- ./curl-83.40.2/curl/docs/examples/asiohiper.cpp:77: [4] (shell) system:
This causes a new program to execute and is difficult to use safely.
try using a library call that implements the same functionality if
available.
static void timer_cb(const boost::system::error_code & error, GlobalInfo *g);
- ./curl-83.40.2/curl/docs/examples/asiohiper.cpp:96: [4] (shell) system:
This causes a new program to execute and is difficult to use safely.
try using a library call that implements the same functionality if
available.
boost::system::error_code error; /*success*/
- ./curl-83.40.2/curl/docs/examples/asiohiper.cpp:198: [4] (shell) system:
This causes a new program to execute and is difficult to use safely.
try using a library call that implements the same functionality if
available.
static void timer_cb(const boost::system::error_code & error, GlobalInfo *g)
- ./curl-83.40.2/curl/docs/examples/asiohiper.cpp:358: [4] (shell) system:
This causes a new program to execute and is difficult to use safely.
try using a library call that implements the same functionality if
available.
boost::system::error_code ec;
- ./curl-83.40.2/curl/docs/examples/cookie_interface.c:88: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
#define snprintf _snprintf
- ./curl-83.40.2/curl/docs/examples/cookie_interface.c:88: [4] (format) _snprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
#define snprintf _snprintf
- ./curl-83.40.2/curl/docs/examples/curlx.c:407: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(serverurl,"https://%s",hostporturl);
- ./curl-83.40.2/curl/docs/examples/curlx.c:445: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(contenttype,"Content-type: %s",mimetype);
- ./curl-83.40.2/curl/docs/examples/evhiperfifo.c:72: [4] (format) printf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
#define DPRINT(x...) printf(x)
- ./curl-83.40.2/curl/docs/examples/htmltidy.c:59: [4] (format) printf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
printf(tidyAttrName(attr));
- ./curl-83.40.2/curl/docs/examples/rtsp.c:147: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(sdp_filename, "%s.sdp", s);
- ./curl-83.40.2/curl/docs/examples/rtsp.c:163: [4] (buffer) sscanf:
The scanf() family's %s operation, without a limit specification,
permits buffer overflows. Specify a limit to %s, or use a different input
function.
sscanf(s, " a = control: %s", control);
- ./curl-83.40.2/curl/docs/examples/rtsp.c:231: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(uri, "%s", url);
- ./curl-83.40.2/curl/docs/examples/rtsp.c:241: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(uri, "%s/%s", url, control);
- ./curl-83.40.2/curl/docs/examples/rtsp.c:245: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(uri, "%s/", url);
- ./curl-83.40.2/curl/docs/examples/synctime.c:151: [4] (buffer) sscanf:
The scanf() family's %s operation, without a limit specification,
permits buffer overflows. Specify a limit to %s, or use a different input
function.
RetVal = sscanf ((char *)(ptr), "Date: %s %hu %s %hu %hu:%hu:%hu",
- ./curl-83.40.2/curl/include/curl/mprintf.h:48: [4] (format) printf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# undef printf
- ./curl-83.40.2/curl/include/curl/mprintf.h:49: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# undef fprintf
- ./curl-83.40.2/curl/include/curl/mprintf.h:50: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
# undef sprintf
- ./curl-83.40.2/curl/include/curl/mprintf.h:51: [4] (buffer) vsprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
# undef vsprintf
- ./curl-83.40.2/curl/include/curl/mprintf.h:52: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
# undef snprintf
- ./curl-83.40.2/curl/include/curl/mprintf.h:53: [4] (format) vprintf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# undef vprintf
- ./curl-83.40.2/curl/include/curl/mprintf.h:54: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# undef vfprintf
- ./curl-83.40.2/curl/include/curl/mprintf.h:55: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
# undef vsnprintf
- ./curl-83.40.2/curl/include/curl/mprintf.h:58: [4] (format) printf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# define printf curl_mprintf
- ./curl-83.40.2/curl/include/curl/mprintf.h:59: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# define fprintf curl_mfprintf
- ./curl-83.40.2/curl/include/curl/mprintf.h:60: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
# define sprintf curl_msprintf
- ./curl-83.40.2/curl/include/curl/mprintf.h:61: [4] (buffer) vsprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
# define vsprintf curl_mvsprintf
- ./curl-83.40.2/curl/include/curl/mprintf.h:62: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
# define snprintf curl_msnprintf
- ./curl-83.40.2/curl/include/curl/mprintf.h:63: [4] (format) vprintf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# define vprintf curl_mvprintf
- ./curl-83.40.2/curl/include/curl/mprintf.h:64: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# define vfprintf curl_mvfprintf
- ./curl-83.40.2/curl/include/curl/mprintf.h:65: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
# define vsnprintf curl_mvsnprintf
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:694: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
snprintf((char *)ptr + NTLM_HMAC_MD5_LEN, NTLMv2_BLOB_LEN,
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:382: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
snprintf((char *)ntlmbuf, NTLM_BUFSIZE,
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:652: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
size = snprintf((char *)ntlmbuf, NTLM_BUFSIZE,
- ./curl-83.40.2/curl/lib/curl_ntlm_wb.c:179: [4] (race) access:
This usually indicates a security flaw. If an attacker can change
anything along the path between the call to access() and the file's actual
use (e.g., by moving files), the attacker can exploit the race
condition. Set up the correct permissions (e.g., using setuid()) and try to
open the file directly.
if(access(ntlm_auth, X_OK) != 0) {
- ./curl-83.40.2/curl/lib/curl_ntlm_wb.c:224: [4] (shell) execl:
This causes a new program to execute and is difficult to use safely.
try using a library call that implements the same functionality if
available.
execl(ntlm_auth, ntlm_auth,
- ./curl-83.40.2/curl/lib/curl_ntlm_wb.c:231: [4] (shell) execl:
This causes a new program to execute and is difficult to use safely.
try using a library call that implements the same functionality if
available.
