The following issues were found

tools/perf/util/spark.c
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 13 Column: 15 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              /* Print spark lines on outf for numval values in val. */
int print_spark(char *bf, int size, unsigned long *val, int numval)
{
	static const char *ticks[NUM_SPARKS] = {
		"▁",  "▂", "▃", "▄", "▅", "▆", "▇", "█"
	};
	int i, printed = 0;
	unsigned long min = ULONG_MAX, max = 0, f;


            

Reported by FlawFinder.

tools/perf/util/srccode.c
1 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 113 Column: 7 CWE codes: 362

              		free_srcfile(h);
	}

	fd = open(fn, O_RDONLY);
	if (fd < 0 || fstat(fd, &st) < 0) {
		pr_debug("cannot open source file %s\n", fn);
		return NULL;
	}


            

Reported by FlawFinder.

tools/perf/util/stat.c
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 87 Column: 14 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              }

#define ID(id, name) [PERF_STAT_EVSEL_ID__##id] = #name
static const char *id_str[PERF_STAT_EVSEL_ID__MAX] = {
	ID(NONE,		x),
	ID(CYCLES_IN_TX,	cpu/cycles-t/),
	ID(TRANSACTION_START,	cpu/tx-start/),
	ID(ELISION_START,	cpu/el-start/),
	ID(CYCLES_IN_TX_CP,	cpu/cycles-ct/),

            

Reported by FlawFinder.

tools/perf/util/strbuf.h
1 issues
strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 87 Column: 27 CWE codes: 126

              
int strbuf_add(struct strbuf *buf, const void *, size_t);
static inline int strbuf_addstr(struct strbuf *sb, const char *s) {
	return strbuf_add(sb, s, strlen(s));
}

int strbuf_addf(struct strbuf *sb, const char *fmt, ...) __printf(2, 3);

/* XXX: if read fails, any partial read is undone */

            

Reported by FlawFinder.

tools/perf/util/symbol.h
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 209 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	u64 addr;
	u64 offs;
	u64 len;
	char extract_filename[sizeof(PERF_KCORE_EXTRACT)];
	int fd;
};

int kcore_extract__create(struct kcore_extract *kce);
void kcore_extract__delete(struct kcore_extract *kce);

            

Reported by FlawFinder.

tools/perf/util/tool.h
1 issues
read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 44 Column: 4 CWE codes: 120 20

              
struct perf_tool {
	event_sample	sample,
			read;
	event_op	mmap,
			mmap2,
			comm,
			namespaces,
			cgroup,

            

Reported by FlawFinder.

tools/perf/util/top.c
1 issues
snprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 19 Column: 13 CWE codes: 134
Suggestion: Use a constant for the format specification

              
#define SNPRINTF(buf, size, fmt, args...) \
({ \
	size_t r = snprintf(buf, size, fmt, ## args); \
	r > size ?  size : r; \
})

size_t perf_top__header_snprintf(struct perf_top *top, char *bf, size_t size)
{

            

Reported by FlawFinder.

tools/perf/util/trace-event.c
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 80 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	char *tp_dir = get_events_file(sys);
	struct tep_handle *pevent = tevent.pevent;
	struct tep_event *event = NULL;
	char path[PATH_MAX];
	size_t size;
	char *data;
	int err;

	if (!tp_dir)

            

Reported by FlawFinder.

tools/perf/util/trace-event.h
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 60 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	/* size is only valid if temp is 'true' */
	ssize_t size;
	bool temp;
	char temp_file[50];
};

struct tracing_data *tracing_data_get(struct list_head *pattrs,
				      int fd, bool temp);
int tracing_data_put(struct tracing_data *tdata);

            

Reported by FlawFinder.

tools/perf/util/units.c
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 67 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              
int unit_number__scnprintf(char *buf, size_t size, u64 n)
{
	char unit[4] = "BKMG";
	int i = 0;

	while (((n / 1024) > 1) && (i < 3)) {
		n /= 1024;
		i++;

            

Reported by FlawFinder.