Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/ptpd-2.3.1-debian1/src/timingdomain.h
Examining data/ptpd-2.3.1-debian1/src/signaling.c
Examining data/ptpd-2.3.1-debian1/src/ptp_timers.h
Examining data/ptpd-2.3.1-debian1/src/bmc.c
Examining data/ptpd-2.3.1-debian1/src/ptpd.h
Examining data/ptpd-2.3.1-debian1/src/ptpd.c
Examining data/ptpd-2.3.1-debian1/src/arith.c
Examining data/ptpd-2.3.1-debian1/src/constants.h
Examining data/ptpd-2.3.1-debian1/src/protocol.c
Examining data/ptpd-2.3.1-debian1/src/dep/startup.c
Examining data/ptpd-2.3.1-debian1/src/dep/statistics.c
Examining data/ptpd-2.3.1-debian1/src/dep/eventtimer_itimer.c
Examining data/ptpd-2.3.1-debian1/src/dep/net.c
Examining data/ptpd-2.3.1-debian1/src/dep/daemonconfig.h
Examining data/ptpd-2.3.1-debian1/src/dep/iniparser/dictionary.h
Examining data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c
Examining data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.h
Examining data/ptpd-2.3.1-debian1/src/dep/iniparser/dictionary.c
Examining data/ptpd-2.3.1-debian1/src/dep/servo.c
Examining data/ptpd-2.3.1-debian1/src/dep/ipv4_acl.c
Examining data/ptpd-2.3.1-debian1/src/dep/datatypes_dep.h
Examining data/ptpd-2.3.1-debian1/src/dep/msg.c
Examining data/ptpd-2.3.1-debian1/src/dep/constants_dep.h
Examining data/ptpd-2.3.1-debian1/src/dep/ptpd_dep.h
Examining data/ptpd-2.3.1-debian1/src/dep/eventtimer.c
Examining data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntp_isc_md5.h
Examining data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntpdcontrol.h
Examining data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntp_isc_md5.c
Examining data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntpdcontrol.c
Examining data/ptpd-2.3.1-debian1/src/dep/outlierfilter.h
Examining data/ptpd-2.3.1-debian1/src/dep/eventtimer_posix.c
Examining data/ptpd-2.3.1-debian1/src/dep/statistics.h
Examining data/ptpd-2.3.1-debian1/src/dep/eventtimer.h
Examining data/ptpd-2.3.1-debian1/src/dep/outlierfilter.c
Examining data/ptpd-2.3.1-debian1/src/dep/snmp.c
Examining data/ptpd-2.3.1-debian1/src/dep/ipv4_acl.h
Examining data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c
Examining data/ptpd-2.3.1-debian1/src/dep/sys.c
Examining data/ptpd-2.3.1-debian1/src/ptp_timers.c
Examining data/ptpd-2.3.1-debian1/src/timingdomain.c
Examining data/ptpd-2.3.1-debian1/src/management.c
Examining data/ptpd-2.3.1-debian1/src/datatypes.h
Examining data/ptpd-2.3.1-debian1/src/display.c
FINAL RESULTS:
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:2609:6: [4] (buffer) sscanf:
The scanf() family's %s operation, without a limit specification, permits
buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
different input function.
if (sscanf(argv[i],"--%[-_a-zA-Z0-9:]=%s",key,val)==2 ||
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:2610:6: [4] (buffer) sscanf:
The scanf() family's %s operation, without a limit specification, permits
buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
different input function.
sscanf(argv[i],"-%[-_a-zA-Z0-9:]=%s",key,val)==2) {
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:2922:4: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
printf(PTPD_PROGNAME" version "USER_VERSION
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:3016:2: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
printf(
data/ptpd-2.3.1-debian1/src/dep/sys.c:351:3: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(destination,PTPD_PROGNAME"[%d].%s (%-9s ",
data/ptpd-2.3.1-debian1/src/dep/sys.c:369:12: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
written = vfprintf(destination, format, ap);
data/ptpd-2.3.1-debian1/src/dep/sys.c:953:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %s, PID %d\n","Host info", hostName, (int)getpid());
data/ptpd-2.3.1-debian1/src/dep/sys.c:954:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %s\n","Local time", timeStr);
data/ptpd-2.3.1-debian1/src/dep/sys.c:956:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %s\n","Kernel time", timeStr);
data/ptpd-2.3.1-debian1/src/dep/sys.c:957:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %s%s\n","Interface", rtOpts->ifaceName,
data/ptpd-2.3.1-debian1/src/dep/sys.c:960:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %s\n","Preset", dictionary_get(rtOpts->currentConfig, "ptpengine:preset", ""));
data/ptpd-2.3.1-debian1/src/dep/sys.c:961:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %s%s","Transport", dictionary_get(rtOpts->currentConfig, "ptpengine:transport", ""),
data/ptpd-2.3.1-debian1/src/dep/sys.c:971:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %s\n","Delay mechanism", dictionary_get(rtOpts->currentConfig, "ptpengine:delay_mechanism", ""));
data/ptpd-2.3.1-debian1/src/dep/sys.c:973:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %s\n","Sync mode", ptpClock->twoStepFlag ? "TWO_STEP" : "ONE_STEP");
data/ptpd-2.3.1-debian1/src/dep/sys.c:976:3: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %d, preferred %d\n","PTP domain",
data/ptpd-2.3.1-debian1/src/dep/sys.c:979:3: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %d, default %d\n","PTP domain", ptpClock->domainNumber, rtOpts->domainNumber);
data/ptpd-2.3.1-debian1/src/dep/sys.c:981:3: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %d\n","PTP domain", ptpClock->domainNumber);
data/ptpd-2.3.1-debian1/src/dep/sys.c:983:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %s\n","Port state", portState_getName(ptpClock->portState));
data/ptpd-2.3.1-debian1/src/dep/sys.c:988:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %s\n","Local port ID", tmpBuf);
data/ptpd-2.3.1-debian1/src/dep/sys.c:995:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %s","Best master ID", tmpBuf);
data/ptpd-2.3.1-debian1/src/dep/sys.c:1006:6: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %s\n","Best master IP", inet_ntoa(tmpAddr));
data/ptpd-2.3.1-debian1/src/dep/sys.c:1010:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" Priority1 %d, Priority2 %d, clockClass %d","GM priority",
