Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/wslay-1.1.1/examples/echoserv.cc
Examining data/wslay-1.1.1/examples/fork-echoserv.c
Examining data/wslay-1.1.1/examples/testclient.cc
Examining data/wslay-1.1.1/lib/includes/wslay/wslay.h
Examining data/wslay-1.1.1/lib/wslay_event.c
Examining data/wslay-1.1.1/lib/wslay_event.h
Examining data/wslay-1.1.1/lib/wslay_frame.c
Examining data/wslay-1.1.1/lib/wslay_frame.h
Examining data/wslay-1.1.1/lib/wslay_net.c
Examining data/wslay-1.1.1/lib/wslay_net.h
Examining data/wslay-1.1.1/lib/wslay_queue.c
Examining data/wslay-1.1.1/lib/wslay_queue.h
Examining data/wslay-1.1.1/lib/wslay_stack.c
Examining data/wslay-1.1.1/lib/wslay_stack.h
Examining data/wslay-1.1.1/tests/main.c
Examining data/wslay-1.1.1/tests/wslay_event_test.c
Examining data/wslay-1.1.1/tests/wslay_event_test.h
Examining data/wslay-1.1.1/tests/wslay_frame_test.c
Examining data/wslay-1.1.1/tests/wslay_frame_test.h
Examining data/wslay-1.1.1/tests/wslay_queue_test.c
Examining data/wslay-1.1.1/tests/wslay_queue_test.h
Examining data/wslay-1.1.1/tests/wslay_session_test.c
Examining data/wslay-1.1.1/tests/wslay_session_test.h
Examining data/wslay-1.1.1/tests/wslay_stack_test.c
Examining data/wslay-1.1.1/tests/wslay_stack_test.h
FINAL RESULTS:
data/wslay-1.1.1/examples/echoserv.cc:377:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[4096];
data/wslay-1.1.1/examples/fork-echoserv.c:156:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(key_src, client_key, 24);
data/wslay-1.1.1/examples/fork-echoserv.c:157:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(key_src+24, WS_GUID, 36);
data/wslay-1.1.1/examples/fork-echoserv.c:250:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char header[16384], accept_key[29], *keyhdstart, *keyhdend, res_header[256];
data/wslay-1.1.1/examples/testclient.cc:171:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, body_.c_str(), wlen);
data/wslay-1.1.1/examples/testclient.cc:304:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[4096];
data/wslay-1.1.1/examples/testclient.cc:325:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[16];
data/wslay-1.1.1/examples/testclient.cc:334:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[4096];
data/wslay-1.1.1/examples/testclient.cc:479:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1024];
data/wslay-1.1.1/lib/wslay_event.c:160:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(c->data+off, data, data_length);
data/wslay-1.1.1/lib/wslay_event.c:227:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((*m)->data, msg, msg_length);
data/wslay-1.1.1/lib/wslay_event.c:272:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf+off, chunk->data, chunk->data_length);
data/wslay-1.1.1/lib/wslay_event.c:305:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(msg, &ncode, 2);
data/wslay-1.1.1/lib/wslay_event.c:307:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(msg+2, reason, reason_length);
data/wslay-1.1.1/lib/wslay_event.c:708:17: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&status_code, msg, 2);
data/wslay-1.1.1/lib/wslay_event.c:863:15: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&status_code, ctx->omsg->data, 2);
data/wslay-1.1.1/lib/wslay_frame.c:82:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(hdptr, &len, 2);
data/wslay-1.1.1/lib/wslay_frame.c:88:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(hdptr, &len, 8);
data/wslay-1.1.1/lib/wslay_frame.c:100:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(hdptr, ctx->omaskkey, 4);
data/wslay-1.1.1/lib/wslay_frame.c:274:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((uint8_t*)&ctx->ipayloadlen+(8-ctx->ireqread),
data/wslay-1.1.1/lib/wslay_frame.c:302:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->imaskkey, ctx->ibufmark, 4);
data/wslay-1.1.1/tests/wslay_event_test.c:56:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(df->data, data, data_length);
data/wslay-1.1.1/tests/wslay_event_test.c:70:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, df->datamark, wlen);
data/wslay-1.1.1/tests/wslay_event_test.c:89:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, df->datamark, wlen);
data/wslay-1.1.1/tests/wslay_event_test.c:105:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(acc->buf+acc->length, buf, len);
data/wslay-1.1.1/tests/wslay_event_test.c:116:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(acc->buf+acc->length, buf, 1);
data/wslay-1.1.1/tests/wslay_frame_test.c:55:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(df->data, data, data_length);
data/wslay-1.1.1/tests/wslay_frame_test.c:66:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, df->datamark, wlen);
data/wslay-1.1.1/tests/wslay_frame_test.c:81:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(df->datamark, data, wlen);
data/wslay-1.1.1/tests/wslay_frame_test.c:342:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(acc->buf+acc->length, buf, len);
data/wslay-1.1.1/tests/wslay_frame_test.c:351:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf, makskey, 4);
data/wslay-1.1.1/examples/echoserv.cc:381:18: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while((r = read(fd_, buf, sizeof(buf))) == -1 && errno == EINTR);
data/wslay-1.1.1/examples/fork-echoserv.c:180:25: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
header_end = header + strlen(header) - 1;
data/wslay-1.1.1/examples/fork-echoserv.c:182:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
field_name_len = strlen(field_name);
data/wslay-1.1.1/examples/fork-echoserv.c:231:54: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(isalnum(value_start[-1]) || isalnum(value_start[strlen(value)]))
data/wslay-1.1.1/examples/fork-echoserv.c:254:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while((r = read(fd, header+header_length,
data/wslay-1.1.1/examples/fork-echoserv.c:295:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
res_header_length = strlen(res_header);
data/wslay-1.1.1/examples/testclient.cc:198:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
dev_urand_.read((char*)buf, len);
data/wslay-1.1.1/examples/testclient.cc:307:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while((r = read(fd, buf, sizeof(buf))) == -1 && errno == EINTR);
data/wslay-1.1.1/examples/testclient.cc:327:5: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
f.read(buf, 16);
ANALYSIS SUMMARY:
Hits = 40
Lines analyzed = 6118 in approximately 0.23 seconds (27172 lines/second)
Physical Source Lines of Code (SLOC) = 4411
Hits@level = [0] 16 [1] 9 [2] 31 [3] 0 [4] 0 [5] 0
Hits@level+ = [0+] 56 [1+] 40 [2+] 31 [3+] 0 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 12.6955 [1+] 9.06824 [2+] 7.02788 [3+] 0 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.