Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/zbar-0.23.1/android/jni/config.h
Examining data/zbar-0.23.1/examples/processor.c
Examining data/zbar-0.23.1/examples/processor.cpp
Examining data/zbar-0.23.1/examples/scan_image.c
Examining data/zbar-0.23.1/examples/scan_image.cpp
Examining data/zbar-0.23.1/gtk/zbargtk.c
Examining data/zbar-0.23.1/gtk/zbargtkprivate.h
Examining data/zbar-0.23.1/include/zbar.h
Examining data/zbar-0.23.1/include/zbar/Decoder.h
Examining data/zbar-0.23.1/include/zbar/Exception.h
Examining data/zbar-0.23.1/include/zbar/Image.h
Examining data/zbar-0.23.1/include/zbar/ImageScanner.h
Examining data/zbar-0.23.1/include/zbar/Processor.h
Examining data/zbar-0.23.1/include/zbar/QZBar.h
Examining data/zbar-0.23.1/include/zbar/QZBarImage.h
Examining data/zbar-0.23.1/include/zbar/Scanner.h
Examining data/zbar-0.23.1/include/zbar/Symbol.h
Examining data/zbar-0.23.1/include/zbar/Video.h
Examining data/zbar-0.23.1/include/zbar/Window.h
Examining data/zbar-0.23.1/include/zbar/zbargtk.h
Examining data/zbar-0.23.1/iphone/ZBarCVImage.h
Examining data/zbar-0.23.1/iphone/debug.h
Examining data/zbar-0.23.1/iphone/examples/EmbedReader/EmbedReader/EmbedReaderAppDelegate.h
Examining data/zbar-0.23.1/iphone/examples/EmbedReader/EmbedReader/EmbedReaderViewController.h
Examining data/zbar-0.23.1/iphone/examples/ReaderSample/ReaderSample/ReaderSampleAppDelegate.h
Examining data/zbar-0.23.1/iphone/examples/ReaderSample/ReaderSample/ReaderSampleViewController.h
Examining data/zbar-0.23.1/iphone/examples/TabReader/TabReader/ResultsViewController.h
Examining data/zbar-0.23.1/iphone/examples/TabReader/TabReader/TabReaderAppDelegate.h
Examining data/zbar-0.23.1/iphone/include/ZBarSDK/ZBarCameraSimulator.h
Examining data/zbar-0.23.1/iphone/include/ZBarSDK/ZBarCaptureReader.h
Examining data/zbar-0.23.1/iphone/include/ZBarSDK/ZBarHelpController.h
Examining data/zbar-0.23.1/iphone/include/ZBarSDK/ZBarImage.h
Examining data/zbar-0.23.1/iphone/include/ZBarSDK/ZBarImageScanner.h
Examining data/zbar-0.23.1/iphone/include/ZBarSDK/ZBarReaderController.h
Examining data/zbar-0.23.1/iphone/include/ZBarSDK/ZBarReaderView.h
Examining data/zbar-0.23.1/iphone/include/ZBarSDK/ZBarReaderViewController.h
Examining data/zbar-0.23.1/iphone/include/ZBarSDK/ZBarSDK.h
Examining data/zbar-0.23.1/iphone/include/ZBarSDK/ZBarSymbol.h
Examining data/zbar-0.23.1/iphone/include/config.h
Examining data/zbar-0.23.1/java/zbarjni.c
Examining data/zbar-0.23.1/perl/ppport.h
Examining data/zbar-0.23.1/plugin/plugin.c
Examining data/zbar-0.23.1/pygtk/zbarpygtkmodule.c
Examining data/zbar-0.23.1/python/decoder.c
Examining data/zbar-0.23.1/python/exception.c
Examining data/zbar-0.23.1/python/image.c
Examining data/zbar-0.23.1/python/imagescanner.c
Examining data/zbar-0.23.1/python/processor.c
Examining data/zbar-0.23.1/python/scanner.c
Examining data/zbar-0.23.1/python/symbol.c
Examining data/zbar-0.23.1/python/symboliter.c
Examining data/zbar-0.23.1/python/symbolset.c
Examining data/zbar-0.23.1/python/zbarmodule.c
Examining data/zbar-0.23.1/python/zbarmodule.h
Examining data/zbar-0.23.1/python/enum.c
Examining data/zbar-0.23.1/qt/QZBar.cpp
Examining data/zbar-0.23.1/qt/QZBarThread.cpp
Examining data/zbar-0.23.1/qt/QZBarThread.h
Examining data/zbar-0.23.1/test/dbg_scan.cpp
Examining data/zbar-0.23.1/test/pdf417_encode.h
Examining data/zbar-0.23.1/test/test_convert.c
Examining data/zbar-0.23.1/test/test_cpp.cpp
Examining data/zbar-0.23.1/test/test_cpp_img.cpp
Examining data/zbar-0.23.1/test/test_dbus.c
Examining data/zbar-0.23.1/test/test_decode.c
Examining data/zbar-0.23.1/test/test_images.c
Examining data/zbar-0.23.1/test/test_images.h
