#!/usr/bin/env python

"""flawfinder: Find potential security flaws ("hits") in source code.

Usage:

flawfinder [options] [source_code_file]+

See the man page for a description of the options."""

version="1.27"

# The default output is as follows:

# filename:line_number [risk_level] (type) function_name: message

# where "risk_level" goes from 0 to 5. 0=no risk, 5=maximum risk.

# The final output is sorted by risk level, most risky first.

# Optionally ":column_number" can be added after the line number.

#

# Currently this program can only analyze C/C++ code.

#

# Copyright (C) 2001-2007 David A. Wheeler

# This is released under the General Public License (GPL):

#

# This program is free software; you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation; either version 2 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA

import sys, re, string, getopt

import pickle # To support load/save/diff of hitlist

import os, glob, operator # To support filename expansion on Windows

import os.path

import time

# import formatter

# Program Options - these are the default values:

show_context = 0

minimum_level = 1

show_immediately = 0

show_inputs = 0 # Only show inputs?

falsepositive = 0 # Work to remove false positives?

allowlink = 0 # Allow symbolic links?

skipdotdir = 1 # If 1, don't recurse into dirs beginning with "."

# Note: This doesn't affect the command line.

num_links_skipped = 0 # Number of links skipped.

num_dotdirs_skipped = 0 # Number of dotdirs skipped.

show_columns = 0

never_ignore = 0 # If true, NEVER ignore problems, even if directed.

list_rules = 0 # If true, list the rules (helpful for debugging)

patch_file = "" # File containing (unified) diff output.

loadhitlist = None

savehitlist = None

diffhitlist = None

quiet = 0

showheading = 1 # --dataonly turns this off

output_format = 0 # 0 = normal, 1 = html.

single_line = 0 # 1 = singleline (can 't be 0 if html)

omit_time = 0 # 1 = omit time-to-run (needed for testing)

displayed_header = 0 # Have we displayed the header yet?

num_ignored_hits = 0 # Number of ignored hits (used if never_ignore==0)

def error(message):

sys.stderr.write("Error: %s\n"% message)

# Support routines: find a pattern.

# To simplify the calling convention, several global variables are used

# and these support routines are defined, in an attempt to make the

# actual calls simpler and clearer.

#

filename = "" # Source filename.

linenumber = 0 # Linenumber from original file.

ignoreline = -1 # Line number to ignore.

sumlines = 0 # Number of lines (total) examined.

sloc = 0 # Physical SLOC

starttime = time.time() # Used to determine analyzed lines/second.

line_beginning = re.compile( r'(?m)^' )

blank_line = re.compile( r'(?m)^\s+$' )

# The following code accepts unified diff format from both subversion (svn)

# and GNU diff, which aren't well-documented. It gets filenames from

# "Index:" if exists, else from the "+++ FILENAME ..." entry.

# Note that this is different than some tools (which will use "+++" in

# preference to "Index:"), but subversion's nonstandard format is easier

# to handle this way.

# Since they aren't well-documented, here's some info on the diff formats:

# GNU diff format:

# --- OLDFILENAME OLDTIMESTAMP

# +++ NEWFILENAME NEWTIMESTAMP

# @@ -OLDSTART,OLDLENGTH +NEWSTART,NEWLENGTH @@

# ... Changes where preceding "+" is add, "-" is remove, " " is unchanged.

#

# ",OLDLENGTH" and ",NEWLENGTH" are optional (they default to 1).

# GNU unified diff format doesn't normally output "Index:"; you use

# the "+++/---" to find them (presuming the diff user hasn't used --label

# to mess it up).

#

# Subversion format:

# Index: FILENAME

# --- OLDFILENAME (comment)

# +++ NEWFILENAME (comment)

# @@ -OLDSTART,OLDLENGTH +NEWSTART,NEWLENGTH @@

#

# In subversion, the "Index:" always occurs, and note that paren'ed

# comments are in the oldfilename/newfilename, NOT timestamps like

# everyone else.

#

# Single Unix Spec version 3 (http://www.unix.org/single_unix_specification/)

# does not specify unified format at all; it only defines the older

# (obsolete) context diff format. That format DOES use "Index:", but

# only when the filename isn't specified otherwise.

# We're only supporting unified format directly; if you have an older diff

# format, use "patch" to apply it, and then use "diff -u" to create a

# unified format.

#

diff_index_filename = re.compile( r'^Index:\s+(?P<filename>.*)' )

diff_newfile = re.compile( r'^\+\+\+\s(?P<filename>.*)$' )

diff_hunk = re.compile( r'^@@ -\d+(,\d+)?\s+\+(?P<linenumber>\d+)[, ].*@@$' )

diff_line_added = re.compile( r'^\+[^+].*' )

diff_line_del = re.compile( r'^-[^-].*' )

