Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/ucspi-tcp-0.88/tcpserver.c
Examining data/ucspi-tcp-0.88/tcprules.c
Examining data/ucspi-tcp-0.88/tcprulescheck.c
Examining data/ucspi-tcp-0.88/recordio.c
Examining data/ucspi-tcp-0.88/argv0.c
Examining data/ucspi-tcp-0.88/tcpclient.c
Examining data/ucspi-tcp-0.88/mconnect-io.c
Examining data/ucspi-tcp-0.88/addcr.c
Examining data/ucspi-tcp-0.88/delcr.c
Examining data/ucspi-tcp-0.88/fixcrio.c
Examining data/ucspi-tcp-0.88/remoteinfo.h
Examining data/ucspi-tcp-0.88/remoteinfo.c
Examining data/ucspi-tcp-0.88/timeoutconn.h
Examining data/ucspi-tcp-0.88/timeoutconn.c
Examining data/ucspi-tcp-0.88/rules.h
Examining data/ucspi-tcp-0.88/rules.c
Examining data/ucspi-tcp-0.88/alloc.c
Examining data/ucspi-tcp-0.88/alloc.h
Examining data/ucspi-tcp-0.88/alloc_re.c
Examining data/ucspi-tcp-0.88/auto-str.c
Examining data/ucspi-tcp-0.88/auto_home.h
Examining data/ucspi-tcp-0.88/buffer.c
Examining data/ucspi-tcp-0.88/buffer.h
Examining data/ucspi-tcp-0.88/buffer_0.c
Examining data/ucspi-tcp-0.88/buffer_1.c
Examining data/ucspi-tcp-0.88/buffer_2.c
Examining data/ucspi-tcp-0.88/buffer_copy.c
Examining data/ucspi-tcp-0.88/buffer_get.c
Examining data/ucspi-tcp-0.88/buffer_put.c
Examining data/ucspi-tcp-0.88/byte.h
Examining data/ucspi-tcp-0.88/byte_chr.c
Examining data/ucspi-tcp-0.88/byte_copy.c
Examining data/ucspi-tcp-0.88/byte_cr.c
Examining data/ucspi-tcp-0.88/byte_diff.c
Examining data/ucspi-tcp-0.88/byte_rchr.c
Examining data/ucspi-tcp-0.88/byte_zero.c
Examining data/ucspi-tcp-0.88/case.h
Examining data/ucspi-tcp-0.88/case_diffb.c
Examining data/ucspi-tcp-0.88/case_diffs.c
Examining data/ucspi-tcp-0.88/cdb.c
Examining data/ucspi-tcp-0.88/cdb.h
Examining data/ucspi-tcp-0.88/cdb_hash.c
Examining data/ucspi-tcp-0.88/cdb_make.c
Examining data/ucspi-tcp-0.88/cdb_make.h
Examining data/ucspi-tcp-0.88/chkshsgr.c
Examining data/ucspi-tcp-0.88/commands.c
Examining data/ucspi-tcp-0.88/commands.h
Examining data/ucspi-tcp-0.88/dns.h
Examining data/ucspi-tcp-0.88/dns_dfd.c
Examining data/ucspi-tcp-0.88/dns_domain.c
Examining data/ucspi-tcp-0.88/dns_dtda.c
Examining data/ucspi-tcp-0.88/dns_ip.c
Examining data/ucspi-tcp-0.88/dns_ipq.c
Examining data/ucspi-tcp-0.88/dns_name.c
Examining data/ucspi-tcp-0.88/dns_nd.c
Examining data/ucspi-tcp-0.88/dns_packet.c
Examining data/ucspi-tcp-0.88/dns_random.c
Examining data/ucspi-tcp-0.88/dns_rcip.c
Examining data/ucspi-tcp-0.88/dns_rcrw.c
Examining data/ucspi-tcp-0.88/dns_resolve.c
Examining data/ucspi-tcp-0.88/dns_sortip.c
Examining data/ucspi-tcp-0.88/dns_transmit.c
Examining data/ucspi-tcp-0.88/dns_txt.c
Examining data/ucspi-tcp-0.88/env.c
Examining data/ucspi-tcp-0.88/env.h
Examining data/ucspi-tcp-0.88/error.c
Examining data/ucspi-tcp-0.88/error_str.c
