Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/sandsifter-1.04/injector.c FINAL RESULTS: data/sandsifter-1.04/injector.c:397:22: [4] (format) vsprintf: Potential format string problem (CWE-134). Make format string constant. stdout_buffer_pos+=vsprintf(stdout_buffer_pos, format, args); data/sandsifter-1.04/injector.c:400:22: [4] (format) vsprintf: Potential format string problem (CWE-134). Make format string constant. stderr_buffer_pos+=vsprintf(stderr_buffer_pos, format, args); data/sandsifter-1.04/injector.c:1235:12: [3] (buffer) getopt: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. while ((c=getopt(argc,argv,"?brtdRTx0Ns:DB:P:S:i:e:c:X:j:l:"))!=-1) { data/sandsifter-1.04/injector.c:1425:2: [3] (random) srand: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. srand(config.seed); data/sandsifter-1.04/injector.c:187:8: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static char stack[SIGSTKSZ]; data/sandsifter-1.04/injector.c:247:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char mne[RAW_REPORT_DISAS_MNE_BYTES]; data/sandsifter-1.04/injector.c:250:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char ops[RAW_REPORT_DISAS_OPS_BYTES]; data/sandsifter-1.04/injector.c:361:1: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char stdout_buffer[LINE_BUFFER_SIZE*BUFFER_LINES]; data/sandsifter-1.04/injector.c:364:1: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char stderr_buffer[LINE_BUFFER_SIZE*BUFFER_LINES]; data/sandsifter-1.04/injector.c:412:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(stdout_buffer_pos, ptr, size*count); data/sandsifter-1.04/injector.c:416:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(stderr_buffer_pos, ptr, size*count); data/sandsifter-1.04/injector.c:927:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(inclusive_end, &r->end.bytes, MAX_INSN_LENGTH); data/sandsifter-1.04/injector.c:1161:5: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(disas.mne, capstone_insn[0].mnemonic, RAW_DISAS_MNEMONIC_BYTES); data/sandsifter-1.04/injector.c:1164:5: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(disas.ops, capstone_insn[0].op_str, RAW_DISAS_OP_BYTES); data/sandsifter-1.04/injector.c:1175:5: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). Risk is low because the source is a constant string. strncpy(disas.mne, "(unk)", RAW_DISAS_MNEMONIC_BYTES); data/sandsifter-1.04/injector.c:1178:5: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). Risk is low because the source is a constant character. strncpy(disas.ops, " ", RAW_DISAS_OP_BYTES); data/sandsifter-1.04/injector.c:1318:39: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). opcode_blacklist[j].opcode=malloc(strlen(optarg)/2+1); ANALYSIS SUMMARY: Hits = 17 Lines analyzed = 1538 in approximately 0.05 seconds (34041 lines/second) Physical Source Lines of Code (SLOC) = 1228 Hits@level = [0] 33 [1] 5 [2] 8 [3] 2 [4] 2 [5] 0 Hits@level+ = [0+] 50 [1+] 17 [2+] 12 [3+] 4 [4+] 2 [5+] 0 Hits/KSLOC@level+ = [0+] 40.7166 [1+] 13.8436 [2+] 9.77199 [3+] 3.25733 [4+] 1.62866 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.