The following issues were found

src/third_party/wiredtiger/src/txn/txn_log.c
2 issues
read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 398 Column: 60 CWE codes: 120 20 

                  WT_ITEM *logrec;
    WT_TXN *txn;
    WT_TXN_SHARED *txn_shared;
    wt_timestamp_t commit, durable, first_commit, prepare, read;

    conn = S2C(session);
    txn = session->txn;
    txn_shared = WT_SESSION_TXN_SHARED(session);

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 436 Column: 47 CWE codes: 120 20 

              
    __wt_epoch(session, &t);
    return (__wt_logop_txn_timestamp_pack(session, logrec, (uint64_t)t.tv_sec, (uint64_t)t.tv_nsec,
      commit, durable, first_commit, prepare, read));
}

/*
 * __wt_txn_checkpoint_log --
 *     Write a log record for a checkpoint operation.

Reported by FlawFinder.

src/third_party/wiredtiger/src/utilities/util_backup.c
2 issues
strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 99 Column: 11 CWE codes: 126 

                  to = NULL;

    /* Build the target pathname. */
    len = strlen(directory) + strlen(name) + 2;
    if ((to = malloc(len)) == NULL) {
        fprintf(stderr, "%s: %s\n", progname, strerror(errno));
        return (1);
    }
    if ((ret = __wt_snprintf(to, len, "%s/%s", directory, name)) != 0) {

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 99 Column: 31 CWE codes: 126 

                  to = NULL;

    /* Build the target pathname. */
    len = strlen(directory) + strlen(name) + 2;
    if ((to = malloc(len)) == NULL) {
        fprintf(stderr, "%s: %s\n", progname, strerror(errno));
        return (1);
    }
    if ((ret = __wt_snprintf(to, len, "%s/%s", directory, name)) != 0) {

Reported by FlawFinder.

src/third_party/wiredtiger/src/utilities/util_stat.c
2 issues
strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 72 Column: 14 CWE codes: 126 

                      return (usage());
    }

    urilen = strlen("statistics:") + strlen(objname) + 1;
    if ((uri = calloc(urilen, 1)) == NULL) {
        fprintf(stderr, "%s: %s\n", progname, strerror(errno));
        goto err;
    }
    if ((ret = __wt_snprintf(uri, urilen, "statistics:%s", objname)) != 0) {

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 72 Column: 38 CWE codes: 126 

                      return (usage());
    }

    urilen = strlen("statistics:") + strlen(objname) + 1;
    if ((uri = calloc(urilen, 1)) == NULL) {
        fprintf(stderr, "%s: %s\n", progname, strerror(errno));
        goto err;
    }
    if ((ret = __wt_snprintf(uri, urilen, "statistics:%s", objname)) != 0) {

Reported by FlawFinder.

src/third_party/wiredtiger/test/3rdparty/extras-0.0.3/extras/tests/__init__.py
2 issues
Missing function or method docstring
Error

Line: 8 Column: 1 

              from unittest import TestSuite, TestLoader


def test_suite():
    from extras.tests import (
        test_extras,
        )
    modules = [
        test_extras,

Reported by Pylint.

Import outside toplevel (extras.tests.test_extras)
Error

Line: 9 Column: 5 

              

def test_suite():
    from extras.tests import (
        test_extras,
        )
    modules = [
        test_extras,
        ]

Reported by Pylint.

src/third_party/wiredtiger/bench/wtperf/runners/get_ckpt.py
2 issues
Missing module docstring
Error

Line: 1 Column: 1 

              #!/usr/bin/env python
#
# Public Domain 2014-present MongoDB, Inc.
# Public Domain 2008-2014 WiredTiger, Inc.
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled

Reported by Pylint.

