Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/python-gsd-2.3.0/gsd/gsd.h Examining data/python-gsd-2.3.0/gsd/gsd.c Examining data/python-gsd-2.3.0/scripts/benchmark-read.cc Examining data/python-gsd-2.3.0/scripts/benchmark-write.cc FINAL RESULTS: data/python-gsd-2.3.0/gsd/gsd.c:87:9: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). #define open _open data/python-gsd-2.3.0/gsd/gsd.c:335:9: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(map->v[hash].name, str, strlen(str) + 1); data/python-gsd-2.3.0/gsd/gsd.c:361:9: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(insert_point->next->name, str, strlen(str) + 1); data/python-gsd-2.3.0/gsd/gsd.c:522:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(buf->data + buf->size, data, size); data/python-gsd-2.3.0/gsd/gsd.c:1284:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char name_v1[GSD_NAME_SIZE]; data/python-gsd-2.3.0/gsd/gsd.c:1373:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char names[GSD_INITIAL_NAME_BUFFER_SIZE]; data/python-gsd-2.3.0/gsd/gsd.c:1579:14: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). int fd = open(fname, data/python-gsd-2.3.0/gsd/gsd.c:1624:18: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). handle->fd = open(fname, data/python-gsd-2.3.0/gsd/gsd.c:1655:22: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). handle->fd = open(fname, O_RDWR | extra_flags); data/python-gsd-2.3.0/gsd/gsd.c:1660:22: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). handle->fd = open(fname, O_RDONLY | extra_flags); data/python-gsd-2.3.0/gsd/gsd.c:1665:22: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). handle->fd = open(fname, O_RDWR | extra_flags); data/python-gsd-2.3.0/gsd/gsd.c:1901:9: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(handle->file_index.data + handle->file_index.size, data/python-gsd-2.3.0/gsd/gsd.c:2327:13: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(buf.data, data/python-gsd-2.3.0/gsd/gsd.c:2464:8: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). #undef open data/python-gsd-2.3.0/gsd/gsd.h:151:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char application[GSD_NAME_SIZE]; data/python-gsd-2.3.0/gsd/gsd.h:154:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char schema[GSD_NAME_SIZE]; data/python-gsd-2.3.0/gsd/gsd.h:157:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char reserved[GSD_RESERVED_BYTES]; data/python-gsd-2.3.0/gsd/gsd.c:330:36: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). map->v[hash].name = calloc(strlen(str) + 1, sizeof(char)); data/python-gsd-2.3.0/gsd/gsd.c:335:40: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). memcpy(map->v[hash].name, str, strlen(str) + 1); data/python-gsd-2.3.0/gsd/gsd.c:356:43: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). insert_point->next->name = calloc(strlen(str) + 1, sizeof(char)); data/python-gsd-2.3.0/gsd/gsd.c:361:47: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). memcpy(insert_point->next->name, str, strlen(str) + 1); data/python-gsd-2.3.0/gsd/gsd.c:1285:9: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(name_v1, name, GSD_NAME_SIZE - 1); data/python-gsd-2.3.0/gsd/gsd.c:1299:65: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). gsd_byte_buffer_append(&handle->frame_names.data, name, strlen(name) + 1); data/python-gsd-2.3.0/gsd/gsd.c:1342:5: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(header.application, application, sizeof(header.application) - 1); data/python-gsd-2.3.0/gsd/gsd.c:1344:5: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(header.schema, schema, sizeof(header.schema) - 1); data/python-gsd-2.3.0/gsd/gsd.c:2273:33: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). search_str = prev + strlen(prev) + 1; data/python-gsd-2.3.0/gsd/gsd.c:2277:24: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). size_t match_len = strlen(match); data/python-gsd-2.3.0/gsd/gsd.c:2292:27: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). search_str += strlen(search_str) + 1; data/python-gsd-2.3.0/gsd/gsd.c:2379:70: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). retval = gsd_byte_buffer_append(&new_name_buf, name, strlen(name) + 1); data/python-gsd-2.3.0/gsd/gsd.c:2463:8: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). #undef read ANALYSIS SUMMARY: Hits = 30 Lines analyzed = 3195 in approximately 0.07 seconds (45429 lines/second) Physical Source Lines of Code (SLOC) = 1990 Hits@level = [0] 0 [1] 13 [2] 17 [3] 0 [4] 0 [5] 0 Hits@level+ = [0+] 30 [1+] 30 [2+] 17 [3+] 0 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 15.0754 [1+] 15.0754 [2+] 8.54271 [3+] 0 [4+] 0 [5+] 0 Dot directories skipped = 4 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.