Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char tmp[IN6ADDRSZ], *tp, *endp, *colonp;
- ./curl-83.40.2/curl/lib/inet_pton.c:229: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(dst, tmp, IN6ADDRSZ);
- ./curl-83.40.2/curl/lib/krb5.c:94: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused). Risk
is low because the source is a constant string.
strcpy(buf, "599 ");
- ./curl-83.40.2/curl/lib/krb5.c:98: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(buf, dec.value, dec.length);
- ./curl-83.40.2/curl/lib/krb5.c:142: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(*to, enc.value, enc.length);
- ./curl-83.40.2/curl/lib/md4.c:57: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char buffer[64];
- ./curl-83.40.2/curl/lib/md4.c:226: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&ctx->buffer[used], data, size);
- ./curl-83.40.2/curl/lib/md4.c:230: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&ctx->buffer[used], data, available);
- ./curl-83.40.2/curl/lib/md4.c:241: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ctx->buffer, data, size);
- ./curl-83.40.2/curl/lib/md5.c:52: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static void MD5_Final(unsigned char digest[16], MD5_CTX * ctx)
- ./curl-83.40.2/curl/lib/md5.c:78: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static void MD5_Final(unsigned char digest[16], MD5_CTX * ctx)
- ./curl-83.40.2/curl/lib/md5.c:80: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(digest, gcry_md_read(*ctx, 0), 16);
- ./curl-83.40.2/curl/lib/md5.c:120: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static void MD5_Final(unsigned char digest[16], MD5_CTX *ctx)
- ./curl-83.40.2/curl/lib/md5.c:152: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static void MD5_Final(unsigned char digest[16], MD5_CTX *ctx)
- ./curl-83.40.2/curl/lib/md5.c:222: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char buffer[64];
- ./curl-83.40.2/curl/lib/md5.c:413: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&ctx->buffer[used], data, size);
- ./curl-83.40.2/curl/lib/md5.c:417: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&ctx->buffer[used], data, available);
- ./curl-83.40.2/curl/lib/md5.c:428: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ctx->buffer, data, size);
- ./curl-83.40.2/curl/lib/memdebug.c:115: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
logfile = fopen(logname, FOPEN_WRITETEXT);
- ./curl-83.40.2/curl/lib/memdebug.c:236: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(mem, str, len);
- ./curl-83.40.2/curl/lib/memdebug.c:261: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(mem, str, bsiz);
- ./curl-83.40.2/curl/lib/memdebug.c:422: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
FILE *res=fopen(file, mode);
- ./curl-83.40.2/curl/lib/memdebug.h:149: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
#undef fopen
- ./curl-83.40.2/curl/lib/memdebug.h:150: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
#define fopen(file,mode) curl_fopen(file,mode,__LINE__,__FILE__)
- ./curl-83.40.2/curl/lib/mprintf.c:576: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char *endpos[MAX_PARAMETERS];
- ./curl-83.40.2/curl/lib/mprintf.c:579: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char work[BUFFSIZE];
- ./curl-83.40.2/curl/lib/mprintf.c:866: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char formatbuf[32]="%";
- ./curl-83.40.2/curl/lib/multi.c:2097: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(data->sockets, socks, num*sizeof(curl_socket_t));
- ./curl-83.40.2/curl/lib/multi.c:2177: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(tv, e->ptr, sizeof(*tv));
- ./curl-83.40.2/curl/lib/multi.c:2537: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(timedup, stamp, sizeof(*timedup));
- ./curl-83.40.2/curl/lib/netrc.c:81: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char pwbuf[1024];
- ./curl-83.40.2/curl/lib/netrc.c:112: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
file = fopen(netrcfile, FOPEN_READTEXT);
- ./curl-83.40.2/curl/lib/netrc.c:119: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char netrcbuffer[256];
- ./curl-83.40.2/curl/lib/non-ascii.c:66: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(convbuf, indata, insize);
- ./curl-83.40.2/curl/lib/openldap.c:194: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char hosturl[1024];
- ./curl-83.40.2/curl/lib/openldap.c:199: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused). Risk
is low because the source is a constant string.
strcpy(hosturl, "ldap");
- ./curl-83.40.2/curl/lib/parsedate.c:97: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char name[5];
- ./curl-83.40.2/curl/lib/parsedate.c:354: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[32]="";
- ./curl-83.40.2/curl/lib/parsedate.h:25: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
extern const char * const Curl_wkday[7];
- ./curl-83.40.2/curl/lib/parsedate.h:26: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
extern const char * const Curl_month[12];
- ./curl-83.40.2/curl/lib/pingpong.c:297: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptr, pp->cache, pp->cache_size);
- ./curl-83.40.2/curl/lib/pingpong.c:429: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(pp->cache, pp->linestart_resp, pp->cache_size);
- ./curl-83.40.2/curl/lib/pop3.c:451: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char digest[MD5_DIGEST_LEN];
- ./curl-83.40.2/curl/lib/pop3.c:452: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char secret[2 * MD5_DIGEST_LEN + 1];
- ./curl-83.40.2/curl/lib/pop3.c:674: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(pop3c->apoptimestamp, line + i, timestamplen);
- ./curl-83.40.2/curl/lib/progress.c:36: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused). Risk
is low because the source is a constant string.
strcpy(r, "--:--:--");
- ./curl-83.40.2/curl/lib/progress.c:265: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char max5[6][10];
- ./curl-83.40.2/curl/lib/progress.c:276: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char time_left[10];
- ./curl-83.40.2/curl/lib/progress.c:277: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char time_total[10];
- ./curl-83.40.2/curl/lib/progress.c:278: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char time_spent[10];
- ./curl-83.40.2/curl/lib/rtsp.c:606: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(rtspc->rtp_buf + rtspc->rtp_bufsize, k->str, *nread);
- ./curl-83.40.2/curl/lib/rtsp.c:680: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(scratch, rtp, rtp_dataleft);
- ./curl-83.40.2/curl/lib/rtsp.c:799: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(data->set.str[STRING_RTSP_SESSION_ID], start, end - start);
- ./curl-83.40.2/curl/lib/security.c:119: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char print_buffer[50];
- ./curl-83.40.2/curl/lib/security.c:222: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(data, (char*)buf->data + buf->index, len);
- ./curl-83.40.2/curl/lib/sendf.c:130: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char print_buffer[2048 + 1];
- ./curl-83.40.2/curl/lib/sendf.c:357: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(dupl, ptr, len);
- ./curl-83.40.2/curl/lib/sendf.c:409: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(newptr + data->state.tempwritesize, ptr, len);
- ./curl-83.40.2/curl/lib/sendf.c:570: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(buf, conn->master_buffer + conn->read_pos, bytestocopy);
- ./curl-83.40.2/curl/lib/sendf.c:594: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(buf, conn->master_buffer, nread);
- ./curl-83.40.2/curl/lib/sendf.c:608: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static const char s_infotype[CURLINFO_END][3] = {
- ./curl-83.40.2/curl/lib/sendf.c:612: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[BUFSIZE+1];
- ./curl-83.40.2/curl/lib/sendf.c:624: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(buf, ptr, size);
- ./curl-83.40.2/curl/lib/sendf.c:680: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buffer[160];
- ./curl-83.40.2/curl/lib/smb.c:349: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy((char *)h->magic, "\xffSMB", 4);
- ./curl-83.40.2/curl/lib/smb.c:411: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(conn->data->state.uploadbuffer + sizeof(struct smb_header),
- ./curl-83.40.2/curl/lib/smb.c:429: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char lm_hash[21];
- ./curl-83.40.2/curl/lib/smb.c:430: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char lm[24];
- ./curl-83.40.2/curl/lib/smb.c:431: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char nt_hash[21];
- ./curl-83.40.2/curl/lib/smb.c:432: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char nt[24];
- ./curl-83.40.2/curl/lib/smb.c:459: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(p, lm, sizeof(lm));
- ./curl-83.40.2/curl/lib/smb.c:461: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(p, nt, sizeof(nt));
- ./curl-83.40.2/curl/lib/smb.c:679: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(smbc->challenge, nrsp->bytes, sizeof(smbc->challenge));
- ./curl-83.40.2/curl/lib/smb.h:37: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char challenge[8];
- ./curl-83.40.2/curl/lib/smb.h:98: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char magic[4];
