-
Notifications
You must be signed in to change notification settings - Fork 0
/
fflog.txt
75 lines (69 loc) · 3.05 KB
/
fflog.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
Flawfinder version 2.0.15, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 222
Examining gen/valueEntry_Calc.h
Examining gen/root_Calc.c
Examining gen/valueEntry_Calc.c
Examining gen/kcg_types.h
Examining gen/kcg_consts.c
Examining gen/kcg_sensors.h
Examining gen/performFunction_Calc.c
Examining gen/kcg_types.c
Examining gen/root_Calc.h
Examining gen/updateDisplay_Calc_Utils.c
Examining gen/kcg_consts.h
Examining gen/kcg_imported_functions.h
Examining gen/performFunction_Calc.h
Examining gen/key2Char_Calc.h
Examining gen/updateDisplay_Calc_Utils.h
Examining gen/key2Char_Calc.c
Examining man/kcg_assign.h
Examining man/init.c
Examining man/main.h
Examining man/memcpy.h
Examining man/user_macros.h
Examining man/memcpy.c
Examining man/main.c
Examining man/printUtils.c
FINAL RESULTS:
man/main.c:28: [4] (buffer) scanf:
The scanf() family's %s operation, without a limit specification, permits
buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
different input function.
man/printUtils.c:10: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
man/printUtils.c:10: [4] (format) _snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
man/kcg_assign.h:12: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
man/memcpy.c:8: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
man/memcpy.h:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
man/printUtils.c:27: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
ANALYSIS SUMMARY:
Hits = 7
Lines analyzed = 1535 in approximately 0.02 seconds (73164 lines/second)
Physical Source Lines of Code (SLOC) = 968
Hits@level = [0] 5 [1] 0 [2] 4 [3] 0 [4] 3 [5] 0
Hits@level+ = [0+] 12 [1+] 7 [2+] 7 [3+] 3 [4+] 3 [5+] 0
Hits/KSLOC@level+ = [0+] 12.3967 [1+] 7.2314 [2+] 7.2314 [3+] 3.09917 [4+] 3.09917 [5+] 0
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
You can inhibit a report by adding a comment in this form:
// flawfinder: ignore
Make *sure* it's a false positive!
You can use the option --neverignore to show these.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.