data/ptpd-2.3.1-debian1/src/dep/sys.c:1021:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" ","Time properties");
data/ptpd-2.3.1-debian1/src/dep/sys.c:1027:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" ","UTC properties");
data/ptpd-2.3.1-debian1/src/dep/sys.c:1043:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %s s","Offset from Master", tmpBuf);
data/ptpd-2.3.1-debian1/src/dep/sys.c:1057:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %s s","Mean Path Delay", tmpBuf);
data/ptpd-2.3.1-debian1/src/dep/sys.c:1071:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %s s","Mean Path (p)Delay", tmpBuf);
data/ptpd-2.3.1-debian1/src/dep/sys.c:1075:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" ","Clock status");
data/ptpd-2.3.1-debian1/src/dep/sys.c:1102:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" % .03f ppm","Clock correction",
data/ptpd-2.3.1-debian1/src/dep/sys.c:1129:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %d","Priority1 ", ptpClock->priority1);
data/ptpd-2.3.1-debian1/src/dep/sys.c:1133:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %d","Priority2 ", ptpClock->priority2);
data/ptpd-2.3.1-debian1/src/dep/sys.c:1137:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %d","ClockClass ", ptpClock->clockQuality.clockClass);
data/ptpd-2.3.1-debian1/src/dep/sys.c:1145:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %s s","Mean Path (p)Delay", tmpBuf);
data/ptpd-2.3.1-debian1/src/dep/sys.c:1154:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" ","Message rates");
data/ptpd-2.3.1-debian1/src/dep/sys.c:1197:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" ","TimingService");
data/ptpd-2.3.1-debian1/src/dep/sys.c:1212:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" ","TimingServices");
data/ptpd-2.3.1-debian1/src/dep/sys.c:1222:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" ","Performance");
data/ptpd-2.3.1-debian1/src/dep/sys.c:1238:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %lu\n","Announce received",
data/ptpd-2.3.1-debian1/src/dep/sys.c:1240:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %lu\n","Sync received",
data/ptpd-2.3.1-debian1/src/dep/sys.c:1243:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %lu\n","Follow-up received",
data/ptpd-2.3.1-debian1/src/dep/sys.c:1246:3: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %lu\n","DelayReq sent",
data/ptpd-2.3.1-debian1/src/dep/sys.c:1248:3: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %lu\n","DelayResp received",
data/ptpd-2.3.1-debian1/src/dep/sys.c:1255:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %lu received, %lu sent \n","Announce",
data/ptpd-2.3.1-debian1/src/dep/sys.c:1258:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %lu\n","Sync sent",
data/ptpd-2.3.1-debian1/src/dep/sys.c:1261:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %lu\n","Follow-up sent",
data/ptpd-2.3.1-debian1/src/dep/sys.c:1265:3: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %lu\n","DelayReq received",
data/ptpd-2.3.1-debian1/src/dep/sys.c:1267:3: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %lu\n","DelayResp sent",
data/ptpd-2.3.1-debian1/src/dep/sys.c:1275:3: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %lu received, %lu sent\n","PdelayReq",
data/ptpd-2.3.1-debian1/src/dep/sys.c:1278:3: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %lu received, %lu sent\n","PdelayResp",
data/ptpd-2.3.1-debian1/src/dep/sys.c:1281:3: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %lu received, %lu sent\n","PdelayRespFollowUp",
data/ptpd-2.3.1-debian1/src/dep/sys.c:1288:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %lu\n","Domain Mismatches",
data/ptpd-2.3.1-debian1/src/dep/sys.c:1292:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %lu\n","Ignored Announce",
data/ptpd-2.3.1-debian1/src/dep/sys.c:1296:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %lu\n","Denied Unicast",
data/ptpd-2.3.1-debian1/src/dep/sys.c:1299:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %lu\n","State transitions",
data/ptpd-2.3.1-debian1/src/dep/sys.c:1301:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(out, STATUSPREFIX" %lu\n","PTP Engine resets",
data/ptpd-2.3.1-debian1/src/bmc.c:140:2: [3] (random) srand:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
srand((ptpClock->netPath.interfaceID[PTP_UUID_LENGTH - 1] << 8) +
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:2807:14: [3] (buffer) getopt_long:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while ((c = getopt_long(argc, argv, "?c:kb:i:d:sgmGMWyUu:nf:S:r:DvCVHhe:Y:tOLEPAaR:l:p", long_options, &opt_index)) != -1) {
data/ptpd-2.3.1-debian1/src/bmc.c:85:6: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ptpClock->clockIdentity + 3, &pid, 2);
data/ptpd-2.3.1-debian1/src/datatypes.h:1054:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char configFile[PATH_MAX];
data/ptpd-2.3.1-debian1/src/datatypes.h:1086:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char lockDirectory[PATH_MAX]; /* Directory to store lock files
data/ptpd-2.3.1-debian1/src/datatypes.h:1088:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char lockFile[PATH_MAX]; /* lock file location */
data/ptpd-2.3.1-debian1/src/datatypes.h:1089:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char driftFile[PATH_MAX]; /* drift file location */
data/ptpd-2.3.1-debian1/src/datatypes.h:1090:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char leapFile[PATH_MAX]; /* leap seconds file location */
data/ptpd-2.3.1-debian1/src/datatypes.h:1106:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char unicastDestinations[MAXHOSTNAMELEN * UNICAST_MAX_DESTINATIONS];
data/ptpd-2.3.1-debian1/src/datatypes.h:1107:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char unicastDomains[MAXHOSTNAMELEN * UNICAST_MAX_DESTINATIONS];
data/ptpd-2.3.1-debian1/src/datatypes.h:1108:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char unicastLocalPreference[MAXHOSTNAMELEN * UNICAST_MAX_DESTINATIONS];