- ./curl-83.40.2/curl/lib/smb.h:104: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char signature[8];
- ./curl-83.40.2/curl/lib/smb.h:128: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char bytes[1];
- ./curl-83.40.2/curl/lib/smb.h:148: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char bytes[1024];
- ./curl-83.40.2/curl/lib/smb.h:157: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char bytes[1024];
- ./curl-83.40.2/curl/lib/smb.h:180: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char bytes[1024];
- ./curl-83.40.2/curl/lib/smtp.c:1537: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char localhost[HOSTNAME_MAX + 1];
- ./curl-83.40.2/curl/lib/smtp.c:1617: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&scratch[si], &SMTP_EOB[eob_sent], smtp->eob - eob_sent);
- ./curl-83.40.2/curl/lib/smtp.c:1635: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&scratch[si], &SMTP_EOB_REPL[eob_sent],
- ./curl-83.40.2/curl/lib/smtp.c:1647: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&scratch[si], &SMTP_EOB[eob_sent], smtp->eob - eob_sent);
- ./curl-83.40.2/curl/lib/sockaddr.h:37: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char cbuf[256]; /* this should be big enough to fit a lot */
- ./curl-83.40.2/curl/lib/socks.c:117: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char socksreq[SOCKS4REQLEN]; /* room for SOCKS4 request incl. user
- ./curl-83.40.2/curl/lib/socks.c:172: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[64];
- ./curl-83.40.2/curl/lib/socks.c:210: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(socksreq + 8, proxy_name, plen+1);
- ./curl-83.40.2/curl/lib/socks.c:371: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char socksreq[600]; /* room for large user/pw (255 max each) */
- ./curl-83.40.2/curl/lib/socks.c:505: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(socksreq + len, proxy_name, proxy_name_len);
- ./curl-83.40.2/curl/lib/socks.c:509: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(socksreq + len, proxy_password, proxy_password_len);
- ./curl-83.40.2/curl/lib/socks.c:572: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&socksreq[len], hostname, hostname_len); /* address str w/o NULL */
- ./curl-83.40.2/curl/lib/socks_gssapi.c:54: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[1024];
- ./curl-83.40.2/curl/lib/socks_gssapi.c:76: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused). Risk
is low because the source is a constant string.
strcpy(buf+len, ".\n");
- ./curl-83.40.2/curl/lib/socks_gssapi.c:122: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char socksreq[4]; /* room for GSS-API exchange header only */
- ./curl-83.40.2/curl/lib/socks_gssapi.c:139: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(service.value, serviceptr, service.length);
- ./curl-83.40.2/curl/lib/socks_gssapi.c:195: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(socksreq+2, &us_length, sizeof(short));
- ./curl-83.40.2/curl/lib/socks_gssapi.c:260: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&us_length, socksreq+2, sizeof(short));
- ./curl-83.40.2/curl/lib/socks_gssapi.c:319: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(user, gss_send_token.value, gss_send_token.length);
- ./curl-83.40.2/curl/lib/socks_gssapi.c:375: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(socksreq+2, &us_length, sizeof(short));
- ./curl-83.40.2/curl/lib/socks_gssapi.c:384: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(gss_send_token.value, &gss_enc, 1);
- ./curl-83.40.2/curl/lib/socks_gssapi.c:400: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(socksreq+2, &us_length, sizeof(short));
- ./curl-83.40.2/curl/lib/socks_gssapi.c:412: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(socksreq, &gss_enc, 1);
- ./curl-83.40.2/curl/lib/socks_gssapi.c:454: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&us_length, socksreq+2, sizeof(short));
- ./curl-83.40.2/curl/lib/socks_gssapi.c:495: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(socksreq, gss_w_token.value, gss_w_token.length);
- ./curl-83.40.2/curl/lib/socks_gssapi.c:507: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(socksreq, gss_recv_token.value, gss_recv_token.length);
- ./curl-83.40.2/curl/lib/socks_sspi.c:85: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char socksreq[4]; /* room for GSS-API exchange header only */
- ./curl-83.40.2/curl/lib/socks_sspi.c:101: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(service_name, service, strlen(service));
- ./curl-83.40.2/curl/lib/socks_sspi.c:198: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(socksreq+2, &us_length, sizeof(short));
- ./curl-83.40.2/curl/lib/socks_sspi.c:282: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&us_length, socksreq+2, sizeof(short));
- ./curl-83.40.2/curl/lib/socks_sspi.c:376: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(socksreq+2, &us_length, sizeof(short));
- ./curl-83.40.2/curl/lib/socks_sspi.c:405: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(sspi_w_token[1].pvBuffer, &gss_enc, 1);
- ./curl-83.40.2/curl/lib/socks_sspi.c:439: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(sspi_send_token.pvBuffer, sspi_w_token[0].pvBuffer,
- ./curl-83.40.2/curl/lib/socks_sspi.c:441: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy((PUCHAR) sspi_send_token.pvBuffer +(int)sspi_w_token[0].cbBuffer,
- ./curl-83.40.2/curl/lib/socks_sspi.c:443: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy((PUCHAR) sspi_send_token.pvBuffer
- ./curl-83.40.2/curl/lib/socks_sspi.c:459: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(socksreq+2, &us_length, sizeof(short));
- ./curl-83.40.2/curl/lib/socks_sspi.c:472: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(socksreq, &gss_enc, 1);
- ./curl-83.40.2/curl/lib/socks_sspi.c:516: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&us_length, socksreq+2, sizeof(short));
- ./curl-83.40.2/curl/lib/socks_sspi.c:526: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
result = Curl_blockread_all(conn, sock, (char *)sspi_w_token[0].pvBuffer,
- ./curl-83.40.2/curl/lib/socks_sspi.c:570: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(socksreq, sspi_w_token[1].pvBuffer, sspi_w_token[1].cbBuffer);
- ./curl-83.40.2/curl/lib/socks_sspi.c:582: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(socksreq, sspi_w_token[0].pvBuffer, sspi_w_token[0].cbBuffer);
- ./curl-83.40.2/curl/lib/ssh.c:426: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(real_path, working_path+3, 4 + working_path_len-3);
- ./curl-83.40.2/curl/lib/ssh.c:428: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(real_path, working_path, 1 + working_path_len);
- ./curl-83.40.2/curl/lib/ssh.c:440: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(real_path, homedir, homelen);
- ./curl-83.40.2/curl/lib/ssh.c:444: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(real_path+homelen+1, working_path + 3,
- ./curl-83.40.2/curl/lib/ssh.c:454: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(real_path, working_path, 1+working_path_len);
- ./curl-83.40.2/curl/lib/ssh.c:653: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char md5buffer[33];
- ./curl-83.40.2/curl/lib/ssh.c:1125: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char tempHome[PATH_MAX];
- ./curl-83.40.2/curl/lib/ssh.c:1949: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(sshc->readdir_line, sshc->readdir_longentry,
- ./curl-83.40.2/curl/lib/ssh.c:3264: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(*path, cp, end - cp);
- ./curl-83.40.2/curl/lib/strdup.c:47: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(newstr, str, (len+1)*sizeof(char));
- ./curl-83.40.2/curl/lib/strdup.c:70: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(buffer, src, length);
- ./curl-83.40.2/curl/lib/strerror.c:639: [2] (buffer) wchar_t:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
wchar_t wbuf[256];
- ./curl-83.40.2/curl/lib/strerror.c:677: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buffer[256];
- ./curl-83.40.2/curl/lib/strerror.c:690: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buffer[256];
- ./curl-83.40.2/curl/lib/strerror.c:803: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char txtbuf[80];
- ./curl-83.40.2/curl/lib/strerror.c:804: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char msgbuf[sizeof(conn->syserr_buf)];
- ./curl-83.40.2/curl/lib/strerror.c:1084: [2] (buffer) wchar_t:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
wchar_t wbuf[256];
- ./curl-83.40.2/curl/lib/telnet.c:160: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char subopt_ttype[32]; /* Set with suboption TTYPE */
- ./curl-83.40.2/curl/lib/telnet.c:161: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char subopt_xdisploc[128]; /* Set with suboption XDISPLOC */
- ./curl-83.40.2/curl/lib/telnet.c:167: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char subbuffer[SUBBUFSIZE];
- ./curl-83.40.2/curl/lib/telnet.c:346: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char buf[3];
- ./curl-83.40.2/curl/lib/telnet.c:822: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char option_keyword[128] = "";
- ./curl-83.40.2/curl/lib/telnet.c:823: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char option_arg[256] = "";
- ./curl-83.40.2/curl/lib/telnet.c:890: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range.
