Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/v86d-0.1.10/libs/lrmi-0.10/lrmi.c
Examining data/v86d-0.1.10/libs/lrmi-0.10/lrmi.h
Examining data/v86d-0.1.10/libs/lrmi-0.10/vbe.h
Examining data/v86d-0.1.10/libs/lrmi-0.10/vbetest.c
Examining data/v86d-0.1.10/libs/x86emu/debug.c
Examining data/v86d-0.1.10/libs/x86emu/decode.c
Examining data/v86d-0.1.10/libs/x86emu/fpu.c
Examining data/v86d-0.1.10/libs/x86emu/ops.c
Examining data/v86d-0.1.10/libs/x86emu/ops2.c
Examining data/v86d-0.1.10/libs/x86emu/prim_ops.c
Examining data/v86d-0.1.10/libs/x86emu/sys.c
Examining data/v86d-0.1.10/libs/x86emu/validate.c
Examining data/v86d-0.1.10/libs/x86emu/x86emu.h
Examining data/v86d-0.1.10/libs/x86emu/x86emu/debug.h
Examining data/v86d-0.1.10/libs/x86emu/x86emu/decode.h
Examining data/v86d-0.1.10/libs/x86emu/x86emu/fpu.h
Examining data/v86d-0.1.10/libs/x86emu/x86emu/fpu_regs.h
Examining data/v86d-0.1.10/libs/x86emu/x86emu/ops.h
Examining data/v86d-0.1.10/libs/x86emu/x86emu/prim_asm.h
Examining data/v86d-0.1.10/libs/x86emu/x86emu/prim_ops.h
Examining data/v86d-0.1.10/libs/x86emu/x86emu/regs.h
Examining data/v86d-0.1.10/libs/x86emu/x86emu/types.h
Examining data/v86d-0.1.10/libs/x86emu/x86emu/x86emui.h
Examining data/v86d-0.1.10/testvbe.c
Examining data/v86d-0.1.10/testvbe.h
Examining data/v86d-0.1.10/v86.c
Examining data/v86d-0.1.10/v86.h
Examining data/v86d-0.1.10/v86_common.c
Examining data/v86d-0.1.10/v86_lrmi.c
Examining data/v86d-0.1.10/v86_mem.c
Examining data/v86d-0.1.10/v86_x86emu.c
Examining data/v86d-0.1.10/v86_x86emu.h
FINAL RESULTS:
data/v86d-0.1.10/libs/lrmi-0.10/vbetest.c:297:2: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(run_command);
data/v86d-0.1.10/libs/x86emu/debug.c:166:2: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(M.x86.decoded_buf+M.x86.enc_str_pos,"%s",x);
data/v86d-0.1.10/libs/x86emu/debug.c:173:2: [4] (format) sprintf:
Potential format string problem (CWE-134). Make format string constant.
sprintf(temp,x,y);
data/v86d-0.1.10/libs/x86emu/debug.c:174:2: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(M.x86.decoded_buf+M.x86.enc_str_pos,"%s",temp);
data/v86d-0.1.10/libs/x86emu/validate.c:598:5: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
vfprintf(stdout, fmt, argptr);
data/v86d-0.1.10/libs/x86emu/validate.c:609:9: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(buf,separator);
data/v86d-0.1.10/libs/x86emu/validate.c:614:9: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(buf,separator);
data/v86d-0.1.10/libs/x86emu/validate.c:619:9: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(buf,separator);
data/v86d-0.1.10/libs/x86emu/validate.c:624:9: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(buf,separator);
data/v86d-0.1.10/libs/x86emu/validate.c:629:9: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(buf,separator);
data/v86d-0.1.10/libs/x86emu/validate.c:634:9: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(buf,separator);
data/v86d-0.1.10/v86.h:34:62: [4] (format) syslog:
If syslog's format strings can be influenced by an attacker, they can be
exploited (CWE-134). Use a constant format string for syslog.