Constant name "time" doesn't conform to UPPER_CASE naming style
Error

Line: 34 Column: 1 

              
import sys

time = 0 # seconds
print("%d, %d" % (0, 0))

for line in sys.stdin:
    if line.strip().endswith('secs'):
        time += int(line.split(' ')[7])

Reported by Pylint.

src/third_party/wiredtiger/test/3rdparty/python-subunit-0.0.16/python/subunit/tests/sample-two-script.py
2 issues
Missing module docstring
Error

Line: 1 Column: 1 

              #!/usr/bin/env python
import sys
print("test old mcdonald")
print("success old mcdonald")
print("test bing crosby")
print("success bing crosby")
sys.exit(0)

Reported by Pylint.

Module name "sample-two-script" doesn't conform to snake_case naming style
Error

Line: 1 Column: 1 

              #!/usr/bin/env python
import sys
print("test old mcdonald")
print("success old mcdonald")
print("test bing crosby")
print("success bing crosby")
sys.exit(0)

Reported by Pylint.

src/third_party/unwind/dist/src/ptrace/_UPT_find_proc_info.c
2 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 39 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              get_unwind_info (struct elf_dyn_info *edi, pid_t pid, unw_addr_space_t as, unw_word_t ip)
{
  unsigned long segbase, mapoff;
  char path[PATH_MAX];

#if UNW_TARGET_IA64 && defined(__linux)
  if (!edi->ktab.start_ip && _Uia64_get_kernel_table (&edi->ktab) < 0)
    return -UNW_ENOINFO;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 123 Column: 15 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              
              if (!mem)
                return -UNW_ENOMEM;
              memcpy (mem, pi->unwind_info, pi->unwind_info_size);
              pi->unwind_info = mem;
            }
        }
    }
#endif

Reported by FlawFinder.

src/third_party/unwind/dist/src/os-solaris.c
2 issues
strcpy - Does not check for buffer overflows when copying to destination [MS-banned]
Security

Line: 70 Column: 3 CWE codes: 120
Suggestion: Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused) 

              void
tdep_get_exe_image_path (char *path)
{
  strcpy(path, getexecname());
}

#endif /* !UNW_REMOTE_ONLY */

Reported by FlawFinder.

strncpy - Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned]
Security

Line: 58 Column: 7 CWE codes: 120 

                  }
  if (path)
    {
      strncpy(path, mi.path, pathlen);
    }
  rc = elf_map_image (ei, mi.path);
  maps_close (&mi);
  return rc;
}

Reported by FlawFinder.

src/third_party/unwind/dist/src/os-linux.c
2 issues
strcpy - Does not check for buffer overflows when copying to destination [MS-banned]
Security

Line: 70 Column: 3 CWE codes: 120
Suggestion: Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused) 

              void
tdep_get_exe_image_path (char *path)
{
  strcpy(path, "/proc/self/exe");
}

#endif /* !UNW_REMOTE_ONLY */

Reported by FlawFinder.

strncpy - Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned]
Security

Line: 58 Column: 7 CWE codes: 120 

                  }
  if (path)
    {
      strncpy(path, mi.path, pathlen);
    }
  rc = elf_map_image (ei, mi.path);
  maps_close (&mi);
  return rc;
}

Reported by FlawFinder.

src/third_party/unwind/dist/src/mi/init.c
2 issues
getenv - Environment variables are untrustable input if they can be set by an attacker. They can have any content and length, and the same variable can be set more than once
Security

Line: 47 Column: 21 CWE codes: 807 20
Suggestion: Check environment variables carefully before using them 

              mi_init (void)
{
#if UNW_DEBUG
  const char *str = getenv ("UNW_DEBUG_LEVEL");

  if (str)
    unwi_debug_level = atoi (str);

  if (unwi_debug_level > 0)

Reported by FlawFinder.

atoi - Unless checked, the resulting number can exceed the expected range
Security

Line: 50 Column: 24 CWE codes: 190
Suggestion: If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended) 

                const char *str = getenv ("UNW_DEBUG_LEVEL");

  if (str)
    unwi_debug_level = atoi (str);

  if (unwi_debug_level > 0)
    {
      setbuf (stdout, NULL);
      setbuf (stderr, NULL);

Reported by FlawFinder.