Examining data/ucspi-tcp-0.88/exit.h
Examining data/ucspi-tcp-0.88/fd.h
Examining data/ucspi-tcp-0.88/fd_copy.c
Examining data/ucspi-tcp-0.88/fd_move.c
Examining data/ucspi-tcp-0.88/fmt.h
Examining data/ucspi-tcp-0.88/fmt_ulong.c
Examining data/ucspi-tcp-0.88/gen_alloc.h
Examining data/ucspi-tcp-0.88/gen_allocdefs.h
Examining data/ucspi-tcp-0.88/getln.c
Examining data/ucspi-tcp-0.88/getln.h
Examining data/ucspi-tcp-0.88/getln2.c
Examining data/ucspi-tcp-0.88/hier.c
Examining data/ucspi-tcp-0.88/install.c
Examining data/ucspi-tcp-0.88/instcheck.c
Examining data/ucspi-tcp-0.88/iopause.c
Examining data/ucspi-tcp-0.88/ip4.h
Examining data/ucspi-tcp-0.88/ip4_fmt.c
Examining data/ucspi-tcp-0.88/ip4_scan.c
Examining data/ucspi-tcp-0.88/ndelay.h
Examining data/ucspi-tcp-0.88/ndelay_off.c
Examining data/ucspi-tcp-0.88/ndelay_on.c
Examining data/ucspi-tcp-0.88/open.h
Examining data/ucspi-tcp-0.88/open_read.c
Examining data/ucspi-tcp-0.88/open_trunc.c
Examining data/ucspi-tcp-0.88/open_write.c
Examining data/ucspi-tcp-0.88/openreadclose.c
Examining data/ucspi-tcp-0.88/openreadclose.h
Examining data/ucspi-tcp-0.88/pathexec.h
Examining data/ucspi-tcp-0.88/pathexec_env.c
Examining data/ucspi-tcp-0.88/pathexec_run.c
Examining data/ucspi-tcp-0.88/prot.c
Examining data/ucspi-tcp-0.88/prot.h
Examining data/ucspi-tcp-0.88/readclose.c
Examining data/ucspi-tcp-0.88/readclose.h
Examining data/ucspi-tcp-0.88/readwrite.h
Examining data/ucspi-tcp-0.88/scan.h
Examining data/ucspi-tcp-0.88/scan_ulong.c
Examining data/ucspi-tcp-0.88/seek.h
Examining data/ucspi-tcp-0.88/seek_set.c
Examining data/ucspi-tcp-0.88/sgetopt.c
Examining data/ucspi-tcp-0.88/sgetopt.h
Examining data/ucspi-tcp-0.88/sig.c
Examining data/ucspi-tcp-0.88/sig.h
Examining data/ucspi-tcp-0.88/sig_block.c
Examining data/ucspi-tcp-0.88/sig_catch.c
Examining data/ucspi-tcp-0.88/sig_pause.c
Examining data/ucspi-tcp-0.88/socket.h
Examining data/ucspi-tcp-0.88/socket_accept.c
Examining data/ucspi-tcp-0.88/socket_bind.c
Examining data/ucspi-tcp-0.88/socket_conn.c
Examining data/ucspi-tcp-0.88/socket_delay.c
Examining data/ucspi-tcp-0.88/socket_listen.c
Examining data/ucspi-tcp-0.88/socket_local.c
Examining data/ucspi-tcp-0.88/socket_opts.c
Examining data/ucspi-tcp-0.88/socket_remote.c
Examining data/ucspi-tcp-0.88/socket_tcp.c
Examining data/ucspi-tcp-0.88/socket_udp.c
Examining data/ucspi-tcp-0.88/str.h
Examining data/ucspi-tcp-0.88/str_chr.c
Examining data/ucspi-tcp-0.88/str_diff.c
Examining data/ucspi-tcp-0.88/str_len.c
Examining data/ucspi-tcp-0.88/str_start.c
Examining data/ucspi-tcp-0.88/stralloc.h
Examining data/ucspi-tcp-0.88/stralloc_cat.c
Examining data/ucspi-tcp-0.88/stralloc_catb.c
Examining data/ucspi-tcp-0.88/stralloc_cats.c
Examining data/ucspi-tcp-0.88/stralloc_copy.c
Examining data/ucspi-tcp-0.88/stralloc_eady.c