execl(ntlm_auth, ntlm_auth,
- ./curl-83.40.2/curl/lib/curl_printf.h:32: [4] (format) printf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# undef printf
- ./curl-83.40.2/curl/lib/curl_printf.h:33: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# undef fprintf
- ./curl-83.40.2/curl/lib/curl_printf.h:34: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
# undef snprintf
- ./curl-83.40.2/curl/lib/curl_printf.h:35: [4] (format) vprintf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# undef vprintf
- ./curl-83.40.2/curl/lib/curl_printf.h:36: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# undef vfprintf
- ./curl-83.40.2/curl/lib/curl_printf.h:37: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
# undef vsnprintf
- ./curl-83.40.2/curl/lib/curl_printf.h:40: [4] (format) printf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# define printf curl_mprintf
- ./curl-83.40.2/curl/lib/curl_printf.h:41: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# define fprintf curl_mfprintf
- ./curl-83.40.2/curl/lib/curl_printf.h:42: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
# define snprintf curl_msnprintf
- ./curl-83.40.2/curl/lib/curl_printf.h:43: [4] (format) vprintf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# define vprintf curl_mvprintf
- ./curl-83.40.2/curl/lib/curl_printf.h:44: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# define vfprintf curl_mvfprintf
- ./curl-83.40.2/curl/lib/curl_printf.h:45: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
# define vsnprintf curl_mvsnprintf
- ./curl-83.40.2/curl/lib/curl_printf.h:51: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
# undef sprintf
- ./curl-83.40.2/curl/lib/curl_printf.h:52: [4] (buffer) vsprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
# undef vsprintf
- ./curl-83.40.2/curl/lib/curl_printf.h:53: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
# define sprintf sprintf_was_used
- ./curl-83.40.2/curl/lib/curl_printf.h:54: [4] (buffer) vsprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
# define vsprintf vsprintf_was_used
- ./curl-83.40.2/curl/lib/curl_sasl_sspi.c:1173: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy((char *) message + sizeof(outdata), user_name);
- ./curl-83.40.2/curl/lib/curlx.h:94: [4] (format) printf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# undef printf
- ./curl-83.40.2/curl/lib/curlx.h:95: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# undef fprintf
- ./curl-83.40.2/curl/lib/curlx.h:96: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
# undef sprintf
- ./curl-83.40.2/curl/lib/curlx.h:97: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
# undef snprintf
- ./curl-83.40.2/curl/lib/curlx.h:98: [4] (format) vprintf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# undef vprintf
- ./curl-83.40.2/curl/lib/curlx.h:99: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# undef vfprintf
- ./curl-83.40.2/curl/lib/curlx.h:100: [4] (buffer) vsprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
# undef vsprintf
- ./curl-83.40.2/curl/lib/curlx.h:101: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
# undef vsnprintf
- ./curl-83.40.2/curl/lib/curlx.h:105: [4] (format) printf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# define printf curlx_mprintf
- ./curl-83.40.2/curl/lib/curlx.h:106: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# define fprintf curlx_mfprintf
- ./curl-83.40.2/curl/lib/curlx.h:107: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
# define sprintf curlx_msprintf
- ./curl-83.40.2/curl/lib/curlx.h:108: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
# define snprintf curlx_msnprintf
- ./curl-83.40.2/curl/lib/curlx.h:109: [4] (format) vprintf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# define vprintf curlx_mvprintf
- ./curl-83.40.2/curl/lib/curlx.h:110: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
# define vfprintf curlx_mvfprintf
- ./curl-83.40.2/curl/lib/curlx.h:111: [4] (buffer) vsprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
# define vsprintf curlx_mvsprintf
- ./curl-83.40.2/curl/lib/curlx.h:112: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
# define vsnprintf curlx_mvsnprintf
- ./curl-83.40.2/curl/lib/formdata.c:878: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
vsnprintf(s, sizeof(s), fmt, ap);
- ./curl-83.40.2/curl/lib/ftp.c:1042: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(addr, string_ftpport);
- ./curl-83.40.2/curl/lib/ftp.c:1052: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(addr, string_ftpport);
- ./curl-83.40.2/curl/lib/ftp.c:4091: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
write_len = vsnprintf(s, SBUF_SIZE-3, fmt, ap);
- ./curl-83.40.2/curl/lib/inet_ntop.c:70: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(dst, tmp);
- ./curl-83.40.2/curl/lib/inet_ntop.c:167: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(dst, tmp);
- ./curl-83.40.2/curl/lib/ldap.c:707: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
vfprintf (stderr, fmt, args);
- ./curl-83.40.2/curl/lib/memdebug.c:477: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
nchars = vsnprintf(buf, LOGLINE_BUFSIZE, format, ap);
- ./curl-83.40.2/curl/lib/mprintf.c:919: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
(sprintf)(work, formatbuf, p->data.dnum);
- ./curl-83.40.2/curl/lib/progress.c:43: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
snprintf(r, 9, "%2" CURL_FORMAT_CURL_OFF_T ":%02" CURL_FORMAT_CURL_OFF_T
- ./curl-83.40.2/curl/lib/progress.c:71: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
snprintf(max5, 6, "%5" CURL_FORMAT_CURL_OFF_T, bytes);
- ./curl-83.40.2/curl/lib/security.c:122: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
vsnprintf(print_buffer, sizeof(print_buffer), message, args);
- ./curl-83.40.2/curl/lib/security.c:402: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(buffer, buf);
- ./curl-83.40.2/curl/lib/sendf.c:132: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
vsnprintf(print_buffer, sizeof(print_buffer), fmt, ap);
- ./curl-83.40.2/curl/lib/sendf.c:149: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
vsnprintf(data->state.buffer, BUFSIZE, fmt, ap);
- ./curl-83.40.2/curl/lib/smb.c:121: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(p, (str)); \
- ./curl-83.40.2/curl/lib/smb.c:126: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(p, (str)); \
- ./curl-83.40.2/curl/lib/smb.c:525: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(msg.bytes, req->path);
- ./curl-83.40.2/curl/lib/smb.h:167: [4] (race) access:
This usually indicates a security flaw. If an attacker can change
anything along the path between the call to access() and the file's actual
use (e.g., by moving files), the attacker can exploit the race
condition. Set up the correct permissions (e.g., using setuid()) and try to
open the file directly.
unsigned int access;
- ./curl-83.40.2/curl/lib/socks.c:232: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy((char*)socksreq + packetsize, hostname);
- ./curl-83.40.2/curl/lib/socks_gssapi.c:67: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(buf+len, (char*) status_string.value);
- ./curl-83.40.2/curl/lib/socks_gssapi.c:88: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(buf+len, (char*) status_string.value);
- ./curl-83.40.2/curl/lib/ssh.c:820: [4] (race) access:
This usually indicates a security flaw. If an attacker can change
anything along the path between the call to access() and the file's actual
use (e.g., by moving files), the attacker can exploit the race
condition. Set up the correct permissions (e.g., using setuid()) and try to
open the file directly.
else if(access(sshc->rsa, R_OK) != 0) {
- ./curl-83.40.2/curl/lib/ssh.c:825: [4] (race) access:
This usually indicates a security flaw. If an attacker can change
anything along the path between the call to access() and the file's actual
use (e.g., by moving files), the attacker can exploit the race
condition. Set up the correct permissions (e.g., using setuid()) and try to
open the file directly.
else if(access(sshc->rsa, R_OK) != 0) {
- ./curl-83.40.2/curl/lib/ssh.c:833: [4] (race) access:
This usually indicates a security flaw. If an attacker can change
anything along the path between the call to access() and the file's actual
use (e.g., by moving files), the attacker can exploit the race
condition. Set up the correct permissions (e.g., using setuid()) and try to
open the file directly.
if(sshc->rsa && access(sshc->rsa, R_OK) != 0) {
- ./curl-83.40.2/curl/lib/ssh.c:836: [4] (race) access:
This usually indicates a security flaw. If an attacker can change
anything along the path between the call to access() and the file's actual
use (e.g., by moving files), the attacker can exploit the race
condition. Set up the correct permissions (e.g., using setuid()) and try to
open the file directly.
if(sshc->rsa && access(sshc->rsa, R_OK) != 0) {
- ./curl-83.40.2/curl/lib/tftp.c:410: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(buf, option);
- ./curl-83.40.2/curl/lib/tftp.c:499: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
snprintf(buf, sizeof(buf), "%" CURL_FORMAT_CURL_OFF_T,
- ./curl-83.40.2/curl/lib/version.c:70: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(ptr, LIBCURL_NAME "/" LIBCURL_VERSION);
- ./curl-83.40.2/curl/lib/vtls/gskit.c:354: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(ciphers[i].ptr, ctp->gsktoken);
- ./curl-83.40.2/curl/lib/vtls/gskit.c:404: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(ciphers[CURL_GSKPROTO_SSLV3].ptr,
- ./curl-83.40.2/curl/packages/OS400/os400sys.c:1129: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(cp, cp2);
- ./curl-83.40.2/curl/packages/OS400/os400sys.c:1161: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(cp, cp2);
- ./curl-83.40.2/curl/packages/OS400/os400sys.c:1193: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(cp, cp2);
- ./curl-83.40.2/curl/src/tool_cb_prg.c:94: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
fprintf(bar->out, format, line, percent);
- ./curl-83.40.2/curl/src/tool_dirhie.c:127: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(dirbuildup, tempdir);
- ./curl-83.40.2/curl/src/tool_dirhie.c:131: [4] (race) access:
This usually indicates a security flaw. If an attacker can change
anything along the path between the call to access() and the file's actual
use (e.g., by moving files), the attacker can exploit the race
condition. Set up the correct permissions (e.g., using setuid()) and try to
open the file directly.