If source untrusted, check both minimum and maximum, even if the input
had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
binary_option=atoi(option_arg);
- ./curl-83.40.2/curl/lib/telnet.c:927: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char temp[2048];
- ./curl-83.40.2/curl/lib/telnet.c:932: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char varname[128] = "";
- ./curl-83.40.2/curl/lib/telnet.c:933: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char varval[128] = "";
- ./curl-83.40.2/curl/lib/telnet.c:1227: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char outbuf[2];
- ./curl-83.40.2/curl/lib/tftp.c:452: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[64];
- ./curl-83.40.2/curl/lib/tftp.c:1094: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&state->remote_addr, &fromaddr, fromlen);
- ./curl-83.40.2/curl/lib/transfer.c:170: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char hexbuffer[11];
- ./curl-83.40.2/curl/lib/transfer.c:196: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(data->req.upload_fromhere, hexbuffer, hexlen);
- ./curl-83.40.2/curl/lib/transfer.c:199: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(data->req.upload_fromhere + nread,
- ./curl-83.40.2/curl/lib/transfer.c:336: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[512 + 1];
- ./curl-83.40.2/curl/lib/transfer.c:341: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(buf, conn->master_buffer + conn->read_pos, show);
- ./curl-83.40.2/curl/lib/transfer.c:1450: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char prot[16]; /* URL protocol string storage */
- ./curl-83.40.2/curl/lib/transfer.c:1597: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(newest, url_clone, urllen);
- ./curl-83.40.2/curl/lib/url.c:1030: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(p, argptr, (size_t)data->set.postfieldsize);
- ./curl-83.40.2/curl/lib/url.c:3929: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char protobuf[16] = "";
- ./curl-83.40.2/curl/lib/url.c:4087: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(path+1, query, hostlen);
- ./curl-83.40.2/curl/lib/url.c:4152: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(reurl, data->change.url, prefixlen);
- ./curl-83.40.2/curl/lib/url.c:4155: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&reurl[prefixlen], path, plen + 1);
- ./curl-83.40.2/curl/lib/url.c:4200: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char ifname[IFNAMSIZ + 2];
- ./curl-83.40.2/curl/lib/url.c:4458: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char proxy_env[128];
- ./curl-83.40.2/curl/lib/url.c:4475: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused). Risk
is low because the source is a constant string.
strcpy(envp, "_proxy");
- ./curl-83.40.2/curl/lib/url.c:4674: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char proxyuser[MAX_CURL_USER_LENGTH]="";
- ./curl-83.40.2/curl/lib/url.c:4675: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char proxypasswd[MAX_CURL_PASSWORD_LENGTH]="";
- ./curl-83.40.2/curl/lib/url.c:4915: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ubuf, login, ulen);
- ./curl-83.40.2/curl/lib/url.c:4923: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(pbuf, psep + 1, plen);
- ./curl-83.40.2/curl/lib/url.c:4931: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(obuf, osep + 1, olen);
- ./curl-83.40.2/curl/lib/url.c:5001: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char type[12]="";
- ./curl-83.40.2/curl/lib/urldata.h:443: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char nonce[8];
- ./curl-83.40.2/curl/lib/urldata.h:862: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char ip_addr_str[MAX_IPADR_LEN];
- ./curl-83.40.2/curl/lib/urldata.h:881: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char primary_ip[MAX_IPADR_LEN];
- ./curl-83.40.2/curl/lib/urldata.h:888: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char local_ip[MAX_IPADR_LEN];
- ./curl-83.40.2/curl/lib/urldata.h:1009: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char syserr_buf [256]; /* buffer for Curl_strerror() */
- ./curl-83.40.2/curl/lib/urldata.h:1095: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char conn_primary_ip[MAX_IPADR_LEN];
- ./curl-83.40.2/curl/lib/urldata.h:1098: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char conn_local_ip[MAX_IPADR_LEN];
- ./curl-83.40.2/curl/lib/urldata.h:1214: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buffer[BUFSIZE+1]; /* download buffer */
- ./curl-83.40.2/curl/lib/urldata.h:1215: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char uploadbuffer[BUFSIZE+1]; /* upload buffer */
- ./curl-83.40.2/curl/lib/urldata.h:1592: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char *str[STRING_LAST]; /* array of strings, pointing to allocated memory */
- ./curl-83.40.2/curl/lib/version.c:65: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static char version[200];
- ./curl-83.40.2/curl/lib/version.c:131: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char suff[2];
- ./curl-83.40.2/curl/lib/version.c:315: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static char ssh_buffer[80];
- ./curl-83.40.2/curl/lib/version.c:319: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static char ssl_buffer[80];
- ./curl-83.40.2/curl/lib/vtls/axtls.c:621: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(buf, read_buf,
- ./curl-83.40.2/curl/lib/vtls/cyassl.c:102: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char error_buffer[CYASSL_MAX_ERROR_SZ];
- ./curl-83.40.2/curl/lib/vtls/cyassl.c:347: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char error_buffer[CYASSL_MAX_ERROR_SZ];
- ./curl-83.40.2/curl/lib/vtls/cyassl.c:497: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char error_buffer[CYASSL_MAX_ERROR_SZ];
- ./curl-83.40.2/curl/lib/vtls/cyassl.c:542: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char error_buffer[CYASSL_MAX_ERROR_SZ];
- ./curl-83.40.2/curl/lib/vtls/darwinssl.c:804: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range.
If source untrusted, check both minimum and maximum, even if the input
had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
*major = atoi(os_version_major);
- ./curl-83.40.2/curl/lib/vtls/darwinssl.c:805: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range.