# The "+++" newfile entries have the filename, followed by a timestamp

# or " (comment)" postpended.

# Timestamps can be of these forms:

# 2005-04-24 14:21:39.000000000 -0400

# Mon Mar 10 15:13:12 1997

# Also, "newfile" can have " (comment)" postpended. Find and eliminate this.

# Note that the expression below is Y10K (and Y100K) ready. :-).

diff_findjunk = re.compile( r'^(?P<filename>.*)((\s\d\d\d\d+-\d\d-\d\d\s+\d\d:\d[0-9:.]+Z?(\s+[\-\+0-9A-Z]+)?)|(\s[A-Za-z][a-z]+\s[A-za-z][a-z]+\s\d+\s\d+:\d[0-9:.]+Z?(\s[\-\+0-9]*)?\s\d\d\d\d+)|(\s\(.*\)))\s*$')

def is_svn_diff(sLine):

if (sLine.find('Index:') != -1):

return True

return False

def svn_diff_get_filename(sLine):

return diff_index_filename.match(sLine)

def gnu_diff_get_filename(sLine):

newfile_match = diff_newfile.match(sLine)

if (newfile_match):

patched_filename = string.strip(newfile_match.group('filename'))

# Clean up filename - remove trailing timestamp and/or (comment).

return diff_findjunk.match(patched_filename)

return None

# For each file found in the file patch_file, keep the

# line numbers of the new file (after patch is applied) which are added.

# We keep this information in a hash table for a quick access later.

#

def load_patch_info(patch_file):

patch={}

line_counter= 0

initial_number= 0

index_statement = False # Set true if we see "Index:".

try: hPatch = open(patch_file, 'r')

except:

print "Error: failed to open", h(patch_file)

sys.exit(1)

patched_filename = "" # Name of new file patched by current hunk.

sLine = hPatch.readline()

#Heuristic to determine if it's a svn diff or a GNU diff.

#Read the first line. If it contains 'Index:', it's a svn diff else it is a

#GNU diff.

#By default we try to get filename in svn diff

fn_get_filename=svn_diff_get_filename

if (is_svn_diff(sLine) == False):

fn_get_filename=gnu_diff_get_filename

while True: # Loop-and-half construct. Read a line, end loop when no more

# This is really a sequence of if ... elsif ... elsif..., but

# because Python forbids '=' in conditions, we do it this way.

filename_match = fn_get_filename(sLine)

if (filename_match):

patched_filename = string.strip(filename_match.group('filename'))

if (patch.has_key(patched_filename) == True):

error("filename occurs more than once in the patch: %s" %

patched_filename)

sys.exit(1)

else:

patch[patched_filename] = {}

else:

hunk_match = diff_hunk.match(sLine)

if (hunk_match):

if (patched_filename == ""):

error("wrong type of patch file : we have a line number without having seen a filename")

sys.exit(1)

initial_number= hunk_match.group('linenumber')

line_counter= 0

else:

line_added_match = diff_line_added.match(sLine)

if (line_added_match):

line_added = line_counter + int(initial_number)

patch[patched_filename][line_added] = True

# Let's also warn about the lines above and below this one,

# so that errors that "leak" into adjacent lines are caught.

# Besides, if you're creating a patch, you had to at least look

# at adjacent lines, so you're in a position to fix them.

patch[patched_filename][line_added - 1] = True

patch[patched_filename][line_added + 1] = True

line_counter += 1

else:

line_del_match = diff_line_del.match(sLine)

if (line_del_match == None):

line_counter += 1

sLine = hPatch.readline()

if (sLine == ''): break # Done reading.

return patch

def htmlize(s):

# Take s, and return legal (UTF-8) HTML.

s1 = string.replace(s,"&","&amp;")

s2 = string.replace(s1,"<","&lt;")

s3 = string.replace(s2,">","&gt;")

return s3

def h(s):

# htmlize s if we're generating html, otherwise just return s.

if output_format: return htmlize(s)

else: return s

def print_multi_line(text):

# Print text as multiple indented lines.

width = 72

prefix = " "

starting_position = len(prefix) + 1

printed_something = 0 # Have we printed on this line?

position = starting_position

nextword = ""

print prefix,

for c in text:

if (c == " "):

print nextword,

position = position + 1 # account for space we just printed.

printed_something = 1

nextword = ""

else: # NonSpace.

nextword = nextword + c

position = position + 1

if position > width: # Whups, out of space

if (printed_something): # We've printed something out.

print # Done with this line, move to next.

print prefix,

position = starting_position

print nextword, # Print remainder (can be overlong if no spaces)

class Hit:

"""

Each instance of Hit is a warning of some kind in a source code file.