if(access(dirbuildup, F_OK) == -1) {
- ./curl-83.40.2/curl/src/tool_doswin.c:111: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(new_name, msdosify(file_name));
- ./curl-83.40.2/curl/src/tool_doswin.c:230: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(file_name, fname);
- ./curl-83.40.2/curl/src/tool_getparam.c:1187: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(n, enc);
- ./curl-83.40.2/curl/src/tool_help.c:305: [4] (format) printf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
printf(CURL_ID "%s\n", curl_version());
- ./curl-83.40.2/curl/src/tool_main.c:103: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(fname, env);
- ./curl-83.40.2/curl/src/tool_msgs.c:50: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
len = vsnprintf(print_buffer, sizeof(print_buffer), fmt, ap);
- ./curl-83.40.2/curl/src/tool_msgs.c:91: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
vfprintf(errors, fmt, ap);
- ./curl-83.40.2/curl/src/tool_paramhlp.c:79: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(string+stringlen, buffer);
- ./curl-83.40.2/curl/src/tool_parsecfg.c:355: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(&line[linelen], buf);
- ./curl-83.40.2/curl/src/tool_setopt.c:532: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
snprintf(buf, sizeof(buf),
- ./curl-83.40.2/curl/tests/libtest/first.c:93: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(fname, env);
- ./curl-83.40.2/curl/tests/libtest/lib1502.c:54: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(redirect, "google.com:%s:%s", libtest_arg2, libtest_arg3);
- ./curl-83.40.2/curl/tests/libtest/lib1506.c:49: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(dnsentry, "server%d.example.com:%s:%s", i + 1, port, address);
- ./curl-83.40.2/curl/tests/libtest/lib1506.c:72: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(target_url, "http://server%d.example.com:%s/path/1506%04i",
- ./curl-83.40.2/curl/tests/libtest/lib1510.c:47: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(dnsentry, "server%d.example.com:%s:%s", i + 1, port, address);
- ./curl-83.40.2/curl/tests/libtest/lib1510.c:76: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(target_url, "http://server%d.example.com:%s/path/1510%04i",
- ./curl-83.40.2/curl/tests/libtest/lib1512.c:52: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(dnsentry, "server.example.curl:%s:%s", port, address);
- ./curl-83.40.2/curl/tests/libtest/lib1512.c:61: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(target_url, "http://server.example.curl:%s/path/1512%04i",
- ./curl-83.40.2/curl/tests/libtest/lib1900.c:66: [4] (buffer) fscanf:
The scanf() family's %s operation, without a limit specification,
permits buffer overflows. Specify a limit to %s, or use a different input
function.
if(fscanf(f, "%d %s\n", &filetime, buf)) {
- ./curl-83.40.2/curl/tests/libtest/lib1900.c:73: [4] (buffer) fscanf:
The scanf() family's %s operation, without a limit specification,
permits buffer overflows. Specify a limit to %s, or use a different input
function.
if(fscanf(f, "blacklist_site %s\n", buf)) {
- ./curl-83.40.2/curl/tests/libtest/lib1900.c:116: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(urlbuf, "%s%s", base_url, urlstring[handlenum]);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:60: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(msgbuff, "%s", msg);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:62: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(msgbuff, "%s, errno %d, %s", msg, err, strerror(err));
- ./curl-83.40.2/curl/tests/libtest/lib518.c:136: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff, fmt, rl.rlim_cur);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:144: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff, fmt, rl.rlim_max);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:202: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff, fmt, rl.rlim_cur);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:210: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff, fmt, rl.rlim_max);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:237: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff2, fmt, rl.rlim_cur);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:238: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff1, fmt, num_open.rlim_cur);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:239: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(strbuff, "fds needed %s > system limit %s",
- ./curl-83.40.2/curl/tests/libtest/lib518.c:261: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff, fmt, num_open.rlim_max);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:289: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff1, fmt, num_open.rlim_max);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:290: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(strbuff, "unable to allocate an array for %s "
- ./curl-83.40.2/curl/tests/libtest/lib518.c:300: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff, fmt, num_open.rlim_max);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:320: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff, fmt, num_open.rlim_max);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:327: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(strbuff, "opening of %s failed", DEV_NULL);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:348: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff1, fmt, num_open.rlim_cur);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:349: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(strbuff, "dup() attempt %s failed", strbuff1);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:352: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff1, fmt, num_open.rlim_cur);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:353: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(strbuff, "fds system limit seems close to %s", strbuff1);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:358: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff2, fmt, num_open.rlim_max);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:359: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff1, fmt, num_open.rlim_cur);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:360: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(strbuff, "fds needed %s > system limit %s",
- ./curl-83.40.2/curl/tests/libtest/lib518.c:378: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff, fmt, num_open.rlim_max);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:433: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff1, fmt, num_open.rlim_max);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:434: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(strbuff, "stdio fopen() fails with %s fds open()",
- ./curl-83.40.2/curl/tests/libtest/lib530.c:56: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(target_url, "%s%04i", URL, i + 1);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:61: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(msgbuff, "%s", msg);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:63: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(msgbuff, "%s, errno %d, %s", msg, err, strerror(err));
- ./curl-83.40.2/curl/tests/libtest/lib537.c:137: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff, fmt, rl.rlim_cur);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:145: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff, fmt, rl.rlim_max);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:197: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff, fmt, rl.rlim_cur);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:205: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff, fmt, rl.rlim_max);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:235: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff, fmt, num_open.rlim_max);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:278: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff1, fmt, num_open.rlim_max);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:279: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(strbuff, "unable to allocate an array for %s "
- ./curl-83.40.2/curl/tests/libtest/lib537.c:290: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff, fmt, num_open.rlim_max);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:314: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff, fmt, num_open.rlim_max);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:321: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(strbuff, "opening of %s failed", DEV_NULL);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:342: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff1, fmt, num_open.rlim_cur);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:343: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(strbuff, "dup() attempt %s failed", strbuff1);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:346: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff1, fmt, num_open.rlim_cur);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:347: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(strbuff, "fds system limit seems close to %s", strbuff1);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:353: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff1, fmt, num_open.rlim_cur);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:354: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(strbuff, "closing %s file descriptors", strbuff1);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:364: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff, fmt, num_open.rlim_max);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:381: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff, fmt, num_open.rlim_max);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:436: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(strbuff1, fmt, num_open.rlim_max);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:437: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(strbuff, "stdio fopen() fails with %s fds open()",
- ./curl-83.40.2/curl/tests/libtest/lib539.c:67: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
newURL = strcat(strcpy(newURL, URL), "./");
- ./curl-83.40.2/curl/tests/libtest/lib540.c:203: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(buffer, "Host: %s", HOST);
- ./curl-83.40.2/curl/tests/libtest/lib547.c:57: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(ptr, UPLOADTHIS);
- ./curl-83.40.2/curl/tests/libtest/lib555.c:56: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(ptr, UPLOADTHIS);
- ./curl-83.40.2/curl/tests/libtest/libauthretry.c:41: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(full_url, "%s%04d", url, seq);
- ./curl-83.40.2/curl/tests/libtest/libntlmconnect.c:148: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(full_url, "%s0200", url);
- ./curl-83.40.2/curl/tests/libtest/libntlmconnect.c:151: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(full_url, "%s0100", url);
- ./curl-83.40.2/curl/tests/server/fake_ntlm.c:79: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(&outbuf[0], "%s", NOTHING_STR);
- ./curl-83.40.2/curl/tests/server/fake_ntlm.c:101: [4] (format) sprintf:
Potential format string problem. Make format string constant.
sprintf(&outbuf[o], HEX_FMT_STR, inbuf[i]);
- ./curl-83.40.2/curl/tests/server/getpart.c:47: [4] (format) printf:
If format strings can be influenced by an attacker, they can be
exploited. Use a constant for the format specification.