If source untrusted, check both minimum and maximum, even if the input
had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
*minor = atoi(os_version_minor);
- ./curl-83.40.2/curl/lib/vtls/darwinssl.c:1224: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char cert_summary_c[128];
- ./curl-83.40.2/curl/lib/vtls/darwinssl.c:1579: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char buf[cap], *data;
- ./curl-83.40.2/curl/lib/vtls/darwinssl.c:1581: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
fd = open(file, 0);
- ./curl-83.40.2/curl/lib/vtls/darwinssl.c:1612: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(data + len, buf, n);
- ./curl-83.40.2/curl/lib/vtls/darwinssl.c:1673: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char subject_cbuf[128];
- ./curl-83.40.2/curl/lib/vtls/darwinssl.c:1960: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char server_cert_summary_c[128];
- ./curl-83.40.2/curl/lib/vtls/darwinssl.c:2240: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[120];
- ./curl-83.40.2/curl/lib/vtls/gskit.c:994: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[120];
- ./curl-83.40.2/curl/lib/vtls/gtls.c:234: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
if(!(f = fopen(file, "rb")))
- ./curl-83.40.2/curl/lib/vtls/gtls.c:794: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char certbuf[256] = ""; /* big enough? */
- ./curl-83.40.2/curl/lib/vtls/gtls.c:858: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
const char *beg = (const char *) chainp[i].data;
- ./curl-83.40.2/curl/lib/vtls/gtls.c:1054: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char addrbuf[sizeof(struct use_addr)];
- ./curl-83.40.2/curl/lib/vtls/gtls.c:1055: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char certaddr[sizeof(struct use_addr)];
- ./curl-83.40.2/curl/lib/vtls/gtls.c:1391: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[120];
- ./curl-83.40.2/curl/lib/vtls/gtls.c:1555: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(md5sum, gcry_md_read (MD5pw, 0), md5len);
- ./curl-83.40.2/curl/lib/vtls/nss.c:689: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char buf[50];
- ./curl-83.40.2/curl/lib/vtls/nss.c:793: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char timeString[256];
- ./curl-83.40.2/curl/lib/vtls/nss.c:1214: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&nspr_io_methods, PR_GetDefaultIOMethods(), sizeof nspr_io_methods);
- ./curl-83.40.2/curl/lib/vtls/nss.c:1774: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char protocols[128];
- ./curl-83.40.2/curl/lib/vtls/nss.c:1779: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&protocols[cur], NGHTTP2_PROTO_VERSION_ID,
- ./curl-83.40.2/curl/lib/vtls/nss.c:1785: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&protocols[cur], ALPN_HTTP_1_1, ALPN_HTTP_1_1_LENGTH);
- ./curl-83.40.2/curl/lib/vtls/openssl.c:155: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(buf, global_passwd, klen+1);
- ./curl-83.40.2/curl/lib/vtls/openssl.c:234: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char randb[64];
- ./curl-83.40.2/curl/lib/vtls/openssl.c:450: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
f = fopen(cert_file, "rb");
- ./curl-83.40.2/curl/lib/vtls/openssl.c:666: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(buf, biomem->data, size);
- ./curl-83.40.2/curl/lib/vtls/openssl.c:808: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[256];
- ./curl-83.40.2/curl/lib/vtls/openssl.c:898: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[120]; /* We will use this for the OpenSSL error buffer, so it has
- ./curl-83.40.2/curl/lib/vtls/openssl.c:1210: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(peer_CN, ASN1_STRING_data(tmp), j);
- ./curl-83.40.2/curl/lib/vtls/openssl.c:1485: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char ssl_buf[1024];
- ./curl-83.40.2/curl/lib/vtls/openssl.c:1486: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char unknown[32];
- ./curl-83.40.2/curl/lib/vtls/openssl.c:1890: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char protocols[128];
- ./curl-83.40.2/curl/lib/vtls/openssl.c:1896: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&protocols[cur], NGHTTP2_PROTO_VERSION_ID,
- ./curl-83.40.2/curl/lib/vtls/openssl.c:1904: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&protocols[cur], ALPN_HTTP_1_1, ALPN_HTTP_1_1_LENGTH);
- ./curl-83.40.2/curl/lib/vtls/openssl.c:2133: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char error_buffer[256]; /* OpenSSL documents that this must be at least
- ./curl-83.40.2/curl/lib/vtls/openssl.c:2261: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char namebuf[32];
- ./curl-83.40.2/curl/lib/vtls/openssl.c:2307: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[512];
- ./curl-83.40.2/curl/lib/vtls/openssl.c:2309: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char namebuf[128];
- ./curl-83.40.2/curl/lib/vtls/openssl.c:2357: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[1024];
- ./curl-83.40.2/curl/lib/vtls/openssl.c:2683: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
fp = fopen(data->set.str[STRING_SSL_ISSUERCERT], FOPEN_READTEXT);
- ./curl-83.40.2/curl/lib/vtls/openssl.c:2983: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char error_buffer[120]; /* OpenSSL documents that this must be at least 120
- ./curl-83.40.2/curl/lib/vtls/openssl.c:3034: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char error_buffer[120]; /* OpenSSL documents that this must be at
- ./curl-83.40.2/curl/lib/vtls/openssl.c:3089: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char sub[3];
- ./curl-83.40.2/curl/lib/vtls/openssl.c:3136: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char sub[2];
- ./curl-83.40.2/curl/lib/vtls/polarssl.c:145: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char errorbuf[128];
- ./curl-83.40.2/curl/lib/vtls/polarssl.c:332: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&connssl->ssn, old_session, old_session_size);
- ./curl-83.40.2/curl/lib/vtls/polarssl.c:393: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buffer[1024];
- ./curl-83.40.2/curl/lib/vtls/polarssl.c:395: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char errorbuf[128];
- ./curl-83.40.2/curl/lib/vtls/polarssl.c:512: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(new_session, our_ssl_sessionid, sizeof(ssl_session));
- ./curl-83.40.2/curl/lib/vtls/schannel.c:395: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(inbuf[0].pvBuffer, connssl->encdata_buffer,
- ./curl-83.40.2/curl/lib/vtls/schannel.c:752: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(outbuf[1].pvBuffer, buf, len);
- ./curl-83.40.2/curl/lib/vtls/schannel.c:1007: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(connssl->decdata_buffer + connssl->decdata_offset,
- ./curl-83.40.2/curl/lib/vtls/schannel.c:1134: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(buf, connssl->decdata_buffer, size);
- ./curl-83.40.2/curl/lib/vtls/schannel.c:1420: [2] (buffer) TCHAR:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
TCHAR cert_hostname_buff[128];
- ./curl-83.40.2/curl/lib/vtls/vtls.c:197: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy((char *)&randseed, force_entropy, min);
- ./curl-83.40.2/curl/lib/vtls/vtls.c:216: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
int fd = open(RANDOM_FILE, O_RDONLY);
- ./curl-83.40.2/curl/lib/vtls/vtls.c:669: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&output[labellen+1], value, valuelen);
- ./curl-83.40.2/curl/lib/vtls/vtls.c:783: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
fp = fopen(pinnedpubkey, "rb");
- ./curl-83.40.2/curl/lib/x509asn1.c:292: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(buf, from, outlength);
- ./curl-83.40.2/curl/packages/OS400/ccsidcurl.c:58: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
makeOS400IconvCode(char buf[ICONV_ID_SIZE], unsigned int ccsid)
- ./curl-83.40.2/curl/packages/OS400/ccsidcurl.c:84: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char fromcode[ICONV_ID_SIZE];
- ./curl-83.40.2/curl/packages/OS400/ccsidcurl.c:85: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char tocode[ICONV_ID_SIZE];
- ./curl-83.40.2/curl/packages/OS400/ccsidcurl.c:133: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(d, s, i);
- ./curl-83.40.2/curl/packages/OS400/ccsidcurl.c:470: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy((char *) id, (char *) p, sizeof *p);
- ./curl-83.40.2/curl/packages/OS400/ccsidcurl.c:476: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(cp, (char *) p->protocols, i);
- ./curl-83.40.2/curl/packages/OS400/ccsidcurl.c:726: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
free((char *) forms[nargs].value);
- ./curl-83.40.2/curl/packages/OS400/os400sys.c:769: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(buf->value, t, i);
- ./curl-83.40.2/curl/packages/OS400/os400sys.c:789: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy((char *) &in, (char *) in_name, sizeof in);
- ./curl-83.40.2/curl/packages/OS400/os400sys.c:1219: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy((char *) dstaddr, (char *) srcaddr, srclen);
- ./curl-83.40.2/curl/packages/OS400/os400sys.c:1333: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy((char *) fromaddr, (char *) &laddr, laddrlen);