Examining data/ucspi-tcp-0.88/stralloc_opyb.c
Examining data/ucspi-tcp-0.88/stralloc_opys.c
Examining data/ucspi-tcp-0.88/stralloc_pend.c
Examining data/ucspi-tcp-0.88/strerr.h
Examining data/ucspi-tcp-0.88/strerr_die.c
Examining data/ucspi-tcp-0.88/strerr_sys.c
Examining data/ucspi-tcp-0.88/subgetopt.c
Examining data/ucspi-tcp-0.88/subgetopt.h
Examining data/ucspi-tcp-0.88/tai.h
Examining data/ucspi-tcp-0.88/tai_pack.c
Examining data/ucspi-tcp-0.88/taia.h
Examining data/ucspi-tcp-0.88/taia_add.c
Examining data/ucspi-tcp-0.88/taia_approx.c
Examining data/ucspi-tcp-0.88/taia_frac.c
Examining data/ucspi-tcp-0.88/taia_less.c
Examining data/ucspi-tcp-0.88/taia_now.c
Examining data/ucspi-tcp-0.88/taia_pack.c
Examining data/ucspi-tcp-0.88/taia_sub.c
Examining data/ucspi-tcp-0.88/taia_uint.c
Examining data/ucspi-tcp-0.88/trycpp.c
Examining data/ucspi-tcp-0.88/trylsock.c
Examining data/ucspi-tcp-0.88/trypoll.c
Examining data/ucspi-tcp-0.88/trysgact.c
Examining data/ucspi-tcp-0.88/trysgprm.c
Examining data/ucspi-tcp-0.88/tryshsgr.c
Examining data/ucspi-tcp-0.88/trysysel.c
Examining data/ucspi-tcp-0.88/tryulong32.c
Examining data/ucspi-tcp-0.88/tryulong64.c
Examining data/ucspi-tcp-0.88/tryvfork.c
Examining data/ucspi-tcp-0.88/trywaitp.c
Examining data/ucspi-tcp-0.88/uint16.h
Examining data/ucspi-tcp-0.88/uint16_pack.c
Examining data/ucspi-tcp-0.88/uint16_unpack.c
Examining data/ucspi-tcp-0.88/uint32_pack.c
Examining data/ucspi-tcp-0.88/uint32_unpack.c
Examining data/ucspi-tcp-0.88/wait.h
Examining data/ucspi-tcp-0.88/wait_nohang.c
Examining data/ucspi-tcp-0.88/wait_pid.c
Examining data/ucspi-tcp-0.88/x86cpuid.c
Examining data/ucspi-tcp-0.88/error.h
Examining data/ucspi-tcp-0.88/rblsmtpd.c
FINAL RESULTS:
data/ucspi-tcp-0.88/install.c:23:7: [5] (race) chown:
This accepts filename arguments; if an attacker can move those files, a
race condition results. (CWE-362). Use fchown( ) instead.
if (chown(home,uid,gid) == -1)
data/ucspi-tcp-0.88/install.c:25:7: [5] (race) chmod:
This accepts filename arguments; if an attacker can move those files, a
race condition results. (CWE-362). Use fchmod( ) instead.
if (chmod(home,mode) == -1)
data/ucspi-tcp-0.88/install.c:41:7: [5] (race) chown:
This accepts filename arguments; if an attacker can move those files, a
race condition results. (CWE-362). Use fchown( ) instead.
if (chown(subdir,uid,gid) == -1)
data/ucspi-tcp-0.88/install.c:43:7: [5] (race) chmod:
This accepts filename arguments; if an attacker can move those files, a
race condition results. (CWE-362). Use fchmod( ) instead.
if (chmod(subdir,mode) == -1)
data/ucspi-tcp-0.88/install.c:96:7: [5] (race) chown:
This accepts filename arguments; if an attacker can move those files, a
race condition results. (CWE-362). Use fchown( ) instead.