#define show(x) printf x
- ./curl-83.40.2/curl/tests/server/getpart.c:401: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(couter, ptag);
- ./curl-83.40.2/curl/tests/server/getpart.c:407: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(cmain, ptag);
- ./curl-83.40.2/curl/tests/server/getpart.c:413: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused).
strcpy(csub, ptag);
- ./curl-83.40.2/curl/tests/server/rtspd.c:378: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(logbuf, "Got request: %s %s %s/%d.%d",
- ./curl-83.40.2/curl/tests/server/rtspd.c:381: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(logbuf, "Got a *HUGE* request %s/%d.%d",
- ./curl-83.40.2/curl/tests/server/rtspd.c:532: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(logbuf, "Received a CONNECT %s HTTP/%d.%d request",
- ./curl-83.40.2/curl/tests/server/rtspd.c:942: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(weare, "HTTP/1.1 200 OK\r\nContent-Length: %zu\r\n\r\n%s",
- ./curl-83.40.2/curl/tests/server/sockfilt.c:1040: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf((char *)buffer, "%s/%hu\n", ipv_inuse, port);
- ./curl-83.40.2/curl/tests/server/sws.c:494: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(logbuf, "Got request: %s %s HTTP/%d.%d",
- ./curl-83.40.2/curl/tests/server/sws.c:551: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(logbuf, "Received a CONNECT %s HTTP/%d.%d request",
- ./curl-83.40.2/curl/tests/server/sws.c:1082: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(weare, "%s", msgbuf);
- ./curl-83.40.2/curl/tests/server/sws.c:1084: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(weare, "HTTP/1.1 200 OK\r\nContent-Length: %zu\r\n\r\n%s",
- ./curl-83.40.2/curl/tests/server/sws.c:1106: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(partbuf, "%s%ld", section, req->partno);
- ./curl-83.40.2/curl/tests/server/sws.c:1108: [4] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf.
sprintf(partbuf, "%s", section);
- ./curl-83.40.2/curl/tests/server/util.c:119: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
vsnprintf(buffer, sizeof(buffer), msg, ap);
- ./curl-83.40.2/curl/tests/server/util.c:190: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate. Use a
constant for the format specification.
snprintf(filename, sizeof(filename), TEST_DATA_PATH, path, testno);
- ./curl-83.40.2/curl/docs/examples/curlx.c:313: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
p.pst = getenv(*(++args));
- ./curl-83.40.2/curl/include/curl/curl.h:1913: [3] (buffer) curl_getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
CURL_EXTERN char *curl_getenv(const char *variable);
- ./curl-83.40.2/curl/lib/config-dos.h:152: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
#define CURL_CA_BUNDLE getenv("CURL_CA_BUNDLE")
- ./curl-83.40.2/curl/lib/curl_gethostname.c:67: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
const char *force_hostname = getenv("CURL_GETHOSTNAME");
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:676: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
char *force_timestamp = getenv("CURL_FORCETIME");
- ./curl-83.40.2/curl/lib/curl_ntlm_wb.c:143: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
username = getenv("NTLMUSER");
- ./curl-83.40.2/curl/lib/curl_ntlm_wb.c:145: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
username = getenv("LOGNAME");
- ./curl-83.40.2/curl/lib/curl_ntlm_wb.c:147: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
username = getenv("USER");
- ./curl-83.40.2/curl/lib/curl_ntlm_wb.c:172: [3] (buffer) curl_getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
ntlm_auth_alloc = curl_getenv("CURL_NTLM_WB_FILE");
- ./curl-83.40.2/curl/lib/curl_setup.h:642: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
#define CURL_CA_BUNDLE getenv("CURL_CA_BUNDLE")
- ./curl-83.40.2/curl/lib/curl_sspi.c:115: [3] (misc) LoadLibrary:
Ensure that the full path to the library is specified, or current
directory may be used. Use registry entry or GetWindowsDirectory to find
library path, if you aren't already.
s_hSecDll = LoadLibrary(TEXT("security.dll"));
- ./curl-83.40.2/curl/lib/curl_sspi.c:117: [3] (misc) LoadLibrary:
Ensure that the full path to the library is specified, or current
directory may be used. Use registry entry or GetWindowsDirectory to find
library path, if you aren't already.
s_hSecDll = LoadLibrary(TEXT("secur32.dll"));
- ./curl-83.40.2/curl/lib/curl_threads.h:42: [3] (misc) InitializeCriticalSection:
Exceptions can be thrown in low-memory situations. Use
InitializeCriticalSectionAndSpinCount instead.
# define Curl_mutex_init(m) InitializeCriticalSection(m)
- ./curl-83.40.2/curl/lib/curl_threads.h:46: [3] (misc) EnterCriticalSection:
On some versions of Windows, exceptions can be thrown in low-memory
situations. Use InitializeCriticalSectionAndSpinCount instead.
# define Curl_mutex_acquire(m) EnterCriticalSection(m)
- ./curl-83.40.2/curl/lib/curlx.h:75: [3] (buffer) curl_getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
#define curlx_getenv curl_getenv
- ./curl-83.40.2/curl/lib/easy.c:159: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
if(!getenv("CHARSET") && cp > 0) {
- ./curl-83.40.2/curl/lib/getenv.c:38: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
char *temp = getenv(variable);
- ./curl-83.40.2/curl/lib/getenv.c:44: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
char *env = getenv(variable);
- ./curl-83.40.2/curl/lib/getenv.c:50: [3] (buffer) curl_getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
char *curl_getenv(const char *v)
- ./curl-83.40.2/curl/lib/ldap.c:700: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
const char *env = getenv("CURL_TRACE");
- ./curl-83.40.2/curl/lib/netrc.c:74: [3] (buffer) curl_getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
char *home = curl_getenv("HOME"); /* portable environment reader */
- ./curl-83.40.2/curl/lib/setup-vms.h:37: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
#define getenv decc_getenv
- ./curl-83.40.2/curl/lib/setup-vms.h:50: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
#undef getenv
- ./curl-83.40.2/curl/lib/setup-vms.h:52: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
#define getenv vms_getenv
- ./curl-83.40.2/curl/lib/ssh.c:809: [3] (buffer) curl_getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
home = curl_getenv("HOME");
- ./curl-83.40.2/curl/lib/telnet.c:1337: [3] (misc) LoadLibrary:
Ensure that the full path to the library is specified, or current
directory may be used. Use registry entry or GetWindowsDirectory to find
library path, if you aren't already.
wsock2 = LoadLibrary(TEXT("WS2_32.DLL"));
- ./curl-83.40.2/curl/lib/url.c:4460: [3] (buffer) curl_getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
no_proxy=curl_getenv("no_proxy");
- ./curl-83.40.2/curl/lib/url.c:4462: [3] (buffer) curl_getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
no_proxy=curl_getenv("NO_PROXY");
- ./curl-83.40.2/curl/lib/url.c:4478: [3] (buffer) curl_getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
prox=curl_getenv(proxy_env);
- ./curl-83.40.2/curl/lib/url.c:4495: [3] (buffer) curl_getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
prox=curl_getenv(proxy_env);
- ./curl-83.40.2/curl/lib/url.c:4501: [3] (buffer) curl_getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
proxy = curl_getenv("all_proxy"); /* default proxy to use */
- ./curl-83.40.2/curl/lib/url.c:4503: [3] (buffer) curl_getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
proxy=curl_getenv("ALL_PROXY");
- ./curl-83.40.2/curl/lib/vtls/nss.c:1191: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
cert_dir = getenv("SSL_DIR");
- ./curl-83.40.2/curl/lib/vtls/vtls.c:191: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
char *force_entropy = getenv("CURL_ENTROPY");
- ./curl-83.40.2/curl/src/tool_homedir.c:57: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
env = getenv(variable);
- ./curl-83.40.2/curl/src/tool_main.c:264: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
if(getenv("_IN_NETWARE_BASH_") == NULL)
- ./curl-83.40.2/curl/src/tool_vms.c:56: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
shell = getenv("SHELL");
- ./curl-83.40.2/curl/tests/libtest/first.c:87: [3] (buffer) curl_getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
env = curl_getenv("CURL_MEMDEBUG");
- ./curl-83.40.2/curl/tests/libtest/first.c:101: [3] (buffer) curl_getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
env = curl_getenv("CURL_MEMLIMIT");
- ./curl-83.40.2/curl/tests/libtest/sethostname.c:32: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
const char *force_hostname = getenv("CURL_GETHOSTNAME");
- ./curl-83.40.2/curl/tests/server/fake_ntlm.c:165: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
env = getenv("CURL_NTLM_AUTH_TESTNUM");
- ./curl-83.40.2/curl/tests/server/fake_ntlm.c:179: [3] (buffer) getenv:
Environment variables are untrustable input if they can be set by an
attacker. They can have any content and length, and the same variable
can be set more than once. Check environment variables carefully before
using them.
