The following issues were found

tools/build/feature/test-libcrypto.c
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 8 Column: 11 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              int main(void)
{
	MD5_CTX context;
	unsigned char md[MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH];
	unsigned char dat[] = "12345";

	MD5_Init(&context);
	MD5_Update(&context, &dat[0], sizeof(dat));
	MD5_Final(&md[0], &context);

Reported by FlawFinder.

tools/testing/selftests/bpf/map_tests/array_map_batch_ops.c
1 issues
syntax error
Error

Line: 21 

              	int cpu_offset = 0;
	DECLARE_LIBBPF_OPTS(bpf_map_batch_opts, opts,
		.elem_flags = 0,
		.flags = 0,
	);

	for (i = 0; i < max_entries; i++) {
		keys[i] = i;
		if (is_pcpu) {

Reported by Cppcheck.

tools/testing/selftests/bpf/map_tests/htab_map_batch_ops.c
1 issues
syntax error
Error

Line: 21 

              	int i, j, err;
	DECLARE_LIBBPF_OPTS(bpf_map_batch_opts, opts,
		.elem_flags = 0,
		.flags = 0,
	);

	if (is_pcpu)
		v = (value *)values;

Reported by Cppcheck.

tools/testing/selftests/bpf/prog_tests/autoload.c
1 issues
usleep - This C routine is considered obsolete (as opposed to the shell command by the same name). The interaction of this function with SIGALRM and other timer functions such as sleep(), alarm(), setitimer(), and nanosleep() is unspecified
Security

Line: 33 Column: 2 CWE codes: 676
Suggestion: Use nanosleep(2) or setitimer(2) instead 

              	if (CHECK(err, "skel_attach", "skeleton attach failed: %d\n", err))
		goto cleanup;

	usleep(1);

	CHECK(!skel->bss->prog1_called, "prog1", "not called\n");
	CHECK(!skel->bss->prog2_called, "prog2", "not called\n");
	CHECK(skel->bss->prog3_called, "prog3", "called?!\n");

Reported by FlawFinder.

tools/build/feature/test-libaudit.c
1 issues
printf - If format strings can be influenced by an attacker, they can be exploited
Security

Line: 4 Column: 12 CWE codes: 134
Suggestion: Use a constant for the format specification 

              // SPDX-License-Identifier: GPL-2.0
#include <libaudit.h>

extern int printf(const char *format, ...);

int main(void)
{
	printf("error message: %s\n", audit_errno_to_name(0));

Reported by FlawFinder.

tools/testing/selftests/bpf/prog_tests/bpf_verif_scale.c
1 issues
vprintf - If format strings can be influenced by an attacker, they can be exploited
Security

Line: 8 Column: 3 CWE codes: 134
Suggestion: Use a constant for the format specification 

              			      const char *format, va_list args)
{
	if (level != LIBBPF_DEBUG) {
		vprintf(format, args);
		return 0;
	}

	if (!strstr(format, "verifier log"))
		return 0;

Reported by FlawFinder.

tools/testing/selftests/bpf/prog_tests/btf_split.c
1 issues
vfprintf - If format strings can be influenced by an attacker, they can be exploited
Security

Line: 12 Column: 2 CWE codes: 134
Suggestion: Use a constant for the format specification 

              
static void btf_dump_printf(void *ctx, const char *fmt, va_list args)
{
	vfprintf(ctx, fmt, args);
}

void test_btf_split() {
	struct btf_dump_opts opts;
	struct btf_dump *d = NULL;

Reported by FlawFinder.

tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c
1 issues
strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 73 Column: 33 CWE codes: 126 

              	if (client_fd < 0)
		goto out_clean;

	if (send(client_fd, "message", strlen("message"), 0) < 0)
		goto out_clean;

	res = false;

out_clean:

Reported by FlawFinder.

tools/testing/selftests/bpf/prog_tests/cgroup_link.c
1 issues
system - This causes a new program to execute and is difficult to use safely
Security

Line: 17 Column: 13 CWE codes: 78
Suggestion: try using a library call that implements the same functionality if available 

              {
	skel->bss->calls = 0;
	skel->bss->alt_calls = 0;
	CHECK_FAIL(system(PING_CMD));
	if (CHECK(skel->bss->calls != exp_calls, "call_cnt",
		  "exp %d, got %d\n", exp_calls, skel->bss->calls))
		return -EINVAL;
	if (CHECK(skel->bss->alt_calls != exp_alt_calls, "alt_call_cnt",
		  "exp %d, got %d\n", exp_alt_calls, skel->bss->alt_calls))

Reported by FlawFinder.

tools/testing/selftests/bpf/prog_tests/core_read_macros.c
1 issues
usleep - This C routine is considered obsolete (as opposed to the shell command by the same name). The interaction of this function with SIGALRM and other timer functions such as sleep(), alarm(), setitimer(), and nanosleep() is unspecified
Security

Line: 54 Column: 2 CWE codes: 676
Suggestion: Use nanosleep(2) or setitimer(2) instead 

              		goto cleanup;

	/* trigger tracepoint */
	usleep(1);

	ASSERT_EQ(bss->k_probe_out, 0x1234, "k_probe_out");
	ASSERT_EQ(bss->k_core_out, 0xabcd, "k_core_out");

	ASSERT_EQ(bss->u_probe_out, 0x5678, "u_probe_out");

Reported by FlawFinder.