- ./curl-83.40.2/curl/packages/vms/curl_crtl_init.c:180: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char unix_shell_name[255];
- ./curl-83.40.2/curl/src/tool_cb_dbg.c:53: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char timebuf[20];
- ./curl-83.40.2/curl/src/tool_cb_dbg.c:82: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
config->trace_stream = fopen(config->trace_dump, FOPEN_WRITETEXT);
- ./curl-83.40.2/curl/src/tool_cb_hdr.c:147: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(copy, ptr, len);
- ./curl-83.40.2/curl/src/tool_cb_hdr.c:212: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buffer[512]; /* suitably large */
- ./curl-83.40.2/curl/src/tool_cb_prg.c:47: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char line[MAX_BARLENGTH+1];
- ./curl-83.40.2/curl/src/tool_cb_prg.c:48: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char format[40];
- ./curl-83.40.2/curl/src/tool_cb_wrt.c:47: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
file = fopen(outs->filename, "rb");
- ./curl-83.40.2/curl/src/tool_cb_wrt.c:57: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
file = fopen(outs->filename, "wb");
- ./curl-83.40.2/curl/src/tool_doswin.c:103: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char new_name[PATH_MAX];
- ./curl-83.40.2/curl/src/tool_doswin.c:123: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static char dos_name[PATH_MAX];
- ./curl-83.40.2/curl/src/tool_doswin.c:184: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy (d, "plus", 4);
- ./curl-83.40.2/curl/src/tool_doswin.c:214: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char fname[PATH_MAX];
- ./curl-83.40.2/curl/src/tool_easysrc.c:179: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
out = fopen(o, FOPEN_WRITETEXT);
- ./curl-83.40.2/curl/src/tool_formparse.c:151: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char name[256];
- ./curl-83.40.2/curl/src/tool_formparse.c:153: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char type_major[128] = "";
- ./curl-83.40.2/curl/src/tool_formparse.c:154: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char type_minor[128] = "";
- ./curl-83.40.2/curl/src/tool_getparam.c:684: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
FILE *newfile = fopen(nextarg, FOPEN_WRITETEXT);
- ./curl-83.40.2/curl/src/tool_getparam.c:1142: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
file = fopen(p, "rb");
- ./curl-83.40.2/curl/src/tool_getparam.c:1208: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
file = fopen(nextarg, "rb");
- ./curl-83.40.2/curl/src/tool_getparam.c:1264: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(config->postfields, oldpost, (size_t)oldlen);
- ./curl-83.40.2/curl/src/tool_getparam.c:1267: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&config->postfields[oldlen+1], postdata, size);
- ./curl-83.40.2/curl/src/tool_getparam.c:1617: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buffer[32];
- ./curl-83.40.2/curl/src/tool_getparam.c:1751: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
file = fopen(nextarg, FOPEN_READTEXT);
- ./curl-83.40.2/curl/src/tool_getpass.c:230: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
int fd = open("/dev/tty", O_RDONLY);
- ./curl-83.40.2/curl/src/tool_homedir.c:36: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf1[1024], buf2[1024];
- ./curl-83.40.2/curl/src/tool_main.c:100: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char fname[CURL_MT_LOGFNAME_BUFSIZE];
- ./curl-83.40.2/curl/src/tool_metalink.c:136: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static void MD5_Final(unsigned char digest[16], MD5_CTX *ctx)
- ./curl-83.40.2/curl/src/tool_metalink.c:154: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static void SHA1_Final(unsigned char digest[20], SHA_CTX *ctx)
- ./curl-83.40.2/curl/src/tool_metalink.c:172: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static void SHA256_Final(unsigned char digest[32], SHA256_CTX *ctx)
- ./curl-83.40.2/curl/src/tool_metalink.c:192: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static void MD5_Final(unsigned char digest[16], MD5_CTX *ctx)
- ./curl-83.40.2/curl/src/tool_metalink.c:194: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(digest, gcry_md_read(*ctx, 0), 16);
- ./curl-83.40.2/curl/src/tool_metalink.c:211: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static void SHA1_Final(unsigned char digest[20], SHA_CTX *ctx)
- ./curl-83.40.2/curl/src/tool_metalink.c:213: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(digest, gcry_md_read(*ctx, 0), 20);
- ./curl-83.40.2/curl/src/tool_metalink.c:230: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static void SHA256_Final(unsigned char digest[32], SHA256_CTX *ctx)
- ./curl-83.40.2/curl/src/tool_metalink.c:232: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(digest, gcry_md_read(*ctx, 0), 32);
- ./curl-83.40.2/curl/src/tool_metalink.c:284: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static void MD5_Final(unsigned char digest[16], MD5_CTX *pctx)
- ./curl-83.40.2/curl/src/tool_metalink.c:301: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static void SHA1_Final(unsigned char digest[20], SHA_CTX *pctx)
- ./curl-83.40.2/curl/src/tool_metalink.c:318: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static void SHA256_Final(unsigned char digest[32], SHA256_CTX *pctx)
- ./curl-83.40.2/curl/src/tool_metalink.c:338: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static void MD5_Final(unsigned char digest[16], MD5_CTX *ctx)
- ./curl-83.40.2/curl/src/tool_metalink.c:356: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static void SHA1_Final(unsigned char digest[20], SHA_CTX *ctx)
- ./curl-83.40.2/curl/src/tool_metalink.c:374: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static void SHA256_Final(unsigned char digest[32], SHA256_CTX *ctx)
- ./curl-83.40.2/curl/src/tool_metalink.c:411: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static void MD5_Final(unsigned char digest[16], MD5_CTX *ctx)
- ./curl-83.40.2/curl/src/tool_metalink.c:432: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static void SHA1_Final(unsigned char digest[20], SHA_CTX *ctx)
- ./curl-83.40.2/curl/src/tool_metalink.c:453: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static void SHA256_Final(unsigned char digest[32], SHA256_CTX *ctx)
- ./curl-83.40.2/curl/src/tool_metalink.c:608: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
fd = open(filename, flags);
- ./curl-83.40.2/curl/src/tool_metalink.c:629: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char buf[4096];
- ./curl-83.40.2/curl/src/tool_msgs.c:47: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char print_buffer[256];
- ./curl-83.40.2/curl/src/tool_operate.c:149: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buffer[8192];
- ./curl-83.40.2/curl/src/tool_operate.c:154: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
file = fopen(name, "r"); /* VMS */
- ./curl-83.40.2/curl/src/tool_operate.c:193: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char errorbuffer[CURL_ERROR_SIZE];
- ./curl-83.40.2/curl/src/tool_operate.c:321: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
FILE *newfile = fopen(config->headerfile, "wb");
- ./curl-83.40.2/curl/src/tool_operate.c:609: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
FILE *file = fopen(outfile, config->resume_from?"ab":"wb",
- ./curl-83.40.2/curl/src/tool_operate.c:613: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
FILE *file = fopen(outfile, config->resume_from?"ab":"wb");
- ./curl-83.40.2/curl/src/tool_operate.c:665: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
infd = open(uploadfile, O_RDONLY | O_BINARY);
- ./curl-83.40.2/curl/src/tool_operate.c:668: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
infd = open(uploadfile, O_RDONLY | O_BINARY,
- ./curl-83.40.2/curl/src/tool_operate.c:674: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
infd = open(uploadfile, O_RDONLY | O_BINARY);
- ./curl-83.40.2/curl/src/tool_operhlp.c:162: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buffer[512]; /* suitably large */
- ./curl-83.40.2/curl/src/tool_paramhlp.c:61: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buffer[256];
- ./curl-83.40.2/curl/src/tool_paramhlp.c:390: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char passwd[256] = "";
- ./curl-83.40.2/curl/src/tool_paramhlp.c:391: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char prompt[256];
- ./curl-83.40.2/curl/src/tool_paramhlp.c:426: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&passptr[userlen+1], passwd, passwdlen+1);
- ./curl-83.40.2/curl/src/tool_parsecfg.c:51: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char filebuffer[512];
- ./curl-83.40.2/curl/src/tool_parsecfg.c:72: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
file = fopen(filebuffer, FOPEN_READTEXT);
- ./curl-83.40.2/curl/src/tool_parsecfg.c:118: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
file = fopen(filename, FOPEN_READTEXT);
- ./curl-83.40.2/curl/src/tool_parsecfg.c:334: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[4096];
- ./curl-83.40.2/curl/src/tool_setopt.c:204: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused). Risk
is low because the source is a constant string.