data/ptpd-2.3.1-debian1/src/datatypes.h:1111:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char unicastPeerDestination[MAXHOSTNAMELEN];
data/ptpd-2.3.1-debian1/src/datatypes.h:1200:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char timingAclPermitText[PATH_MAX];
data/ptpd-2.3.1-debian1/src/datatypes.h:1201:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char timingAclDenyText[PATH_MAX];
data/ptpd-2.3.1-debian1/src/datatypes.h:1202:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char managementAclPermitText[PATH_MAX];
data/ptpd-2.3.1-debian1/src/datatypes.h:1203:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char managementAclDenyText[PATH_MAX];
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:409:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[50];\
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:434:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[50];\
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:455:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[50];\
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:476:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[50];\
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:496:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[50];\
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:522:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[50];\
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:543:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[50];\
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:564:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[50];\
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:682:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char sbuf[SCREEN_BUFSZ];
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:2602:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char key[PATH_MAX],val[PATH_MAX];
data/ptpd-2.3.1-debian1/src/dep/datatypes_dep.h:74:18: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char hwAddress[14];
data/ptpd-2.3.1-debian1/src/dep/datatypes_dep.h:129:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char logPath[PATH_MAX];
data/ptpd-2.3.1-debian1/src/dep/eventtimer.h:40:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char id[EVENTTIMER_MAX_DESC + 1];
data/ptpd-2.3.1-debian1/src/dep/iniparser/dictionary.c:46:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(newptr, ptr, size);
data/ptpd-2.3.1-debian1/src/dep/iniparser/dictionary.c:395:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cval[90] ;
data/ptpd-2.3.1-debian1/src/dep/iniparser/dictionary.c:404:9: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(cval, "%04d", i);
data/ptpd-2.3.1-debian1/src/dep/iniparser/dictionary.c:409:9: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(cval, "%04d", i);
data/ptpd-2.3.1-debian1/src/dep/iniparser/dictionary.c:417:9: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(cval, "%04d", i);
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:46:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char l[ASCIILINESZ+1];
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:76:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char l[ASCIILINESZ+1];
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:247:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char keym[ASCIILINESZ+1];
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:281:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char keym[ASCIILINESZ+1];
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:323:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char keym[ASCIILINESZ+1];
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:527:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char section[ASCIILINESZ+1];
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:567:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char line[ASCIILINESZ+1];
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:638:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char line [ASCIILINESZ+1] ;
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:639:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char section [ASCIILINESZ+1] ;
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:640:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char key [ASCIILINESZ+1] ;
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:641:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmp [ASCIILINESZ+1] ;
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:642:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char val [ASCIILINESZ+1] ;
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:651:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((in=fopen(ininame, "r"))==NULL) {
data/ptpd-2.3.1-debian1/src/dep/msg.c:1217:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( p->addressField, buf+4, p->addressLength);
data/ptpd-2.3.1-debian1/src/dep/msg.c:1229:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( buf+4, p->addressField, p->addressLength);
data/ptpd-2.3.1-debian1/src/dep/msg.c:1248:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( s->textField, buf+1, s->lengthField);
data/ptpd-2.3.1-debian1/src/dep/msg.c:1259:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( buf+1, s->textField, s->lengthField);
data/ptpd-2.3.1-debian1/src/dep/msg.c:1278:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( p->addressField, buf+2, p->addressLength);
data/ptpd-2.3.1-debian1/src/dep/msg.c:1289:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( buf+2, p->addressField, p->addressLength);
data/ptpd-2.3.1-debian1/src/dep/msg.c:1305:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dest, src, CLOCK_IDENTITY_LENGTH);
data/ptpd-2.3.1-debian1/src/dep/msg.c:1490:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&header->correctionField.msb, (buf + 8), 4);
data/ptpd-2.3.1-debian1/src/dep/msg.c:1491:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&header->correctionField.lsb, (buf + 12), 4);
data/ptpd-2.3.1-debian1/src/dep/msg.c:1608:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf + 61, &stepsRemoved, sizeof(UInteger16));