env = getenv("CURL_NTLM_AUTH_SRCDIR");
- ./curl-83.40.2/curl/CMake/CurlTests.c:116: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buffer[8192];
- ./curl-83.40.2/curl/CMake/CurlTests.c:512: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buffer[1024]; /* big enough to play with */
- ./curl-83.40.2/curl/CMake/CurlTests.c:526: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buffer[1024]; /* big enough to play with */
- ./curl-83.40.2/curl/docs/examples/anyauthput.c:130: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
hd = open(file, O_RDONLY) ;
- ./curl-83.40.2/curl/docs/examples/asiohiper.cpp:74: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char error[CURL_ERROR_SIZE];
- ./curl-83.40.2/curl/docs/examples/asiohiper.cpp:359: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
tcp_socket->open(boost::asio::ip::tcp::v4(), ec);
- ./curl-83.40.2/curl/docs/examples/cookie_interface.c:67: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char nline[256];
- ./curl-83.40.2/curl/docs/examples/curlgtk.c:52: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
outfile = fopen("test.curl", "w");
- ./curl-83.40.2/curl/docs/examples/curlx.c:149: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(tmp, ia5->data, ia5->length);
- ./curl-83.40.2/curl/docs/examples/evhiperfifo.c:95: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char error[CURL_ERROR_SIZE];
- ./curl-83.40.2/curl/docs/examples/evhiperfifo.c:360: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char s[1024];
- ./curl-83.40.2/curl/docs/examples/evhiperfifo.c:400: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
sockfd = open(fifo, O_RDWR | O_NONBLOCK, 0);
- ./curl-83.40.2/curl/docs/examples/fileupload.c:35: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
fd = fopen("debugit", "rb"); /* open file to upload */
- ./curl-83.40.2/curl/docs/examples/fopen.c:117: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&url->buffer[url->buffer_pos], buffer, size);
- ./curl-83.40.2/curl/docs/examples/fopen.c:243: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
if((file->handle.file=fopen(url,operation)))
- ./curl-83.40.2/curl/docs/examples/fopen.c:355: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptr, file->buffer, want);
- ./curl-83.40.2/curl/docs/examples/fopen.c:403: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptr, file->buffer, want);
- ./curl-83.40.2/curl/docs/examples/fopen.c:455: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buffer[256];
- ./curl-83.40.2/curl/docs/examples/fopen.c:464: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
outf=fopen("fgets.test","w+");
- ./curl-83.40.2/curl/docs/examples/fopen.c:488: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
outf=fopen("fread.test","w+");
- ./curl-83.40.2/curl/docs/examples/fopen.c:512: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
outf=fopen("rewind.test","w+");
- ./curl-83.40.2/curl/docs/examples/ftp-wildcard.c:118: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
data->output = fopen(finfo->filename, "w");
- ./curl-83.40.2/curl/docs/examples/ftpget.c:43: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
out->stream=fopen(out->filename, "wb");
- ./curl-83.40.2/curl/docs/examples/ftpgetresp.c:48: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
ftpfile = fopen("ftp-list", "wb"); /* b is binary, needed on win32 */
- ./curl-83.40.2/curl/docs/examples/ftpgetresp.c:51: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
respfile = fopen("ftp-responses", "wb"); /* b is binary, needed on win32 */
- ./curl-83.40.2/curl/docs/examples/ftpsget.c:45: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
out->stream=fopen(out->filename, "wb");
- ./curl-83.40.2/curl/docs/examples/ftpupload.c:89: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
hd_src = fopen(LOCAL_FILE, "rb");
- ./curl-83.40.2/curl/docs/examples/ftpuploadresume.c:91: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
f = fopen(localpath, "rb");
- ./curl-83.40.2/curl/docs/examples/getinmemory.c:51: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&(mem->memory[mem->size]), contents, realsize);
- ./curl-83.40.2/curl/docs/examples/ghiper.c:84: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char error[CURL_ERROR_SIZE];
- ./curl-83.40.2/curl/docs/examples/ghiper.c:411: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
socket = open (fifo, O_RDWR | O_NONBLOCK, 0);
- ./curl-83.40.2/curl/docs/examples/hiperfifo.c:91: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char error[CURL_ERROR_SIZE];
- ./curl-83.40.2/curl/docs/examples/hiperfifo.c:348: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char s[1024];
- ./curl-83.40.2/curl/docs/examples/hiperfifo.c:385: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
sockfd = open(fifo, O_RDWR | O_NONBLOCK, 0);
- ./curl-83.40.2/curl/docs/examples/href_extractor.c:42: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
html_parser_char_parse(hsp, ((char *)buffer)[p]);
- ./curl-83.40.2/curl/docs/examples/href_extractor.c:55: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char tag[1], attr[4], val[128];
- ./curl-83.40.2/curl/docs/examples/htmltidy.c:81: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char curl_errbuf[CURL_ERROR_SIZE];
- ./curl-83.40.2/curl/docs/examples/htmltitle.cpp:63: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static char errorBuffer[CURL_ERROR_SIZE];
- ./curl-83.40.2/curl/docs/examples/http2-download.c:145: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char filename[128];
- ./curl-83.40.2/curl/docs/examples/http2-download.c:147: [2] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf. Risk
is low because the source has a constant maximum length.
sprintf(filename, "dl-%d", num);
- ./curl-83.40.2/curl/docs/examples/http2-download.c:149: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
out = fopen(filename, "wb");
- ./curl-83.40.2/curl/docs/examples/http2-download.c:188: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range.
If source untrusted, check both minimum and maximum, even if the input
had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
num_transfers = atoi(argv[1]);
- ./curl-83.40.2/curl/docs/examples/http2-upload.c:109: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char timebuf[20];
- ./curl-83.40.2/curl/docs/examples/http2-upload.c:180: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char url[256];
- ./curl-83.40.2/curl/docs/examples/http2-upload.c:181: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char filename[128];
- ./curl-83.40.2/curl/docs/examples/http2-upload.c:185: [2] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf. Risk
is low because the source has a constant maximum length.
sprintf(filename, "dl-%d", num);
- ./curl-83.40.2/curl/docs/examples/http2-upload.c:186: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
out = fopen(filename, "wb");
- ./curl-83.40.2/curl/docs/examples/http2-upload.c:188: [2] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf. Risk
is low because the source has a constant maximum length.
sprintf(url, "https://localhost:8443/upload-%d", num);
- ./curl-83.40.2/curl/docs/examples/http2-upload.c:194: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
indata[num].in = fopen(upload, "rb");
- ./curl-83.40.2/curl/docs/examples/http2-upload.c:245: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range.