strcpy(e, "\\n");
- ./curl-83.40.2/curl/src/tool_setopt.c:208: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused). Risk
is low because the source is a constant string.
strcpy(e, "\\r");
- ./curl-83.40.2/curl/src/tool_setopt.c:212: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused). Risk
is low because the source is a constant string.
strcpy(e, "\\t");
- ./curl-83.40.2/curl/src/tool_setopt.c:216: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused). Risk
is low because the source is a constant string.
strcpy(e, "\\\\");
- ./curl-83.40.2/curl/src/tool_setopt.c:220: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused). Risk
is low because the source is a constant string.
strcpy(e, "\\\"");
- ./curl-83.40.2/curl/src/tool_setopt.c:281: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char preamble[80]; /* should accommodate any symbol name */
- ./curl-83.40.2/curl/src/tool_setopt.c:324: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char preamble[80];
- ./curl-83.40.2/curl/src/tool_setopt.c:473: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[256];
- ./curl-83.40.2/curl/src/tool_strdup.c:42: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(newstr, str, (len+1)*sizeof(char));
- ./curl-83.40.2/curl/src/tool_urlglob.c:54: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(pat->content.Set.elements[0], fixed, len);
- ./curl-83.40.2/curl/src/tool_urlglob.c:352: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(buf, pattern, skip);
- ./curl-83.40.2/curl/src/tool_urlglob.c:440: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char text[128];
- ./curl-83.40.2/curl/src/tool_urlglob.c:578: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char numbuf[18];
- ./curl-83.40.2/curl/src/tool_urlglob.c:665: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(&target[stringlen], appendthis, appendlen);
- ./curl-83.40.2/curl/src/tool_writeenv.c:76: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char *string, numtext[10];
- ./curl-83.40.2/curl/tests/libtest/chkhostname.c:30: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buff[HOSTNAME_MAX];
- ./curl-83.40.2/curl/tests/libtest/first.c:90: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char fname[CURL_MT_LOGFNAME_BUFSIZE];
- ./curl-83.40.2/curl/tests/libtest/first.c:117: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static char dump[200*3+1];
- ./curl-83.40.2/curl/tests/libtest/lib1502.c:49: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char redirect[160];
- ./curl-83.40.2/curl/tests/libtest/lib1506.c:39: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char target_url[256];
- ./curl-83.40.2/curl/tests/libtest/lib1506.c:40: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char dnsentry[256];
- ./curl-83.40.2/curl/tests/libtest/lib1510.c:37: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char target_url[256];
- ./curl-83.40.2/curl/tests/libtest/lib1510.c:38: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char dnsentry[256];
- ./curl-83.40.2/curl/tests/libtest/lib1512.c:41: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char dnsentry[256];
- ./curl-83.40.2/curl/tests/libtest/lib1512.c:44: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char target_url[256];
- ./curl-83.40.2/curl/tests/libtest/lib1515.c:120: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char dns_entry[256];
- ./curl-83.40.2/curl/tests/libtest/lib1515.c:132: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char target_url[256];
- ./curl-83.40.2/curl/tests/libtest/lib1520.c:63: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptr, data, len);
- ./curl-83.40.2/curl/tests/libtest/lib1525.c:42: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptr, data, strlen(data));
- ./curl-83.40.2/curl/tests/libtest/lib1526.c:41: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptr, data, strlen(data));
- ./curl-83.40.2/curl/tests/libtest/lib1527.c:41: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptr, data, strlen(data));
- ./curl-83.40.2/curl/tests/libtest/lib1529.c:31: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char bURL[512];
- ./curl-83.40.2/curl/tests/libtest/lib1900.c:33: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char *urlstring[MAX_URLS];
- ./curl-83.40.2/curl/tests/libtest/lib1900.c:35: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char *site_blacklist[MAX_BLACKLIST];
- ./curl-83.40.2/curl/tests/libtest/lib1900.c:36: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char *server_blacklist[MAX_BLACKLIST];
- ./curl-83.40.2/curl/tests/libtest/lib1900.c:55: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[200];
- ./curl-83.40.2/curl/tests/libtest/lib1900.c:61: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
f = fopen(filename, "rb");
- ./curl-83.40.2/curl/tests/libtest/lib1900.c:114: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char urlbuf[256];
- ./curl-83.40.2/curl/tests/libtest/lib500.c:96: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
FILE *moo = fopen(libtest_arg2, "wb");
- ./curl-83.40.2/curl/tests/libtest/lib505.c:56: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
hd_src = fopen(libtest_arg2, "rb");
- ./curl-83.40.2/curl/tests/libtest/lib510.c:51: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptr, data, len);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:55: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static char msgbuff[256];
- ./curl-83.40.2/curl/tests/libtest/lib518.c:86: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
fpa[i] = fopen(DEV_NULL, "r");
- ./curl-83.40.2/curl/tests/libtest/lib518.c:107: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char strbuff[256];
- ./curl-83.40.2/curl/tests/libtest/lib518.c:108: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char strbuff1[81];
- ./curl-83.40.2/curl/tests/libtest/lib518.c:109: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char strbuff2[81];
- ./curl-83.40.2/curl/tests/libtest/lib518.c:133: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused). Risk
is low because the source is a constant string.
strcpy(strbuff, "INFINITY");
- ./curl-83.40.2/curl/tests/libtest/lib518.c:141: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused). Risk
is low because the source is a constant string.
strcpy(strbuff, "INFINITY");
- ./curl-83.40.2/curl/tests/libtest/lib518.c:199: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused). Risk
is low because the source is a constant string.