data/ptpd-2.3.1-debian1/src/dep/msg.c:1647:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&stepsRemoved, buf + 61, sizeof(UInteger16));
data/ptpd-2.3.1-debian1/src/dep/net.c:277:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(addr, ifa->ifa_addr, sizeof(struct sockaddr));
data/ptpd-2.3.1-debian1/src/dep/net.c:326:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(hwAddr, LLADDR(sdl),
data/ptpd-2.3.1-debian1/src/dep/net.c:384:6: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(hwAddr, ifr.ifr_hwaddr.sa_data, hwAddrSize);
data/ptpd-2.3.1-debian1/src/dep/net.c:386:10: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(hwAddr, ifr.ifr_addr.sa_data, hwAddrSize);
data/ptpd-2.3.1-debian1/src/dep/net.c:549:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char addrStr[NET_ADDRESS_LENGTH+1];
data/ptpd-2.3.1-debian1/src/dep/net.c:932:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char errbuf[PCAP_ERRBUF_SIZE];
data/ptpd-2.3.1-debian1/src/dep/net.c:950:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(netPath->etherDest.octet, ether_aton(PTP_ETHER_DST), ETHER_ADDR_LEN);
data/ptpd-2.3.1-debian1/src/dep/net.c:951:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(netPath->peerEtherDest.octet, ether_aton(PTP_ETHER_PEER), ETHER_ADDR_LEN);
data/ptpd-2.3.1-debian1/src/dep/net.c:953:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(netPath->etherDest.ether_addr_octet, ether_aton(PTP_ETHER_DST), ETHER_ADDR_LEN);
data/ptpd-2.3.1-debian1/src/dep/net.c:954:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(netPath->peerEtherDest.ether_addr_octet, ether_aton(PTP_ETHER_PEER), ETHER_ADDR_LEN);
data/ptpd-2.3.1-debian1/src/dep/net.c:998:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(netPath->interfaceID, &addr, 2);
data/ptpd-2.3.1-debian1/src/dep/net.c:999:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(netPath->interfaceID + 4, &addr + 2, 2);
data/ptpd-2.3.1-debian1/src/dep/net.c:1381:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&snmp_timer_wait, tv_ptr, sizeof(struct timeval));
data/ptpd-2.3.1-debian1/src/dep/net.c:1442:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char control[256];
data/ptpd-2.3.1-debian1/src/dep/net.c:1644:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf, pkt_data + netPath->headerOffset,
data/ptpd-2.3.1-debian1/src/dep/net.c:1739:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf, pkt_data + netPath->headerOffset,
data/ptpd-2.3.1-debian1/src/dep/net.c:1756:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ether, dst->octet, ETHER_ADDR_LEN);
data/ptpd-2.3.1-debian1/src/dep/net.c:1757:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ether + ETHER_ADDR_LEN, src->octet, ETHER_ADDR_LEN);
data/ptpd-2.3.1-debian1/src/dep/net.c:1759:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ether, dst->ether_addr_octet, ETHER_ADDR_LEN);
data/ptpd-2.3.1-debian1/src/dep/net.c:1760:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ether + ETHER_ADDR_LEN, src->ether_addr_octet, ETHER_ADDR_LEN);
data/ptpd-2.3.1-debian1/src/dep/net.c:1763:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ether + ETHER_HDR_LEN, buf, length);
data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntp_isc_md5.c:34:33: [2] (buffer) bcopy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
#define memmove(t, f, c) bcopy(f, t, (int)(c))
data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntp_isc_md5.c:35:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
#define memcpy(t, f, c) bcopy(f, t, (int)(c))
data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntp_isc_md5.c:35:33: [2] (buffer) bcopy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
#define memcpy(t, f, c) bcopy(f, t, (int)(c))
data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntp_isc_md5.c:191:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((unsigned char *)ctx->in + 64 - t, buf, len);
data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntp_isc_md5.c:195:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((unsigned char *)ctx->in + 64 - t, buf, t);
data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntp_isc_md5.c:203:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->in, buf, 64);
data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntp_isc_md5.c:211:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->in, buf, len);
data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntp_isc_md5.c:245:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(digest, ctx->buf, 16);
data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntpdcontrol.c:264:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(qpkt.data, qdata, datasize);
data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntpdcontrol.c:372:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char haveseq[MAXSEQ+1];
data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntpdcontrol.c:615:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(datap, tmp_data, (unsigned)size);
data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntpdcontrol.c:656:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char junk[512];
data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntpdcontrol.h:20:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char key[20];
data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntpdcontrol.h:114:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char data[128 + 48]; /* data area [32 prev](176 byte max) */
data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntpdcontrol.h:118:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char mac[MAX_MAC_LEN-sizeof(keyid_t)]; /* (optional) auth code */
data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntpdcontrol.h:128:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char mac[MAX_MAC_LEN-sizeof(keyid_t)]; /* (optional) auth code */
data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntpdcontrol.h:154:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char data[RESP_DATA_SIZE]; /* data area */
