Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/qthid-fcd-controller-4.1/hidraw.c
Examining data/qthid-fcd-controller-4.1/firmware.cpp
Examining data/qthid-fcd-controller-4.1/fcd.h
Examining data/qthid-fcd-controller-4.1/hidmac.c
Examining data/qthid-fcd-controller-4.1/hidwin.c
Examining data/qthid-fcd-controller-4.1/mainwindow.h
Examining data/qthid-fcd-controller-4.1/firmware.h
Examining data/qthid-fcd-controller-4.1/fcdhidcmd.h
Examining data/qthid-fcd-controller-4.1/v2/mainwindow.h
Examining data/qthid-fcd-controller-4.1/v2/hidwin.cpp
Examining data/qthid-fcd-controller-4.1/v2/hidmac.c
Examining data/qthid-fcd-controller-4.1/v2/fcd.h
Examining data/qthid-fcd-controller-4.1/v2/hid-libusb.c
Examining data/qthid-fcd-controller-4.1/v2/main.cpp
Examining data/qthid-fcd-controller-4.1/v2/fcd.c
Examining data/qthid-fcd-controller-4.1/v2/mainwindow.cpp
Examining data/qthid-fcd-controller-4.1/hid-libusb.c
Examining data/qthid-fcd-controller-4.1/freqctrl.h
Examining data/qthid-fcd-controller-4.1/main.cpp
Examining data/qthid-fcd-controller-4.1/freqctrl.cpp
Examining data/qthid-fcd-controller-4.1/fcd.c
Examining data/qthid-fcd-controller-4.1/mainwindow.cpp
FINAL RESULTS:
data/qthid-fcd-controller-4.1/hid-libusb.c:57:18: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
#define LOG(...) fprintf(stderr, __VA_ARGS__)
data/qthid-fcd-controller-4.1/hidmac.c:315:2: [4] (buffer) wcscpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using a function version that stops copying at the end
of the buffer.
wcscpy(ret, s);
data/qthid-fcd-controller-4.1/v2/hid-libusb.c:53:18: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
#define LOG(...) fprintf(stderr, __VA_ARGS__)
data/qthid-fcd-controller-4.1/v2/hidmac.c:250:2: [4] (buffer) wcscpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using a function version that stops copying at the end
of the buffer.
wcscpy(ret, s);
data/qthid-fcd-controller-4.1/fcd.c:102:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/fcd.c:103:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/fcd.c:153:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/fcd.c:154:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/fcd.c:207:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/fcd.c:265:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/fcd.c:266:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/fcd.c:311:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/fcd.c:312:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/fcd.c:364:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/fcd.c:365:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/fcd.c:410:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/fcd.c:411:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/fcd.c:440:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/fcd.c:441:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/fcd.c:480:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/fcd.c:481:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/fcd.c:514:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/fcd.c:515:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/fcd.c:550:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/fcd.c:551:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/fcd.c:580:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/fcd.c:581:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/fcd.c:617:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/fcd.c:618:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/fcd.c:651:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/fcd.c:652:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/fcd.c:691:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/fcd.c:692:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/fcd.c:725:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/fcd.c:726:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/fcd.c:762:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/fcd.c:763:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/fcd.c:792:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/fcd.c:793:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/firmware.cpp:97:13: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!qf.open(QIODevice::ReadOnly))
data/qthid-fcd-controller-4.1/firmware.cpp:171:13: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!qf.open(QIODevice::ReadOnly))
data/qthid-fcd-controller-4.1/hid-libusb.c:325:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[512];
data/qthid-fcd-controller-4.1/hid-libusb.c:328:2: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t wbuf[256];
data/qthid-fcd-controller-4.1/hid-libusb.c:414:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[64];
data/qthid-fcd-controller-4.1/hid-libusb.c:546:18: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char data[256];
