chore: add flawfinder scan by marco6 · Pull Request #794 · canonical/dqlite

marco6 · 2025-07-11T14:33:00Z

No description provided.

github-actions · 2025-07-11T14:34:52Z

Flawfinder scan

Total issues found: 337 (41 HIGH | 296 MEDIUM)

Details

At src/vfs.c:180

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	size_t n_filename = strlen(filename);

At src/vfs.c:181

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	size_t n_suffix = strlen(suffix);

At src/vfs.c:243

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(&f->header[8], &salt[0], sizeof salt[0]);

At src/vfs.c:244

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(&f->header[12], &salt[1], sizeof salt[1]);

At src/vfs.c:249

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(f->page, page, page_size);

At src/vfs.c:499

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	char *dbname = sqlite3_malloc((int)strlen(name) + 1);

At src/vfs.c:503

Level	Rule
error	FF1001

buffer/strcpy:Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120).

	strcpy(dbname, name);

At src/vfs.c:778

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	size_t n = strlen(filename);

At src/vfs.c:785

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

		n -= strlen("-wal");

At src/vfs.c:788

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

		n -= strlen("-journal");

At src/vfs.c:793

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

		if (strlen(database->name) == n &&

At src/vfs.c:988

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(buf, f->database->wal.hdr, VFS__WAL_HEADER_SIZE);

At src/vfs.c:1006

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

			memcpy(buf, f->database->wal.hdr + offset, (size_t)amount);

At src/vfs.c:1062

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(buf, frame->header, (size_t)amount);

At src/vfs.c:1064

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(buf, frame->header + 16, (size_t)amount);

At src/vfs.c:1066

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(buf, frame->page, (size_t)amount);

At src/vfs.c:1068

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(buf, frame->header, FORMAT__WAL_FRAME_HDR_SIZE);

At src/vfs.c:1069

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(buf + FORMAT__WAL_FRAME_HDR_SIZE, frame->page,

At src/vfs.c:1092

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(f->database->wal.hdr, buf, (size_t)amount);

At src/vfs.c:1141

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(frame->header, buf, FORMAT__WAL_FRAME_HDR_SIZE);

At src/vfs.c:1148

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(frame->page, buf, (size_t)amount);

At src/vfs.c:1304

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(buf, pgno == 1 ? page + offset : page, (size_t)amount);

At src/vfs.c:1375

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(page, buf, (size_t)amount);

At src/vfs.c:1427

Level	Rule
note	FF1047

integer/atoi:Unless checked, the resulting number can exceed the expected range (CWE-190).

		int page_size = atoi(right);

At src/vfs.c:1633

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(region, f->mappedShmRegions.ptr[i], VFS__WAL_INDEX_REGION_SIZE);

At src/vfs.c:1649

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(first_region_shared + headerSize, first_region_private + headerSize, VFS__WAL_INDEX_REGION_SIZE - headerSize);

At src/vfs.c:1653

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(first_region_shared + VFS__WAL_INDEX_HEADER_SIZE, f->mappedShmRegions.ptr[0] + VFS__WAL_INDEX_HEADER_SIZE, VFS__WAL_INDEX_HEADER_SIZE);

At src/vfs.c:1656

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(first_region_shared, f->mappedShmRegions.ptr[0], VFS__WAL_INDEX_HEADER_SIZE);

At src/vfs.c:1972

Level	Rule
note	FF1047

integer/atoi:Unless checked, the resulting number can exceed the expected range (CWE-190).

		int page_size = atoi(right);

At src/vfs.c:2813

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(*cursor, d->pages[i], page_size);

At src/vfs.c:2827

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(*cursor, w->hdr, VFS__WAL_HEADER_SIZE);

At src/vfs.c:2835

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(*cursor, frame->header, FORMAT__WAL_FRAME_HDR_SIZE);

At src/vfs.c:2837

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(*cursor, frame->page, page_size);

At src/vfs.c:2998

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(page, &data[offset], page_size);

At src/vfs.c:3045

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(w->hdr, data, VFS__WAL_HEADER_SIZE);

At src/vfs.c:3062

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(frame->header, p, VFS__FRAME_HEADER_SIZE);

At src/vfs.c:3063

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(frame->page, p + VFS__FRAME_HEADER_SIZE, page_size);

At src/vfs.c:3207

Level	Rule
note	FF1040

misc/open:Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362).

	fd = open(path, O_RDONLY);

At src/vfs.c:3273

Level	Rule
note	FF1040

misc/open:Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362).

	fd = open(filename, O_CREAT | O_TRUNC | O_WRONLY, 0600);

At src/tracing.c:18

Level	Rule
warning	FF1053

buffer/getenv:Environment variables are untrustable input if they can be set by an attacker. They can have any content and length, and the same variable can be set more than once (CWE-807, CWE-20).

	const char *trace_level = getenv(LIBDQLITE_TRACE);

At src/tracing.c:24

Level	Rule
note	FF1047

integer/atoi:Unless checked, the resulting number can exceed the expected range (CWE-190).

		tracer__level = (unsigned)atoi(trace_level);

At src/tracing.c:36

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	return p != NULL ? p + strlen(top_src_dir) : fname;