Examining data/zbar-0.23.1/test/test_jpeg.c
Examining data/zbar-0.23.1/test/test_proc.c
Examining data/zbar-0.23.1/test/test_video.c
Examining data/zbar-0.23.1/test/test_window.c
Examining data/zbar-0.23.1/zbar/config.c
Examining data/zbar-0.23.1/zbar/convert.c
Examining data/zbar-0.23.1/zbar/debug.h
Examining data/zbar-0.23.1/zbar/decoder.c
Examining data/zbar-0.23.1/zbar/decoder.h
Examining data/zbar-0.23.1/zbar/decoder/codabar.c
Examining data/zbar-0.23.1/zbar/decoder/codabar.h
Examining data/zbar-0.23.1/zbar/decoder/code128.c
Examining data/zbar-0.23.1/zbar/decoder/code128.h
Examining data/zbar-0.23.1/zbar/decoder/code39.c
Examining data/zbar-0.23.1/zbar/decoder/code39.h
Examining data/zbar-0.23.1/zbar/decoder/code93.c
Examining data/zbar-0.23.1/zbar/decoder/code93.h
Examining data/zbar-0.23.1/zbar/decoder/databar.c
Examining data/zbar-0.23.1/zbar/decoder/databar.h
Examining data/zbar-0.23.1/zbar/decoder/ean.c
Examining data/zbar-0.23.1/zbar/decoder/ean.h
Examining data/zbar-0.23.1/zbar/decoder/i25.c
Examining data/zbar-0.23.1/zbar/decoder/i25.h
Examining data/zbar-0.23.1/zbar/decoder/pdf417.c
Examining data/zbar-0.23.1/zbar/decoder/pdf417.h
Examining data/zbar-0.23.1/zbar/decoder/pdf417_hash.h
Examining data/zbar-0.23.1/zbar/decoder/qr_finder.c
Examining data/zbar-0.23.1/zbar/decoder/qr_finder.h
Examining data/zbar-0.23.1/zbar/decoder/sq_finder.c
Examining data/zbar-0.23.1/zbar/decoder/sq_finder.h
Examining data/zbar-0.23.1/zbar/error.c
Examining data/zbar-0.23.1/zbar/error.h
Examining data/zbar-0.23.1/zbar/event.h
Examining data/zbar-0.23.1/zbar/gettext.h
Examining data/zbar-0.23.1/zbar/image.c
Examining data/zbar-0.23.1/zbar/image.h
Examining data/zbar-0.23.1/zbar/img_scanner.c
Examining data/zbar-0.23.1/zbar/img_scanner.h
Examining data/zbar-0.23.1/zbar/jpeg.c
Examining data/zbar-0.23.1/zbar/misc.c
Examining data/zbar-0.23.1/zbar/misc.h
Examining data/zbar-0.23.1/zbar/mutex.h
Examining data/zbar-0.23.1/zbar/processor.c
Examining data/zbar-0.23.1/zbar/processor.h
Examining data/zbar-0.23.1/zbar/processor/lock.c
Examining data/zbar-0.23.1/zbar/processor/null.c
Examining data/zbar-0.23.1/zbar/processor/posix.c
Examining data/zbar-0.23.1/zbar/processor/posix.h
Examining data/zbar-0.23.1/zbar/processor/win.c
Examining data/zbar-0.23.1/zbar/processor/x.c
Examining data/zbar-0.23.1/zbar/qrcode.h
Examining data/zbar-0.23.1/zbar/qrcode/bch15_5.c
Examining data/zbar-0.23.1/zbar/qrcode/bch15_5.h
Examining data/zbar-0.23.1/zbar/qrcode/binarize.c
Examining data/zbar-0.23.1/zbar/qrcode/binarize.h
Examining data/zbar-0.23.1/zbar/qrcode/isaac.c
Examining data/zbar-0.23.1/zbar/qrcode/isaac.h
Examining data/zbar-0.23.1/zbar/qrcode/qrdec.c
Examining data/zbar-0.23.1/zbar/qrcode/qrdec.h
Examining data/zbar-0.23.1/zbar/qrcode/qrdectxt.c
Examining data/zbar-0.23.1/zbar/qrcode/rs.c
Examining data/zbar-0.23.1/zbar/qrcode/rs.h
Examining data/zbar-0.23.1/zbar/qrcode/util.c
Examining data/zbar-0.23.1/zbar/qrcode/util.h
Examining data/zbar-0.23.1/zbar/refcnt.c
Examining data/zbar-0.23.1/zbar/refcnt.h
Examining data/zbar-0.23.1/zbar/scanner.c
Examining data/zbar-0.23.1/zbar/sqcode.c
Examining data/zbar-0.23.1/zbar/sqcode.h
Examining data/zbar-0.23.1/zbar/svg.c
Examining data/zbar-0.23.1/zbar/svg.h
Examining data/zbar-0.23.1/zbar/symbol.c
Examining data/zbar-0.23.1/zbar/symbol.h
Examining data/zbar-0.23.1/zbar/thread.h
Examining data/zbar-0.23.1/zbar/timer.h
Examining data/zbar-0.23.1/zbar/video.c
Examining data/zbar-0.23.1/zbar/video.h
Examining data/zbar-0.23.1/zbar/video/dshow.c
Examining data/zbar-0.23.1/zbar/video/null.c
Examining data/zbar-0.23.1/zbar/video/v4l.c
Examining data/zbar-0.23.1/zbar/video/v4l1.c
Examining data/zbar-0.23.1/zbar/video/v4l2.c