data/ptpd-2.3.1-debian1/src/dep/outlierfilter.h:89:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char id [OUTLIERFILTER_MAX_DESC + 1];
data/ptpd-2.3.1-debian1/src/dep/snmp.c:146:17: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(name, vp->name, sizeof(oid) * vp->namelen);
data/ptpd-2.3.1-debian1/src/dep/snmp.c:183:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(idx->best, index, sizeof(oid) * len);
data/ptpd-2.3.1-debian1/src/dep/snmp.c:196:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(idx->best, index, sizeof(oid) * len);
data/ptpd-2.3.1-debian1/src/dep/snmp.c:214:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(idx->name + idx->vp->namelen,
data/ptpd-2.3.1-debian1/src/dep/startup.c:565:26: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ( (G_lockFilePointer=fopen(rtOpts->lockFile, "w+")) == NULL) {
data/ptpd-2.3.1-debian1/src/dep/startup.c:681:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char sbuf[1000];
data/ptpd-2.3.1-debian1/src/dep/startup.c:876:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ptpClock->user_description, &USER_DESCRIPTION, sizeof(USER_DESCRIPTION));
data/ptpd-2.3.1-debian1/src/dep/statistics.c:557:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sortedSamples, container->meanContainer->samples, count * sizeof(sample));
data/ptpd-2.3.1-debian1/src/dep/statistics.c:578:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sortedSamples, container->meanContainer->samples, count * sizeof(sample));
data/ptpd-2.3.1-debian1/src/dep/statistics.c:589:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sortedSamples, container->meanContainer->samples, count * sizeof(sample));
data/ptpd-2.3.1-debian1/src/dep/statistics.c:600:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sortedSamples, container->meanContainer->samples, count * sizeof(sample));
data/ptpd-2.3.1-debian1/src/dep/statistics.c:611:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sortedSamples, container->meanContainer->samples, count * sizeof(sample));
data/ptpd-2.3.1-debian1/src/dep/statistics.c:719:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sortedSamples, container->meanContainer->samples, count * sizeof(sample));
data/ptpd-2.3.1-debian1/src/dep/statistics.c:740:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sortedSamples, container->meanContainer->samples, count * sizeof(sample));
data/ptpd-2.3.1-debian1/src/dep/statistics.c:751:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sortedSamples, container->meanContainer->samples, count * sizeof(sample));
data/ptpd-2.3.1-debian1/src/dep/statistics.c:762:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sortedSamples, container->meanContainer->samples, count * sizeof(sample));
data/ptpd-2.3.1-debian1/src/dep/statistics.c:773:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sortedSamples, container->meanContainer->samples, count * sizeof(sample));
data/ptpd-2.3.1-debian1/src/dep/statistics.h:102:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char identifier[10];
data/ptpd-2.3.1-debian1/src/dep/statistics.h:111:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char identifier[10];
data/ptpd-2.3.1-debian1/src/dep/statistics.h:123:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char identifier[10];
data/ptpd-2.3.1-debian1/src/dep/sys.c:83:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char buf[100];
data/ptpd-2.3.1-debian1/src/dep/sys.c:96:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char buf[BUF_SIZE];
data/ptpd-2.3.1-debian1/src/dep/sys.c:143:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char buf[1000];
data/ptpd-2.3.1-debian1/src/dep/sys.c:239:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char buf[BUF_SIZE];
data/ptpd-2.3.1-debian1/src/dep/sys.c:277:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[100];
data/ptpd-2.3.1-debian1/src/dep/sys.c:325:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char time_str[MAXTIMESTR];
data/ptpd-2.3.1-debian1/src/dep/sys.c:491:32: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ( (handler->logFP = fopen(handler->logPath, handler->openMode)) == NULL) {
data/ptpd-2.3.1-debian1/src/dep/sys.c:543:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char fname[PATH_MAX];
data/ptpd-2.3.1-debian1/src/dep/sys.c:623:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char sbuf[SCREEN_BUFSZ];
data/ptpd-2.3.1-debian1/src/dep/sys.c:629:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char time_str[MAXTIMESTR];
data/ptpd-2.3.1-debian1/src/dep/sys.c:821:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmpBuf[200];
data/ptpd-2.3.1-debian1/src/dep/sys.c:822:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char masterIdBuf[150];
data/ptpd-2.3.1-debian1/src/dep/sys.c:833:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char strAddr[MAXHOSTNAMELEN];
data/ptpd-2.3.1-debian1/src/dep/sys.c:896:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char sbuf[SCREEN_BUFSZ];
data/ptpd-2.3.1-debian1/src/dep/sys.c:897:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char strAddr[MAXHOSTNAMELEN];
data/ptpd-2.3.1-debian1/src/dep/sys.c:928:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char outBuf[2048];
data/ptpd-2.3.1-debian1/src/dep/sys.c:929:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmpBuf[200];
data/ptpd-2.3.1-debian1/src/dep/sys.c:934:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char timeStr[MAXTIMESTR];
data/ptpd-2.3.1-debian1/src/dep/sys.c:935:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char hostName[MAXHOSTNAMELEN];
data/ptpd-2.3.1-debian1/src/dep/sys.c:1311:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char sbuf[SCREEN_BUFSZ];
data/ptpd-2.3.1-debian1/src/dep/sys.c:1433:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char timeStr[MAXTIMESTR];
data/ptpd-2.3.1-debian1/src/dep/sys.c:1486:14: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if((rtcFd = open(rtcDev, O_RDONLY)) < 0) {
data/ptpd-2.3.1-debian1/src/dep/sys.c:1568:22: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if((fileHandle = fopen(fileName,"w+")) == NULL) {