At src/tracing.c:76

Level	Rule
note	FF1017

format/fprintf:If format strings can be influenced by an attacker, they can be exploited (CWE-134).

	fprintf(stderr,

At src/tracing.c:103

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char msg[1024];

At src/tracing.c:106

Level	Rule
error	FF1019

format/vsnprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

		vsnprintf(msg, sizeof msg, fmt, args);

At src/db.c:38

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	db->filename = sqlite3_malloc((int)(strlen(filename) + 1));

At src/db.c:42

Level	Rule
error	FF1001

buffer/strcpy:Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120).

	strcpy(db->filename, filename);

At src/db.c:49

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

		rv = snprintf(db->path, MAX_PATHNAME + 1, "%s/%s",

At src/db.c:52

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

		rv = snprintf(db->path, MAX_PATHNAME + 1, "%s", db->filename);

At src/db.c:113

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char pragma[255];

At src/db.c:146

Level	Rule
note	FF1015

buffer/sprintf:Does not check for buffer overflows (CWE-120).

		sprintf(pragma, "PRAGMA page_size=%d", db->config->page_size);

At src/conn.c:18

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	buffer__reset(&c->read);

At src/conn.c:19

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	buf->base = buffer__advance(&c->read, size);

At src/conn.c:104

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	buffer__close(&c->read);

At src/conn.c:143

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	cursor->p = buffer__cursor(&c->read, 0);

At src/conn.c:144

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	cursor->cap = buffer__offset(&c->read);

At src/conn.c:200

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	cursor.p = buffer__cursor(&c->read, 0);

At src/conn.c:201

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	cursor.cap = buffer__offset(&c->read);

At src/conn.c:244

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	cursor.p = buffer__cursor(&c->read, 0);

At src/conn.c:245

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	cursor.cap = buffer__offset(&c->read);

At src/conn.c:311

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	rv = buffer__init(&c->read);

At src/conn.c:333

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	buffer__close(&c->read);

At src/server.c:59

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char db_dir_path[1024];

At src/server.c:65

Level	Rule
error	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

	rv = snprintf(db_dir_path, sizeof db_dir_path, DATABASE_DIR_FMT, dir);

At src/server.c:67

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

		snprintf(d->errmsg, DQLITE_ERRMSG_BUF_SIZE,

At src/server.c:74

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

		snprintf(d->errmsg, DQLITE_ERRMSG_BUF_SIZE,

At src/server.c:87

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

		snprintf(d->errmsg, DQLITE_ERRMSG_BUF_SIZE,

At src/server.c:98

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

		snprintf(d->errmsg, DQLITE_ERRMSG_BUF_SIZE,

At src/server.c:112

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

		snprintf(d->errmsg, DQLITE_ERRMSG_BUF_SIZE, "raft_init(): %s",

At src/server.c:128

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

		snprintf(d->errmsg, DQLITE_ERRMSG_BUF_SIZE, "sem_init(): %s",

At src/server.c:135

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

		snprintf(d->errmsg, DQLITE_ERRMSG_BUF_SIZE, "sem_init(): %s",

At src/server.c:142

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

		snprintf(d->errmsg, DQLITE_ERRMSG_BUF_SIZE, "sem_init(): %s",

At src/server.c:277

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

		int sz = ((int)strlen(address)) + 1; /* Room for '\0' */

At src/server.c:283

Level	Rule
error	FF1001

buffer/strcpy:Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120).

		strcpy(t->bind_address, address);

At src/server.c:483

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

			snprintf(d->errmsg, DQLITE_ERRMSG_BUF_SIZE,

At src/server.c:726

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

		snprintf(d->errmsg, DQLITE_ERRMSG_BUF_SIZE, "raft_start(): %s",

At src/server.c:828

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char path[PATH_MAX];

At src/server.c:832

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

	snprintf(path, sizeof(path), "%s/%s", dir, LOCK_FILENAME);

At src/server.c:833

Level	Rule
note	FF1040

misc/open:Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362).

	fd = open(path, O_RDWR|O_CREAT|O_CLOEXEC, S_IRUSR|S_IWUSR);

At src/server.c:860

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

		snprintf(t->errmsg, DQLITE_ERRMSG_BUF_SIZE,

At src/server.c:867

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

		snprintf(t->errmsg, DQLITE_ERRMSG_BUF_SIZE,

At src/server.c:891

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

		snprintf(t->errmsg, DQLITE_ERRMSG_BUF_SIZE,

At src/server.c:1058

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

		snprintf(n->errmsg, DQLITE_ERRMSG_BUF_SIZE, "raft_recover(): %s",

At src/server.c:1115

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(new, cache->nodes, cache->len * sizeof *new);

At src/server.c:1260

Level	Rule
note	FF1017

format/fprintf:If format strings can be influenced by an attacker, they can be exploited (CWE-134).

	k = fprintf(f, "%s\n", NODE_STORE_INFO_FORMAT_V1);

At src/server.c:1272

Level	Rule
note	FF1017

format/fprintf:If format strings can be influenced by an attacker, they can be exploited (CWE-134).