Examining data/zbar-0.23.1/zbar/video/vfw.c
Examining data/zbar-0.23.1/zbar/window.c
Examining data/zbar-0.23.1/zbar/window.h
Examining data/zbar-0.23.1/zbar/window/dib.c
Examining data/zbar-0.23.1/zbar/window/null.c
Examining data/zbar-0.23.1/zbar/window/vfw.c
Examining data/zbar-0.23.1/zbar/window/win.c
Examining data/zbar-0.23.1/zbar/window/win.h
Examining data/zbar-0.23.1/zbar/window/x.c
Examining data/zbar-0.23.1/zbar/window/x.h
Examining data/zbar-0.23.1/zbar/window/ximage.c
Examining data/zbar-0.23.1/zbar/window/xv.c
Examining data/zbar-0.23.1/zbarcam/scan_video.c
Examining data/zbar-0.23.1/zbarcam/zbarcam-gtk.c
Examining data/zbar-0.23.1/zbarcam/zbarcam-qt.cpp
Examining data/zbar-0.23.1/zbarcam/zbarcam.c
Examining data/zbar-0.23.1/zbarimg/zbarimg.c
FINAL RESULTS:
data/zbar-0.23.1/test/test_decode.c:46:13: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(stderr, format , ##__VA_ARGS__); \
data/zbar-0.23.1/zbar/debug.h:43:13: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(stderr, args); \
data/zbar-0.23.1/zbar/debug.h:48:13: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(stderr, __VA_ARGS__); \
data/zbar-0.23.1/zbar/debug.h:74:13: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(stderr, "WARNING: %s:%d: %s:" \
data/zbar-0.23.1/zbar/error.c:132:11: [4] (format) sprintf:
Potential format string problem (CWE-134). Make format string constant.
len = sprintf(err->buf, basefmt, sev, mod, func, type);
data/zbar-0.23.1/zbar/error.c:142:20: [4] (format) sprintf:
Potential format string problem (CWE-134). Make format string constant.
len += sprintf(err->buf + len, err->detail, err->arg_str);
data/zbar-0.23.1/zbar/error.c:146:20: [4] (format) sprintf:
Potential format string problem (CWE-134). Make format string constant.
len += sprintf(err->buf + len, err->detail, err->arg_int);
data/zbar-0.23.1/zbar/error.c:150:20: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
len += sprintf(err->buf + len, "%s", err->detail);
data/zbar-0.23.1/zbar/error.c:161:16: [4] (format) sprintf:
Potential format string problem (CWE-134). Make format string constant.
len += sprintf(err->buf + len, sysfmt, syserr, err->errnum);
data/zbar-0.23.1/zbar/error.c:174:20: [4] (format) sprintf:
Potential format string problem (CWE-134). Make format string constant.
len += sprintf(err->buf + len, sysfmt, syserr, err->errnum);
data/zbar-0.23.1/zbar/error.h:109:13: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(stderr, "%s: " format, __func__ , ##args); \
data/zbar-0.23.1/zbar/error.h:116:13: [4] (format) fwprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fwprintf(stderr, format, ##args); \
data/zbar-0.23.1/zbar/error.h:123:13: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(stderr, "%s: " format, __func__ , ##__VA_ARGS__); \
data/zbar-0.23.1/zbar/error.h:130:13: [4] (format) fwprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fwprintf(stderr, format, ##__VA_ARGS__); \
data/zbar-0.23.1/zbar/image.c:241:5: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(filename, filebase);
data/zbar-0.23.1/zbar/svg.c:79:5: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(svg, svg_head, x, y, w, h);
data/zbar-0.23.1/zbar/svg.c:96:5: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
vfprintf(svg, format, args);
data/zbar-0.23.1/zbar/symbol.c:288:13: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
i = snprintf(*buf + n, maxlen - n, _st, __VA_ARGS__); \
data/zbar-0.23.1/zbar/video/dshow.c:346:13: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(msg, known_uuids[i].name);
data/zbar-0.23.1/zbarcam/zbarcam-qt.cpp:700:21: [4] (format) sprintf:
Potential format string problem (CWE-134). Make format string constant.