strcpy(strbuff, "INFINITY");
- ./curl-83.40.2/curl/tests/libtest/lib518.c:207: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused). Risk
is low because the source is a constant string.
strcpy(strbuff, "INFINITY");
- ./curl-83.40.2/curl/tests/libtest/lib518.c:325: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
fd[0] = open(DEV_NULL, O_RDONLY);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:398: [2] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf. Risk
is low because the source has a constant maximum length.
sprintf(strbuff, "select limit is FD_SETSIZE %d", FD_SETSIZE);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:412: [2] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf. Risk
is low because the source has a constant maximum length.
sprintf(strbuff, "select limit is FD_SETSIZE %d", FD_SETSIZE);
- ./curl-83.40.2/curl/tests/libtest/lib518.c:437: [2] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf. Risk
is low because the source has a constant maximum length.
sprintf(strbuff, "stdio fopen() fails with lots of fds open()");
- ./curl-83.40.2/curl/tests/libtest/lib525.c:56: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
hd_src = fopen(libtest_arg2, "rb");
- ./curl-83.40.2/curl/tests/libtest/lib530.c:39: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char target_url[256];
- ./curl-83.40.2/curl/tests/libtest/lib537.c:56: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static char msgbuff[256];
- ./curl-83.40.2/curl/tests/libtest/lib537.c:87: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
fpa[i] = fopen(DEV_NULL, "r");
- ./curl-83.40.2/curl/tests/libtest/lib537.c:109: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char strbuff[256];
- ./curl-83.40.2/curl/tests/libtest/lib537.c:110: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char strbuff1[81];
- ./curl-83.40.2/curl/tests/libtest/lib537.c:134: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused). Risk
is low because the source is a constant string.
strcpy(strbuff, "INFINITY");
- ./curl-83.40.2/curl/tests/libtest/lib537.c:142: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused). Risk
is low because the source is a constant string.
strcpy(strbuff, "INFINITY");
- ./curl-83.40.2/curl/tests/libtest/lib537.c:194: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused). Risk
is low because the source is a constant string.
strcpy(strbuff, "INFINITY");
- ./curl-83.40.2/curl/tests/libtest/lib537.c:202: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused). Risk
is low because the source is a constant string.
strcpy(strbuff, "INFINITY");
- ./curl-83.40.2/curl/tests/libtest/lib537.c:319: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
fd[0] = open(DEV_NULL, O_RDONLY);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:401: [2] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf. Risk
is low because the source has a constant maximum length.
sprintf(strbuff, "select limit is FD_SETSIZE %d", FD_SETSIZE);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:415: [2] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf. Risk
is low because the source has a constant maximum length.
sprintf(strbuff, "select limit is FD_SETSIZE %d", FD_SETSIZE);
- ./curl-83.40.2/curl/tests/libtest/lib537.c:440: [2] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf. Risk
is low because the source has a constant maximum length.
sprintf(strbuff, "stdio fopen() fails with lots of fds open()");
- ./curl-83.40.2/curl/tests/libtest/lib539.c:67: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination.
Consider using strncat or strlcat (warning, strncat is easily misused).
Risk is low because the source is a constant string.
newURL = strcat(strcpy(newURL, URL), "./");
- ./curl-83.40.2/curl/tests/libtest/lib540.c:191: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buffer[246]; /* naively fixed-size */
- ./curl-83.40.2/curl/tests/libtest/lib541.c:48: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
hd_src = fopen(libtest_arg2, "rb");
- ./curl-83.40.2/curl/tests/libtest/lib544.c:69: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination.
Consider using strncpy or strlcpy (warning, strncpy is easily misused). Risk
is low because the source is a constant string.
strcpy(teststring, "FAIL");
- ./curl-83.40.2/curl/tests/libtest/lib552.c:124: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static char databuf[70000]; /* MUST be more than 64k OR MAX_INITIAL_POST_SIZE */
- ./curl-83.40.2/curl/tests/libtest/lib552.c:132: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptr, databuf + current_offset, given);
- ./curl-83.40.2/curl/tests/libtest/lib553.c:36: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static char buf[1024];
- ./curl-83.40.2/curl/tests/libtest/lib553.c:48: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptr, buf, size);
- ./curl-83.40.2/curl/tests/libtest/lib553.c:56: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static char buf[SIZE_HEADERS + 100];
- ./curl-83.40.2/curl/tests/libtest/lib553.c:77: [2] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf. Risk
is low because the source has a constant maximum length.
int len = sprintf(buf, "Header%d: ", i);
- ./curl-83.40.2/curl/tests/libtest/lib556.c:73: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[1024];
- ./curl-83.40.2/curl/tests/libtest/lib557.c:61: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char result[BUFSZ]; /* result string */
- ./curl-83.40.2/curl/tests/libtest/lib557.c:68: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char result[BUFSZ]; /* result string */
- ./curl-83.40.2/curl/tests/libtest/lib557.c:75: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char result[BUFSZ]; /* result string */
- ./curl-83.40.2/curl/tests/libtest/lib557.c:82: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char result[BUFSZ]; /* result string */
- ./curl-83.40.2/curl/tests/libtest/lib557.c:89: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char result[BUFSZ]; /* result string */
- ./curl-83.40.2/curl/tests/libtest/lib557.c:96: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char result[BUFSZ]; /* result string */
- ./curl-83.40.2/curl/tests/libtest/lib557.c:103: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char result[BUFSZ]; /* result string */
- ./curl-83.40.2/curl/tests/libtest/lib566.c:53: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
moo = fopen(libtest_arg2, "wb");
- ./curl-83.40.2/curl/tests/libtest/lib568.c:77: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
sdp = open("log/file568.txt", O_RDONLY);
- ./curl-83.40.2/curl/tests/libtest/lib568.c:81: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
sdpf = fopen("log/file568.txt", "rb");
- ./curl-83.40.2/curl/tests/libtest/lib569.c:44: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
idfile = fopen(libtest_arg2, "wb");
- ./curl-83.40.2/curl/tests/libtest/lib571.c:107: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
protofile = fopen(libtest_arg2, "wb");
- ./curl-83.40.2/curl/tests/libtest/lib572.c:95: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
params = open("log/file572.txt", O_RDONLY);
- ./curl-83.40.2/curl/tests/libtest/lib572.c:99: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
paramsf = fopen("log/file572.txt", "rb");
- ./curl-83.40.2/curl/tests/libtest/lib578.c:33: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
FILE *moo = fopen(libtest_arg2, "wb");
- ./curl-83.40.2/curl/tests/libtest/lib579.c:56: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
moo = fopen(libtest_arg2, "ab");
- ./curl-83.40.2/curl/tests/libtest/lib579.c:80: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptr, data, len);
- ./curl-83.40.2/curl/tests/libtest/lib582.c:245: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
hd_src = fopen(libtest_arg2, "rb");
- ./curl-83.40.2/curl/tests/libtest/lib591.c:51: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
upload = fopen(libtest_arg3, "rb");
- ./curl-83.40.2/curl/tests/libtest/lib599.c:82: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
moo = fopen(libtest_arg2, "wb");
- ./curl-83.40.2/curl/tests/libtest/libntlmconnect.c:56: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(output, ptr, size * nmemb);
- ./curl-83.40.2/curl/tests/libtest/testtrace.c:92: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char timebuf[20];
- ./curl-83.40.2/curl/tests/server/fake_ntlm.c:113: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char buf[1024];