		k = fprintf(f, "%s\n%" PRIu64 "\n%s\n",

At src/server.c:1367

Level	Rule
note	FF1017

format/fprintf:If format strings can be influenced by an attacker, they can be exploited (CWE-134).

	k = fprintf(f, "%s\n%s\n%" PRIu64 "\n", NODE_STORE_INFO_FORMAT_V1,

At src/server.c:1705

Level	Rule
note	FF1040

misc/open:Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362).

	server->dir_fd = open(server->dir_path, O_RDONLY | O_DIRECTORY);

At src/conn.h:29

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	struct buffer read;                     /* Read buffer */

At src/config.c:39

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	c->address = sqlite3_malloc((int)strlen(address) + 1);

At src/config.c:43

Level	Rule
error	FF1001

buffer/strcpy:Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120).

	strcpy(c->address, address);

At src/config.c:47

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

	rv = snprintf(c->name, sizeof c->name, "dqlite-%u", serial);

At src/config.c:54

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

	snprintf(c->raft_dir, sizeof(c->raft_dir), "%s", (raft_dir != NULL) ? raft_dir : "");

At src/config.c:55

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

	snprintf(c->database_dir, sizeof(c->database_dir), "%s", database_dir);

At src/client/protocol.c:74

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

			memcpy(p, val->blob.base, val->blob.len);

At src/client/protocol.c:106

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(val, cursor.p, sizeof(*val));

At src/client/protocol.c:174

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

		n = read(fd, (char *)buf + (size_t)total,

At src/client/protocol.c:277

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	cursor.p = buffer__cursor(&c->read, 0);

At src/client/protocol.c:278

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	cursor.cap = buffer__offset(&c->read);

At src/client/protocol.c:316

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	rv = buffer__init(&c->read);

At src/client/protocol.c:340

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	buffer__close(&c->read);

At src/client/protocol.c:434

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	buffer__reset(&c->read);

At src/client/protocol.c:436

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	p = buffer__advance(&c->read, n);

At src/client/protocol.c:455

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	buffer__reset(&c->read);

At src/client/protocol.c:457

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	p = buffer__advance(&c->read, n);

At src/client/protocol.c:488

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

		cursor.p = buffer__cursor(&c->read, 0);               \

At src/client/protocol.c:489

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

		cursor.cap = buffer__offset(&c->read);                \

At src/client/protocol.c:525

Level	Rule
note	FF1040

misc/open:Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362).

	REQUEST(open, OPEN, 0);

At src/client/protocol.c:731

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	cursor.p = buffer__cursor(&c->read, 0);

At src/client/protocol.c:732

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	cursor.cap = buffer__offset(&c->read);

At src/client/protocol.c:1094

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(fs[i].blob, cursor.p, z);

At src/client/protocol.h:46

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	struct buffer read;  /* Read buffer */

At src/request.h:52

Level	Rule
note	FF1040

misc/open:Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362).

	X(open, OPEN, __VA_ARGS__)                           \

At src/raft/uv_tcp_connect.c:56

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	size_t address_len = bytePad64(strlen(address) + 1);

At src/raft/uv_tcp_connect.c:69

Level	Rule
error	FF1001

buffer/strcpy:Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120).

	strcpy(cursor, address);

At src/raft/uv_tcp_connect.c:269

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char hostname[NI_MAXHOST];

At src/raft/uv_tcp_connect.c:270

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char service[NI_MAXSERV];

At src/raft/log.c:524

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(&entries[i], entryAt(l, i), sizeof *entries);

At src/raft/byte.c:183

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(block, buffer, 64);

At src/raft/byte.c:316

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(&s->buffer[j], data, (i = 64 - j));

At src/raft/byte.c:324

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(&s->buffer[j], &data[i], len - i);

At src/raft/err.h:36

Level	Rule
error	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

	snprintf(ERRMSG, RAFT_ERRMSG_BUF_SIZE, __VA_ARGS__)

At src/raft/err.h:41

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

		char _errmsg[RAFT_ERRMSG_BUF_SIZE]; \

At src/raft/err.h:50

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(ERRMSG2, ERRMSG1, RAFT_ERRMSG_BUF_SIZE); \

At src/raft/err.h:54

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(ERRMSG2, ERRMSG1, RAFT_ERRMSG_BUF_SIZE); \

At src/raft/raft.c:64

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	r->address = RaftHeapMalloc(strlen(address) + 1);

At src/raft/raft.c:69

Level	Rule
error	FF1001

buffer/strcpy:Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120).

	strcpy(r->address, address);

At src/raft/raft.c:290

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	byteSha1Update(&sha1, (const uint8_t *)text, (uint32_t)strlen(text));

At src/raft/raft.c:294

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(&digest, value + (sizeof value - sizeof digest), sizeof digest);

At src/raft/election.c:34

Level	Rule
warning	FF1048

random/random:This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327).

	unsigned timeout = (unsigned)r->io->random(

At src/raft/uv.c:55

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

			    strlen(TMP_FILE_PREFIX)) == 0) {

At src/raft/uv.c:339

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(new_segments, &(*segments)[i],

At src/raft/uv.c:380

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

		char snapshot_filename[UV__FILENAME_LEN];