new_res.sprintf("%dx%d - %.2f fps (max)",
data/zbar-0.23.1/zbarcam/zbarcam.c:163:9: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(stderr, BELL);
data/zbar-0.23.1/zbarcam/zbarcam.c:234:20: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
return(printf(PACKAGE_VERSION "\n") <= 0);
data/zbar-0.23.1/zbarcam/zbarcam.c:317:9: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
printf(xml_head, video_device);
data/zbar-0.23.1/test/test_decode.c:1279:5: [3] (random) srand:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
srand(seed);
data/zbar-0.23.1/test/test_decode.c:1329:9: [3] (random) srand:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
srand(seed);
data/zbar-0.23.1/zbar/mutex.h:46:5: [3] (misc) InitializeCriticalSection:
Exceptions can be thrown in low-memory situations. Use
InitializeCriticalSectionAndSpinCount instead.
InitializeCriticalSection(&lock->mutex);
data/zbar-0.23.1/zbar/mutex.h:57:5: [3] (misc) EnterCriticalSection:
On some versions of Windows, exceptions can be thrown in low-memory
situations. Use InitializeCriticalSectionAndSpinCount instead.
EnterCriticalSection(&lock->mutex);
data/zbar-0.23.1/zbar/mutex.h:77:5: [3] (misc) InitializeCriticalSection:
Exceptions can be thrown in low-memory situations. Use
InitializeCriticalSectionAndSpinCount instead.
InitializeCriticalSection(lock);
data/zbar-0.23.1/zbar/mutex.h:88:5: [3] (misc) EnterCriticalSection:
On some versions of Windows, exceptions can be thrown in low-memory
situations. Use InitializeCriticalSectionAndSpinCount instead.
EnterCriticalSection(lock);
data/zbar-0.23.1/zbar/qrcode/rs.c:627:3: [3] (random) srand:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
srand(0);
data/zbar-0.23.1/examples/scan_image.c:30:18: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *file = fopen(name, "rb");
data/zbar-0.23.1/include/zbar/Video.h:55:9: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
open(device);
data/zbar-0.23.1/include/zbar/Video.h:70:10: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
void open (std::string& device)
data/zbar-0.23.1/java/zbarjni.c:70:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char fmtstr[8];
data/zbar-0.23.1/java/zbarjni.c:389:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char fmtstr[5] = { fourcc, fourcc >> 8, fourcc >> 16, fourcc >> 24, 0 };
data/zbar-0.23.1/perl/ppport.h:3260:42: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
# define CopyD(s,d,n,t) memcpy((char*)(d),(char*)(s), (n) * sizeof(t))
data/zbar-0.23.1/perl/ppport.h:4812:24: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
&& (xdigit = strchr((char *) PL_hexdigit, s[1])))
data/zbar-0.23.1/test/test_dbus.c:60:15: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
log = fopen(optarg, "wb");
data/zbar-0.23.1/test/test_dbus.c:63:19: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
bin_log = fopen(optarg, "wb");
data/zbar-0.23.1/test/test_decode.c:587:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const char codabar_char[0x14] =
data/zbar-0.23.1/test/test_decode.c:596:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmp[4] = { 0, };
data/zbar-0.23.1/test/test_decode.c:680:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char i25[10] = {
data/zbar-0.23.1/test/test_decode.c:1145:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char data[32] = "0100845963000052";
data/zbar-0.23.1/test/test_decode.c:1167:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char tmp[32] = "01";
data/zbar-0.23.1/test/test_decode.c:1282:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char data[32];
data/zbar-0.23.1/test/test_jpeg.c:37:10: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char jpeg[405] = {
data/zbar-0.23.1/test/test_jpeg.c:91:10: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char rgb[8*8*3] = {
data/zbar-0.23.1/test/test_proc.c:82:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((char*)&fmt, argv[i], n);
data/zbar-0.23.1/test/test_video.c:77:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((char*)&vidfmt, optarg, len);
data/zbar-0.23.1/zbar/convert.c:314:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((void*)dst->data, src->data, n);
data/zbar-0.23.1/zbar/convert.c:323:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(pdst, psrc, width);
data/zbar-0.23.1/zbar/convert.c:333:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(pdst, psrc, width);
data/zbar-0.23.1/zbar/decoder/codabar.c:37:21: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const signed char codabar_lo[12] = {
data/zbar-0.23.1/zbar/decoder/codabar.c:42:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char codabar_hi[8] = {
data/zbar-0.23.1/zbar/decoder/codabar.c:46:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char codabar_characters[20] =
data/zbar-0.23.1/zbar/decoder/codabar.h:33:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char buf[6]; /* initial scan buffer */
data/zbar-0.23.1/zbar/decoder/code128.c:53:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char characters[NUM_CHARS] = {
data/zbar-0.23.1/zbar/decoder/code128.c:92:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char lo_base[8] = {
data/zbar-0.23.1/zbar/decoder/code128.c:96:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char lo_offset[0x80] = {
data/zbar-0.23.1/zbar/decoder/code39.c:37:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char code39_hi[32] = {
data/zbar-0.23.1/zbar/decoder/code39.c:126:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char code39_characters[NUM_CHARS] =
