Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/ruby-thrift-0.11.0.0/ext/memory_buffer.c
Examining data/ruby-thrift-0.11.0.0/ext/constants.h
Examining data/ruby-thrift-0.11.0.0/ext/binary_protocol_accelerated.c
Examining data/ruby-thrift-0.11.0.0/ext/compact_protocol.c
Examining data/ruby-thrift-0.11.0.0/ext/thrift_native.c
Examining data/ruby-thrift-0.11.0.0/ext/binary_protocol_accelerated.h
Examining data/ruby-thrift-0.11.0.0/ext/struct.c
Examining data/ruby-thrift-0.11.0.0/ext/macros.h
Examining data/ruby-thrift-0.11.0.0/ext/struct.h
Examining data/ruby-thrift-0.11.0.0/ext/memory_buffer.h
Examining data/ruby-thrift-0.11.0.0/ext/protocol.h
Examining data/ruby-thrift-0.11.0.0/ext/compact_protocol.h
Examining data/ruby-thrift-0.11.0.0/ext/protocol.c
Examining data/ruby-thrift-0.11.0.0/ext/strlcpy.c
Examining data/ruby-thrift-0.11.0.0/ext/bytes.c
Examining data/ruby-thrift-0.11.0.0/ext/strlcpy.h
Examining data/ruby-thrift-0.11.0.0/ext/bytes.h
FINAL RESULTS:
data/ruby-thrift-0.11.0.0/ext/binary_protocol_accelerated.c:45:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char data[2];
data/ruby-thrift-0.11.0.0/ext/binary_protocol_accelerated.c:54:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char data[4];
data/ruby-thrift-0.11.0.0/ext/binary_protocol_accelerated.c:66:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char data[8];
data/ruby-thrift-0.11.0.0/ext/compact_protocol.c:90:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[50];
data/ruby-thrift-0.11.0.0/ext/compact_protocol.c:91:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(str, "don't know what type: %d", type);
data/ruby-thrift-0.11.0.0/ext/compact_protocol.c:296:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[8];
data/ruby-thrift-0.11.0.0/ext/compact_protocol.c:361:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[50];
data/ruby-thrift-0.11.0.0/ext/compact_protocol.c:362:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(str, "don't know what type: %d", ctype);
data/ruby-thrift-0.11.0.0/ext/compact_protocol.c:439:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[100];
data/ruby-thrift-0.11.0.0/ext/compact_protocol.c:440:15: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
int len = sprintf(buf, "Expected protocol id %d but got %d", PROTOCOL_ID, protocol_id);
data/ruby-thrift-0.11.0.0/ext/compact_protocol.c:448:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[100];
data/ruby-thrift-0.11.0.0/ext/compact_protocol.c:449:15: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
int len = sprintf(buf, "Expected version id %d but got %d", version, VERSION);
data/ruby-thrift-0.11.0.0/ext/struct.c:217:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name_buf[RSTRING_LEN(field_name) + 2];
data/ruby-thrift-0.11.0.0/ext/struct.c:408:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name_buf[RSTRING_LEN(field_name) + 2];
data/ruby-thrift-0.11.0.0/ext/strlcpy.c:38:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return n + strlen (src);
ANALYSIS SUMMARY:
Hits = 15
Lines analyzed = 2510 in approximately 0.10 seconds (25453 lines/second)
Physical Source Lines of Code (SLOC) = 1757
Hits@level = [0] 0 [1] 1 [2] 14 [3] 0 [4] 0 [5] 0
Hits@level+ = [0+] 15 [1+] 15 [2+] 14 [3+] 0 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 8.53728 [1+] 8.53728 [2+] 7.96813 [3+] 0 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.