At src/raft/uv.c:653

Level	Rule
warning	FF1048

random/srand:This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327).

	srand(seed);

At src/raft/uv.c:695

Level	Rule
note	FF1008

buffer/strncpy:Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120).

	strncpy(uv->dir, dir, sizeof(uv->dir) - 1);

At src/raft/uv_snapshot.c:29

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	size_t filename_len = strlen(filename);

At src/raft/uv_snapshot.c:32

Level	Rule
error	FF1021

buffer/sscanf:The scanf() family's %s operation, without a limit specification, permits buffer overflows (CWE-120, CWE-20).

		matched = sscanf(filename, UV__SNAPSHOT_META_TEMPLATE "%n",

At src/raft/uv_snapshot.c:35

Level	Rule
error	FF1021

buffer/sscanf:The scanf() family's %s operation, without a limit specification, permits buffer overflows (CWE-120, CWE-20).

		matched = sscanf(filename, UV__SNAPSHOT_TEMPLATE "%n", term,

At src/raft/uv_snapshot.c:59

Level	Rule
note	FF1008

buffer/strncpy:Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120).

	strncpy(info->filename, filename, n);

At src/raft/uv_snapshot.c:66

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	size_t len = strlen(info->filename) - strlen(".meta");

At src/raft/uv_snapshot.c:66

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	size_t len = strlen(info->filename) - strlen(".meta");

At src/raft/uv_snapshot.c:68

Level	Rule
error	FF1001

buffer/strcpy:Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120).

	strcpy(filename, info->filename);

At src/raft/uv_snapshot.c:80

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char snapshot_filename[UV__FILENAME_LEN];

At src/raft/uv_snapshot.c:83

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char errmsg[RAFT_ERRMSG_BUF_SIZE];

At src/raft/uv_snapshot.c:151

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char sibling_filename[UV__FILENAME_LEN];

At src/raft/uv_snapshot.c:153

Level	Rule
error	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

		rv = snprintf(sibling_filename, UV__FILENAME_LEN,

At src/raft/uv_snapshot.c:156

Level	Rule
error	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

		rv = snprintf(sibling_filename, UV__FILENAME_LEN,

At src/raft/uv_snapshot.c:167

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char ignored[RAFT_ERRMSG_BUF_SIZE];

At src/raft/uv_snapshot.c:325

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char filename[UV__FILENAME_LEN];

At src/raft/uv_snapshot.c:396

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char errmsg[RAFT_ERRMSG_BUF_SIZE];

At src/raft/uv_snapshot.c:407

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char errmsg[RAFT_ERRMSG_BUF_SIZE];

At src/raft/uv_snapshot.c:417

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char errmsg[RAFT_ERRMSG_BUF_SIZE];

At src/raft/uv_snapshot.c:427

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

		char filename[UV__FILENAME_LEN];

At src/raft/uv_snapshot.c:509

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char metadata[UV__FILENAME_LEN];

At src/raft/uv_snapshot.c:510

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char snapshot[UV__FILENAME_LEN];

At src/raft/uv_snapshot.c:511

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char errmsg[RAFT_ERRMSG_BUF_SIZE];

At src/raft/uv_snapshot.c:514

Level	Rule
error	FF1015

format/sprintf:Potential format string problem (CWE-134).

	sprintf(metadata, UV__SNAPSHOT_META_TEMPLATE, put->snapshot->term,

At src/raft/uv_snapshot.c:525

Level	Rule
error	FF1015

format/sprintf:Potential format string problem (CWE-134).

	sprintf(snapshot, UV__SNAPSHOT_TEMPLATE, put->snapshot->term,

At src/raft/uv_ip.c:65

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char hostname[NI_MAXHOST];

At src/raft/uv_ip.c:66

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char service[NI_MAXSERV];

At src/raft/uv_fs.c:83

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char path[UV__PATH_SZ];

At src/raft/uv_fs.c:114

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char path[UV__PATH_SZ];

At src/raft/uv_fs.c:156

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char path[UV__PATH_SZ];

At src/raft/uv_fs.c:175

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char path[UV__PATH_SZ];

At src/raft/uv_fs.c:194

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char path[UV__PATH_SZ];

At src/raft/uv_fs.c:332

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char tmp_filename[UV__FILENAME_LEN + 1] = {0};

At src/raft/uv_fs.c:333

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char path[UV__PATH_SZ] = {0};

At src/raft/uv_fs.c:334

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char tmp_path[UV__PATH_SZ] = {0};

At src/raft/uv_fs.c:339

Level	Rule
error	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

	rv = snprintf(tmp_filename, sz, TMP_FILE_FMT, filename);

At src/raft/uv_fs.c:380

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

		char ignored[RAFT_ERRMSG_BUF_SIZE];

At src/raft/uv_fs.c:397

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char path[UV__PATH_SZ];

At src/raft/uv_fs.c:409

Level	Rule
note	FF1040

misc/open:Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362).

open:

At src/raft/uv_fs.c:416

Level	Rule
note	FF1040

misc/open:Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362).

			goto open;