data/zbar-0.23.1/zbar/decoder/code93.c:33:21: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const signed char code93_hash[0x40] = {
data/zbar-0.23.1/zbar/decoder/databar.c:37:21: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const signed char finder_hash[0x20] = {
data/zbar-0.23.1/zbar/decoder/databar.h:52:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
signed char chars[16]; /* outstanding character indices */
data/zbar-0.23.1/zbar/decoder/ean.c:88:17: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static unsigned char debug_buf[0x18];
data/zbar-0.23.1/zbar/decoder/ean.h:33:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char raw[7]; /* decode in process */
data/zbar-0.23.1/zbar/decoder/ean.h:43:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
signed char buf[18]; /* holding buffer */
data/zbar-0.23.1/zbar/decoder/i25.h:33:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char buf[4]; /* initial scan buffer */
data/zbar-0.23.1/zbar/gettext.h:220:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char msg_ctxt_id[msgctxt_len + msgid_len];
data/zbar-0.23.1/zbar/gettext.h:222:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1024];
data/zbar-0.23.1/zbar/gettext.h:231:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (msg_ctxt_id, msgctxt, msgctxt_len - 1);
data/zbar-0.23.1/zbar/gettext.h:233:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (msg_ctxt_id + msgctxt_len, msgid, msgid_len);
data/zbar-0.23.1/zbar/gettext.h:268:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char msg_ctxt_id[msgctxt_len + msgid_len];
data/zbar-0.23.1/zbar/gettext.h:270:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[1024];
data/zbar-0.23.1/zbar/gettext.h:279:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (msg_ctxt_id, msgctxt, msgctxt_len - 1);
data/zbar-0.23.1/zbar/gettext.h:281:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (msg_ctxt_id + msgctxt_len, msgid, msgid_len);
data/zbar-0.23.1/zbar/image.c:156:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(newimg, img, sizeof(zbar_image_t));
data/zbar-0.23.1/zbar/image.c:254:9: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen(filename, "w");
data/zbar-0.23.1/zbar/image.c:311:12: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
file = fopen(filename, "wb");
data/zbar-0.23.1/zbar/image.h:159:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((void*)dst->data, src->data, src->datalen);
data/zbar-0.23.1/zbar/img_scanner.c:316:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(entry->data, sym->data, sym->datalen);
data/zbar-0.23.1/zbar/img_scanner.c:477:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sym->data, data, datalen + 1);
data/zbar-0.23.1/zbar/img_scanner.c:1128:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ean_sym->data, ean->data, ean->datalen);
data/zbar-0.23.1/zbar/img_scanner.c:1129:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ean_sym->data + ean->datalen,
data/zbar-0.23.1/zbar/processor/posix.c:210:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(state->thr_polling.fds, state->polling.fds,
data/zbar-0.23.1/zbar/processor/posix.c:212:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(state->thr_polling.handlers, state->polling.handlers,
data/zbar-0.23.1/zbar/qrcode/bch15_5.c:10:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char gf16_exp[31]={
data/zbar-0.23.1/zbar/qrcode/bch15_5.c:15:21: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const signed char gf16_log[16]={
data/zbar-0.23.1/zbar/qrcode/binarize.c:594:10: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fout=fopen("binary.png","wb");
data/zbar-0.23.1/zbar/qrcode/binarize.c:625:9: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fin=fopen(_argv[1],"rb");
data/zbar-0.23.1/zbar/qrcode/isaac.c:68:25: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char SHIFT[8]={11,2,8,16,10,4,8,9};
data/zbar-0.23.1/zbar/qrcode/isaac.c:108:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(m+i,x,sizeof(x));
data/zbar-0.23.1/zbar/qrcode/isaac.c:113:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(m+i,x,sizeof(x));
data/zbar-0.23.1/zbar/qrcode/qrdec.c:1400:8: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fout=fopen("undistorted_aff.png","wb");
data/zbar-0.23.1/zbar/qrcode/qrdec.c:1470:8: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fout=fopen("undistorted_hom.png","wb");
data/zbar-0.23.1/zbar/qrcode/qrdec.c:1840:27: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char MASK_COORDS[8][2]={
data/zbar-0.23.1/zbar/qrcode/qrdec.c:2570:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char QR_ALIGNMENT_SPACING[34]={
data/zbar-0.23.1/zbar/qrcode/qrdec.c:2635:17: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
if(_version<2)memcpy(_grid->cells[0],&base_cell,sizeof(base_cell));
data/zbar-0.23.1/zbar/qrcode/qrdec.c:2734:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(_grid->cell_limits,align_pos+1,
data/zbar-0.23.1/zbar/qrcode/qrdec.c:2824:8: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fout=fopen("grid.png","wb");
data/zbar-0.23.1/zbar/qrcode/qrdec.c:3178:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char QR_ALNUM_TABLE[45]={
data/zbar-0.23.1/zbar/qrcode/qrdec.c:3223:29: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char LEN_BITS[3][4]={
data/zbar-0.23.1/zbar/qrcode/qrdec.c:3471:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(_qrlist->qrdata+_qrlist->nqrdata++,_qrdata,sizeof(*_qrdata));