data/qthid-fcd-controller-4.1/hid-libusb.c:674:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(rpt->data, transfer->buffer, transfer->actual_length);
data/qthid-fcd-controller-4.1/hid-libusb.c:992:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, rpt->data, len);
data/qthid-fcd-controller-4.1/hid-libusb.c:1382:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char search_string[64];
data/qthid-fcd-controller-4.1/hidmac.c:325:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char transport[32];
data/qthid-fcd-controller-4.1/hidmac.c:420:3: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t buf[BUF_LEN];
data/qthid-fcd-controller-4.1/hidmac.c:421:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cbuf[BUF_LEN];
data/qthid-fcd-controller-4.1/hidmac.c:558:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(rpt->data, report, report_length);
data/qthid-fcd-controller-4.1/hidmac.c:689:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cbuf[BUF_LEN];
data/qthid-fcd-controller-4.1/hidmac.c:698:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[32];
data/qthid-fcd-controller-4.1/hidmac.c:711:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(str, "HIDAPI_%p", os_dev);
data/qthid-fcd-controller-4.1/hidmac.c:793:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, rpt->data, len);
data/qthid-fcd-controller-4.1/hidmac.c:1084:3: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t serial[256], buf[256];
data/qthid-fcd-controller-4.1/hidmac.c:1085:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cbuf[256];
data/qthid-fcd-controller-4.1/hidraw.c:619:23: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
dev->device_handle = open(path, O_RDWR);
data/qthid-fcd-controller-4.1/hidwin.c:332:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char driver_name[256];
data/qthid-fcd-controller-4.1/hidwin.c:384:4: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t wstr[WSTR_LEN]; // TODO: Determine Size
data/qthid-fcd-controller-4.1/hidwin.c:611:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf, data, length);
data/qthid-fcd-controller-4.1/hidwin.c:698:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, dev->read_buf+1, copy_len);
data/qthid-fcd-controller-4.1/hidwin.c:703:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, dev->read_buf, copy_len);
data/qthid-fcd-controller-4.1/hidwin.c:876:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char buf[65];
data/qthid-fcd-controller-4.1/hidwin.c:888:15: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
int handle = open(VendorID, ProductID, L"12345");
data/qthid-fcd-controller-4.1/mainwindow.cpp:260:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char fwVerStr[6];
data/qthid-fcd-controller-4.1/v2/fcd.c:90:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/v2/fcd.c:91:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/v2/fcd.c:155:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/v2/fcd.c:156:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/v2/fcd.c:203:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/v2/fcd.c:204:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/v2/fcd.c:236:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/v2/fcd.c:237:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/v2/fcd.c:284:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/v2/fcd.c:285:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/v2/fcd.c:314:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/v2/fcd.c:315:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/v2/fcd.c:377:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&aucBufOut[3],&pc[u32Addr],48);
data/qthid-fcd-controller-4.1/v2/fcd.c:400:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufIn[65];
data/qthid-fcd-controller-4.1/v2/fcd.c:401:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aucBufOut[65];
data/qthid-fcd-controller-4.1/v2/hid-libusb.c:307:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[512];
data/qthid-fcd-controller-4.1/v2/hid-libusb.c:310:2: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t wbuf[256];
data/qthid-fcd-controller-4.1/v2/hid-libusb.c:392:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[64];
data/qthid-fcd-controller-4.1/v2/hid-libusb.c:501:18: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char data[256];
data/qthid-fcd-controller-4.1/v2/hid-libusb.c:624:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(rpt->data, transfer->buffer, transfer->actual_length);
data/qthid-fcd-controller-4.1/v2/hid-libusb.c:927:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, rpt->data, len);
data/qthid-fcd-controller-4.1/v2/hid-libusb.c:1262:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char search_string[64];
data/qthid-fcd-controller-4.1/v2/hidmac.c:260:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char transport[32];