data/ptpd-2.3.1-debian1/src/dep/sys.c:1592:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char searchPattern[PATH_MAX];
data/ptpd-2.3.1-debian1/src/dep/sys.c:2066:19: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if( (driftFP = fopen(rtOpts->driftFile,"r")) == NULL) {
data/ptpd-2.3.1-debian1/src/dep/sys.c:2171:17: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if( (driftFP = fopen(rtOpts->driftFile,"w")) == NULL) {
data/ptpd-2.3.1-debian1/src/dep/sys.c:2195:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char lineBuf[PATH_MAX];
data/ptpd-2.3.1-debian1/src/dep/sys.c:2207:19: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if( (leapFP = fopen(path,"r")) == NULL) {
data/ptpd-2.3.1-debian1/src/management.c:140:17: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data->physicalLayerProtocol.textField,
data/ptpd-2.3.1-debian1/src/management.c:146:17: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data->physicalAddress.addressField,
data/ptpd-2.3.1-debian1/src/management.c:154:17: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data->protocolAddress.addressField,
data/ptpd-2.3.1-debian1/src/management.c:167:17: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data->productDescription.textField,
data/ptpd-2.3.1-debian1/src/management.c:174:17: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data->revisionData.textField,
data/ptpd-2.3.1-debian1/src/management.c:181:17: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data->userDescription.textField,
data/ptpd-2.3.1-debian1/src/management.c:260:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ptpClock->user_description, data->userDescription.textField,
data/ptpd-2.3.1-debian1/src/management.c:278:17: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data->userDescription.textField,
data/ptpd-2.3.1-debian1/src/protocol.c:638:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char filterMask[200];
data/ptpd-2.3.1-debian1/src/protocol.c:1507:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&ptpClock->foreign[ptpClock->foreign_record_best].header,
data/ptpd-2.3.1-debian1/src/protocol.c:1509:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&ptpClock->foreign[ptpClock->foreign_record_best].announce,
data/ptpd-2.3.1-debian1/src/signaling.c:240:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char portId[PATH_MAX];
data/ptpd-2.3.1-debian1/src/signaling.c:378:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char portId[PATH_MAX];
data/ptpd-2.3.1-debian1/src/signaling.c:456:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char portId[PATH_MAX];
data/ptpd-2.3.1-debian1/src/signaling.c:534:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char portId[PATH_MAX];
data/ptpd-2.3.1-debian1/src/timingdomain.h:68:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char id[TIMINGSERVICE_MAX_DESC+1]; /* description like PTP-eth0 */
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:361:28: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
if (variable!=tmpstring) strncpy(variable,tmpstring,sizeof(variable) / sizeof(char));\
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:782:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(helptext);
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:892:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(rtOpts->lockDirectory, DEFAULT_LOCKDIR, PATH_MAX);
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:893:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(rtOpts->driftFile, DEFAULT_DRIFTFILE, PATH_MAX);
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:1019:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120). Risk is low because the source is a
constant string.
strncpy(rtOpts->ntpOptions.hostAddress,"localhost",MAXHOSTNAMELEN); /* not configurable, but could be */
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:1058:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(rtOpts->statusLog.logPath, DEFAULT_STATUSFILE, PATH_MAX);
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:2606:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if( strlen(argv[i]) > 3 &&
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:2624:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
( (strlen(argv[i+i]) > 1) && argv[i+1][1] !='-' )) {
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:2625:4: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(val,argv[i+1],PATH_MAX);
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:2640:5: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(strlen(key) > 0) {
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:2826:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(strlen(optarg) > 0)
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:2836:4: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(rtOpts->configFile, optarg, PATH_MAX);
data/ptpd-2.3.1-debian1/src/dep/daemonconfig.c:2847:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if( (c=='i') && strlen(optarg) > 0 && isdigit((unsigned char)optarg[0]) ) {
data/ptpd-2.3.1-debian1/src/dep/eventtimer.c:57:9: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(timer->id, id, EVENTTIMER_MAX_DESC);
data/ptpd-2.3.1-debian1/src/dep/iniparser/dictionary.c:66:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
t = (char*)calloc(strlen(s)+1,sizeof(char)) ;
data/ptpd-2.3.1-debian1/src/dep/iniparser/dictionary.c:68:9: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(t,s,strlen(s));
data/ptpd-2.3.1-debian1/src/dep/iniparser/dictionary.c:68:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strncpy(t,s,strlen(s));
data/ptpd-2.3.1-debian1/src/dep/iniparser/dictionary.c:94:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(key);
data/ptpd-2.3.1-debian1/src/dep/iniparser/dictionary.c:370:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if((source->val[i] == NULL) || (strlen(source->val[i])==0))
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:83:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(l, s, ASCIILINESZ);