data/zbar-0.23.1/zbar/qrcode/qrdec.c:3498:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char QR_RS_NPAR[40][4]={
data/zbar-0.23.1/zbar/qrcode/qrdec.c:3513:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char QR_RS_NPAR_VALS[71]={
data/zbar-0.23.1/zbar/qrcode/qrdec.c:3525:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char QR_RS_NPAR_OFFS[40]={
data/zbar-0.23.1/zbar/qrcode/qrdec.c:3534:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char QR_RS_NBLOCKS[40][4]={
data/zbar-0.23.1/zbar/qrcode/qrdec.c:3649:39: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
qr_code_data *_qrdata,const unsigned char *_img,int _width,int _height,
data/zbar-0.23.1/zbar/qrcode/qrdec.c:3725:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(_qrdata->bbox,bbox,sizeof(bbox));
data/zbar-0.23.1/zbar/qrcode/qrdec.c:3753:27: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const signed char LINE_TESTS[12][6]={
data/zbar-0.23.1/zbar/qrcode/qrdec.c:3874:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(_qrdata->bbox,bbox,sizeof(bbox));
data/zbar-0.23.1/zbar/qrcode/qrdec.c:3978:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(lines->lines + lines->nlines++, line, sizeof(*line));
data/zbar-0.23.1/zbar/qrcode/qrdectxt.c:253:17: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(out, in, inleft);
data/zbar-0.23.1/zbar/qrcode/qrdectxt.c:344:15: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sa_text+sa_ntext,entry->payload.data.buf,
data/zbar-0.23.1/zbar/qrcode/qrdectxt.c:362:15: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sa_text+sa_ntext,in,plen*sizeof(*in));
data/zbar-0.23.1/zbar/qrcode/qrdectxt.c:379:15: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(sa_text+sa_ntext,in,inleft*sizeof(*sa_text));
data/zbar-0.23.1/zbar/qrcode/qrdectxt.c:390:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(bytebuf_text+bytebuf_ntext,in,inleft*sizeof(*bytebuf_text));
data/zbar-0.23.1/zbar/qrcode/qrdectxt.c:396:13: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[16];
data/zbar-0.23.1/zbar/qrcode/qrdectxt.c:401:17: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(buf,"ISO8859-%i",QR_MAXI(cur_eci,3)-2);
data/zbar-0.23.1/zbar/qrcode/rs.c:89:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char _x[2]){
data/zbar-0.23.1/zbar/qrcode/rs.c:166:47: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned _a,unsigned _b,unsigned _c,unsigned char _x[3]){
data/zbar-0.23.1/zbar/qrcode/rs.c:253:59: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned _a,unsigned _b,unsigned _c,unsigned _d,unsigned char _x[3]){
data/zbar-0.23.1/zbar/qrcode/rs.c:335:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(_p,_q,_dp1*sizeof(*_p));
data/zbar-0.23.1/zbar/qrcode/rs.c:424:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char tt[256];
data/zbar-0.23.1/zbar/qrcode/rs.c:513:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char lambda[256];
data/zbar-0.23.1/zbar/qrcode/rs.c:514:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char omega[256];
data/zbar-0.23.1/zbar/qrcode/rs.c:515:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char epos[256];
data/zbar-0.23.1/zbar/qrcode/rs.c:516:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char s[256];
data/zbar-0.23.1/zbar/qrcode/rs.c:629:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char genpoly[256];
data/zbar-0.23.1/zbar/qrcode/rs.c:630:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char data[256];
data/zbar-0.23.1/zbar/qrcode/rs.c:631:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char epos[256];
data/zbar-0.23.1/zbar/qrcode/rs.c:700:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char data[255];
data/zbar-0.23.1/zbar/qrcode/rs.c:701:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char erasures[255];
data/zbar-0.23.1/zbar/qrcode/rs.c:723:16: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char data2[255];
data/zbar-0.23.1/zbar/qrcode/rs.c:724:16: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char genpoly[255];
data/zbar-0.23.1/zbar/qrcode/rs.c:752:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char x[4];
data/zbar-0.23.1/zbar/qrcode/rs.c:753:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char r[4];
data/zbar-0.23.1/zbar/qrcode/rs.h:34:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char log[256];
data/zbar-0.23.1/zbar/qrcode/rs.h:39:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char exp[511];
data/zbar-0.23.1/zbar/svg.c:75:11: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
svg = fopen(name, "w");
data/zbar-0.23.1/zbar/symbol.c:103:25: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const signed char hash[ZBAR_CODE128 + 1] = {
data/zbar-0.23.1/zbar/symbol.c:281:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(*buf + n, _st, i + 1); \
data/zbar-0.23.1/zbar/symbol.c:375:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(*buf + n, sym->data, sym->datalen + 1);
data/zbar-0.23.1/zbar/video.c:382:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((void*)img->data, tmp->data, img->datalen);
data/zbar-0.23.1/zbar/video/dshow.c:185:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dst, src, bytesPerLine);
data/zbar-0.23.1/zbar/video/dshow.c:535:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((void*)img->data, buffer, img->datalen);
data/zbar-0.23.1/zbar/video/dshow.c:867:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(state->bih, bih, state->bi_size);
data/zbar-0.23.1/zbar/video/dshow.c:1129:5: [2] (buffer) MultiByteToWideChar:
Requires maximum length in CHARACTERS, not bytes (CWE-120).
