Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/sslh-1.20/echosrv.c Examining data/sslh-1.20/probe.c Examining data/sslh-1.20/probe.h Examining data/sslh-1.20/sslh-fork.c Examining data/sslh-1.20/sslh-select.c Examining data/sslh-1.20/systemd-sslh-generator.c Examining data/sslh-1.20/tls.c Examining data/sslh-1.20/tls.h Examining data/sslh-1.20/common.c Examining data/sslh-1.20/common.h Examining data/sslh-1.20/sslh-main.c FINAL RESULTS: data/sslh-1.20/common.c:547:9: [4] (format) vfprintf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. vfprintf(stderr, msg, ap); data/sslh-1.20/common.c:623:9: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(addr_str, STRING_UNKNOWN); data/sslh-1.20/common.c:626:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(host, STRING_UNKNOWN); data/sslh-1.20/echosrv.c:104:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(buffer, prefix); data/sslh-1.20/sslh-main.c:100:5: [4] (format) fprintf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. fprintf(stderr, USAGE_STRING, prots); data/sslh-1.20/sslh-main.c:303:9: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy (sni_hostname_list[i], config_item); data/sslh-1.20/systemd-sslh-generator.c:13:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(conn, hostname); data/sslh-1.20/systemd-sslh-generator.c:15:5: [4] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). strcat(conn, port); data/sslh-1.20/systemd-sslh-generator.c:58:21: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy((*listen)[i], resolve_listen(hostname, port)); data/sslh-1.20/systemd-sslh-generator.c:123:9: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(runtime_conf, runtime_unit_dir); data/sslh-1.20/systemd-sslh-generator.c:124:9: [4] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). strcat(runtime_conf, unit_file); data/sslh-1.20/common.c:768:15: [3] (misc) chroot: chroot can be very helpful, but is hard to use correctly (CWE-250, CWE-22). Make sure the program immediately chdir("/"), closes file descriptors, and drops root privileges, and that all necessary files (and no more!) are in the new root. res = chroot(chroot_path); data/sslh-1.20/common.c:61:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[NI_MAXHOST]; data/sslh-1.20/common.c:263:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[NI_MAXHOST]; data/sslh-1.20/common.c:325:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(p, data, data_size); data/sslh-1.20/common.c:388:4: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buffer[BUFSIZ]; data/sslh-1.20/common.c:441:4: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char host[NI_MAXHOST], serv[NI_MAXSERV]; data/sslh-1.20/common.c:559:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char peer[MAX_NAMELENGTH], service[MAX_NAMELENGTH], data/sslh-1.20/common.c:612:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char addr_str[NI_MAXHOST], host[NI_MAXHOST]; data/sslh-1.20/common.c:797:9: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). f = fopen(pidfile, "w"); data/sslh-1.20/echosrv.c:98:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buffer[1 << 20]; data/sslh-1.20/probe.c:346:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buffer[BUFSIZ]; data/sslh-1.20/sslh-main.c:122:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[NI_MAXHOST]; data/sslh-1.20/sslh-main.c:155:9: [2] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). Risk is low because the source is a constant string. strcpy(setting, "tls"); /* legacy configuration */ data/sslh-1.20/sslh-main.c:167:13: [2] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). Risk is low because the source is a constant string. strcpy(argv[i], "--tls"); data/sslh-1.20/sslh-main.c:490:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(all_options, const_options, sizeof(const_options)); data/sslh-1.20/sslh-main.c:576:13: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(p, &builtins[c-PROT_SHIFT], sizeof(*p)); data/sslh-1.20/sslh-main.c:593:32: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). probing_timeout = atoi(optarg); data/sslh-1.20/systemd-sslh-generator.c:99:14: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). config = fopen(sslh_conf, "r"); data/sslh-1.20/systemd-sslh-generator.c:102:18: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). config = fopen(sslh_conf, "r"); data/sslh-1.20/systemd-sslh-generator.c:125:27: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). runtime_conf_fd = fopen(runtime_conf, "w"); data/sslh-1.20/tls.c:270:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(name_nullterminated, name, name_len); data/sslh-1.20/common.c:394:13: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). size_r = read(from, buffer, sizeof(buffer)); data/sslh-1.20/common.c:459:12: [1] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). Risk is low because the source is a constant character. strcpy(host, "?"); data/sslh-1.20/common.c:460:12: [1] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). Risk is low because the source is a constant character. strcpy(serv, "?"); data/sslh-1.20/echosrv.c:101:18: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). prefix_len = strlen(prefix); data/sslh-1.20/echosrv.c:107:15: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). ret = read(fd, buffer + prefix_len, sizeof(buffer)); data/sslh-1.20/probe.c:196:15: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (len < strlen(opt)) data/sslh-1.20/probe.c:199:29: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). return !strncmp(p, opt, strlen(opt)); data/sslh-1.20/probe.c:350:9: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). n = read(cnx->q[0].fd, buffer, sizeof(buffer)); data/sslh-1.20/sslh-main.c:287:27: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). server_name_len = strlen(server_name); data/sslh-1.20/systemd-sslh-generator.c:11:25: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). char *conn = malloc(strlen(hostname)+strlen(port)+2); data/sslh-1.20/systemd-sslh-generator.c:11:42: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). char *conn = malloc(strlen(hostname)+strlen(port)+2); data/sslh-1.20/systemd-sslh-generator.c:14:5: [1] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant character. strcat(conn, ":"); data/sslh-1.20/systemd-sslh-generator.c:56:43: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). (*listen)[i] = malloc(strlen(resolve_listen(hostname, port))); data/sslh-1.20/systemd-sslh-generator.c:119:25: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). size_t uf_len = strlen(unit_file); data/sslh-1.20/systemd-sslh-generator.c:120:30: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). size_t runtime_len = strlen(runtime_unit_dir) + uf_len + 1; ANALYSIS SUMMARY: Hits = 47 Lines analyzed = 3508 in approximately 0.12 seconds (28634 lines/second) Physical Source Lines of Code (SLOC) = 2455 Hits@level = [0] 93 [1] 15 [2] 20 [3] 1 [4] 11 [5] 0 Hits@level+ = [0+] 140 [1+] 47 [2+] 32 [3+] 12 [4+] 11 [5+] 0 Hits/KSLOC@level+ = [0+] 57.0265 [1+] 19.1446 [2+] 13.0346 [3+] 4.88798 [4+] 4.48065 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.