At src/raft/uv_fs.c:474

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

		rv = read(fd, (char *)buf->base + offset, buf->len - offset);

At src/raft/uv_fs.c:501

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char path[UV__PATH_SZ];

At src/raft/uv_fs.c:552

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char path[UV__PATH_SZ];

At src/raft/uv_fs.c:583

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char path[UV__PATH_SZ];

At src/raft/uv_fs.c:602

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char path1[UV__PATH_SZ];

At src/raft/uv_fs.c:603

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char path2[UV__PATH_SZ];

At src/raft/uv_fs.c:630

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char path1[UV__PATH_SZ];

At src/raft/uv_fs.c:631

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char path2[UV__PATH_SZ];

At src/raft/uv_fs.c:848

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char ignored[RAFT_ERRMSG_BUF_SIZE];

At src/raft/uv_fs.c:879

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char ignored[RAFT_ERRMSG_BUF_SIZE];

At src/raft/recv.c:118

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char msg[128];

At src/raft/recv.c:123

Level	Rule
note	FF1015

buffer/sprintf:Does not check for buffer overflows (CWE-120).

	sprintf(msg, "remote term %lld is higher than %lld -> bump local term",

At src/raft/recv.c:126

Level	Rule
note	FF1005

buffer/strcat:Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120).

		strcat(msg, " and step down");

At src/raft/recv.c:216

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	    RaftHeapMalloc(strlen(address) + 1);

At src/raft/recv.c:220

Level	Rule
error	FF1001

buffer/strcpy:Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120).

	strcpy(r->follower_state.current_leader.address, address);

At src/raft/compress.c:127

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

			    (char *)bufs[i].base + src_offset, src_size, NULL);

At src/raft/err.c:9

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

#define WRAP_SEP_LEN ((size_t)strlen(WRAP_SEP))

At src/raft/err.c:20

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	prefix_n = strlen(format);

At src/raft/uv.h:60

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char dir[UV__DIR_LEN];               /* Data directory */

At src/raft/uv.h:131

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char filename[UV__SEGMENT_FILENAME_BUF_SIZE]; /* Segment filename */

At src/raft/uv.h:238

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char filename[UV__FILENAME_LEN];

At src/raft/uv_tcp.c:111

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char hostname[NI_MAXHOST];

At src/raft/uv_tcp.c:112

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char service[NI_MAXSERV];

At src/raft/uv_tcp.c:121

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	t->bind_address = raft_malloc(strlen(address) + 1);

At src/raft/uv_tcp.c:125

Level	Rule
error	FF1001

buffer/strcpy:Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120).

	strcpy(t->bind_address, address);

At src/raft/uv_finalize.c:28

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char filename1[UV__FILENAME_LEN];

At src/raft/uv_finalize.c:29

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char filename2[UV__FILENAME_LEN];

At src/raft/uv_finalize.c:30

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char errmsg[RAFT_ERRMSG_BUF_SIZE];

At src/raft/uv_finalize.c:33

Level	Rule
error	FF1015

format/sprintf:Potential format string problem (CWE-134).

	sprintf(filename1, UV__OPEN_TEMPLATE, segment->counter);

At src/raft/uv_finalize.c:34

Level	Rule
error	FF1015

format/sprintf:Potential format string problem (CWE-134).

	sprintf(filename2, UV__CLOSED_TEMPLATE, segment->first_index,

At src/raft/uv_segment.c:31

Level	Rule
error	FF1021

buffer/sscanf:The scanf() family's %s operation, without a limit specification, permits buffer overflows (CWE-120, CWE-20).

	matched = sscanf(filename, UV__CLOSED_TEMPLATE "%n", &info->first_index,

At src/raft/uv_segment.c:39

Level	Rule
error	FF1021

buffer/sscanf:The scanf() family's %s operation, without a limit specification, permits buffer overflows (CWE-120, CWE-20).

	    sscanf(filename, UV__OPEN_TEMPLATE "%n", &info->counter, &consumed);

At src/raft/uv_segment.c:49

Level	Rule
note	FF1008

buffer/strncpy:Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120).

	strncpy(info->filename, filename, n);

At src/raft/uv_segment.c:164

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char errmsg[RAFT_ERRMSG_BUF_SIZE];

At src/raft/uv_segment.c:222

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char errmsg[RAFT_ERRMSG_BUF_SIZE];

At src/raft/uv_segment.c:381

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char errmsg[RAFT_ERRMSG_BUF_SIZE];

At src/raft/uv_segment.c:499

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char errmsg[RAFT_ERRMSG_BUF_SIZE];

At src/raft/uv_segment.c:608

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

		char filename[UV__SEGMENT_FILENAME_BUF_SIZE];

At src/raft/uv_segment.c:613

Level	Rule
error	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

		int nb = snprintf(filename, sizeof(filename),

At src/raft/uv_segment.c:641

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(info->filename, filename, (size_t)nb);

At src/raft/uv_segment.c:690

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(base, b->arena.base, b->arena.len);

At src/raft/uv_segment.c:775

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(cursor, entry->buf.base, entry->buf.len);

At src/raft/uv_segment.c:818

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(b->arena.base, b->arena.base + retain * b->block_size,