See the rulesets, which define the conditions for triggering a hit.

Hit is initialized with a tuple containing the following:

hook: function to call when function name found.

level: (default) warning level, 0-5. 0=no problem, 5=very risky.

warning: warning (text saying what's the problem)

suggestion: suggestion (text suggesting what to do instead)

category: One of "buffer" (buffer overflow), "race" (race condition),

"tmpfile" (temporary file creation), "format" (format string).

Use "" if you don't have a better category.

url: URL fragment reference.

other: A dictionary with other settings.

Other settings usually set:

name: function name

parameter: the function parameters (0th parameter null)

input: set to 1 if the function inputs from external sources.

start: start position (index) of the function name (in text)

end: end position of the function name (in text)

filename: name of file

line: line number in file

column: column in line in file

context_text: text surrounding hit"""

# Set default values:

source_position = 2 # By default, the second parameter is the source.

format_position = 1 # By default, the first parameter is the format.

input = 0 # By default, this doesn't read input.

note = "" # No additional notes.

filename = "" # Empty string is filename.

extract_lookahead = 0 # Normally don't extract lookahead.

def __init__(self, data):

hook, level, warning, suggestion, category, url, other = data

self.hook, self.level = hook, level

self.warning, self.suggestion = warning, suggestion

self.category, self.url = category, url

# These will be set later, but I set them here so that

# analysis tools like PyChecker will know about them.

self.column = 0

self.line = 0

self.name = ""

self.context_text = ""

for key in other.keys():

setattr(self, key, other[key])

def __cmp__(self, other):

return (cmp(other.level, self.level) or # Highest risk first.

cmp(self.filename, other.filename) or

cmp(self.line, other.line) or

cmp(self.column, other.column) or

cmp(self.name, other.name))

def __getitem__(self, X): # Define this so this works: "%(line)" % hit

return getattr(self, X)

def show(self):

if output_format: print "<li>",

sys.stdout.write(h(self.filename))

if show_columns: print ":%(line)s:%(column)s:" % self,

else: print ":%(line)s:" % self,

if output_format: print "<b>",

# Extra space before risk level in text, makes it easier to find:

print " [%(level)s]" % self,

if output_format: print "</b>",

print "(%(category)s)" % self,

if output_format: print "<i>",

print h("%(name)s:" % self),

if single_line:

print h("%(warning)s." % self),

if self.suggestion: print h(self.suggestion)+".",

print h(self.note),

else:

main_text = h("%(warning)s. " % self)

if self.suggestion: main_text = main_text + h(self.suggestion) + ". "

main_text = main_text + h(self.note)

print

print_multi_line(main_text)

if output_format: print "</i>",

print

if show_context:

if output_format: print "<pre>"

print h(self.context_text)

if output_format: print "</pre>"

# The "hitlist" is the list of all hits (warnings) found so far.

# Use add_warning to add to it.

hitlist = []

def add_warning(hit):

global hitlist, num_ignored_hits

if show_inputs and not hit.input: return

if hit.level >= minimum_level:

if linenumber == ignoreline:

num_ignored_hits = num_ignored_hits + 1

else:

hitlist.append(hit)

if show_immediately:

hit.show()

def internal_warn(message):

print h(message)

# C Language Specific

def extract_c_parameters(text, pos=0):

"Return a list of the given C function's parameters, starting at text[pos]"

# '(a,b)' produces ['', 'a', 'b']

i = pos

# Skip whitespace and find the "("; if there isn't one, return []:

while i < len(text):

if text[i] == '(': break

elif text[i] in string.whitespace: i = i + 1

else: return []

else: # Never found a reasonable ending.

return []

i = i + 1

parameters = [""] # Insert 0th entry, so 1st parameter is parameter[1].