MultiByteToWideChar(CP_UTF8, 0, dev, -1, wdev, strlen(dev) + 1);
data/zbar-0.23.1/zbar/video/v4l.c:41:20: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
# define v4l2_open open
data/zbar-0.23.1/zbar/video/vfw.c:469:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[MAX_NAME], desc[MAX_NAME];
data/zbar-0.23.1/zbar/window.c:127:13: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char text[32];
data/zbar-0.23.1/zbar/window.c:128:13: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(text, "%d.%01d fps", 1000 / avg, (10000 / avg) % 10);
data/zbar-0.23.1/zbarcam/scan_video.c:138:14: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd = open(file, O_RDWR);
data/zbar-0.23.1/perl/ppport.h:3775:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
sv_vsetpvfn(sv, pat, strlen(pat), args, Null(SV**), 0, Null(bool*));
data/zbar-0.23.1/perl/ppport.h:3784:59: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
# define sv_vcatpvf(sv, pat, args) sv_vcatpvfn(sv, pat, strlen(pat), args, Null(SV**), 0, Null(bool*))
data/zbar-0.23.1/perl/ppport.h:3789:59: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
# define sv_vsetpvf(sv, pat, args) sv_vsetpvfn(sv, pat, strlen(pat), args, Null(SV**), 0, Null(bool*))
data/zbar-0.23.1/perl/ppport.h:3810:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
sv_vcatpvfn(sv, pat, strlen(pat), &args, Null(SV**), 0, Null(bool*));
data/zbar-0.23.1/perl/ppport.h:3839:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
sv_vcatpvfn(sv, pat, strlen(pat), &args, Null(SV**), 0, Null(bool*));
data/zbar-0.23.1/perl/ppport.h:3860:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
sv_vcatpvfn(sv, pat, strlen(pat), args, Null(SV**), 0, Null(bool*)); \
data/zbar-0.23.1/perl/ppport.h:3883:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
sv_vsetpvfn(sv, pat, strlen(pat), &args, Null(SV**), 0, Null(bool*));
data/zbar-0.23.1/perl/ppport.h:3912:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
sv_vsetpvfn(sv, pat, strlen(pat), &args, Null(SV**), 0, Null(bool*));
data/zbar-0.23.1/perl/ppport.h:3933:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
sv_vsetpvfn(sv, pat, strlen(pat), args, Null(SV**), 0, Null(bool*)); \
data/zbar-0.23.1/perl/ppport.h:4404:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
STRLEN len = strlen(radix);
data/zbar-0.23.1/python/image.c:433:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(strlen(format) != 4) {
data/zbar-0.23.1/test/dbg_scan.cpp:62:11: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
image.read(filename);
data/zbar-0.23.1/test/test_decode.c:130:50: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
zbar_decoder_get_data_length(decoder) == strlen(data);
data/zbar-0.23.1/test/test_decode.c:408:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
n = strlen(data);
data/zbar-0.23.1/test/test_decode.c:595:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
unsigned len = strlen(src);
data/zbar-0.23.1/test/test_decode.c:669:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int i, n = strlen(data);
data/zbar-0.23.1/test/test_decode.c:695:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for(i = (strlen(data) & 1) ? -1 : 0; i < 0 || data[i]; i += 2) {
data/zbar-0.23.1/test/test_decode.c:1168:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(tmp + 2, data + 1, 13);
data/zbar-0.23.1/test/test_decode.c:1178:10: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
data[strlen(data) & ~1] = 0;
data/zbar-0.23.1/test/test_proc.c:79:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int n = strlen(argv[i]);
data/zbar-0.23.1/test/test_video.c:74:19: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int len = strlen(optarg);
data/zbar-0.23.1/zbar/config.c:110:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(cfgstr);
data/zbar-0.23.1/zbar/error.c:32:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
#define SEV_MAX (strlen(sev_str[0]))
data/zbar-0.23.1/zbar/error.c:37:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
#define MOD_MAX (strlen(mod_str[ZBAR_MOD_IMAGE_SCANNER]))
data/zbar-0.23.1/zbar/error.c:54:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
#define ERR_MAX (strlen(err_str[ZBAR_ERR_CLOSED]))