At src/raft/uv_segment.c:830

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char errmsg[RAFT_ERRMSG_BUF_SIZE] = {0};

At src/raft/uv_segment.c:831

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char new_filename[UV__FILENAME_LEN + 1] = {0};

At src/raft/uv_segment.c:839

Level	Rule
error	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

	rv = snprintf(new_filename, sz, CORRUPT_FILE_FMT, ns, info->filename);

At src/raft/uv_segment.c:1001

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char filename[UV__FILENAME_LEN];

At src/raft/uv_segment.c:1006

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char errmsg[RAFT_ERRMSG_BUF_SIZE];

At src/raft/uv_segment.c:1012

Level	Rule
error	FF1015

format/sprintf:Potential format string problem (CWE-134).

	sprintf(filename, UV__CLOSED_TEMPLATE, first_index, last_index);

At src/raft/uv_segment.c:1064

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char filename[UV__FILENAME_LEN];

At src/raft/uv_segment.c:1068

Level	Rule
error	FF1015

format/sprintf:Potential format string problem (CWE-134).

	sprintf(filename, UV__CLOSED_TEMPLATE, index, index);

At src/raft/uv_segment.c:1102

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char filename[UV__FILENAME_LEN];

At src/raft/uv_segment.c:1108

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char errmsg[RAFT_ERRMSG_BUF_SIZE];

At src/raft/uv_segment.c:1144

Level	Rule
error	FF1015

format/sprintf:Potential format string problem (CWE-134).

	sprintf(filename, UV__CLOSED_TEMPLATE, segment->first_index, index - 1);

At src/raft/uv_send.c:91

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	c->address = RaftHeapMalloc(strlen(address) + 1);

At src/raft/uv_send.c:97

Level	Rule
error	FF1001

buffer/strcpy:Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120).

	strcpy(c->address, address);

At src/raft/uv_truncate.c:78

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char errmsg[RAFT_ERRMSG_BUF_SIZE];

At src/raft/uv_list.c:15

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	if (strlen(filename) >= UV__FILENAME_LEN) {

At src/raft/membership.c:147

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char msg[128];

At src/raft/membership.c:161

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

	snprintf(msg, sizeof(msg), "uncommitted config change at index:%llu",

At src/raft/uv_os.c:116

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(sb, &req.statbuf, sizeof *sb);

At src/raft/uv_os.c:147

Level	Rule
error	FF1001

buffer/strcpy:Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120).

	strcpy(path, dir);

At src/raft/uv_os.c:148

Level	Rule
note	FF1005

buffer/strcat:Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120).

	strcat(path, "/");

At src/raft/uv_os.c:149

Level	Rule
error	FF1005

buffer/strcat:Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120).

	strcat(path, filename);

At src/raft/entry.c:35

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(dst->buf.base, src->buf.base, dst->buf.len);

At src/raft/entry.c:80

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy((*dst)[i].buf.base, src[i].buf.base, src[i].buf.len);

At src/raft/byte.h:105

Level	Rule
error	FF1001

buffer/strcpy:Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120).

	strcpy(*p, value);

At src/raft/byte.h:106

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	*p += strlen(value) + 1;

At src/raft/configuration.c:153

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	address_copy = raft_malloc(strlen(address) + 1);

At src/raft/configuration.c:158

Level	Rule
error	FF1001

buffer/strcpy:Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120).

	strcpy(address_copy, address);

At src/raft/configuration.c:262

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

		n += strlen(server->address) + 1; /* Address */

At src/raft/utils.h:11

Level	Rule
note	FF1017

format/fprintf:If format strings can be influenced by an attacker, they can be exploited (CWE-134).

#define DBG() fprintf(stderr, "%s:%d\n", __func__, __LINE__)

At src/raft/uv_writer.h:66

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char errmsg[256]; /* Error description (for thread-safety) */

At src/raft/uv_writer.c:163

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	rv = (int)read(w->event_fd, &completed, sizeof completed);

At src/raft/uv_prepare.c:41

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char errmsg[RAFT_ERRMSG_BUF_SIZE]; /* Error of threadpool callback */

At src/raft/uv_prepare.c:43

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char filename[UV__FILENAME_LEN];   /* Filename of the segment */

At src/raft/uv_prepare.c:163

Level	Rule
error	FF1015

format/sprintf:Potential format string problem (CWE-134).

	sprintf(segment->filename, UV__OPEN_TEMPLATE, segment->counter);

At src/raft/uv_prepare.c:205

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

			char errmsg[RAFT_ERRMSG_BUF_SIZE];

At src/raft/uv_prepare.c:268

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char errmsg[RAFT_ERRMSG_BUF_SIZE];

At src/raft/uv_prepare.c:269

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char filename[UV__FILENAME_LEN];

At src/raft/uv_prepare.c:272

Level	Rule
error	FF1015

format/sprintf:Potential format string problem (CWE-134).

	sprintf(filename, UV__OPEN_TEMPLATE, counter);

At src/raft/uv_metadata.c:51

Level	Rule
error	FF1015

format/sprintf:Potential format string problem (CWE-134).

	sprintf(filename, METADATA_FILENAME_PREFIX "%d", n);