#define ulog(level, args...) if (level <= MAX_LOG_LEVEL) { syslog(level, ##args); }
data/v86d-0.1.10/libs/lrmi-0.10/lrmi.c:92:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd = open(name, O_RDONLY);
data/v86d-0.1.10/libs/lrmi-0.10/lrmi.c:116:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd = open(name, (flags & MAP_SHARED) ? O_RDWR : O_RDONLY);
data/v86d-0.1.10/libs/lrmi-0.10/lrmi.c:395:13: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
((unsigned char *)m)[0] = 0xcd; /* int opcode */
data/v86d-0.1.10/libs/lrmi-0.10/lrmi.c:396:13: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
((unsigned char *)m)[1] = RETURN_TO_32_INT;
data/v86d-0.1.10/libs/lrmi-0.10/lrmi.c:876:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&CONTEXT_REGS, sc, sizeof(*sc));
data/v86d-0.1.10/libs/lrmi-0.10/lrmi.c:915:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sc, &CONTEXT_REGS, sizeof(*sc));
data/v86d-0.1.10/libs/lrmi-0.10/lrmi.c:924:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&CONTEXT_REGS, sc, sizeof(*sc));
data/v86d-0.1.10/libs/lrmi-0.10/lrmi.c:957:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sc, &CONTEXT_REGS, sizeof(*sc));
data/v86d-0.1.10/libs/lrmi-0.10/vbe.h:11:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char vbe_signature[4];
data/v86d-0.1.10/libs/lrmi-0.10/vbe.h:26:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char reserved[222];
data/v86d-0.1.10/libs/lrmi-0.10/vbe.h:27:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char oem_data[256];
data/v86d-0.1.10/libs/lrmi-0.10/vbe.h:85:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char res2[206];
data/v86d-0.1.10/libs/lrmi-0.10/vbetest.c:177:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(vbe.win + addr, &c, pixel_size);
data/v86d-0.1.10/libs/lrmi-0.10/vbetest.c:388:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(vbe.info->vbe_signature, "VBE2", 4);
data/v86d-0.1.10/libs/x86emu/debug.c:172:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char temp[100];
data/v86d-0.1.10/libs/x86emu/debug.c:187:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf1[64];
data/v86d-0.1.10/libs/x86emu/debug.c:189:3: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(buf1+2*i,"%02x", fetch_data_byte_abs(s,o+i));
data/v86d-0.1.10/libs/x86emu/debug.c:231:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char s[1024];
data/v86d-0.1.10/libs/x86emu/validate.c:64:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf1[80],buf2[80]; \
data/v86d-0.1.10/libs/x86emu/validate.c:195:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf1[80],buf2[80]; \
data/v86d-0.1.10/libs/x86emu/validate.c:263:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf1[80],buf2[80]; \
data/v86d-0.1.10/libs/x86emu/validate.c:343:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf1[80],buf2[80]; \
data/v86d-0.1.10/libs/x86emu/validate.c:384:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf1[80],buf2[80]; \
data/v86d-0.1.10/libs/x86emu/validate.c:426:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf1[80],buf2[80]; \
data/v86d-0.1.10/libs/x86emu/validate.c:467:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf1[80],buf2[80]; \
data/v86d-0.1.10/libs/x86emu/validate.c:511:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf1[80],buf2[80]; \
data/v86d-0.1.10/libs/x86emu/validate.c:556:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf1[80],buf2[80]; \
data/v86d-0.1.10/libs/x86emu/validate.c:610:9: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant string.
strcat(buf,"CF");
data/v86d-0.1.10/libs/x86emu/validate.c:615:9: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant string.
strcat(buf,"PF");
data/v86d-0.1.10/libs/x86emu/validate.c:620:9: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant string.
strcat(buf,"AF");
data/v86d-0.1.10/libs/x86emu/validate.c:625:9: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant string.
strcat(buf,"ZF");
data/v86d-0.1.10/libs/x86emu/validate.c:630:9: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant string.
strcat(buf,"SF");
data/v86d-0.1.10/libs/x86emu/validate.c:635:9: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant string.
strcat(buf,"OF");
data/v86d-0.1.10/libs/x86emu/validate.c:639:9: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(buf,"None");
data/v86d-0.1.10/libs/x86emu/x86emu/regs.h:285:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char decode_buf[32]; /* encoded byte stream */
data/v86d-0.1.10/libs/x86emu/x86emu/regs.h:286:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char decoded_buf[256]; /* disassembled strings */
data/v86d-0.1.10/v86.c:27:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[CONNECTOR_MAX_MSG_SIZE];
data/v86d-0.1.10/v86.c:40:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(m, msg, sizeof(*m) + msg->len);
data/v86d-0.1.10/v86.c:68:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[CONNECTOR_MAX_MSG_SIZE];
data/v86d-0.1.10/v86_common.c:56:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(vptr(lbuf), buf, tsk->buf_len);
data/v86d-0.1.10/v86_common.c:65:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf, vptr(lbuf), tsk->buf_len);
data/v86d-0.1.10/v86_common.c:130:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(vptr(lbuf), buf, tsk->buf_len);
data/v86d-0.1.10/v86_common.c:147:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf, vptr(lbuf), tsk->buf_len);
data/v86d-0.1.10/v86_mem.c:89:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd = open(name, (flags & MAP_SHARED) ? O_RDWR : O_RDONLY);
data/v86d-0.1.10/v86_mem.c:226:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dest, mem_tmp + diff, num_bytes);
data/v86d-0.1.10/libs/lrmi-0.10/lrmi.c:99:6: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (read(fd, p, n) != n) {
data/v86d-0.1.10/libs/x86emu/debug.c:167:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
M.x86.enc_str_pos += strlen(x);
data/v86d-0.1.10/libs/x86emu/debug.c:175:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
M.x86.enc_str_pos += strlen(temp);
data/v86d-0.1.10/testvbe.c:29:2: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120). Risk is low because the source is a
constant string.
strncpy((char*)&ib.vbe_signature, "VBE2", 4);
data/v86d-0.1.10/v86_common.c:18:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy((char*)cbuf, vptr(t), fsize); \
ANALYSIS SUMMARY:
Hits = 62
Lines analyzed = 26628 in approximately 0.60 seconds (44454 lines/second)
Physical Source Lines of Code (SLOC) = 20683
Hits@level = [0] 59 [1] 5 [2] 45 [3] 0 [4] 12 [5] 0
Hits@level+ = [0+] 121 [1+] 62 [2+] 57 [3+] 12 [4+] 12 [5+] 0
Hits/KSLOC@level+ = [0+] 5.85022 [1+] 2.99763 [2+] 2.75589 [3+] 0.580187 [4+] 0.580187 [5+] 0
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.