if (chown(file,uid,gid) == -1)
data/ucspi-tcp-0.88/install.c:98:7: [5] (race) chmod:
This accepts filename arguments; if an attacker can move those files, a
race condition results. (CWE-362). Use fchmod( ) instead.
if (chmod(file,mode) == -1)
data/ucspi-tcp-0.88/install.c:134:7: [5] (race) chown:
This accepts filename arguments; if an attacker can move those files, a
race condition results. (CWE-362). Use fchown( ) instead.
if (chown(file,uid,gid) == -1)
data/ucspi-tcp-0.88/install.c:136:7: [5] (race) chmod:
This accepts filename arguments; if an attacker can move those files, a
race condition results. (CWE-362). Use fchmod( ) instead.
if (chmod(file,mode) == -1)
data/ucspi-tcp-0.88/rblsmtpd.c:177:17: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while ((opt = getopt(argc,argv,"bBcCt:r:a:")) != opteof)
data/ucspi-tcp-0.88/sgetopt.c:19:9: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
#define getopt sgetoptmine
data/ucspi-tcp-0.88/sgetopt.c:28:5: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
int getopt(int argc,char **argv,char *opts)
data/ucspi-tcp-0.88/sgetopt.h:5:9: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
#define getopt sgetoptmine
data/ucspi-tcp-0.88/tcpclient.c:83:17: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while ((opt = getopt(argc,argv,"dDvqQhHrRi:p:t:T:l:")) != opteof)
data/ucspi-tcp-0.88/tcpserver.c:303:17: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while ((opt = getopt(argc,argv,"dDvqQhHrR1UXx:t:u:g:l:b:B:c:pPoO")) != opteof)
data/ucspi-tcp-0.88/alloc.c:9:17: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
typedef union { char irrelevant[ALIGNMENT]; double d; } aligned;
data/ucspi-tcp-0.88/auto-str.c:5:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char bspace[256];
data/ucspi-tcp-0.88/auto-str.c:18:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char octal[4];
data/ucspi-tcp-0.88/buffer_0.c:10:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer_0_space[BUFFER_INSIZE];
data/ucspi-tcp-0.88/buffer_1.c:4:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer_1_space[BUFFER_OUTSIZE];
data/ucspi-tcp-0.88/buffer_2.c:4:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer_2_space[256];
data/ucspi-tcp-0.88/cdb.c:72:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[32];
data/ucspi-tcp-0.88/cdb.c:89:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[8];
data/ucspi-tcp-0.88/cdb_make.c:54:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[8];
data/ucspi-tcp-0.88/cdb_make.c:75:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[8];
data/ucspi-tcp-0.88/cdb_make.h:20:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char bspace[8192];
data/ucspi-tcp-0.88/cdb_make.h:21:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char final[2048];
data/ucspi-tcp-0.88/dns.h:38:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char localip[4];
data/ucspi-tcp-0.88/dns.h:39:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char qtype[2];
data/ucspi-tcp-0.88/dns_dfd.c:8:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char label[63];
data/ucspi-tcp-0.88/dns_dfd.c:10:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[255];
data/ucspi-tcp-0.88/dns_dtda.c:9:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[4];
data/ucspi-tcp-0.88/dns_ip.c:9:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char header[12];
data/ucspi-tcp-0.88/dns_name.c:11:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char header[12];
data/ucspi-tcp-0.88/dns_name.c:38:29: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
int dns_name4(stralloc *out,char ip[4])
data/ucspi-tcp-0.88/dns_name.c:40:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[DNS_NAME4_DOMAIN];
data/ucspi-tcp-0.88/dns_nd.c:5:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
void dns_name4_domain(char name[DNS_NAME4_DOMAIN],char ip[4])
data/ucspi-tcp-0.88/dns_nd.c:5:51: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
void dns_name4_domain(char name[DNS_NAME4_DOMAIN],char ip[4])
data/ucspi-tcp-0.88/dns_packet.c:42:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[255];
data/ucspi-tcp-0.88/dns_random.c:32:22: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
void dns_random_init(char data[128])
data/ucspi-tcp-0.88/dns_random.c:36:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tpack[16];
data/ucspi-tcp-0.88/dns_rcip.c:10:17: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static int init(char ip[64])
data/ucspi-tcp-0.88/dns_rcip.c:61:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char ip[64]; /* defined if ok */
data/ucspi-tcp-0.88/dns_rcip.c:63:22: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
int dns_resolvconfip(char s[64])
data/ucspi-tcp-0.88/dns_rcrw.c:12:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char host[256];
data/ucspi-tcp-0.88/dns_resolve.c:8:17: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
int dns_resolve(char *q,char qtype[2])
data/ucspi-tcp-0.88/dns_resolve.c:8:25: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
int dns_resolve(char *q,char qtype[2])
data/ucspi-tcp-0.88/dns_resolve.c:12:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char servers[64];
data/ucspi-tcp-0.88/dns_sortip.c:10:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmp[4];
data/ucspi-tcp-0.88/dns_transmit.c:11:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char out[12];
data/ucspi-tcp-0.88/dns_transmit.c:20:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char out[12];
data/ucspi-tcp-0.88/dns_transmit.c:32:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char out[12];
data/ucspi-tcp-0.88/dns_transmit.c:194:47: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
int dns_transmit_start(struct dns_transmit *d,char servers[64],int flagrecursive,char *q,char qtype[2],char localip[4])
data/ucspi-tcp-0.88/dns_transmit.c:194:82: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
int dns_transmit_start(struct dns_transmit *d,char servers[64],int flagrecursive,char *q,char qtype[2],char localip[4])
data/ucspi-tcp-0.88/dns_transmit.c:194:90: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
int dns_transmit_start(struct dns_transmit *d,char servers[64],int flagrecursive,char *q,char qtype[2],char localip[4])
data/ucspi-tcp-0.88/dns_transmit.c:194:104: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
int dns_transmit_start(struct dns_transmit *d,char servers[64],int flagrecursive,char *q,char qtype[2],char localip[4])
data/ucspi-tcp-0.88/dns_transmit.c:241:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char udpbuf[513];
data/ucspi-tcp-0.88/dns_txt.c:9:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char header[12];
data/ucspi-tcp-0.88/fixcrio.c:12:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char prebuf[256];
data/ucspi-tcp-0.88/fixcrio.c:15:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char leftbuf[512];
data/ucspi-tcp-0.88/fixcrio.c:21:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char rightbuf[512];
data/ucspi-tcp-0.88/install.c:47:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char inbuf[BUFFER_INSIZE];
data/ucspi-tcp-0.88/install.c:48:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char outbuf[BUFFER_OUTSIZE];
data/ucspi-tcp-0.88/ip4_fmt.c:4:22: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned int ip4_fmt(char *s,char ip[4])
data/ucspi-tcp-0.88/ip4_fmt.c:4:30: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned int ip4_fmt(char *s,char ip[4])
data/ucspi-tcp-0.88/ip4_scan.c:4:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned int ip4_scan(char *s,char ip[4])
data/ucspi-tcp-0.88/ip4_scan.c:4:31: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned int ip4_scan(char *s,char ip[4])
data/ucspi-tcp-0.88/mconnect-io.c:9:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char outbuf[512];
data/ucspi-tcp-0.88/mconnect-io.c:12:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char inbuf[512];
data/ucspi-tcp-0.88/open_read.c:6:10: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
{ return open(fn,O_RDONLY | O_NDELAY); }
data/ucspi-tcp-0.88/open_trunc.c:6:10: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
{ return open(fn,O_WRONLY | O_NDELAY | O_TRUNC | O_CREAT,0644); }
data/ucspi-tcp-0.88/open_write.c:6:10: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
{ return open(fn,O_WRONLY | O_NDELAY); }
data/ucspi-tcp-0.88/rblsmtpd.c:96:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char strnum[FMT_ULONG];
data/ucspi-tcp-0.88/rblsmtpd.c:99:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char inspace[64]; buffer in = BUFFER_INIT(read,0,inspace,sizeof inspace);
data/ucspi-tcp-0.88/rblsmtpd.c:100:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char outspace[1]; buffer out = BUFFER_INIT(write,1,outspace,sizeof outspace);
data/ucspi-tcp-0.88/recordio.c:14:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pid[FMT_ULONG];
data/ucspi-tcp-0.88/recordio.c:16:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char recordbuf[512];
