Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/telepathy-idle-0.2.0/src/idle-debug.h
Examining data/telepathy-idle-0.2.0/src/room-config.h
Examining data/telepathy-idle-0.2.0/src/idle-text.h
Examining data/telepathy-idle-0.2.0/src/idle-handles.c
Examining data/telepathy-idle-0.2.0/src/idle-im-channel.h
Examining data/telepathy-idle-0.2.0/src/protocol.h
Examining data/telepathy-idle-0.2.0/src/server-tls-manager.c
Examining data/telepathy-idle-0.2.0/src/idle-text.c
Examining data/telepathy-idle-0.2.0/src/idle-muc-manager.h
Examining data/telepathy-idle-0.2.0/src/idle-muc-channel.h
Examining data/telepathy-idle-0.2.0/src/idle-handles.h
Examining data/telepathy-idle-0.2.0/src/idle-muc-channel.c
Examining data/telepathy-idle-0.2.0/src/server-tls-channel.h
Examining data/telepathy-idle-0.2.0/src/room-config.c
Examining data/telepathy-idle-0.2.0/src/idle-debug.c
Examining data/telepathy-idle-0.2.0/src/idle-parser.h
Examining data/telepathy-idle-0.2.0/src/server-tls-channel.c
Examining data/telepathy-idle-0.2.0/src/idle-connection-manager.h
Examining data/telepathy-idle-0.2.0/src/protocol.c
Examining data/telepathy-idle-0.2.0/src/idle-im-channel.c
Examining data/telepathy-idle-0.2.0/src/idle-ctcp.h
Examining data/telepathy-idle-0.2.0/src/idle-ctcp.c
Examining data/telepathy-idle-0.2.0/src/idle-muc-manager.c
Examining data/telepathy-idle-0.2.0/src/tls-certificate.c
Examining data/telepathy-idle-0.2.0/src/idle-contact-info.h
Examining data/telepathy-idle-0.2.0/src/idle-roomlist-channel.c
Examining data/telepathy-idle-0.2.0/src/idle-roomlist-manager.c
Examining data/telepathy-idle-0.2.0/src/idle-connection.h
Examining data/telepathy-idle-0.2.0/src/idle-roomlist-channel.h
Examining data/telepathy-idle-0.2.0/src/tls-certificate.h
Examining data/telepathy-idle-0.2.0/src/idle-server-connection.c
Examining data/telepathy-idle-0.2.0/src/server-tls-manager.h
Examining data/telepathy-idle-0.2.0/src/idle-contact-info.c
Examining data/telepathy-idle-0.2.0/src/idle.c
Examining data/telepathy-idle-0.2.0/src/idle-connection.c
Examining data/telepathy-idle-0.2.0/src/idle-server-connection.h
Examining data/telepathy-idle-0.2.0/src/idle-im-manager.c
Examining data/telepathy-idle-0.2.0/src/idle-connection-manager.c
Examining data/telepathy-idle-0.2.0/src/idle-parser.c
Examining data/telepathy-idle-0.2.0/src/idle-roomlist-manager.h
Examining data/telepathy-idle-0.2.0/src/idle-im-manager.h
Examining data/telepathy-idle-0.2.0/extensions/extensions.h
Examining data/telepathy-idle-0.2.0/tests/test-ctcp-kill-blingbling.c
Examining data/telepathy-idle-0.2.0/tests/test-text-encode-and-split.c
Examining data/telepathy-idle-0.2.0/tests/test-ctcp-tokenize.c
FINAL RESULTS:
data/telepathy-idle-0.2.0/tests/test-text-encode-and-split.c:14:7: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf (stderr, message "\n", ##__VA_ARGS__); \
data/telepathy-idle-0.2.0/tests/test-text-encode-and-split.c:35:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *expected_prefixes[3] = {
data/telepathy-idle-0.2.0/tests/test-text-encode-and-split.c:41:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *expected_infixes[3] = {
data/telepathy-idle-0.2.0/tests/test-text-encode-and-split.c:47:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *expected_suffixes[3] = {
data/telepathy-idle-0.2.0/src/idle-connection.c:978:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(cmd);
data/telepathy-idle-0.2.0/src/idle-connection.c:1007:28: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
return IRC_MSG_MAXLEN - (strlen(priv->relay_prefix) + 2);
data/telepathy-idle-0.2.0/src/idle-ctcp.c:93:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
killed = g_malloc0(strlen(msg) + 1);
data/telepathy-idle-0.2.0/src/idle-handles.c:101:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(channel);
data/telepathy-idle-0.2.0/src/idle-server-connection.c:585:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
priv->count = strlen(cmd);
data/telepathy-idle-0.2.0/src/idle-server-connection.c:593:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(priv->output_buffer, cmd, output_buffer_size);
data/telepathy-idle-0.2.0/src/idle-text.c:38:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t actionlen = strlen("\001ACTION ");
data/telepathy-idle-0.2.0/src/idle-text.c:41:38: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
tmp = g_strndup(text + actionlen, strlen(text + actionlen) - 1);
data/telepathy-idle-0.2.0/src/idle-text.c:79:41: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
const gchar * const text_end = text + strlen(text);
data/telepathy-idle-0.2.0/src/idle-text.c:103:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
max_bytes = max_msg_len - (strlen(header) + strlen(footer));
data/telepathy-idle-0.2.0/src/idle-text.c:103:46: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
max_bytes = max_msg_len - (strlen(header) + strlen(footer));
data/telepathy-idle-0.2.0/tests/test-text-encode-and-split.c:31:52: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
GString *reconstituted_msg = g_string_sized_new (strlen (msg));
data/telepathy-idle-0.2.0/tests/test-text-encode-and-split.c:63:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen (line) > IRC_MSG_MAXLEN)
data/telepathy-idle-0.2.0/tests/test-text-encode-and-split.c:73:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
c += strlen (expected_prefixes[type]);
data/telepathy-idle-0.2.0/tests/test-text-encode-and-split.c:79:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
c += strlen (recipient);
data/telepathy-idle-0.2.0/tests/test-text-encode-and-split.c:86:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
c += strlen (expected_infixes[type]);
data/telepathy-idle-0.2.0/tests/test-text-encode-and-split.c:94:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strncmp (c, bodies[i], strlen (c) - strlen (expected_suffixes[type])))
data/telepathy-idle-0.2.0/tests/test-text-encode-and-split.c:94:47: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strncmp (c, bodies[i], strlen (c) - strlen (expected_suffixes[type])))
data/telepathy-idle-0.2.0/tests/test-text-encode-and-split.c:100:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen (c) - strlen (expected_suffixes[type]));
data/telepathy-idle-0.2.0/tests/test-text-encode-and-split.c:100:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen (c) - strlen (expected_suffixes[type]));
ANALYSIS SUMMARY:
Hits = 24
Lines analyzed = 11411 in approximately 0.24 seconds (47510 lines/second)
Physical Source Lines of Code (SLOC) = 7927
Hits@level = [0] 9 [1] 20 [2] 3 [3] 0 [4] 1 [5] 0
Hits@level+ = [0+] 33 [1+] 24 [2+] 4 [3+] 1 [4+] 1 [5+] 0
Hits/KSLOC@level+ = [0+] 4.16299 [1+] 3.02763 [2+] 0.504605 [3+] 0.126151 [4+] 0.126151 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.