At src/raft/uv_metadata.c:61

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char filename[METADATA_FILENAME_SIZE];  /* Filename of the metadata file

At src/raft/uv_metadata.c:178

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char filename[METADATA_FILENAME_SIZE];  /* Filename of the metadata file

At src/raft/uv_recv.c:65

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	s->address = RaftHeapMalloc(strlen(address) + 1);

At src/raft/uv_recv.c:69

Level	Rule
error	FF1001

buffer/strcpy:Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120).

	strcpy(s->address, address);

At src/raft/snapshot.c:104

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(cursor, src->bufs[i].base, src->bufs[i].len);

At src/raft/fixture.c:38

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char address[16];          /* Server address (stringified ID). */

At src/raft/fixture.c:430

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(dst->data.base, src->data.base, src->data.len);

At src/raft/fixture.c:1059

Level	Rule
note	FF1017

format/fprintf:If format strings can be influenced by an attacker, they can be exploited (CWE-134).

	fprintf(stderr, "%d: %30s:%*d - %s\n", id, file, 3, line, message);

At src/raft/fixture.c:1073

Level	Rule
note	FF1015

buffer/sprintf:Does not check for buffer overflows (CWE-120).

	sprintf(s->address, "%llu", s->id);

At src/raft/fixture.c:1270

Level	Rule
note	FF1017

format/fprintf:If format strings can be influenced by an attacker, they can be exploited (CWE-134).

				fprintf(stderr,

At src/raft/fixture.c:1426

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(buf.base, entry->buf.base, buf.len);

At src/error.c:139

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	len = strlen(*e) + 1;

At src/error.c:147

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(copy, *e, len);

At src/roles.c:460

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

		cluster[i].address = raft_malloc(strlen(server->address) + 1);

At src/roles.c:464

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(cluster[i].address, server->address,

At src/roles.c:465

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

		       strlen(server->address) + 1);

At src/roles.c:593

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	leader_addr = raft_malloc(strlen(borrowed_addr) + 1);

At src/roles.c:597

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(leader_addr, borrowed_addr, strlen(borrowed_addr) + 1);

At src/roles.c:597

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	memcpy(leader_addr, borrowed_addr, strlen(borrowed_addr) + 1);

At src/gateway.c:314

Level	Rule
note	FF1040

misc/open:Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362).

	START_V0(open, db);

At src/gateway.c:1126

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(cur, data, n);

At src/gateway.c:1141

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char filename[1024] = { 0 };

At src/gateway.c:1203

Level	Rule
note	FF1008

buffer/strncpy:Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120).

	strncpy(filename, request.filename,

At src/gateway.c:1204

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

		sizeof(filename) - strlen(wal_suffix) - 1);

At src/gateway.c:1205

Level	Rule
error	FF1005

buffer/strcat:Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120).

	strcat(filename, wal_suffix);

At src/utils.h:17

Level	Rule
note	FF1017

format/fprintf:If format strings can be influenced by an attacker, they can be exploited (CWE-134).

#define DBG() fprintf(stderr, "%s:%d\n", __func__, __LINE__)

At src/config.h:17

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char name[256];                /* VFS/replication registriatio name */

At src/config.h:20

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char raft_dir[1024];               /* Directory used by raft */

At src/config.h:21

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char database_dir[1024];           /* Data dir for on-disk database */

At src/server.h:57

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char errmsg[DQLITE_ERRMSG_BUF_SIZE]; /* Last error occurred */

At src/command.c:44

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(*cursor, frames->pages[i], frames->page_size);

At src/logger.c:10

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char buf[EMIT_BUF_LEN];

At src/logger.c:19

Level	Rule
note	FF1015

buffer/sprintf:Does not check for buffer overflows (CWE-120).

			sprintf(cursor, "[DEBUG]: ");

At src/logger.c:22

Level	Rule
note	FF1015

buffer/sprintf:Does not check for buffer overflows (CWE-120).

			sprintf(cursor, "[INFO ]: ");

At src/logger.c:25

Level	Rule
note	FF1015

buffer/sprintf:Does not check for buffer overflows (CWE-120).

			sprintf(cursor, "[WARN ]: ");

At src/logger.c:28

Level	Rule
note	FF1015

buffer/sprintf:Does not check for buffer overflows (CWE-120).

			sprintf(cursor, "[ERROR]: ");

At src/logger.c:31

Level	Rule
note	FF1015

buffer/sprintf:Does not check for buffer overflows (CWE-120).

			sprintf(cursor, "[     ]: ");

At src/logger.c:35

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	cursor = buf + strlen(buf);

At src/logger.c:38

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	n = EMIT_BUF_LEN - strlen(buf) - 1;

At src/logger.c:39

Level	Rule
error	FF1019

format/vsnprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

	vsnprintf(cursor, n, fmt, args);

At src/logger.c:41

Level	Rule
note	FF1017

format/fprintf:If format strings can be influenced by an attacker, they can be exploited (CWE-134).

	fprintf(stderr, "%s\n", buf);

At src/command.h:47

Level	Rule
note	FF1040

misc/open:Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362).