data/qthid-fcd-controller-4.1/v2/hidmac.c:318:3: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t buf[BUF_LEN];
data/qthid-fcd-controller-4.1/v2/hidmac.c:319:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cbuf[BUF_LEN];
data/qthid-fcd-controller-4.1/v2/hidmac.c:456:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(rpt->data, report, report_length);
data/qthid-fcd-controller-4.1/v2/hidmac.c:496:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cbuf[BUF_LEN];
data/qthid-fcd-controller-4.1/v2/hidmac.c:505:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[32];
data/qthid-fcd-controller-4.1/v2/hidmac.c:518:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(str, "%p", os_dev);
data/qthid-fcd-controller-4.1/v2/hidmac.c:596:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, rpt->data, len);
data/qthid-fcd-controller-4.1/v2/hidmac.c:825:3: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t serial[256], buf[256];
data/qthid-fcd-controller-4.1/v2/hidmac.c:826:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cbuf[256];
data/qthid-fcd-controller-4.1/v2/hidwin.cpp:298:4: [2] (buffer) wchar_t:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
wchar_t wstr[WSTR_LEN]; // TODO: Determine Size
data/qthid-fcd-controller-4.1/v2/hidwin.cpp:737:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char buf[65];
data/qthid-fcd-controller-4.1/v2/hidwin.cpp:749:15: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
int handle = open(VendorID, ProductID, L"12345");
data/qthid-fcd-controller-4.1/v2/mainwindow.cpp:198:17: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!qf.open(QIODevice::ReadOnly))
data/qthid-fcd-controller-4.1/v2/mainwindow.cpp:290:17: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!qf.open(QIODevice::ReadOnly))
data/qthid-fcd-controller-4.1/fcd.c:183:13: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(str, (char *)(aucBufIn+9), 5);
data/qthid-fcd-controller-4.1/firmware.cpp:106:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (qf.read(buf,qn64size) != qn64size)
data/qthid-fcd-controller-4.1/firmware.cpp:180:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (qf.read(buf,qn64size) != qn64size)
data/qthid-fcd-controller-4.1/hid-libusb.c:1219:3: [1] (buffer) wcsncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
wcsncpy(string, str, maxlen);
data/qthid-fcd-controller-4.1/hid-libusb.c:1391:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(search_string, locale, sizeof(search_string));
data/qthid-fcd-controller-4.1/hidmac.c:313:15: [1] (buffer) wcslen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t len = wcslen(s);
data/qthid-fcd-controller-4.1/hidraw.c:281:7: [1] (buffer) wcsncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120). Risk is low because the source is a
constant character.
wcsncpy(string, L"", maxlen);
data/qthid-fcd-controller-4.1/hidraw.c:688:15: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
bytes_read = read(dev->device_handle, data, length);
data/qthid-fcd-controller-4.1/hidwin.c:413:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(str);
data/qthid-fcd-controller-4.1/hidwin.c:415:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(cur_dev->path, str, len+1);
data/qthid-fcd-controller-4.1/hidwin.c:906:2: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
read(handle, buf, 65);
data/qthid-fcd-controller-4.1/v2/hid-libusb.c:1099:3: [1] (buffer) wcsncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
wcsncpy(string, str, maxlen);
data/qthid-fcd-controller-4.1/v2/hid-libusb.c:1271:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(search_string, locale, sizeof(search_string));
data/qthid-fcd-controller-4.1/v2/hidmac.c:248:15: [1] (buffer) wcslen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t len = wcslen(s);
data/qthid-fcd-controller-4.1/v2/hidwin.cpp:327:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(str);
data/qthid-fcd-controller-4.1/v2/hidwin.cpp:329:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(cur_dev->path, str, len+1);
data/qthid-fcd-controller-4.1/v2/hidwin.cpp:767:2: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
read(handle, buf, 65);
data/qthid-fcd-controller-4.1/v2/mainwindow.cpp:211:20: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (qf.read(buf,qn64size)!=qn64size)
data/qthid-fcd-controller-4.1/v2/mainwindow.cpp:303:20: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (qf.read(buf,qn64size)!=qn64size)
ANALYSIS SUMMARY:
Hits = 123
Lines analyzed = 11238 in approximately 0.29 seconds (38934 lines/second)
Physical Source Lines of Code (SLOC) = 7730
Hits@level = [0] 32 [1] 19 [2] 100 [3] 0 [4] 4 [5] 0
Hits@level+ = [0+] 155 [1+] 123 [2+] 104 [3+] 4 [4+] 4 [5+] 0
Hits/KSLOC@level+ = [0+] 20.0517 [1+] 15.912 [2+] 13.4541 [3+] 0.517464 [4+] 0.517464 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.