data/ucspi-tcp-0.88/recordio.c:44:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char leftbuf[256];
data/ucspi-tcp-0.88/recordio.c:49:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char rightbuf[256];
data/ucspi-tcp-0.88/remoteinfo.c:48:37: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static int doit(stralloc *out,int s,char ipremote[4],uint16 portremote,char iplocal[4],uint16 portlocal,unsigned int timeout)
data/ucspi-tcp-0.88/remoteinfo.c:48:72: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static int doit(stralloc *out,int s,char ipremote[4],uint16 portremote,char iplocal[4],uint16 portlocal,unsigned int timeout)
data/ucspi-tcp-0.88/remoteinfo.c:51:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char bspace[128];
data/ucspi-tcp-0.88/remoteinfo.c:52:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char strnum[FMT_ULONG];
data/ucspi-tcp-0.88/remoteinfo.c:82:30: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
int remoteinfo(stralloc *out,char ipremote[4],uint16 portremote,char iplocal[4],uint16 portlocal,unsigned int timeout)
data/ucspi-tcp-0.88/remoteinfo.c:82:65: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
int remoteinfo(stralloc *out,char ipremote[4],uint16 portremote,char iplocal[4],uint16 portlocal,unsigned int timeout)
data/ucspi-tcp-0.88/sgetopt.c:41:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char chp[2]; chp[0] = optproblem; chp[1] = '\n';
data/ucspi-tcp-0.88/socket_accept.c:8:26: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
int socket_accept4(int s,char ip[4],uint16 *port)
data/ucspi-tcp-0.88/socket_bind.c:8:24: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
int socket_bind4(int s,char ip[4],uint16 port)
data/ucspi-tcp-0.88/socket_bind.c:20:30: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
int socket_bind4_reuse(int s,char ip[4],uint16 port)
data/ucspi-tcp-0.88/socket_conn.c:9:27: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
int socket_connect4(int s,char ip[4],uint16 port)
data/ucspi-tcp-0.88/socket_local.c:8:25: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
int socket_local4(int s,char ip[4],uint16 *port)
data/ucspi-tcp-0.88/socket_remote.c:8:26: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
int socket_remote4(int s,char ip[4],uint16 *port)
data/ucspi-tcp-0.88/tcpclient.c:50:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char iplocal[4] = { 0,0,0,0 };
data/ucspi-tcp-0.88/tcpclient.c:54:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ipremote[4];
data/ucspi-tcp-0.88/tcpclient.c:63:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char strnum[FMT_ULONG];
data/ucspi-tcp-0.88/tcpclient.c:64:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ipstr[IP4_FMT];
data/ucspi-tcp-0.88/tcpclient.c:66:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char seed[128];
data/ucspi-tcp-0.88/tcprules.c:43:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char strnum[FMT_ULONG];
data/ucspi-tcp-0.88/tcpserver.c:43:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char localportstr[FMT_ULONG];
data/ucspi-tcp-0.88/tcpserver.c:44:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char localip[4];
data/ucspi-tcp-0.88/tcpserver.c:45:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char localipstr[IP4_FMT];
data/ucspi-tcp-0.88/tcpserver.c:50:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char remoteportstr[FMT_ULONG];
data/ucspi-tcp-0.88/tcpserver.c:51:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char remoteip[4];
data/ucspi-tcp-0.88/tcpserver.c:52:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char remoteipstr[IP4_FMT];
data/ucspi-tcp-0.88/tcpserver.c:56:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char strnum[FMT_ULONG];
data/ucspi-tcp-0.88/tcpserver.c:57:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char strnum2[FMT_ULONG];
data/ucspi-tcp-0.88/tcpserver.c:63:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char bspace[16];
data/ucspi-tcp-0.88/timeoutconn.c:7:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
int timeoutconn(int s,char ip[4],uint16 port,unsigned int timeout)
data/ucspi-tcp-0.88/trypoll.c:9:10: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
x.fd = open("trypoll.c",O_RDONLY);
data/ucspi-tcp-0.88/tryvfork.c:3:3: [2] (race) vfork:
On some old systems, vfork() permits race conditions, and it's very
difficult to use correctly (CWE-362). Use fork() instead.
vfork();
data/ucspi-tcp-0.88/uint16_pack.c:3:18: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
void uint16_pack(char s[2],uint16 u)
data/ucspi-tcp-0.88/uint16_pack.c:9:22: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
void uint16_pack_big(char s[2],uint16 u)
data/ucspi-tcp-0.88/uint16_unpack.c:3:20: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
void uint16_unpack(char s[2],uint16 *u)
data/ucspi-tcp-0.88/uint16_unpack.c:14:24: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
void uint16_unpack_big(char s[2],uint16 *u)
data/ucspi-tcp-0.88/uint32_pack.c:3:18: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
void uint32_pack(char s[4],uint32 u)
data/ucspi-tcp-0.88/uint32_pack.c:13:22: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
void uint32_pack_big(char s[4],uint32 u)
data/ucspi-tcp-0.88/uint32_unpack.c:3:20: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
void uint32_unpack(char s[4],uint32 *u)
data/ucspi-tcp-0.88/uint32_unpack.c:18:24: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
void uint32_unpack_big(char s[4],uint32 *u)
data/ucspi-tcp-0.88/buffer_0.c:7:10: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
return read(fd,buf,len);
data/ucspi-tcp-0.88/cdb.c:55:13: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
r = read(c->fd,buf,len);
data/ucspi-tcp-0.88/dns_transmit.c:318:9: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
r = read(fd,&ch,1);
data/ucspi-tcp-0.88/dns_transmit.c:331:9: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
r = read(fd,&ch,1);
data/ucspi-tcp-0.88/dns_transmit.c:349:9: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
r = read(fd,d->packet + d->pos,d->packetlen - d->pos);
data/ucspi-tcp-0.88/fixcrio.c:75:11: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
r = read(0,prebuf,sizeof prebuf);
data/ucspi-tcp-0.88/fixcrio.c:103:11: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
r = read(fdright,prebuf,sizeof prebuf);
data/ucspi-tcp-0.88/install.c:69:21: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
buffer_init(&ssin,read,fdin,inbuf,sizeof inbuf);
data/ucspi-tcp-0.88/install.c:146:3: [1] (access) umask:
Ensure that umask is given most restrictive possible setting (e.g., 066 or
077) (CWE-732).
umask(077);
data/ucspi-tcp-0.88/mconnect-io.c:18:10: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
return read(fd,buf,len);
data/ucspi-tcp-0.88/rblsmtpd.c:99:43: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
char inspace[64]; buffer in = BUFFER_INIT(read,0,inspace,sizeof inspace);
data/ucspi-tcp-0.88/readclose.c:10:9: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
r = read(fd,sa->s + sa->len,bufsize);
data/ucspi-tcp-0.88/readwrite.h:4:12: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
extern int read();
data/ucspi-tcp-0.88/recordio.c:100:11: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
r = read(0,leftbuf,sizeof leftbuf);
data/ucspi-tcp-0.88/recordio.c:122:11: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
r = read(fdright,rightbuf,sizeof rightbuf);
data/ucspi-tcp-0.88/remoteinfo.c:45:10: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
return read(fd,buf,len);
data/ucspi-tcp-0.88/socket_conn.c:29:5: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
read(s,&ch,1); /* sets errno */
ANALYSIS SUMMARY:
Hits = 134
Lines analyzed = 6637 in approximately 0.20 seconds (33729 lines/second)
Physical Source Lines of Code (SLOC) = 5595
Hits@level = [0] 4 [1] 17 [2] 103 [3] 6 [4] 0 [5] 8
Hits@level+ = [0+] 138 [1+] 134 [2+] 117 [3+] 14 [4+] 8 [5+] 8
Hits/KSLOC@level+ = [0+] 24.6649 [1+] 23.95 [2+] 20.9115 [3+] 2.50223 [4+] 1.42985 [5+] 1.42985
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.