currentstart = i

parenlevel = 1

instring = 0 # 1=in double-quote, 2=in single-quote

incomment = 0

while i < len(text):

c = text[i]

if instring:

if c == '"' and instring == 1: instring = 0

elif c == "'" and instring == 2: instring = 0

# if \, skip next character too. The C/C++ rules for

# \ are actually more complex, supporting \ooo octal and

# \xhh hexadecimal (which can be shortened), but we don't need to

# parse that deeply, we just need to know we'll stay in string mode:

elif c == '\\': i = i + 1

elif incomment:

if c == '*' and text[i:i+2]=='*/':

incomment = 0

i = i + 1

else:

if c == '"': instring = 1

elif c == "'": instring = 2

elif c == '/' and text[i:i+2]=='/*':

incomment = 1

i = i + 1

elif c == '/' and text[i:i+2]=='//':

while i < len(text) and text[i] != "\n":

i = i + 1

elif c == '\\' and text[i:i+2]=='\\"': i = i + 1 # Handle exposed '\"'

elif c == '(': parenlevel = parenlevel + 1

elif c == ',' and (parenlevel == 1):

parameters.append(string.strip(

p_trailingbackslashes.sub('', text[currentstart:i])))

currentstart = i + 1

elif c == ')':

parenlevel = parenlevel - 1

if parenlevel <= 0:

parameters.append(string.strip(

p_trailingbackslashes.sub('', text[currentstart:i])))

# Re-enable these for debugging:

# print " EXTRACT_C_PARAMETERS: ", text[pos:pos+80]

# print " RESULTS: ", parameters

return parameters

elif c == ';':

internal_warn("Parsing failed to find end of parameter list; "

"semicolon terminated it in %s" % text[pos:pos+200])

return parameters

i = i + 1

internal_warn("Parsing failed to find end of parameter list in %s" %

text[pos:pos+200])

# These patterns match gettext() and _() for internationalization.

# This is compiled here, to avoid constant recomputation.

# FIXME: assumes simple function call if it ends with ")",

# so will get confused by patterns like gettext("hi") + function("bye")

# In practice, this doesn't seem to be a problem; gettext() is usually

# wrapped around the entire parameter.

# The ?s makes it possible to match multi-line strings.

gettext_pattern = re.compile(r'(?s)^\s*' + 'gettext' + r'\s*\((.*)\)\s*$')

undersc_pattern = re.compile(r'(?s)^\s*' + '_(T(EXT)?)?' + r'\s*\((.*)\)\s*$')

def strip_i18n(text):

"Strip any internationalization function calls surrounding 'text', "

"such as gettext() and _()."

match = gettext_pattern.search(text)

if match: return string.strip(match.group(1))

match = undersc_pattern.search(text)

if match: return string.strip(match.group(3))

return text

p_trailingbackslashes = re.compile( r'(\s|\\(\n|\r))*$')

p_c_singleton_string = re.compile( r'^\s*"([^\\]|\\[^0-6]|\\[0-6]+)?"\s*$')

def c_singleton_string(text):

"Returns true if text is a C string with 0 or 1 character."

if p_c_singleton_string.search(text): return 1

else: return 0

# This string defines a C constant.

p_c_constant_string = re.compile( r'^\s*"([^\\]|\\[^0-6]|\\[0-6]+)*"$')

def c_constant_string(text):

"Returns true if text is a constant C string."

if p_c_constant_string.search(text): return 1

else: return 0

# Precompile patterns for speed.

def c_buffer(hit):

source_position = hit.source_position

if source_position <= len(hit.parameters)-1:

source=hit.parameters[source_position]

if c_singleton_string(source):

hit.level = 1

hit.note = "Risk is low because the source is a constant character."

elif c_constant_string(strip_i18n(source)):

hit.level = max( hit.level - 2, 1)

hit.note = "Risk is low because the source is a constant string."

add_warning(hit)

p_dangerous_strncat = re.compile(r'^\s*sizeof\s*(\(\s*)?[A-Za-z_$0-9]+' +

r'\s*(\)\s*)?(-\s*1\s*)?$')

# This is a heuristic: constants in C are usually given in all upper case letters.

# Yes, this need not be true, but it's true often enough that it's worth

# using as a heuristic. strncat better not be passed a constant as the length!

p_looks_like_constant = re.compile(r'^\s*[A-Z][A-Z_$0-9]+\s*(-\s*1\s*)?$')

def c_strncat(hit):

if len(hit.parameters) > 3:

# A common mistake is to think that when calling strncat(dest,src,len), that

# "len" means the ENTIRE length of the destination. This isn't true, it must

# be the length of the characters TO BE ADDED at most. Which is one reason that

# strlcat is better than strncat. We'll detect a common case of this error;

# if the length parameter is of the form "sizeof(dest)", we have this error.

# Actually, sizeof(dest) is okay if the dest's first character is always \0,

# but in that case the programmer should use strncpy, NOT strncat.

# The following heuristic will certainly miss some dangerous cases, but

# it at least catches the most obvious situation.

# This particular heuristic is overzealous; it detects ANY sizeof, instead of

# only the sizeof(dest) (where dest is given in hit.parameters[1]).

# However, there aren't many other likely candidates for sizeof; some people

# use it to capture just the length of the source, but this is just as dangerous,

# since then it absolutely does NOT take care of the destination maximum length

# in general. It also detects if a constant is given as a length, if the

# constant follows common C naming rules.

length_text=hit.parameters[3]

if p_dangerous_strncat.search(length_text) or p_looks_like_constant.search(length_text):

hit.level = 5

hit.note = ( "Risk is high; the length parameter appears to be a constant, " +

"instead of computing the number of characters left.")