If source untrusted, check both minimum and maximum, even if the input
had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
num_transfers = atoi(argv[1]);
- ./curl-83.40.2/curl/docs/examples/httpput.c:77: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
hd_src = fopen(file, "rb");
- ./curl-83.40.2/curl/docs/examples/imap-append.c:68: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptr, data, len);
- ./curl-83.40.2/curl/docs/examples/multi-uv.c:79: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char filename[50];
- ./curl-83.40.2/curl/docs/examples/multi-uv.c:83: [2] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf. Risk
is low because the source has a constant maximum length.
sprintf(filename, "%d.download", num);
- ./curl-83.40.2/curl/docs/examples/multi-uv.c:85: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
file = fopen(filename, "w");
- ./curl-83.40.2/curl/docs/examples/multithread.c:40: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
const char * const urls[NUMT]= {
- ./curl-83.40.2/curl/docs/examples/postinmemory.c:45: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&(mem->memory[mem->size]), contents, realsize);
- ./curl-83.40.2/curl/docs/examples/rtsp.c:86: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
FILE *sdp_fp = fopen(sdp_filename, "wt");
- ./curl-83.40.2/curl/docs/examples/rtsp.c:143: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused). Risk
is low because the source is a constant string.
strcpy(sdp_filename, "video.sdp");
- ./curl-83.40.2/curl/docs/examples/rtsp.c:159: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
FILE *sdp_fp = fopen(sdp_filename, "rt");
- ./curl-83.40.2/curl/docs/examples/sendrecv.c:118: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[1024];
- ./curl-83.40.2/curl/docs/examples/sepheaders.c:57: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
headerfile = fopen(headerfilename, "wb");
- ./curl-83.40.2/curl/docs/examples/sepheaders.c:64: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
bodyfile = fopen(bodyfilename, "wb");
- ./curl-83.40.2/curl/docs/examples/sftpget.c:48: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
out->stream=fopen(out->filename, "wb");
- ./curl-83.40.2/curl/docs/examples/simplessl.c:70: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
headerfile = fopen("dumpit", "w");
- ./curl-83.40.2/curl/docs/examples/smooth-gtk-thread.c:88: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
outfile = fopen(urls[j], "w");
- ./curl-83.40.2/curl/docs/examples/smtp-mail.c:69: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptr, data, len);
- ./curl-83.40.2/curl/docs/examples/smtp-multi.c:70: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptr, data, len);
- ./curl-83.40.2/curl/docs/examples/smtp-ssl.c:70: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptr, data, len);
- ./curl-83.40.2/curl/docs/examples/smtp-tls.c:70: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptr, data, len);
- ./curl-83.40.2/curl/docs/examples/synctime.c:99: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char http_proxy[MAX_STRING1];
- ./curl-83.40.2/curl/docs/examples/synctime.c:100: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char proxy_user[MAX_STRING1];
- ./curl-83.40.2/curl/docs/examples/synctime.c:101: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char timeserver[MAX_STRING1];
- ./curl-83.40.2/curl/docs/examples/synctime.c:104: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
const char DefaultTimeServer[3][MAX_STRING1] =
- ./curl-83.40.2/curl/docs/examples/synctime.c:135: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char TmpStr1[26], TmpStr2[26];
- ./curl-83.40.2/curl/docs/examples/synctime.c:207: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
outfile = fopen(OutFileName, "wb");
- ./curl-83.40.2/curl/docs/examples/synctime.c:261: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char timeBuf[61];
- ./curl-83.40.2/curl/docs/examples/synctime.c:262: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char tzoneBuf[16];
- ./curl-83.40.2/curl/docs/examples/url2file.c:63: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
pagefile = fopen(pagefilename, "wb");
- ./curl-83.40.2/curl/docs/examples/xmlstream.c:76: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&(mem->memory[mem->size]), s, len);
- ./curl-83.40.2/curl/include/curl/curlrules.h:141: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
typedef char
- ./curl-83.40.2/curl/include/curl/curlrules.h:151: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
typedef char
- ./curl-83.40.2/curl/include/curl/curlrules.h:161: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
typedef char
- ./curl-83.40.2/curl/include/curl/curlrules.h:171: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
typedef char
- ./curl-83.40.2/curl/include/curl/curlrules.h:181: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
typedef char
- ./curl-83.40.2/curl/lib/asyn-ares.c:670: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char a6[INET6_ADDRSTRLEN];
- ./curl-83.40.2/curl/lib/asyn-thread.c:271: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char service[12];
- ./curl-83.40.2/curl/lib/asyn-thread.c:598: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char sbuf[12];
- ./curl-83.40.2/curl/lib/base64.c:177: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char ibuf[3];
- ./curl-83.40.2/curl/lib/base64.c:178: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char obuf[4];
- ./curl-83.40.2/curl/lib/connect.c:269: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char myhost[256] = "";
- ./curl-83.40.2/curl/lib/connect.c:393: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range.
If source untrusted, check both minimum and maximum, even if the input
had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
si6->sin6_scope_id = atoi(scope_ptr);
- ./curl-83.40.2/curl/lib/connect.c:601: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(conn->data->info.conn_primary_ip, conn->primary_ip, MAX_IPADR_LEN);
- ./curl-83.40.2/curl/lib/connect.c:602: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(conn->data->info.conn_local_ip, conn->local_ip, MAX_IPADR_LEN);
- ./curl-83.40.2/curl/lib/connect.c:698: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(conn->ip_addr_str, conn->primary_ip, MAX_IPADR_LEN);
- ./curl-83.40.2/curl/lib/connect.c:824: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char ipaddress[MAX_IPADR_LEN];
- ./curl-83.40.2/curl/lib/connect.c:999: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char ipaddress[MAX_IPADR_LEN];
- ./curl-83.40.2/curl/lib/connect.c:1323: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&addr->sa_addr, ai->ai_addr, addr->addrlen);
- ./curl-83.40.2/curl/lib/content_encoding.c:357: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(z->next_in, k->str, z->avail_in);
- ./curl-83.40.2/curl/lib/content_encoding.c:383: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(z->next_in + z->avail_in - nread, k->str, nread);
- ./curl-83.40.2/curl/lib/cookie.c:375: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char name[MAX_NAME];
- ./curl-83.40.2/curl/lib/cookie.c:619: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(co->path, path, pathlen);
- ./curl-83.40.2/curl/lib/cookie.c:917: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
fp = file?fopen(file, FOPEN_READTEXT):NULL;
- ./curl-83.40.2/curl/lib/cookie.c:1051: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(newco, co, sizeof(struct Cookie));
- ./curl-83.40.2/curl/lib/cookie.c:1265: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
out = fopen(dumphere, FOPEN_WRITETEXT);
- ./curl-83.40.2/curl/lib/curl_addrinfo.c:172: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ca->ai_addr, ai->ai_addr, ss_size);
- ./curl-83.40.2/curl/lib/curl_addrinfo.c:333: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&addr->sin_addr, curr, sizeof(struct in_addr));
- ./curl-83.40.2/curl/lib/curl_addrinfo.c:342: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&addr6->sin6_addr, curr, sizeof(struct in6_addr));
- ./curl-83.40.2/curl/lib/curl_addrinfo.c:369: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char *h_addr_list[2];
- ./curl-83.40.2/curl/lib/curl_addrinfo.c:416: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(addrentry, inaddr, sizeof(struct in_addr));
- ./curl-83.40.2/curl/lib/curl_addrinfo.c:422: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(addrentry, inaddr, sizeof(struct in6_addr));
- ./curl-83.40.2/curl/lib/curl_addrinfo.c:506: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(sa_un->sun_path, path, path_len + 1); /* copy NUL byte */
- ./curl-83.40.2/curl/lib/curl_fnmatch.c:72: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char keyword[KEYLEN] = { 0 };
- ./curl-83.40.2/curl/lib/curl_fnmatch.c:314: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char charset[CURLFNM_CHSET_SIZE] = { 0 };
- ./curl-83.40.2/curl/lib/curl_gssapi.c:97: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[1024];
- ./curl-83.40.2/curl/lib/curl_multibyte.c:43: [2] (buffer) MultiByteToWideChar:
Requires maximum length in CHARACTERS, not bytes.
