Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/symlinks-1.4/symlinks.c FINAL RESULTS: data/symlinks-1.4/symlinks.c:167:11: [5] (race) readlink: This accepts filename arguments; if an attacker can move those files or change the link content, a race condition results. Also, it does not terminate with ASCII NUL. (CWE-362, CWE-20). Reconsider approach. if ((c = readlink(path, lpath, sizeof(lpath))) == -1) { data/symlinks-1.4/symlinks.c:62:13: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). old_s = strcpy(tmp, s); data/symlinks-1.4/symlinks.c:176:3: [4] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). strcat(abspath,path); data/symlinks-1.4/symlinks.c:184:2: [4] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). strcat(abspath,lpath); data/symlinks-1.4/symlinks.c:211:24: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). fix_messy = tidy_path(strcpy(new,lpath)); data/symlinks-1.4/symlinks.c:249:3: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy (np, tail); data/symlinks-1.4/symlinks.c:284:3: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(name, dp->d_name); data/symlinks-1.4/symlinks.c:303:2: [4] (format) fprintf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. fprintf(stderr, progver, progname); data/symlinks-1.4/symlinks.c:371:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(path,cwd); data/symlinks-1.4/symlinks.c:372:14: [4] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). tidy_path(strcat(path, p)); data/symlinks-1.4/symlinks.c:117:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static char dir[PATH_MAX]; data/symlinks-1.4/symlinks.c:162:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static char lpath[PATH_MAX], new[PATH_MAX], abspath[PATH_MAX]; data/symlinks-1.4/symlinks.c:319:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static char path[PATH_MAX+2]; data/symlinks-1.4/symlinks.c:322:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static char path[PATH_MAX+2], cwd[PATH_MAX+2]; data/symlinks-1.4/symlinks.c:42:15: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). int oldlen = strlen(old), newlen = 0; data/symlinks-1.4/symlinks.c:48:12: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). newlen = strlen(new); data/symlinks-1.4/symlinks.c:51:21: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if ((tmp = malloc(strlen(s))) == NULL) { data/symlinks-1.4/symlinks.c:81:13: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). s = path + strlen(path) - 1; data/symlinks-1.4/symlinks.c:100:3: [1] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). Risk is low because the source is a constant character. strcpy(path,"/"); data/symlinks-1.4/symlinks.c:101:13: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). p = path + strlen(path) - 1; data/symlinks-1.4/symlinks.c:122:20: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). while (abspath && strlen(abspath) > 1 && (p = strstr(path,"../"))) { data/symlinks-1.4/symlinks.c:141:17: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). a = abspath + strlen(abspath) - 1; data/symlinks-1.4/symlinks.c:150:23: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strncmp(dir, a, strlen(dir))) data/symlinks-1.4/symlinks.c:177:7: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). c = strlen(abspath); data/symlinks-1.4/symlinks.c:182:3: [1] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant character. strcat(abspath,"/"); data/symlinks-1.4/symlinks.c:292:20: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). dirwalk(path, strlen(path), dev); data/symlinks-1.4/symlinks.c:342:21: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). cwd = realloc(cwd, strlen(cwd)+2); data/symlinks-1.4/symlinks.c:348:19: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (!*cwd || cwd[strlen(cwd)-1] != '/') data/symlinks-1.4/symlinks.c:349:3: [1] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant character. strcat(cwd,"/"); data/symlinks-1.4/symlinks.c:376:19: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). dirwalk(path, strlen(path), st.st_dev); ANALYSIS SUMMARY: Hits = 30 Lines analyzed = 383 in approximately 0.05 seconds (8506 lines/second) Physical Source Lines of Code (SLOC) = 336 Hits@level = [0] 10 [1] 16 [2] 4 [3] 0 [4] 9 [5] 1 Hits@level+ = [0+] 40 [1+] 30 [2+] 14 [3+] 10 [4+] 10 [5+] 1 Hits/KSLOC@level+ = [0+] 119.048 [1+] 89.2857 [2+] 41.6667 [3+] 29.7619 [4+] 29.7619 [5+] 2.97619 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.