The following issues were found
tests/unit/unit1307.c
2 issues
Line: 268
Column: 6
CWE codes:
78
Suggestion:
try using a library call that implements the same functionality if available
/* not reached */
}
enum system {
SYSTEM_CUSTOM,
SYSTEM_LINUX,
SYSTEM_MACOS
};
Reported by FlawFinder.
Line: 278
Column: 8
CWE codes:
78
Suggestion:
try using a library call that implements the same functionality if available
{
int testnum = sizeof(tests) / sizeof(struct testcase);
int i;
enum system machine;
#ifdef HAVE_FNMATCH
if(strstr(OS, "apple") || strstr(OS, "darwin")) {
machine = SYSTEM_MACOS;
}
Reported by FlawFinder.
docs/examples/anyauthput.c
2 issues
Line: 116
Column: 8
CWE codes:
362
url = argv[2];
/* get the file size of the local file */
hd = open(file, O_RDONLY);
fstat(hd, &file_info);
/* In windows, this will init the winsock stuff */
curl_global_init(CURL_GLOBAL_ALL);
Reported by FlawFinder.
Line: 89
Column: 13
CWE codes:
120
20
int *fdp = (int *)stream;
int fd = *fdp;
retcode = read(fd, ptr, (READ_3RD_ARG)(size * nmemb));
nread = (curl_off_t)retcode;
fprintf(stderr, "*** We read %" CURL_FORMAT_CURL_OFF_T
" bytes from file\n", nread);
Reported by FlawFinder.
lib/mime.h
2 issues
Line: 84
Column: 3
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
size_t pos; /* Position on output line. */
size_t bufbeg; /* Next data index in input buffer. */
size_t bufend; /* First unused byte index in input buffer. */
char buf[ENCODING_BUFFER_SIZE]; /* Input buffer. */
};
/* Mime readback state. */
struct mime_state {
enum mimestate state; /* Current state token. */
Reported by FlawFinder.
Line: 103
Column: 3
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
curl_mimepart *parent; /* Parent part. */
curl_mimepart *firstpart; /* First part. */
curl_mimepart *lastpart; /* Last part. */
char boundary[MIME_BOUNDARY_LEN]; /* The part boundary. */
struct mime_state state; /* Current readback state. */
};
/* A mime part. */
struct curl_mimepart {
Reported by FlawFinder.
lib/memdebug.h
2 issues
Line: 150
Column: 8
CWE codes:
362
#define fake_sclose(sockfd) curl_dbg_mark_sclose(sockfd,__LINE__,__FILE__)
#undef fopen
#define fopen(file,mode) curl_dbg_fopen(file,mode,__LINE__,__FILE__)
#undef fdopen
#define fdopen(file,mode) curl_dbg_fdopen(file,mode,__LINE__,__FILE__)
#define fclose(file) curl_dbg_fclose(file,__LINE__,__FILE__)
Reported by FlawFinder.
Line: 151
Column: 9
CWE codes:
362
#define fake_sclose(sockfd) curl_dbg_mark_sclose(sockfd,__LINE__,__FILE__)
#undef fopen
#define fopen(file,mode) curl_dbg_fopen(file,mode,__LINE__,__FILE__)
#undef fdopen
#define fdopen(file,mode) curl_dbg_fdopen(file,mode,__LINE__,__FILE__)
#define fclose(file) curl_dbg_fclose(file,__LINE__,__FILE__)
#endif /* MEMDEBUG_NODEFINES */
Reported by FlawFinder.
tests/libtest/lib554.c
2 issues
Line: 79
Column: 19
CWE codes:
126
struct WriteThis pooh2;
pooh.readptr = data;
pooh.sizeleft = strlen(data);
/* Fill in the file upload field */
if(oldstyle) {
formrc = curl_formadd(&formpost,
&lastptr,
Reported by FlawFinder.
Line: 109
Column: 20
CWE codes:
126
a file upload but still using the callback */
pooh2.readptr = data;
pooh2.sizeleft = strlen(data);
/* Fill in the file upload field */
formrc = curl_formadd(&formpost,
&lastptr,
CURLFORM_COPYNAME, "callbackdata",
Reported by FlawFinder.
docs/examples/postinmemory.c
2 issues
Line: 50
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
}
mem->memory = ptr;
memcpy(&(mem->memory[mem->size]), contents, realsize);
mem->size += realsize;
mem->memory[mem->size] = 0;
return realsize;
}
Reported by FlawFinder.
Line: 86
Column: 57
CWE codes:
126
/* if we don't provide POSTFIELDSIZE, libcurl will strlen() by
itself */
curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)strlen(postthis));
/* Perform the request, res will get the return code */
res = curl_easy_perform(curl);
/* Check for errors */
if(res != CURLE_OK) {
Reported by FlawFinder.
tests/libtest/lib556.c
2 issues
Line: 81
Column: 9
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
/* we assume that sending always work */
do {
char buf[1024];
/* busy-read like crazy */
res = curl_easy_recv(curl, buf, sizeof(buf), &iolen);
#ifdef TPF
sleep(1); /* avoid ctl-10 dump */
Reported by FlawFinder.
Line: 75
Column: 41
CWE codes:
126
#endif
size_t iolen = 0;
res = curl_easy_send(curl, request, strlen(request), &iolen);
if(!res) {
/* we assume that sending always work */
do {
Reported by FlawFinder.
lib/http_negotiate.c
2 issues
Line: 84
Column: 13
CWE codes:
126
passwdp = "";
/* Obtain the input token, if any */
header += strlen("Negotiate");
while(*header && ISSPACE(*header))
header++;
len = strlen(header);
neg_ctx->havenegdata = len != 0;
Reported by FlawFinder.
Line: 88
Column: 9
CWE codes:
126
while(*header && ISSPACE(*header))
header++;
len = strlen(header);
neg_ctx->havenegdata = len != 0;
if(!len) {
if(state == GSS_AUTHSUCC) {
infof(data, "Negotiate auth restarted");
Curl_http_auth_cleanup_negotiate(conn);
Reported by FlawFinder.
lib/vtls/keylog.h
2 issues
Line: 46
Column: 34
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
* Appends a key log file entry.
* Returns true iff the key log file is open and a valid entry was provided.
*/
bool Curl_tls_keylog_write(const char *label,
const unsigned char client_random[32],
const unsigned char *secret, size_t secretlen);
/*
* Appends a line to the key log file, ensure it is terminated by a LF.
Reported by FlawFinder.
Line: 47
Column: 43
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
* Returns true iff the key log file is open and a valid entry was provided.
*/
bool Curl_tls_keylog_write(const char *label,
const unsigned char client_random[32],
const unsigned char *secret, size_t secretlen);
/*
* Appends a line to the key log file, ensure it is terminated by a LF.
* Returns true iff the key log file is open and a valid line was provided.
Reported by FlawFinder.
docs/examples/ftpget.c
1 issues
Line: 41
Column: 19
CWE codes:
362
struct FtpFile *out = (struct FtpFile *)stream;
if(!out->stream) {
/* open file for writing */
out->stream = fopen(out->filename, "wb");
if(!out->stream)
return -1; /* failure, can't open file to write */
}
return fwrite(buffer, size, nmemb, out->stream);
}
Reported by FlawFinder.