int str_w_len = MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS,
- ./curl-83.40.2/curl/lib/curl_multibyte.c:48: [2] (buffer) MultiByteToWideChar:
Requires maximum length in CHARACTERS, not bytes.
if(MultiByteToWideChar(CP_UTF8, 0, str_utf8, -1, str_w,
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:164: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char key[8];
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:184: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char key[8];
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:208: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char key[8]; /* expanded 64 bit key */
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:266: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char key[8];
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:289: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char key[8];
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:318: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char key[8];
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:347: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(out, in, 8);
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:424: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char pw[14];
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:549: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy (ntbuffer, gcry_md_read (MD4pw, 0), MD4_DIGEST_LENGTH);
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:666: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char hmac_output[NTLM_HMAC_MD5_LEN];
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:700: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptr + 32, challenge_client, 8);
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:701: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptr + 44, ntlm->target_info, ntlm->target_info_len);
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:704: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptr + 8, &ntlm->nonce[0], 8);
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:713: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptr, hmac_output, NTLM_HMAC_MD5_LEN);
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:741: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char data[16];
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:742: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char hmac_output[16];
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:745: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&data[0], challenge_server, 8);
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:746: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&data[8], challenge_client, 8);
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:753: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(lmresp, hmac_output, 16);
- ./curl-83.40.2/curl/lib/curl_ntlm_core.c:754: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(lmresp+16, challenge_client, 8);
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:188: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ntlm->target_info, &buffer[target_info_offset], target_info_len);
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:289: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ntlm->nonce, &type2[24], 8);
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:363: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char ntlmbuf[NTLM_BUFSIZE];
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:489: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char ntlmbuf[NTLM_BUFSIZE];
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:491: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char lmresp[24]; /* fixed-size */
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:495: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char ntresp[24]; /* fixed-size */
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:500: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char host[HOSTNAME_MAX + 1] = "";
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:537: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char ntbuffer[0x18];
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:539: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char ntlmv2hash[0x18];
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:575: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char ntbuffer[0x18];
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:576: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char tmp[0x18];
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:577: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char md5sum[MD5_DIGEST_LENGTH];
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:585: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(lmresp, entropy, 8);
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:591: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(tmp, &ntlm->nonce[0], 8);
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:592: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(tmp + 8, entropy, 8);
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:612: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char ntbuffer[0x18];
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:614: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char lmbuffer[0x18];
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:740: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&ntlmbuf[size], lmresp, 0x18);
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:752: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&ntlmbuf[size], ptr_ntresp, ntresplen);
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:783: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&ntlmbuf[size], domain, domlen);
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:791: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&ntlmbuf[size], user, userlen);
- ./curl-83.40.2/curl/lib/curl_ntlm_msgs.c:799: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&ntlmbuf[size], host, hostlen);
- ./curl-83.40.2/curl/lib/curl_ntlm_wb.c:124: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char pwbuf[1024];
- ./curl-83.40.2/curl/lib/curl_sasl.c:320: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(plainauth, userp, ulen);
- ./curl-83.40.2/curl/lib/curl_sasl.c:322: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(plainauth + ulen + 1, userp, ulen);
- ./curl-83.40.2/curl/lib/curl_sasl.c:324: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(plainauth + 2 * ulen + 2, passwdp, plen);
- ./curl-83.40.2/curl/lib/curl_sasl.c:453: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char digest[MD5_DIGEST_LEN];
- ./curl-83.40.2/curl/lib/curl_sasl.c:593: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char digest[MD5_DIGEST_LEN];
- ./curl-83.40.2/curl/lib/curl_sasl.c:594: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char HA1_hex[2 * MD5_DIGEST_LEN + 1];
- ./curl-83.40.2/curl/lib/curl_sasl.c:595: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char HA2_hex[2 * MD5_DIGEST_LEN + 1];
- ./curl-83.40.2/curl/lib/curl_sasl.c:596: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char resp_hash_hex[2 * MD5_DIGEST_LEN + 1];
- ./curl-83.40.2/curl/lib/curl_sasl.c:597: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char nonce[64];
- ./curl-83.40.2/curl/lib/curl_sasl.c:598: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char realm[128];
- ./curl-83.40.2/curl/lib/curl_sasl.c:599: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char algorithm[64];
- ./curl-83.40.2/curl/lib/curl_sasl.c:600: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char qop_options[64];
- ./curl-83.40.2/curl/lib/curl_sasl.c:602: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char cnonce[33];
- ./curl-83.40.2/curl/lib/curl_sasl.c:773: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char value[DIGEST_MAX_VALUE_LENGTH];
- ./curl-83.40.2/curl/lib/curl_sasl.c:774: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char content[DIGEST_MAX_CONTENT_LENGTH];
- ./curl-83.40.2/curl/lib/curl_sasl.c:906: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char md5buf[16]; /* 16 bytes/128 bits */
- ./curl-83.40.2/curl/lib/curl_sasl.c:907: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char request_digest[33];
- ./curl-83.40.2/curl/lib/curl_sasl.c:909: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char ha1[33];/* 32 digits and 1 zero byte */
- ./curl-83.40.2/curl/lib/curl_sasl.c:910: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char ha2[33];/* 32 digits and 1 zero byte */
- ./curl-83.40.2/curl/lib/curl_sasl.c:911: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char cnoncebuf[33];
- ./curl-83.40.2/curl/lib/curl_sasl_gssapi.c:290: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&indata, output_token.value, 4);
- ./curl-83.40.2/curl/lib/curl_sasl_gssapi.c:328: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(message, &outdata, sizeof(outdata));
- ./curl-83.40.2/curl/lib/curl_sasl_gssapi.c:329: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(message + sizeof(outdata), username_token.value,
- ./curl-83.40.2/curl/lib/curl_sasl_sspi.c:299: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char value[DIGEST_MAX_VALUE_LENGTH];
- ./curl-83.40.2/curl/lib/curl_sasl_sspi.c:300: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char content[DIGEST_MAX_CONTENT_LENGTH];
- ./curl-83.40.2/curl/lib/curl_sasl_sspi.c:521: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(resp, resp_buf.pvBuffer, resp_buf.cbBuffer);
- ./curl-83.40.2/curl/lib/curl_sasl_sspi.c:995: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(krb5->context, &context, sizeof(context));
- ./curl-83.40.2/curl/lib/curl_sasl_sspi.c:1122: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&indata, input_buf[1].pvBuffer, 4);