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:84:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
last = l + strlen(l);
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:253:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
seclen = (int)strlen(s);
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:289:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
seclen = (int)strlen(s);
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:335:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
seclen = (int)strlen(s);
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:570:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(line, strstrip(input_line), ASCIILINESZ);
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:571:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = (int)strlen(line);
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:583:9: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(section, strstrip(section), ASCIILINESZ);
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:584:9: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(section, strlwc(section), ASCIILINESZ);
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:590:9: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(key, strstrip(key), ASCIILINESZ);
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:591:9: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(key, strlwc(key), ASCIILINESZ);
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:592:9: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(value, strstrip(value), ASCIILINESZ);
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:609:9: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(key, strstrip(key), ASCIILINESZ);
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:610:9: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(key, strlwc(key), ASCIILINESZ);
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:671:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = (int)strlen(line)-1;
data/ptpd-2.3.1-debian1/src/dep/iniparser/iniparser.c:708:59: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
snprintf(tmp, ASCIILINESZ, "%s%s%s", section, strlen(section)==0?"":":", key);
data/ptpd-2.3.1-debian1/src/dep/ipv4_acl.c:223:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(strlen(input)==0) return 0;
data/ptpd-2.3.1-debian1/src/dep/net.c:190:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(!strlen(ifaceName)) {
data/ptpd-2.3.1-debian1/src/dep/net.c:226:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(!strlen(ifaceName)) {
data/ptpd-2.3.1-debian1/src/dep/net.c:304:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(!strlen(ifaceName))
data/ptpd-2.3.1-debian1/src/dep/net.c:363:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(ifr.ifr_name, ifaceName, IFACE_NAME_LENGTH);
data/ptpd-2.3.1-debian1/src/dep/net.c:556:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(addrStr, DEFAULT_PTP_DOMAIN_ADDRESS, NET_ADDRESS_LENGTH);
data/ptpd-2.3.1-debian1/src/dep/net.c:574:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(addrStr, PEER_PTP_DOMAIN_ADDRESS, NET_ADDRESS_LENGTH);
data/ptpd-2.3.1-debian1/src/dep/net.c:662:6: [1] (obsolete) usleep:
This C routine is considered obsolete (as opposed to the shell command by
the same name). The interaction of this function with SIGALRM and other
timer functions such as sleep(), alarm(), setitimer(), and nanosleep() is
unspecified (CWE-676). Use nanosleep(2) or setitimer(2) instead.
usleep(10);
data/ptpd-2.3.1-debian1/src/dep/net.c:666:2: [1] (obsolete) usleep:
This C routine is considered obsolete (as opposed to the shell command by
the same name). The interaction of this function with SIGALRM and other
timer functions such as sleep(), alarm(), setitimer(), and nanosleep() is
unspecified (CWE-676). Use nanosleep(2) or setitimer(2) instead.
usleep(LATE_TXTIMESTAMP_US);
data/ptpd-2.3.1-debian1/src/dep/net.c:724:9: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy( ifRequest.ifr_name, rtOpts->ifaceName, IFNAMSIZ - 1);
data/ptpd-2.3.1-debian1/src/dep/net.c:843:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(strlen(rtOpts->unicastDestinations)==0) return 0;
data/ptpd-2.3.1-debian1/src/dep/net.c:1199:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
rtOpts->ifaceName, strlen(rtOpts->ifaceName)) < 0
data/ptpd-2.3.1-debian1/src/dep/net.c:1201:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
rtOpts->ifaceName, strlen(rtOpts->ifaceName)) < 0){
data/ptpd-2.3.1-debian1/src/dep/net.c:2179:2: [1] (obsolete) usleep:
This C routine is considered obsolete (as opposed to the shell command by
the same name). The interaction of this function with SIGALRM and other
timer functions such as sleep(), alarm(), setitimer(), and nanosleep() is
unspecified (CWE-676). Use nanosleep(2) or setitimer(2) instead.
usleep(100*1000);
data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntp_isc_md5.c:268:47: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
EVP_DigestUpdate(&ctx, (u_char *)key, (u_int)strlen(key));
data/ptpd-2.3.1-debian1/src/dep/ntpengine/ntpdcontrol.c:256:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(key,options->key,20);
data/ptpd-2.3.1-debian1/src/dep/outlierfilter.c:84:17: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(filter->id, id, OUTLIERFILTER_MAX_DESC);
data/ptpd-2.3.1-debian1/src/dep/outlierfilter.c:85:17: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(filter->rawStats->identifier, id, 10);
data/ptpd-2.3.1-debian1/src/dep/snmp.c:456:10: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(snmpPtpClock->user_description));
data/ptpd-2.3.1-debian1/src/dep/snmp.c:689:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (msg) msg[strlen(msg)-1] = '\0';
data/ptpd-2.3.1-debian1/src/dep/startup.c:161:5: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(strlen(rtOpts->configFile) == 0)
data/ptpd-2.3.1-debian1/src/dep/startup.c:709:2: [1] (access) umask:
Ensure that umask is given most restrictive possible setting (e.g., 066 or
077) (CWE-732).