- ./curl-83.40.2/curl/tests/server/fake_ntlm.c:185: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
stream=fopen(filename, "rb");
- ./curl-83.40.2/curl/tests/server/fake_ntlm.c:203: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
stream=fopen(filename, "rb");
- ./curl-83.40.2/curl/tests/server/fake_ntlm.c:223: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
stream=fopen(filename, "rb");
- ./curl-83.40.2/curl/tests/server/fake_ntlm.c:244: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
stream=fopen(filename, "rb");
- ./curl-83.40.2/curl/tests/server/getpart.c:183: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(*dst_buf + *dst_len, src_buf, src_len);
- ./curl-83.40.2/curl/tests/server/getpart.c:218: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(*buf, buf64, src_len);
- ./curl-83.40.2/curl/tests/server/getpart.c:253: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char couter[MAX_TAG_LEN+1]; /* current outermost section */
- ./curl-83.40.2/curl/tests/server/getpart.c:254: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char cmain[MAX_TAG_LEN+1]; /* current main section */
- ./curl-83.40.2/curl/tests/server/getpart.c:255: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char csub[MAX_TAG_LEN+1]; /* current sub section */
- ./curl-83.40.2/curl/tests/server/getpart.c:256: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char ptag[MAX_TAG_LEN+1]; /* potential tag */
- ./curl-83.40.2/curl/tests/server/getpart.c:257: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char patt[MAX_TAG_LEN+1]; /* potential attributes */
- ./curl-83.40.2/curl/tests/server/getpart.c:316: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptag, ptr, len.uns);
- ./curl-83.40.2/curl/tests/server/getpart.c:377: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(ptag, ptr, len.uns);
- ./curl-83.40.2/curl/tests/server/getpart.c:396: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(patt, ptr, len.uns);
- ./curl-83.40.2/curl/tests/server/rtspd.c:95: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char reqbuf[REQBUFSIZ]; /* buffer area for the incoming request */
- ./curl-83.40.2/curl/tests/server/rtspd.c:100: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
bool open; /* keep connection open info, as found in the request */
- ./curl-83.40.2/curl/tests/server/rtspd.c:331: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static char request[REQUEST_KEYWORD_SIZE];
- ./curl-83.40.2/curl/tests/server/rtspd.c:332: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static char doc[MAXDOCNAMELEN];
- ./curl-83.40.2/curl/tests/server/rtspd.c:333: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static char prot_str[5];
- ./curl-83.40.2/curl/tests/server/rtspd.c:334: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char logbuf[256];
- ./curl-83.40.2/curl/tests/server/rtspd.c:412: [2] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf. Risk
is low because the source has a constant maximum length.
sprintf(logbuf, "Requested test number %ld part %ld",
- ./curl-83.40.2/curl/tests/server/rtspd.c:418: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
stream=fopen(filename, "rb");
- ./curl-83.40.2/curl/tests/server/rtspd.c:498: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(rtp_scratch + 4 + i, RTP_DATA, RTP_DATA_SIZE);
- ./curl-83.40.2/curl/tests/server/rtspd.c:506: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination. Make
sure destination can always hold the source data.
memcpy(req->rtp_buffer + req->rtp_buffersize, rtp_scratch, rtp_size + 4);
- ./curl-83.40.2/curl/tests/server/rtspd.c:676: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
req->open &&
- ./curl-83.40.2/curl/tests/server/rtspd.c:732: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
dump = fopen(REQUEST_DUMP, "ab");
- ./curl-83.40.2/curl/tests/server/rtspd.c:898: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static char weare[256];
- ./curl-83.40.2/curl/tests/server/rtspd.c:900: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char partbuf[80]="data";
- ./curl-83.40.2/curl/tests/server/rtspd.c:930: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char msgbuf[64];
- ./curl-83.40.2/curl/tests/server/rtspd.c:940: [2] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf. Risk
is low because the source has a constant maximum length.
sprintf(msgbuf, "RTSP_SERVER WE ROOLZ: %ld\r\n", (long)getpid());
- ./curl-83.40.2/curl/tests/server/rtspd.c:974: [2] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf. Risk
is low because the source has a constant maximum length.
sprintf(partbuf, "data%ld", req->partno);
- ./curl-83.40.2/curl/tests/server/rtspd.c:976: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
stream=fopen(filename, "rb");
- ./curl-83.40.2/curl/tests/server/rtspd.c:1000: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
stream=fopen(filename, "rb");
- ./curl-83.40.2/curl/tests/server/rtspd.c:1041: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
dump = fopen(RESPONSE_DUMP, "ab");
- ./curl-83.40.2/curl/tests/server/rtspd.c:1123: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char command[32];
- ./curl-83.40.2/curl/tests/server/rtspd.c:1405: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
if(!req.open) {
- ./curl-83.40.2/curl/tests/server/rtspd.c:1410: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
if(req.open)
- ./curl-83.40.2/curl/tests/server/rtspd.c:1413: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
} while(req.open || (req.testno == DOCNUMBER_CONNECT));
- ./curl-83.40.2/curl/tests/server/sockfilt.c:467: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char data[120];
- ./curl-83.40.2/curl/tests/server/sockfilt.c:476: [2] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf. Risk
is low because the source has a constant maximum length.
sprintf(optr, "\\n");
- ./curl-83.40.2/curl/tests/server/sockfilt.c:481: [2] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf. Risk
is low because the source has a constant maximum length.
sprintf(optr, "\\r");
- ./curl-83.40.2/curl/tests/server/sockfilt.c:486: [2] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf. Risk
is low because the source has a constant maximum length.
sprintf(optr, "%c", (ISGRAPH(ptr[i]) || ptr[i]==0x20) ?ptr[i]:'.');
- ./curl-83.40.2/curl/tests/server/sockfilt.c:903: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
unsigned char buffer[17010];
- ./curl-83.40.2/curl/tests/server/sockfilt.c:904: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char data[16];
- ./curl-83.40.2/curl/tests/server/sws.c:95: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char reqbuf[REQBUFSIZ]; /* buffer area for the incoming request */
- ./curl-83.40.2/curl/tests/server/sws.c:102: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
bool open; /* keep connection open info, as found in the request */
- ./curl-83.40.2/curl/tests/server/sws.c:356: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move
things around to create a race condition, control its ancestors, or change
its contents?.
stream=fopen(filename, "rb");
- ./curl-83.40.2/curl/tests/server/sws.c:455: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static char request[REQUEST_KEYWORD_SIZE];
- ./curl-83.40.2/curl/tests/server/sws.c:456: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
static char doc[MAXDOCNAMELEN];
- ./curl-83.40.2/curl/tests/server/sws.c:457: [2] (buffer) char:
Statically-sized arrays can be overflowed. Perform bounds checking,
use functions that limit length, or ensure that the size is larger than
the maximum possible length.
char logbuf[456];
- ./curl-83.40.2/curl/tests/server/sws.c:497: [2] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf. Risk
is low because the source has a constant maximum length.
sprintf(logbuf, "Got a *HUGE* request HTTP/%d.%d",
- ./curl-83.40.2/curl/tests/server/sws.c:530: [2] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf. Risk
is low because the source has a constant maximum length.
sprintf(logbuf, "Requested test number %ld part %ld",
- ./curl-83.40.2/curl/tests/server/sws.c:621: [2] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf. Risk
is low because the source has a constant maximum length.
sprintf(logbuf, "Requested test number %ld part %ld (from host name)",
- ./curl-83.40.2/curl/tests/server/sws.c:671: [2] (buffer) sprintf:
Does not check for buffer overflows. Use snprintf or vsnprintf. Risk