data/zbar-0.23.1/zbar/error.c:130:41: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = SEV_MAX + MOD_MAX + ERR_MAX + strlen(func) + sizeof(basefmt);
data/zbar-0.23.1/zbar/error.c:137:28: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int newlen = len + strlen(err->detail) + 1;
data/zbar-0.23.1/zbar/error.c:141:51: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
err->buf = realloc(err->buf, newlen + strlen(err->arg_str));
data/zbar-0.23.1/zbar/error.c:160:44: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
err->buf = realloc(err->buf, len + strlen(sysfmt) + strlen(syserr));
data/zbar-0.23.1/zbar/error.c:160:61: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
err->buf = realloc(err->buf, len + strlen(sysfmt) + strlen(syserr));
data/zbar-0.23.1/zbar/error.c:173:48: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
err->buf = realloc(err->buf, len + strlen(sysfmt) + strlen(syserr));
data/zbar-0.23.1/zbar/error.c:173:65: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
err->buf = realloc(err->buf, len + strlen(sysfmt) + strlen(syserr));
data/zbar-0.23.1/zbar/error.c:181:16: [1] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source is a constant character.
len += sprintf(err->buf + len, "\n");
data/zbar-0.23.1/zbar/gettext.h:216:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t msgctxt_len = strlen (msgctxt) + 1;
data/zbar-0.23.1/zbar/gettext.h:217:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t msgid_len = strlen (msgid) + 1;
data/zbar-0.23.1/zbar/gettext.h:264:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t msgctxt_len = strlen (msgctxt) + 1;
data/zbar-0.23.1/zbar/gettext.h:265:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t msgid_len = strlen (msgid) + 1;
data/zbar-0.23.1/zbar/image.c:236:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int len = strlen(filebase) + 16;
data/zbar-0.23.1/zbar/processor/posix.c:223:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
int rc = read(state->kick_fds[0], junk, 2 * sizeof(unsigned));
data/zbar-0.23.1/zbar/symbol.c:280:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
i = strlen(_st); \
data/zbar-0.23.1/zbar/symbol.c:318:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
datalen = strlen(sym->data);
data/zbar-0.23.1/zbar/symbol.c:322:28: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
maxlen = (MAX_STATIC + strlen(type) + strlen(orient) +
data/zbar-0.23.1/zbar/symbol.c:322:43: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
maxlen = (MAX_STATIC + strlen(type) + strlen(orient) +
data/zbar-0.23.1/zbar/video/dshow.c:345:26: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
msg = malloc(strlen(known_uuids[i].name) + 1);
data/zbar-0.23.1/zbar/video/dshow.c:1106:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
else if (strlen(dev) == 1 &&
data/zbar-0.23.1/zbar/video/dshow.c:1126:41: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
BSTR wdev = SysAllocStringLen(NULL, strlen(dev));
data/zbar-0.23.1/zbar/video/dshow.c:1129:52: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
MultiByteToWideChar(CP_UTF8, 0, dev, -1, wdev, strlen(dev) + 1);
data/zbar-0.23.1/zbar/video/v4l1.c:117:13: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
else if(read(fd, (void*)img->data, img->datalen) != img->datalen)
data/zbar-0.23.1/zbar/video/v4l2.c:136:27: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ssize_t datalen = read(fd, (void*)img->data, img->datalen);
data/zbar-0.23.1/zbar/video/vfw.c:464:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
else if(strlen(dev) == 1 &&
data/zbar-0.23.1/zbarcam/zbarcam.c:285:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(argv[i]) == 12)
data/zbar-0.23.1/zbarcam/zbarcam.c:289:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen(argv[i]) == 13)
ANALYSIS SUMMARY:
Hits = 205
Lines analyzed = 52153 in approximately 1.34 seconds (38921 lines/second)
Physical Source Lines of Code (SLOC) = 35949
Hits@level = [0] 198 [1] 52 [2] 123 [3] 7 [4] 23 [5] 0
Hits@level+ = [0+] 403 [1+] 205 [2+] 153 [3+] 30 [4+] 23 [5+] 0
Hits/KSLOC@level+ = [0+] 11.2103 [1+] 5.70252 [2+] 4.25603 [3+] 0.834516 [4+] 0.639795 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.