Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/ruby-bson-4.10.0/ext/bson/bson-endian.h Examining data/ruby-bson-4.10.0/ext/bson/bson-native.h Examining data/ruby-bson-4.10.0/ext/bson/bytebuf.c Examining data/ruby-bson-4.10.0/ext/bson/endian.c Examining data/ruby-bson-4.10.0/ext/bson/init.c Examining data/ruby-bson-4.10.0/ext/bson/libbson-utf8.c Examining data/ruby-bson-4.10.0/ext/bson/util.c Examining data/ruby-bson-4.10.0/ext/bson/write.c Examining data/ruby-bson-4.10.0/ext/bson/read.c FINAL RESULTS: data/ruby-bson-4.10.0/ext/bson/bson-native.h:50:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buffer[BSON_BYTE_BUFFER_SIZE]; data/ruby-bson-4.10.0/ext/bson/bytebuf.c:60:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(new_b_ptr, READ_PTR(buffer_ptr), READ_SIZE(buffer_ptr)); data/ruby-bson-4.10.0/ext/bson/endian.c:112:4: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&uv, &v, sizeof(v)); data/ruby-bson-4.10.0/ext/bson/init.c:38:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char rb_bson_machine_id[256]; data/ruby-bson-4.10.0/ext/bson/read.c:47:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&length, READ_PTR(b), 4); data/ruby-bson-4.10.0/ext/bson/read.c:169:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&length_le, READ_PTR(b), 4); data/ruby-bson-4.10.0/ext/bson/read.c:258:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&i32, READ_PTR(b), 4); data/ruby-bson-4.10.0/ext/bson/read.c:279:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&i32, READ_PTR(b), 4); data/ruby-bson-4.10.0/ext/bson/read.c:307:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&i64, READ_PTR(b), 8); data/ruby-bson-4.10.0/ext/bson/read.c:339:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&d, READ_PTR(b), 8); data/ruby-bson-4.10.0/ext/bson/util.c:22:8: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static char rb_bson_machine_id_hash[HOST_NAME_HASH_MAX]; data/ruby-bson-4.10.0/ext/bson/util.c:27:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(rb_bson_machine_id_hash, RSTRING_PTR(digest), RSTRING_LEN(digest)); data/ruby-bson-4.10.0/ext/bson/util.c:35:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char bytes[12]; data/ruby-bson-4.10.0/ext/bson/util.c:49:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&bytes, &t, 4); data/ruby-bson-4.10.0/ext/bson/util.c:50:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&bytes[4], rb_bson_machine_id_hash, 3); data/ruby-bson-4.10.0/ext/bson/util.c:51:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&bytes[7], &pid, 2); data/ruby-bson-4.10.0/ext/bson/util.c:52:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&bytes[9], &c, 3); data/ruby-bson-4.10.0/ext/bson/write.c:103:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(WRITE_PTR(b), str, 1); data/ruby-bson-4.10.0/ext/bson/write.c:124:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(WRITE_PTR(b), str, length); data/ruby-bson-4.10.0/ext/bson/write.c:195:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(WRITE_PTR(b), &length_le, 4); data/ruby-bson-4.10.0/ext/bson/write.c:197:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(WRITE_PTR(b), str, length); data/ruby-bson-4.10.0/ext/bson/write.c:312:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(WRITE_PTR(b), str, bytes_to_write); data/ruby-bson-4.10.0/ext/bson/write.c:346:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(READ_PTR(b) + position, &i32, 4); data/ruby-bson-4.10.0/ext/bson/write.c:390:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(WRITE_PTR(b), &i32, 4); data/ruby-bson-4.10.0/ext/bson/write.c:421:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(WRITE_PTR(b), &i32, 4); data/ruby-bson-4.10.0/ext/bson/write.c:442:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(WRITE_PTR(b), &i64, 8); data/ruby-bson-4.10.0/ext/bson/write.c:460:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(WRITE_PTR(b), &d, 8); data/ruby-bson-4.10.0/ext/bson/write.c:473:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(WRITE_PTR(b), &low64, 8); data/ruby-bson-4.10.0/ext/bson/write.c:476:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(WRITE_PTR(b), &high64, 8); data/ruby-bson-4.10.0/ext/bson/write.c:635:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buffer[16]; data/ruby-bson-4.10.0/ext/bson/write.c:647:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(WRITE_PTR(b), c_str, length); data/ruby-bson-4.10.0/ext/bson/read.c:224:17: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). length = (int)strlen(READ_PTR(b)); data/ruby-bson-4.10.0/ext/bson/read.c:237:17: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). length = (int)strlen(READ_PTR(b)); data/ruby-bson-4.10.0/ext/bson/write.c:645:12: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). length = strlen(c_str) + 1; ANALYSIS SUMMARY: Hits = 34 Lines analyzed = 2244 in approximately 0.10 seconds (21747 lines/second) Physical Source Lines of Code (SLOC) = 1311 Hits@level = [0] 1 [1] 3 [2] 31 [3] 0 [4] 0 [5] 0 Hits@level+ = [0+] 35 [1+] 34 [2+] 31 [3+] 0 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 26.6972 [1+] 25.9344 [2+] 23.6461 [3+] 0 [4+] 0 [5+] 0 Dot directories skipped = 3 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.