3916 [3+] 0.826105 [4+] 0.413052 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.