Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/speechd-up-0.5~20110719/configuration.c
Examining data/speechd-up-0.5~20110719/configuration.h
Examining data/speechd-up-0.5~20110719/options.h
Examining data/speechd-up-0.5~20110719/options.c
Examining data/speechd-up-0.5~20110719/log.c
Examining data/speechd-up-0.5~20110719/log.h
Examining data/speechd-up-0.5~20110719/speechd-up.c
FINAL RESULTS:
data/speechd-up-0.5~20110719/log.c:71:4: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
vfprintf(logfile, format, args);
data/speechd-up-0.5~20110719/speechd-up.c:500:5: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(po, helper);
data/speechd-up-0.5~20110719/speechd-up.c:526:5: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(po, ssml_entities[current_char]);
data/speechd-up-0.5~20110719/options.c:143:7: [3] (buffer) getopt_long:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
getopt_long(argc, argv, spd_short_options, spd_long_options,
data/speechd-up-0.5~20110719/speechd-up.c:112:18: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *fp_char = fopen(options.speakup_characters, "w");
data/speechd-up-0.5~20110719/speechd-up.c:126:12: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fp_char = fopen(options.speakup_chartab, "w");
data/speechd-up-0.5~20110719/speechd-up.c:282:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cmd[13];
data/speechd-up-0.5~20110719/speechd-up.c:308:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
const char *ssml_entities[128];
data/speechd-up-0.5~20110719/speechd-up.c:415:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char character[2];
data/speechd-up-0.5~20110719/speechd-up.c:421:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(character, "%c", text[i]);
data/speechd-up-0.5~20110719/speechd-up.c:445:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char helper[20];
data/speechd-up-0.5~20110719/speechd-up.c:455:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char text[BUF_SIZE * 16]; /* Definitely big enough. */
data/speechd-up-0.5~20110719/speechd-up.c:499:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(helper, "<mark name=\"%d\"/>", param);
data/speechd-up-0.5~20110719/speechd-up.c:574:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
pid_file = fopen(spd_spk_pid_file, "r");
data/speechd-up-0.5~20110719/speechd-up.c:601:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
pid_file = fopen(spd_spk_pid_file, "w");
data/speechd-up-0.5~20110719/speechd-up.c:635:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUF_SIZE + 1];
data/speechd-up-0.5~20110719/speechd-up.c:652:12: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
logfile = fopen(options.log_file_name, "w+");
data/speechd-up-0.5~20110719/speechd-up.c:677:13: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((fd = open(options.speakup_device, O_RDWR)) < 0) {
data/speechd-up-0.5~20110719/speechd-up.c:682:14: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((fd = open(options.speakup_device, O_RDONLY)) < 0) {
data/speechd-up-0.5~20110719/log.c:63:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
assert(strlen(tstr) > 1);
data/speechd-up-0.5~20110719/log.c:64:10: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
tstr[strlen(tstr) - 1] = 0;
data/speechd-up-0.5~20110719/speechd-up.c:323:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ssml_entity_lengths['<'] = strlen(ssml_less_than);
data/speechd-up-0.5~20110719/speechd-up.c:325:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ssml_entity_lengths['>'] = strlen(ssml_greater_than);
data/speechd-up-0.5~20110719/speechd-up.c:327:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ssml_entity_lengths['&'] = strlen(ssml_ampersand);
data/speechd-up-0.5~20110719/speechd-up.c:329:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ssml_entity_lengths['\''] = strlen(ssml_single_quote);
data/speechd-up-0.5~20110719/speechd-up.c:331:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ssml_entity_lengths['\"'] = strlen(ssml_double_quote);
data/speechd-up-0.5~20110719/speechd-up.c:340:25: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
utf8_text = malloc(4 * strlen(text) + 1);
data/speechd-up-0.5~20110719/speechd-up.c:348:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
out_bytes = 4 * strlen(text);
data/speechd-up-0.5~20110719/speechd-up.c:349:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
in_bytes = strlen(text);
data/speechd-up-0.5~20110719/speechd-up.c:385:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int bufsize = strlen(utf8_text) + 16;
data/speechd-up-0.5~20110719/speechd-up.c:418:19: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for (i = 0; i <= strlen(text) - 1; i++) {
data/speechd-up-0.5~20110719/speechd-up.c:502:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
po += strlen(helper) * sizeof(char);
data/speechd-up-0.5~20110719/speechd-up.c:752:23: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
chars_read_signed = read(fd, buf, BUF_SIZE);
ANALYSIS SUMMARY:
Hits = 33
Lines analyzed = 1365 in approximately 0.07 seconds (19112 lines/second)
Physical Source Lines of Code (SLOC) = 1009
Hits@level = [0] 23 [1] 14 [2] 15 [3] 1 [4] 3 [5] 0
Hits@level+ = [0+] 56 [1+] 33 [2+] 19 [3+] 4 [4+] 3 [5+] 0
Hits/KSLOC@level+ = [0+] 55.5005 [1+] 32.7056 [2+] 18.8305 [3+] 3.96432 [4+] 2.97324 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.