add_warning(hit)

return

c_buffer(hit)

def c_printf(hit):

format_position = hit.format_position

if format_position <= len(hit.parameters)-1:

# Assume that translators are trusted to not insert "evil" formats:

source = strip_i18n(hit.parameters[format_position])

if c_constant_string(source):

# Parameter is constant, so there's no risk of format string problems.

if hit.name == "snprintf" or hit.name == "vsnprintf":

hit.level = 1

hit.warning = \

"On some very old systems, snprintf is incorrectly implemented " \

"and permits buffer overflows; there are also incompatible " \

"standard definitions of it"

hit.suggestion = "Check it during installation, or use something else"

hit.category = "port"

else:

# We'll pass it on, just in case it's needed, but at level 0 risk.

hit.level = 0

hit.note = "Constant format string, so not considered very risky (there's some residual risk, especially in a loop)."

add_warning(hit)

p_dangerous_sprintf_format = re.compile(r'%-?([0-9]+|\*)?s')

# sprintf has both buffer and format vulnerabilities.

def c_sprintf(hit):

source_position = hit.source_position

if source_position <= len(hit.parameters)-1:

source=hit.parameters[source_position]

if c_singleton_string(source):

hit.level = 1

hit.note = "Risk is low because the source is a constant character."

else:

source = strip_i18n(source)

if c_constant_string(source):

if not p_dangerous_sprintf_format.search(source):

hit.level = max( hit.level - 2, 1)

hit.note = "Risk is low because the source has a constant maximum length."

# otherwise, warn of potential buffer overflow (the default)

else:

# Ho ho - a nonconstant format string - we have a different problem.

hit.warning = "Potential format string problem"

hit.suggestion = "Make format string constant"

hit.level = 4

hit.category = "format"

hit.url = ""

add_warning(hit)

p_dangerous_scanf_format = re.compile(r'%s')

p_low_risk_scanf_format = re.compile(r'%[0-9]+s')

def c_scanf(hit):

format_position = hit.format_position

if format_position <= len(hit.parameters)-1:

# Assume that translators are trusted to not insert "evil" formats;

# it's not clear that translators will be messing with INPUT formats,

# but it's possible so we'll account for it.

source = strip_i18n(hit.parameters[format_position])

if c_constant_string(source):

if p_dangerous_scanf_format.search(source): pass # Accept default.

elif p_low_risk_scanf_format.search(source):

# This is often okay, but sometimes extremely serious.

hit.level = 1

hit.warning = "it's unclear if the %s limit in the format string is small enough"

hit.suggestion = "Check that the limit is sufficiently small, or use a different input function"

else:

# No risky scanf request.

# We'll pass it on, just in case it's needed, but at level 0 risk.

hit.level = 0

hit.note = "No risky scanf format detected."

else:

# Format isn't a constant.

hit.warning = "If format strings to scanf's family of functions can be influenced by an attacker, they can be exploited"

hit.suggestion = "Use a constant for the format specification"

add_warning(hit)

p_dangerous_multi_byte = re.compile(r'^\s*sizeof\s*(\(\s*)?[A-Za-z_$0-9]+' +

r'\s*(\)\s*)?(-\s*1\s*)?$')

p_safe_multi_byte = re.compile(r'^\s*sizeof\s*(\(\s*)?[A-Za-z_$0-9]+\s*(\)\s*)?' +

r'/\s*sizeof\s*\(\s*?[A-Za-z_$0-9]+\s*' +

r'\[\s*0\s*\]\)\s*(-\s*1\s*)?$')

def c_multi_byte_to_wide_char(hit):

# Unfortunately, this doesn't detect bad calls when it's a #define or constant

# set by a sizeof(), but trying to do so would create FAR too many false positives.

if len(hit.parameters)-1 >= 6:

num_chars_to_copy=hit.parameters[6]

if p_dangerous_multi_byte.search(num_chars_to_copy):

hit.level = 5

hit.note = ("Risk is high, it appears that the size is given as bytes, but the " +

"function requires size as characters.")

elif p_safe_multi_byte.search(num_chars_to_copy):