umask(~DEFAULT_FILE_PERMS);
data/ptpd-2.3.1-debian1/src/dep/startup.c:756:5: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(strlen(rtOpts->configFile) > 0) {
data/ptpd-2.3.1-debian1/src/dep/startup.c:910:4: [1] (obsolete) usleep:
This C routine is considered obsolete (as opposed to the shell command by
the same name). The interaction of this function with SIGALRM and other
timer functions such as sleep(), alarm(), setitimer(), and nanosleep() is
unspecified (CWE-676). Use nanosleep(2) or setitimer(2) instead.
usleep(1);
data/ptpd-2.3.1-debian1/src/dep/startup.c:1033:6: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120). Risk is low because the source is a
constant string.
strncpy(ts->id, "NTP0", TIMINGSERVICE_MAX_DESC);
data/ptpd-2.3.1-debian1/src/dep/statistics.c:496:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(container->identifier, id, 10);
data/ptpd-2.3.1-debian1/src/dep/statistics.c:655:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(container->identifier, id, 10);
data/ptpd-2.3.1-debian1/src/dep/sys.c:266:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(hostname, buf, 100);
data/ptpd-2.3.1-debian1/src/dep/sys.c:2296:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120). Risk is low because the source is a
constant string.
strncpy(utx.ut_user, "date", sizeof(utx.ut_user));
data/ptpd-2.3.1-debian1/src/dep/sys.c:2298:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120). Risk is low because the source is a
constant character.
strncpy(utx.ut_line, "|", sizeof(utx.ut_line));
data/ptpd-2.3.1-debian1/src/dep/sys.c:2300:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(utx.ut_line, OTIME_MSG, sizeof(utx.ut_line));
data/ptpd-2.3.1-debian1/src/dep/sys.c:2327:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120). Risk is low because the source is a
constant string.
strncpy(ut.ut_name, "date", sizeof(ut.ut_name));
data/ptpd-2.3.1-debian1/src/dep/sys.c:2329:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120). Risk is low because the source is a
constant character.
strncpy(ut.ut_line, "|", sizeof(ut.ut_line));
data/ptpd-2.3.1-debian1/src/dep/sys.c:2331:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(ut.ut_line, OTIME_MSG, sizeof(ut.ut_line));
data/ptpd-2.3.1-debian1/src/dep/sys.c:2376:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120). Risk is low because the source is a
constant string.
strncpy(utx.ut_user, "date", sizeof(utx.ut_user));
data/ptpd-2.3.1-debian1/src/dep/sys.c:2378:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120). Risk is low because the source is a
constant character.
strncpy(utx.ut_line, "{", sizeof(utx.ut_line));
data/ptpd-2.3.1-debian1/src/dep/sys.c:2380:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(utx.ut_line, NTIME_MSG, sizeof(utx.ut_line));
data/ptpd-2.3.1-debian1/src/dep/sys.c:2406:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120). Risk is low because the source is a
constant string.
strncpy(ut.ut_name, "date", sizeof(ut.ut_name));
data/ptpd-2.3.1-debian1/src/dep/sys.c:2408:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120). Risk is low because the source is a
constant character.
strncpy(ut.ut_line, "{", sizeof(ut.ut_line));
data/ptpd-2.3.1-debian1/src/dep/sys.c:2410:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(ut.ut_line, NTIME_MSG, sizeof(ut.ut_line));
data/ptpd-2.3.1-debian1/src/management.c:178:53: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
data->userDescription.lengthField = strlen(ptpClock->user_description);
data/ptpd-2.3.1-debian1/src/management.c:275:53: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
data->userDescription.lengthField = strlen(ptpClock->user_description);
data/ptpd-2.3.1-debian1/src/protocol.c:233:9: [1] (obsolete) usleep:
This C routine is considered obsolete (as opposed to the shell command by
the same name). The interaction of this function with SIGALRM and other
timer functions such as sleep(), alarm(), setitimer(), and nanosleep() is
unspecified (CWE-676). Use nanosleep(2) or setitimer(2) instead.
usleep(10000);
data/ptpd-2.3.1-debian1/src/protocol.c:661:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(filterMask,FILTER_MASK,199);
data/ptpd-2.3.1-debian1/src/ptpd.c:105:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120). Risk is low because the source is a
constant string.
strncpy(ts->id, "PTP0", TIMINGSERVICE_MAX_DESC);
data/ptpd-2.3.1-debian1/src/signaling.c:929:6: [1] (obsolete) usleep:
This C routine is considered obsolete (as opposed to the shell command by
the same name). The interaction of this function with SIGALRM and other
timer functions such as sleep(), alarm(), setitimer(), and nanosleep() is
unspecified (CWE-676). Use nanosleep(2) or setitimer(2) instead.
usleep(250+round(getRand()*250));
ANALYSIS SUMMARY:
Hits = 297
Lines analyzed = 32786 in approximately 0.88 seconds (37413 lines/second)
Physical Source Lines of Code (SLOC) = 22017
Hits@level = [0] 282 [1] 81 [2] 159 [3] 2 [4] 55 [5] 0
Hits@level+ = [0+] 579 [1+] 297 [2+] 216 [3+] 57 [4+] 55 [5+] 0
Hits/KSLOC@level+ = [0+] 26.2979 [1+] 13.4896 [2+] 9.8106 [3+] 2.58891 [4+] 2.49807 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.