	X(open, OPEN, __VA_ARGS__)     \

At src/raft.h:647

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char errmsg[RAFT_ERRMSG_BUF_SIZE];

At src/raft.h:660

Level	Rule
note	FF1070

input/recv:Function accepts input from outside program (CWE-20).

		     raft_io_recv_cb recv);

At src/raft.h:694

Level	Rule
warning	FF1048

random/random:This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327).

	int (*random)(struct raft_io *io, int min, int max);

At src/raft.h:1023

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char errmsg[RAFT_ERRMSG_BUF_SIZE];

At src/raft.h:1649

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char errmsg[RAFT_ERRMSG_BUF_SIZE];

At src/lib/sm.h:36

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char name[SM_MAX_NAME_LENGTH];

At src/lib/addr.c:20

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	size_t input_len = strlen(input);

At src/lib/addr.c:51

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

		memcpy(addr_un->sun_path + 1, name, name_len);

At src/lib/addr.c:101

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(addr, res->ai_addr, res->ai_addrlen);

At src/lib/sm.c:37

Level	Rule
note	FF1013

buffer/char:Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120).

	char v[SM_MAX_ATTR_LENGTH];

At src/lib/sm.c:40

Level	Rule
error	FF1019

format/vsnprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

	vsnprintf(v, sizeof(v), fmt, ap);

At src/lib/sm.c:66

Level	Rule
note	FF1019

format/snprintf:If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134).

	snprintf(m->name, SM_MAX_NAME_LENGTH, "%s", name);

At src/lib/serialize.h:154

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	return BytePad64(strlen(*value) + 1);

At src/lib/serialize.h:172

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(*cursor, &x, sizeof(uint16_t));

At src/lib/serialize.h:179

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(*cursor, &x, sizeof(uint32_t));

At src/lib/serialize.h:186

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(*cursor, &x, sizeof(uint64_t));

At src/lib/serialize.h:193

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(*cursor, &x, sizeof(int64_t));

At src/lib/serialize.h:200

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(*cursor, &x, sizeof(uint64_t));

At src/lib/serialize.h:206

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	size_t len = BytePad64(strlen(*value) + 1);

At src/lib/serialize.h:208

Level	Rule
error	FF1001

buffer/strcpy:Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120).

	strcpy(*cursor, *value);

At src/lib/serialize.h:217

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(*cursor, value->base, value->len);

At src/lib/serialize.h:239

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(value, cursor->p, sizeof(*value));

At src/lib/serialize.h:252

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(value, cursor->p, sizeof(*value));

At src/lib/serialize.h:265

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(value, cursor->p, sizeof(*value));

At src/lib/serialize.h:278

Level	Rule
note	FF1004

buffer/memcpy:Does not check for buffer overflows when copying to destination (CWE-120).

	memcpy(value, cursor->p, sizeof(*value));

At src/lib/serialize.h:308

Level	Rule
note	FF1022

buffer/strlen:Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

	n = BytePad64(strlen(*value) + 1);

At src/lib/transport.c:14

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	assert(t->read.base != NULL);

At src/lib/transport.c:15

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	assert(t->read.len > 0);

At src/lib/transport.c:16

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	*buf = t->read;

At src/lib/transport.c:29

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	t->read.base = NULL;

At src/lib/transport.c:30

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	t->read.len = 0;

At src/lib/transport.c:45

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

		assert(n <= t->read.len);

At src/lib/transport.c:48

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

		t->read.base += n;

At src/lib/transport.c:49

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

		t->read.len -= n;

At src/lib/transport.c:53

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

		if (t->read.len > 0) {

At src/lib/transport.c:123

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	t->read.base = NULL;

At src/lib/transport.c:124

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	t->read.len = 0;

At src/lib/transport.c:153

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	assert(t->read.base == NULL);

At src/lib/transport.c:154

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	assert(t->read.len == 0);

At src/lib/transport.h:28

Level	Rule
note	FF1029

buffer/read:Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

	uv_buf_t read;               /* Read buffer */

marco6 requested review from just-now and letFunny July 11, 2025 14:33

marco6 force-pushed the add-security-scan branch from 126981e to d9c0116 Compare July 11, 2025 14:33

just-now approved these changes Aug 7, 2025

View reviewed changes

marco6 marked this pull request as ready for review August 20, 2025 14:26

chore: add flawfinder scan

e7af89e

marco6 force-pushed the add-security-scan branch from d9c0116 to e7af89e Compare August 28, 2025 12:38

marco6 force-pushed the master branch 7 times, most recently from 2ec54b4 to 3769fab Compare August 29, 2025 14:57

marco6 added Maybe Undecided whether in scope for the project Blocked Waiting on an external task labels Nov 5, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: add flawfinder scan#794

chore: add flawfinder scan#794
marco6 wants to merge 1 commit intomainfrom
add-security-scan

marco6 commented Jul 11, 2025

Uh oh!

github-actions bot commented Jul 11, 2025 •

edited

Loading

Details

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

marco6 commented Jul 11, 2025

Uh oh!

github-actions bot commented Jul 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Flawfinder scan

Details

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions bot commented Jul 11, 2025 •

edited

Loading