- ./curl-83.40.2/curl/lib/curl_sasl_sspi.c:1172: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(message, &outdata, sizeof(outdata));
- ./curl-83.40.2/curl/lib/curl_sasl_sspi.c:1223: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(appdata, wrap_buf[0].pvBuffer, wrap_buf[0].cbBuffer);
- ./curl-83.40.2/curl/lib/curl_sasl_sspi.c:1225: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(appdata + offset, wrap_buf[1].pvBuffer, wrap_buf[1].cbBuffer);
- ./curl-83.40.2/curl/lib/curl_sasl_sspi.c:1227: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(appdata + offset, wrap_buf[2].pvBuffer, wrap_buf[2].cbBuffer);
- ./curl-83.40.2/curl/lib/dotdot.c:165: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(outptr, &input[oindex], qlen+1); /* include the ending zero byte */
- ./curl-83.40.2/curl/lib/easy.c:156: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[60];
- ./curl-83.40.2/curl/lib/escape.c:163: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char hexstr[3];
- ./curl-83.40.2/curl/lib/file.c:76: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
# define open_readonly(p,f) open((p),(f),(0))
- ./curl-83.40.2/curl/lib/file.c:78: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
# define open_readonly(p,f) open((p),(f))
- ./curl-83.40.2/curl/lib/file.c:337: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
fd = open(file->path, mode, conn->data->set.new_file_perms);
- ./curl-83.40.2/curl/lib/formdata.c:754: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buffer[8192];
- ./curl-83.40.2/curl/lib/formdata.c:759: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
file = fopen(name, "r"); /* VMS */
- ./curl-83.40.2/curl/lib/formdata.c:829: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(newform->line, line, length);
- ./curl-83.40.2/curl/lib/formdata.c:875: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char s[4096];
- ./curl-83.40.2/curl/lib/formdata.c:927: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buffer[8192];
- ./curl-83.40.2/curl/lib/formdata.c:1259: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
stdin:fopen(file->contents, "rb"); /* binary read for win32 */
- ./curl-83.40.2/curl/lib/formdata.c:1281: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buffer[512];
- ./curl-83.40.2/curl/lib/formdata.c:1367: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
# define fopen_read fopen
- ./curl-83.40.2/curl/lib/formdata.c:1388: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
return fopen(file, "r"); /* VMS */
- ./curl-83.40.2/curl/lib/formdata.c:1391: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
return fopen(file, "r", "rfm=stmlf", "ctx=stm");
- ./curl-83.40.2/curl/lib/formdata.c:1468: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(buffer + gotsize , form->data->line + form->sent,
- ./curl-83.40.2/curl/lib/formdata.c:1476: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(buffer+gotsize,
- ./curl-83.40.2/curl/lib/ftp.c:974: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char myhost[256] = "";
- ./curl-83.40.2/curl/lib/ftp.c:979: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char hbuf[NI_MAXHOST];
- ./curl-83.40.2/curl/lib/ftp.c:985: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char tmp[1024];
- ./curl-83.40.2/curl/lib/ftp.c:1162: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(sa, ai->ai_addr, ai->ai_addrlen);
- ./curl-83.40.2/curl/lib/ftp.c:1945: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char separator[4];
- ./curl-83.40.2/curl/lib/ftp.c:2403: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buffer[24]= { "Accept-ranges: bytes\r\n" };
- ./curl-83.40.2/curl/lib/ftp.c:3560: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[256];
- ./curl-83.40.2/curl/lib/ftp.c:4081: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char s[SBUF_SIZE];
- ./curl-83.40.2/curl/lib/ftp.c:4094: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused). Risk
is low because the source is a constant string.
strcpy(&s[write_len], "\r\n"); /* append a trailing CRLF */
- ./curl-83.40.2/curl/lib/getenv.c:37: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char env[MAX_PATH]; /* MAX_PATH is from windef.h */
- ./curl-83.40.2/curl/lib/hash.c:101: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(dupkey, key, key_len);
- ./curl-83.40.2/curl/lib/hostip.c:776: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char hostname[256];
- ./curl-83.40.2/curl/lib/hostip.c:777: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char address[256];
- ./curl-83.40.2/curl/lib/hostip4.c:140: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char sbuf[12];
- ./curl-83.40.2/curl/lib/hostip6.c:137: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[INET6_ADDRSTRLEN];
- ./curl-83.40.2/curl/lib/hostip6.c:168: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char sbuf[12];
- ./curl-83.40.2/curl/lib/hostip6.c:170: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char addrbuf[128];
- ./curl-83.40.2/curl/lib/http.c:281: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(value, start, len);
- ./curl-83.40.2/curl/lib/http.c:1012: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(buffer, http->postdata, (size_t)http->postsize);
- ./curl-83.40.2/curl/lib/http.c:1032: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(buffer, http->postdata, fullsize);
- ./curl-83.40.2/curl/lib/http.c:1126: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(conn->data->state.uploadbuffer, ptr, sendsize);
- ./curl-83.40.2/curl/lib/http.c:1283: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&in->buffer[in->size_used], inptr, size);
- ./curl-83.40.2/curl/lib/http.c:1759: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char ftp_typecode[sizeof("/;type=?")] = "";
- ./curl-83.40.2/curl/lib/http.c:2062: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(newurl, url, ptr - url);
- ./curl-83.40.2/curl/lib/http.c:2064: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(newurl + (ptr - url), conn->host.name, newlen);
- ./curl-83.40.2/curl/lib/http.c:2066: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(newurl + newlen + (ptr - url),
- ./curl-83.40.2/curl/lib/http.c:2879: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(k->hbufp, k->str_start, length);
- ./curl-83.40.2/curl/lib/http.c:3254: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char scratch[SCRATCHSIZE+1]; /* "HTTP/major.minor 123" */
- ./curl-83.40.2/curl/lib/http2.c:280: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&stream->mem[stream->memlen],
- ./curl-83.40.2/curl/lib/http2.c:375: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&stream->mem[stream->memlen], data, nread);
- ./curl-83.40.2/curl/lib/http2.c:620: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(buf, stream->upload_mem, nread);
- ./curl-83.40.2/curl/lib/http2.c:835: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(mem, stream->header_recvbuf->buffer + stream->nread_header_recvbuf,
- ./curl-83.40.2/curl/lib/http2.c:861: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(mem, stream->pausedata, nread);
- ./curl-83.40.2/curl/lib/http2.c:1069: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
nva[0].namelen = (uint16_t)strlen((char *)nva[0].name);
- ./curl-83.40.2/curl/lib/http2.c:1078: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
nva[1].namelen = (uint16_t)strlen((char *)nva[1].name);
- ./curl-83.40.2/curl/lib/http2.c:1084: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
nva[2].namelen = (uint16_t)strlen((char *)nva[2].name);
- ./curl-83.40.2/curl/lib/http2.c:1089: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
nva[2].valuelen = (uint16_t)strlen((char *)nva[2].value);
- ./curl-83.40.2/curl/lib/http2.c:1103: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
nva[i].namelen = (uint16_t)strlen((char *)nva[i].name);
- ./curl-83.40.2/curl/lib/http2.c:1309: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(httpc->inbuf, mem, nread);
- ./curl-83.40.2/curl/lib/http_chunks.h:83: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char hexbuffer[ MAXNUM_SIZE + 1];
- ./curl-83.40.2/curl/lib/idn_win32.c:74: [2] (buffer) wchar_t:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
wchar_t punycode[IDN_MAX_LENGTH];
- ./curl-83.40.2/curl/lib/if2ip.c:139: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char scope[12] = "";
- ./curl-83.40.2/curl/lib/if2ip.c:140: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char ipstr[64];
- ./curl-83.40.2/curl/lib/if2ip.c:199: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[256];
- ./curl-83.40.2/curl/lib/if2ip.c:230: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(req.ifr_name, interf, len+1);
- ./curl-83.40.2/curl/lib/if2ip.c:242: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&in, &s->sin_addr, sizeof(in));
- ./curl-83.40.2/curl/lib/if2ip.h:53: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char ifrn_name[IFNAMSIZ]; /* if name, e.g. "en0" */
- ./curl-83.40.2/curl/lib/imap.c:1053: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char tmp[20];
- ./curl-83.40.2/curl/lib/imap.h:77: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char resptag[5]; /* Response tag to wait for */
- ./curl-83.40.2/curl/lib/inet_ntop.c:53: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char tmp[sizeof "<IP_ADDRESS>"];
- ./curl-83.40.2/curl/lib/inet_ntop.c:87: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char tmp[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:<IP_ADDRESS>")];
- ./curl-83.40.2/curl/lib/inet_pton.c:97: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char tmp[INADDRSZ], *tp;
- ./curl-83.40.2/curl/lib/inet_pton.c:131: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(dst, tmp, INADDRSZ);
- ./curl-83.40.2/curl/lib/inet_pton.c:154: [2] (buffer) char: