Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/upower-0.99.11/libupower-glib/up-types.c
Examining data/upower-0.99.11/libupower-glib/up-autocleanups.h
Examining data/upower-0.99.11/libupower-glib/up-client.c
Examining data/upower-0.99.11/libupower-glib/upower.h
Examining data/upower-0.99.11/libupower-glib/up-history-item.h
Examining data/upower-0.99.11/libupower-glib/up-version.h
Examining data/upower-0.99.11/libupower-glib/up-wakeup-item.h
Examining data/upower-0.99.11/libupower-glib/up-wakeups.h
Examining data/upower-0.99.11/libupower-glib/up-history-item.c
Examining data/upower-0.99.11/libupower-glib/up-wakeups.c
Examining data/upower-0.99.11/libupower-glib/up-wakeup-item.c
Examining data/upower-0.99.11/libupower-glib/up-stats-item.c
Examining data/upower-0.99.11/libupower-glib/up-types.h
Examining data/upower-0.99.11/libupower-glib/up-device.h
Examining data/upower-0.99.11/libupower-glib/up-device.c
Examining data/upower-0.99.11/libupower-glib/up-client.h
Examining data/upower-0.99.11/libupower-glib/up-stats-item.h
Examining data/upower-0.99.11/dbus/up-device-generated.h
Examining data/upower-0.99.11/dbus/up-daemon-generated.h
Examining data/upower-0.99.11/dbus/up-daemon-generated.c
Examining data/upower-0.99.11/dbus/up-wakeups-generated.c
Examining data/upower-0.99.11/dbus/up-device-generated.c
Examining data/upower-0.99.11/dbus/up-kbd-backlight-generated.c
Examining data/upower-0.99.11/dbus/up-wakeups-generated.h
Examining data/upower-0.99.11/dbus/up-kbd-backlight-generated.h
Examining data/upower-0.99.11/tools/up-tool.c
Examining data/upower-0.99.11/src/up-constants.h
Examining data/upower-0.99.11/src/bsd/up-backend-common.c
Examining data/upower-0.99.11/src/linux/up-native.c
Examining data/upower-0.99.11/src/linux/up-device-idevice.h
Examining data/upower-0.99.11/src/linux/up-input.c
Examining data/upower-0.99.11/src/linux/up-device-supply.h
Examining data/upower-0.99.11/src/linux/sysfs-utils.c
Examining data/upower-0.99.11/src/linux/up-device-csr.c
Examining data/upower-0.99.11/src/linux/up-input.h
Examining data/upower-0.99.11/src/linux/sysfs-utils.h
Examining data/upower-0.99.11/src/linux/hidpp-device.c
Examining data/upower-0.99.11/src/linux/up-backend.c
Examining data/upower-0.99.11/src/linux/hidpp-device.h
Examining data/upower-0.99.11/src/linux/up-device-bluez.c
Examining data/upower-0.99.11/src/linux/up-device-supply.c
Examining data/upower-0.99.11/src/linux/up-device-wup.h
Examining data/upower-0.99.11/src/linux/up-device-bluez.h
Examining data/upower-0.99.11/src/linux/hidpp-test.c
Examining data/upower-0.99.11/src/linux/up-device-csr.h
Examining data/upower-0.99.11/src/linux/up-device-idevice.c
Examining data/upower-0.99.11/src/linux/up-device-hid.h
Examining data/upower-0.99.11/src/linux/up-backend-linux-private.h
Examining data/upower-0.99.11/src/linux/up-device-wup.c
Examining data/upower-0.99.11/src/linux/up-device-unifying.c
Examining data/upower-0.99.11/src/linux/up-device-unifying.h
Examining data/upower-0.99.11/src/linux/up-device-hid.c
Examining data/upower-0.99.11/src/up-daemon.h
Examining data/upower-0.99.11/src/up-history.h
Examining data/upower-0.99.11/src/up-kbd-backlight.c
Examining data/upower-0.99.11/src/up-self-test.c
Examining data/upower-0.99.11/src/up-daemon.c
Examining data/upower-0.99.11/src/up-device-list.c
Examining data/upower-0.99.11/src/openbsd/up-native.c
Examining data/upower-0.99.11/src/openbsd/up-backend.c
Examining data/upower-0.99.11/src/openbsd/up-apm-native.h
Examining data/upower-0.99.11/src/up-wakeups.h
Examining data/upower-0.99.11/src/up-wakeups.c
Examining data/upower-0.99.11/src/freebsd/up-util.h
Examining data/upower-0.99.11/src/freebsd/up-devd.h
Examining data/upower-0.99.11/src/freebsd/up-native.c
Examining data/upower-0.99.11/src/freebsd/up-device-supply.h
Examining data/upower-0.99.11/src/freebsd/up-backend.c
Examining data/upower-0.99.11/src/freebsd/up-device-supply.c
Examining data/upower-0.99.11/src/freebsd/up-acpi-native.h
Examining data/upower-0.99.11/src/freebsd/up-backend-acpi.h
Examining data/upower-0.99.11/src/freebsd/up-util.c
Examining data/upower-0.99.11/src/freebsd/up-devd.c
Examining data/upower-0.99.11/src/freebsd/up-acpi-native.c
Examining data/upower-0.99.11/src/up-kbd-backlight.h
Examining data/upower-0.99.11/src/up-config.h
Examining data/upower-0.99.11/src/up-backend-bsd-private.h
Examining data/upower-0.99.11/src/up-backend.h
Examining data/upower-0.99.11/src/up-device-list.h
Examining data/upower-0.99.11/src/dummy/up-native.c
Examining data/upower-0.99.11/src/dummy/up-backend.c
Examining data/upower-0.99.11/src/up-device.h
Examining data/upower-0.99.11/src/up-device.c
Examining data/upower-0.99.11/src/up-config.c
Examining data/upower-0.99.11/src/up-native.h
Examining data/upower-0.99.11/src/up-history.c
Examining data/upower-0.99.11/src/up-main.c
FINAL RESULTS:
data/upower-0.99.11/src/freebsd/up-backend.c:53:79: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
static gboolean up_backend_acpi_devd_notify (UpBackend *backend, const gchar *system, const gchar *subsystem, const gchar *type, const gchar *data);
data/upower-0.99.11/src/freebsd/up-backend.c:113:63: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
up_backend_acpi_devd_notify (UpBackend *backend, const gchar *system, const gchar *subsystem, const gchar *type, const gchar *data)
data/upower-0.99.11/src/freebsd/up-backend.c:118:14: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
if (strcmp (system, "ACPI"))
data/upower-0.99.11/src/freebsd/up-devd.c:79:18: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
gchar **system,
data/upower-0.99.11/src/freebsd/up-devd.c:92:23: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
g_return_val_if_fail(system != NULL, FALSE);
data/upower-0.99.11/src/freebsd/up-devd.c:120:24: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
const gchar *system,
data/upower-0.99.11/src/freebsd/up-devd.c:128:19: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
g_return_if_fail(system != NULL);
data/upower-0.99.11/src/freebsd/up-devd.c:134:60: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
if (handlers[i]->notify && handlers[i]->notify (backend, system, subsystem, type, data))
data/upower-0.99.11/src/freebsd/up-devd.c:158:10: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
gchar *system;
data/upower-0.99.11/src/freebsd/up-devd.c:163:42: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
if (!up_devd_parse_notify (event + 1, &system, &subsystem, &type, &data))
data/upower-0.99.11/src/freebsd/up-devd.c:166:42: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
up_devd_process_notify_event (backend, system, subsystem, type, data);
data/upower-0.99.11/src/freebsd/up-devd.c:168:11: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
g_free (system);
data/upower-0.99.11/src/freebsd/up-devd.h:37:19: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
const char *system,
data/upower-0.99.11/src/up-self-test.c:151:34: [3] (buffer) g_get_tmp_dir:
This function is synonymous with 'getenv("TMP")';it returns untrustable
input if the environment can beset by an attacker. It can have any content
and length, and the same variable can be set more than once (CWE-807,
CWE-20). Check environment variables carefully before using them.
history_dir = g_build_filename (g_get_tmp_dir(), "upower-test.XXXXXX", NULL);
data/upower-0.99.11/libupower-glib/up-history-item.c:220:42: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
up_history_item_set_time (history_item, atoi (parts[0]));
data/upower-0.99.11/src/freebsd/up-acpi-native.c:95:24: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
self->priv->_unit = atoi (_tmp6_ = g_match_info_fetch (mi, 2));
data/upower-0.99.11/src/freebsd/up-device-supply.c:173:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd = open (UP_ACPIDEV, O_RDONLY);
data/upower-0.99.11/src/linux/hidpp-device.c:661:14: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
priv->fd = open (device->priv->hidraw_device, O_RDWR | O_NONBLOCK);
data/upower-0.99.11/src/linux/sysfs-utils.c:117:12: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
result = atoi (contents);
data/upower-0.99.11/src/linux/up-device-hid.c:329:18: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
hid->priv->fd = open (device_file, O_RDONLY | O_NONBLOCK);
data/upower-0.99.11/src/linux/up-device-wup.c:263:9: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
size = atoi (tokens[2]);
data/upower-0.99.11/src/linux/up-device-wup.c:318:18: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
wup->priv->fd = open (device_file, O_RDWR | O_NONBLOCK);
data/upower-0.99.11/src/linux/up-input.c:221:25: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
input->priv->eventfp = open (device_file, O_RDONLY | O_NONBLOCK);
data/upower-0.99.11/src/openbsd/up-native.c:63:17: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((apm_fd = open("/dev/apm", O_RDONLY)) == -1) {
data/upower-0.99.11/src/up-kbd-backlight.c:292:28: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
kbd_backlight->priv->fd = open (path_now, O_RDWR);
data/upower-0.99.11/src/up-kbd-backlight.c:299:39: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
kbd_backlight->priv->fd_hw_changed = open (path_hw_changed, O_RDONLY);
data/upower-0.99.11/src/up-wakeups.c:382:10: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
irq = atoi (found);
data/upower-0.99.11/src/up-wakeups.c:390:18: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
interrupts += atoi (found);
data/upower-0.99.11/src/up-wakeups.c:500:16: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
interrupts = atoi (string);
data/upower-0.99.11/src/up-wakeups.c:506:9: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
pid = atoi (string);
data/upower-0.99.11/src/up-wakeups.c:583:9: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
file = fopen (UP_WAKEUPS_SOURCE_USERSPACE, "w");
data/upower-0.99.11/src/up-wakeups.c:628:9: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
file = fopen (UP_WAKEUPS_SOURCE_USERSPACE, "w");
data/upower-0.99.11/src/freebsd/up-backend.c:193:59: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strncmp (up_acpi_native_get_path (native), "dev.", strlen ("dev."))) {
data/upower-0.99.11/src/freebsd/up-backend.c:205:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
handle += strlen ("handle=");
data/upower-0.99.11/src/freebsd/up-devd.c:64:10: [1] (buffer) equal:
Function does not check the second iterator for over-read conditions
(CWE-126). This function is often discouraged by most C++ coding standards
in favor of its safer alternatives provided since C++14. Consider using a
form of this function that checks the second iterator before potentially
overflowing it.
gchar *equal;
data/upower-0.99.11/src/freebsd/up-devd.c:68:10: [1] (buffer) equal:
Function does not check the second iterator for over-read conditions
(CWE-126). This function is often discouraged by most C++ coding standards
in favor of its safer alternatives provided since C++14. Consider using a
form of this function that checks the second iterator before potentially
overflowing it.
equal ? g_strndup(pairs[i], equal - pairs[i]) : g_strdup(pairs[i]),
data/upower-0.99.11/src/freebsd/up-devd.c:69:10: [1] (buffer) equal:
Function does not check the second iterator for over-read conditions
(CWE-126). This function is often discouraged by most C++ coding standards
in favor of its safer alternatives provided since C++14. Consider using a
form of this function that checks the second iterator before potentially
overflowing it.
equal ? g_strdup(equal + 1) : NULL);
data/upower-0.99.11/src/freebsd/up-devd.c:228:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy (addr.sun_path, UP_DEVD_SOCK_PATH, sizeof(addr.sun_path));
data/upower-0.99.11/src/linux/hidpp-device.c:311:7: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
r = read (priv->fd, &c, 1);
data/upower-0.99.11/src/linux/hidpp-device.c:425:7: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
r = read (priv->fd, response, sizeof (*response));
data/upower-0.99.11/src/linux/up-device-hid.c:402:7: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
rd = read (hid->priv->fd, ev, sizeof (ev));
data/upower-0.99.11/src/linux/up-device-supply.c:521:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(str);
data/upower-0.99.11/src/linux/up-device-wup.c:137:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
length = strlen (data);
data/upower-0.99.11/src/linux/up-device-wup.c:157:11: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
retval = read (wup->priv->fd, &buffer, UP_DEVICE_WUP_COMMAND_LEN);
data/upower-0.99.11/src/linux/up-device-wup.c:195:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
length = strlen (data);
data/upower-0.99.11/src/linux/up-device-wup.c:213:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
length = strlen (packet);
data/upower-0.99.11/src/linux/up-device-wup.c:236:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
length = strlen (tokens[0]);
data/upower-0.99.11/src/linux/up-device-wup.c:248:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
length = strlen (tokens[1]);
data/upower-0.99.11/src/linux/up-device-wup.c:256:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
length = strlen (tokens[2]);
data/upower-0.99.11/src/up-device.c:280:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (model != NULL && strlen (model) > 2) {
data/upower-0.99.11/src/up-device.c:289:25: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (serial != NULL && strlen (serial) > 2) {
data/upower-0.99.11/src/up-kbd-backlight.c:76:8: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
len = read (fd, buf, G_N_ELEMENTS (buf) - 1);
data/upower-0.99.11/src/up-kbd-backlight.c:116:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
length = strlen (text);
data/upower-0.99.11/src/up-wakeups.c:265:4: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy (temp_data, start, len);
ANALYSIS SUMMARY:
Hits = 54
Lines analyzed = 31154 in approximately 0.68 seconds (45949 lines/second)
Physical Source Lines of Code (SLOC) = 20374
Hits@level = [0] 3 [1] 22 [2] 18 [3] 1 [4] 13 [5] 0
Hits@level+ = [0+] 57 [1+] 54 [2+] 32 [3+] 14 [4+] 13 [5+] 0
Hits/KSLOC@level+ = [0+] 2.79768 [1+] 2.65044 [2+] 1.57063 [3+] 0.68715 [4+] 0.638068 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.