# This isn't really risk-free, since it might not be the destination, or the

# destination might be a character array (if it's a char pointer, the pattern

# is actually quite dangerous, but programmers are unlikely to make that error).

hit.level = 1

hit.note = "Risk is very low, the length appears to be in characters not bytes."

add_warning(hit)

p_null_text = re.compile(r'^ *(NULL|0|0x0) *$')

def c_hit_if_null(hit):

null_position = hit.check_for_null

if null_position <= len(hit.parameters)-1:

null_text=hit.parameters[null_position]

if p_null_text.search(null_text):

add_warning(hit)

else:

return

add_warning(hit) # If insufficient # of parameters.

p_static_array = re.compile(r'^[A-Za-z_]+\s+[A-Za-z0-9_$,\s\*()]+\[[^]]')

def c_static_array(hit):

# This is cheating, but it does the job for most real code.

# In some cases it will match something that it shouldn't.

# We don't match ALL arrays, just those of certain types (e.g., char).

# In theory, any array can overflow, but in practice it seems that

# certain types are far more prone to problems, so we just report those.

if p_static_array.search(hit.lookahead):

add_warning(hit) # Found a static array, warn about it.

def normal(hit):

add_warning(hit)

# "c_ruleset": the rules for identifying "hits" in C (potential warnings).

# It's a dictionary, where the key is the function name causing the hit,

# and the value is a tuple with the following format:

# (hook, level, warning, suggestion, category, {other})

# See the definition for class "Hit".

# The key can have multiple values separated with "|".

c_ruleset = {

"strcpy" :

(c_buffer, 4,

"Does not check for buffer overflows when copying to destination",

"Consider using strncpy or strlcpy (warning, strncpy is easily misused)",

"buffer", "", {}),

"lstrcpy|wcscpy|_tcscpy|_mbscpy" :

(c_buffer, 4,

"Does not check for buffer overflows when copying to destination",

"Consider using a function version that stops copying at the end of the buffer",

"buffer", "", {}),

"memcpy|CopyMemory|bcopy" :

(normal, 2, # I've found this to have a lower risk in practice.

"Does not check for buffer overflows when copying to destination",

"Make sure destination can always hold the source data",

"buffer", "", {}),

"strcat" :

(c_buffer, 4,

"Does not check for buffer overflows when concatenating to destination",

"Consider using strncat or strlcat (warning, strncat is easily misused)",

"buffer", "", {}),

"lstrcat|wcscat|_tcscat|_mbscat" :

(c_buffer, 4,

"Does not check for buffer overflows when concatenating to destination",

"",

"buffer", "", {}),

"strncpy" :

(c_buffer,

1, # Low risk level, because this is often used correctly when FIXING security

# problems, and raising it to a higher risk level would cause many false positives.

"Easily used incorrectly; doesn't always \\0-terminate or " +

"check for invalid pointers",

"",

"buffer", "", {}),

"lstrcpyn|wcsncpy|_tcsncpy|_mbsnbcpy" :

(c_buffer,

1, # Low risk level, because this is often used correctly when FIXING security

# problems, and raising it to a higher risk level would cause many false positives.

"Easily used incorrectly; doesn't always \\0-terminate or " +

"check for invalid pointers",

"",

"buffer", "", {}),

"strncat" :

(c_strncat,

1, # Low risk level, because this is often used correctly when

# FIXING security problems, and raising it to a

# higher risk level would cause many false positives.

"Easily used incorrectly (e.g., incorrectly computing the correct maximum size to add)",

"Consider strlcat or automatically resizing strings",

"buffer", "", {}),

"lstrcatn|wcsncat|_tcsncat|_mbsnbcat" :

(c_strncat,

1, # Low risk level, because this is often used correctly when FIXING security

# problems, and raising it to a higher risk level would cause many false positives.

"Easily used incorrectly (e.g., incorrectly computing the correct maximum size to add)",

"Consider strlcat or automatically resizing strings",

"buffer", "", {}),

"strccpy|strcadd":

(normal, 1,

"Subject to buffer overflow if buffer is not as big as claimed",

"Ensure that destination buffer is sufficiently large",

"buffer", "", {}),

"char|TCHAR|wchar_t": # This isn't really a function call, but it works.

(c_static_array, 2,

"Statically-sized arrays can be overflowed",

("Perform bounds checking, use functions that limit length, " +

"or ensure that the size is larger than the maximum possible length"),

"buffer", "", {'extract_lookahead' : 1}),

"gets|_getts":

(normal, 5, "Does not check for buffer overflows",

"Use fgets() instead", "buffer", "", {'input' : 1}),

# The "sprintf" hook will raise "format" issues instead if appropriate:

"sprintf|vsprintf|swprintf|vswprintf|_stprintf|_vstprintf":

(c_sprintf, 4,

"Does not check for buffer overflows",

"Use snprintf or vsnprintf",

"buffer", "", {}),

# TODO: Add "wide character" versions of these functions.

"printf|vprintf|vwprintf|vfwprintf|_vtprintf":

(c_printf, 4,

"If format strings can be influenced by an attacker, they can be exploited",

"Use a constant for the format specification",

"format", "", {}),

"fprintf|vfprintf|_ftprintf|_vftprintf":

(c_printf, 4,

"If format strings can be influenced by an attacker, they can be exploited",

"Use a constant for the format specification",

"format", "", { 'format_position' : 2}),

# The "syslog" hook will raise "format" issues.

"syslog":

(c_printf, 4,

"If syslog's format strings can be influenced by an attacker, " +

"they can be exploited",

"Use a constant format string for syslog",

"format", "", { 'format_position' : 2} ),

"snprintf|vsnprintf|_snprintf|_sntprintf|_vsntprintf":

(c_printf, 4,

"If format strings can be influenced by an attacker, they can be " +

"exploited, and note that sprintf variations do not always \\0-terminate",

"Use a constant for the format specification",

"format", "", { 'format_position' : 3}),

"scanf|vscanf|wscanf|_tscanf":

(c_scanf, 4,

"The scanf() family's %s operation, without a limit specification, " +

"permits buffer overflows",

"Specify a limit to %s, or use a different input function",

"buffer", "", {'input' : 1}),

"fscanf|sscanf|vsscanf|vfscanf|_ftscanf":

(c_scanf, 4,

"The scanf() family's %s operation, without a limit specification, "

"permits buffer overflows",

"Specify a limit to %s, or use a different input function",

"buffer", "", {'input' : 1, 'format_position' : 2}),

"strlen|wcslen|_tcslen|_mbslen" :

(normal,

1, # Often this isn't really a risk, and even when, it usually at worst causes

# program crash (and nothing worse).

"Does not handle strings that are not \\0-terminated (it could cause a crash " +

"if unprotected)",

"",

"buffer", "", {}),

"MultiByteToWideChar" : # Windows

(c_multi_byte_to_wide_char,

2, # Only the default - this will be changed in many cases.

"Requires maximum length in CHARACTERS, not bytes",

"",

"buffer", "", {}),

"streadd|strecpy":

(normal, 4,

"This function does not protect against buffer overflows",

"Ensure the destination has 4 times the size of the source, to leave room for expansion",

"buffer", "dangers-c", {}),

"strtrns":

(normal, 3,

"This function does not protect against buffer overflows",

"Ensure that destination is at least as long as the source",

"buffer", "dangers-c", {}),

"realpath":

(normal, 3,

"This function does not protect against buffer overflows, " +

"and some implementations can overflow internally",

"Ensure that the destination buffer is at least of size MAXPATHLEN, and" +

"to protect against implementation problems, the input argument should also " +

"be checked to ensure it is no larger than MAXPATHLEN",

"buffer", "dangers-c", {}),

"getopt|getopt_long":

(normal, 3,

"Some older implementations do not protect against internal buffer overflows ",

"Check implementation on installation, or limit the size of all string inputs",

"buffer", "dangers-c", {'input' : 1}),

"getpass":

(normal, 3,

"Some implementations may overflow buffers",

"",

"buffer", "dangers-c", {'input' : 1}),

"getwd":

(normal, 3,

"This does not protect against buffer overflows "

"by itself, so use with caution",

"Use getcwd instead",

"buffer", "dangers-c", {'input' : 1}),

# fread not included here; in practice I think it's rare to mistake it.

"getchar|fgetc|getc|read|_gettc":

(normal, 1,

"Check buffer boundaries if used in a loop", # loops may be via recursion, too.

"",

"buffer", "dangers-c", {'input' : 1}),

"access": # ???: TODO: analyze TOCTOU more carefully.

(normal, 4,

"This usually indicates a security flaw. If an " +

"attacker can change anything along the path between the " +

"call to access() and the file's actual use (e.g., by moving " +

"files), the attacker can exploit the race condition",

"Set up the correct permissions (e.g., using setuid()) and " +

"try to open the file directly",

"race",

"avoid-race#atomic-filesystem", {}),

"chown":

(normal, 5,

"This accepts filename arguments; if an attacker " +

"can move those files, a race condition results. ",

"Use fchown( ) instead",

"race", "", {}),

"chgrp":

(normal, 5,

"This accepts filename arguments; if an attacker " +

"can move those files, a race condition results. ",

"Use fchgrp( ) instead",

"race", "", {}),

"chmod":

(normal, 5,

"This accepts filename arguments; if an attacker " +

"can move those files, a race condition results. ",

"Use fchmod( ) instead",

"race", "", {}),

"vfork":

(normal, 2,

"On some old systems, vfork() permits race conditions, and it's " +

"very difficult to use correctly",

"Use fork() instead",

"race", "", {}),

"readlink":

(normal, 5,

"This accepts filename arguments; if an attacker " +

"can move those files or change the link content, " +

"a race condition results. Also, it does not terminate with ASCII NUL",

# This is often just a bad idea, and it's hard to suggest a

# simple alternative:

"Reconsider approach",

"race", "", {'input' : 1}),

"tmpfile":

(normal, 2,

"Function tmpfile() has a security flaw on some systems (e.g., older System V systems)",

"",

"tmpfile", "", {}),

"tmpnam|tempnam":

(normal, 3,

"Temporary file race condition",

"",

"tmpfile", "avoid-race", {}),

# TODO: Detect GNOME approach to mktemp and ignore it.

"mktemp":

(normal, 4,

"Temporary file race condition",

"",

"tmpfile", "avoid-race", {}),

"mkstemp":

(normal, 2,

"Potential for temporary file vulnerability in some circumstances. Some older Unix-like systems create temp files with permission to write by all by default, so be sure to set the umask to override this. Also, some older Unix systems might fail to use O_EXCL when opening the file, so make sure that O_EXCL is used by the library",

"",

"tmpfile", "avoid-race", {}),

"fopen|open":

(normal, 2,

"Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?",

"",

"misc", "", {}),

"umask":

(normal, 1,

"Ensure that umask is given most restrictive possible setting (e.g., 066 or 077)",

"",

"access", "", {}),

# Windows. TODO: Detect correct usage approaches and ignore it.

"GetTempFileName":

(normal, 3,

"Temporary file race condition in certain cases " +

"(e.g., if run as SYSTEM in many versions of Windows)",

"",

"tmpfile", "avoid-race", {}),

# TODO: Need to detect varying levels of danger.

"execl|execlp|execle|execv|execvp|system|popen|WinExec|ShellExecute":

(normal, 4,

"This causes a new program to execute and is difficult to use safely",

"try using a library call that implements the same functionality " +

"if available",

"shell", "", {}),

# TODO: Need to detect varying levels of danger.

"execl|execlp|execle|execv|execvp|system|popen|WinExec|ShellExecute":

(normal, 4,

"This causes a new program to execute and is difficult to use safely",

"try using a library call that implements the same functionality " +

"if available",

"shell", "", {}),

# TODO: Be more specific. The biggest problem involves "first" param NULL,

# second param with embedded space. Windows.

"CreateProcessAsUser|CreateProcessWithLogon":

(normal, 3,

"This causes a new process to execute and is difficult to use safely",

"Especially watch out for embedded spaces",

"shell", "", {}),

# TODO: Be more specific. The biggest problem involves "first" param NULL,

# second param with embedded space. Windows.

"CreateProcess":

(c_hit_if_null, 3,

"This causes a new process to execute and is difficult to use safely",

"Specify the application path in the first argument, NOT as part of the second, " +

"or embedded spaces could allow an attacker to force a different program to run",

"shell", "", {'check_for_null' : 1}),

"atoi|atol":

(normal, 2,

"Unless checked, the resulting number can exceed the expected range",

" If source untrusted, check both minimum and maximum, even if the" +

" input had no minus sign (large numbers can roll over into negative" +

" number; consider saving to an unsigned value if that is intended)",

"integer", "dangers-c", {}),

# Random values. Don't trigger on "initstate", it's too common a term.

"drand48|erand48|jrand48|lcong48|lrand48|mrand48|nrand48|random|seed48|setstate|srand|strfry|srandom":

(normal, 3,

"This function is not sufficiently random for security-related functions such as key and nonce creation",

"use a more secure technique for acquiring random values",

"random", "", {}),

"crypt":

(normal, 4,

"Function crypt is a poor one-way hashing algorithm; since it only accepts passwords of 8 " +

"characters or less, and only a two-byte salt, it is excessively vulnerable to " +

"dictionary attacks given today's faster computing equipment",

"Use a different algorithm, such as SHA-1, with a larger non-repeating salt",

"crypto", "", {}),

# OpenSSL EVP calls to use DES.

"EVP_des_ecb|EVP_des_cbc|EVP_des_cfb|EVP_des_ofb|EVP_desx_cbc":

(normal, 4,