The following issues were found

net/ipv4/devinet.c
20 issues
strcpy - Does not check for buffer overflows when copying to destination [MS-banned]
Security

Line: 1267 Column: 3 CWE codes: 120
Suggestion: Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused) 

              		if (len < size)
			break;
		memset(&ifr, 0, sizeof(struct ifreq));
		strcpy(ifr.ifr_name, ifa->ifa_label);

		(*(struct sockaddr_in *)&ifr.ifr_addr).sin_family = AF_INET;
		(*(struct sockaddr_in *)&ifr.ifr_addr).sin_addr.s_addr =
								ifa->ifa_local;

Reported by FlawFinder.

strcat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 1496 Column: 4 CWE codes: 120
Suggestion: Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused) 

              			dot = old;
		}
		if (strlen(dot) + strlen(dev->name) < IFNAMSIZ)
			strcat(ifa->ifa_label, dot);
		else
			strcpy(ifa->ifa_label + (IFNAMSIZ - strlen(dot) - 1), dot);
skip:
		rtmsg_ifa(RTM_NEWADDR, ifa, NULL, 0);
	}

Reported by FlawFinder.

strcpy - Does not check for buffer overflows when copying to destination [MS-banned]
Security

Line: 1498 Column: 4 CWE codes: 120
Suggestion: Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused) 

              		if (strlen(dot) + strlen(dev->name) < IFNAMSIZ)
			strcat(ifa->ifa_label, dot);
		else
			strcpy(ifa->ifa_label + (IFNAMSIZ - strlen(dot) - 1), dot);
skip:
		rtmsg_ifa(RTM_NEWADDR, ifa, NULL, 0);
	}
}

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 885 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	if (tb[IFA_LABEL])
		nla_strscpy(ifa->ifa_label, tb[IFA_LABEL], IFNAMSIZ);
	else
		memcpy(ifa->ifa_label, dev->name, IFNAMSIZ);

	if (tb[IFA_RT_PRIORITY])
		ifa->ifa_rt_priority = nla_get_u32(tb[IFA_RT_PRIORITY]);

	if (tb[IFA_CACHEINFO]) {

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1023 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	ifr->ifr_name[IFNAMSIZ - 1] = 0;

	/* save original address for comparison */
	memcpy(&sin_orig, sin, sizeof(*sin));

	colon = strchr(ifr->ifr_name, ':');
	if (colon)
		*colon = 0;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1157 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              				break;
			INIT_HLIST_NODE(&ifa->hash);
			if (colon)
				memcpy(ifa->ifa_label, ifr->ifr_name, IFNAMSIZ);
			else
				memcpy(ifa->ifa_label, dev->name, IFNAMSIZ);
		} else {
			ret = 0;
			if (ifa->ifa_local == sin->sin_addr.s_addr)

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1159 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              			if (colon)
				memcpy(ifa->ifa_label, ifr->ifr_name, IFNAMSIZ);
			else
				memcpy(ifa->ifa_label, dev->name, IFNAMSIZ);
		} else {
			ret = 0;
			if (ifa->ifa_local == sin->sin_addr.s_addr)
				break;
			inet_del_ifa(in_dev, ifap, 0);

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1484 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	int named = 0;

	in_dev_for_each_ifa_rtnl(ifa, in_dev) {
		char old[IFNAMSIZ], *dot;

		memcpy(old, ifa->ifa_label, IFNAMSIZ);
		memcpy(ifa->ifa_label, dev->name, IFNAMSIZ);
		if (named++ == 0)
			goto skip;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1486 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	in_dev_for_each_ifa_rtnl(ifa, in_dev) {
		char old[IFNAMSIZ], *dot;

		memcpy(old, ifa->ifa_label, IFNAMSIZ);
		memcpy(ifa->ifa_label, dev->name, IFNAMSIZ);
		if (named++ == 0)
			goto skip;
		dot = strchr(old, ':');
		if (!dot) {

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1487 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		char old[IFNAMSIZ], *dot;

		memcpy(old, ifa->ifa_label, IFNAMSIZ);
		memcpy(ifa->ifa_label, dev->name, IFNAMSIZ);
		if (named++ == 0)
			goto skip;
		dot = strchr(old, ':');
		if (!dot) {
			sprintf(old, ":%d", named);

Reported by FlawFinder.

include/linux/bcm963xx_tag.h
20 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 48 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              
struct bcm_tag {
	/* 0-3: Version of the image tag */
	char tag_version[TAGVER_LEN];
	/* 4-23: Company Line 1 */
	char sig_1[SIG1_LEN];
	/*  24-37: Company Line 2 */
	char sig_2[SIG2_LEN];
	/* 38-43: Chip this image is for */

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 50 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	/* 0-3: Version of the image tag */
	char tag_version[TAGVER_LEN];
	/* 4-23: Company Line 1 */
	char sig_1[SIG1_LEN];
	/*  24-37: Company Line 2 */
	char sig_2[SIG2_LEN];
	/* 38-43: Chip this image is for */
	char chip_id[CHIPID_LEN];
	/* 44-59: Board name */

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 52 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	/* 4-23: Company Line 1 */
	char sig_1[SIG1_LEN];
	/*  24-37: Company Line 2 */
	char sig_2[SIG2_LEN];
	/* 38-43: Chip this image is for */
	char chip_id[CHIPID_LEN];
	/* 44-59: Board name */
	char board_id[BOARDID_LEN];
	/* 60-61: Map endianness -- 1 BE 0 LE */

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 54 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	/*  24-37: Company Line 2 */
	char sig_2[SIG2_LEN];
	/* 38-43: Chip this image is for */
	char chip_id[CHIPID_LEN];
	/* 44-59: Board name */
	char board_id[BOARDID_LEN];
	/* 60-61: Map endianness -- 1 BE 0 LE */
	char big_endian[ENDIANFLAG_LEN];
	/* 62-71: Total length of image */

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 56 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	/* 38-43: Chip this image is for */
	char chip_id[CHIPID_LEN];
	/* 44-59: Board name */
	char board_id[BOARDID_LEN];
	/* 60-61: Map endianness -- 1 BE 0 LE */
	char big_endian[ENDIANFLAG_LEN];
	/* 62-71: Total length of image */
	char total_length[IMAGE_LEN];
	/* 72-83: Address in memory of CFE */

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 58 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	/* 44-59: Board name */
	char board_id[BOARDID_LEN];
	/* 60-61: Map endianness -- 1 BE 0 LE */
	char big_endian[ENDIANFLAG_LEN];
	/* 62-71: Total length of image */
	char total_length[IMAGE_LEN];
	/* 72-83: Address in memory of CFE */
	char cfe__address[ADDRESS_LEN];
	/* 84-93: Size of CFE */

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 60 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	/* 60-61: Map endianness -- 1 BE 0 LE */
	char big_endian[ENDIANFLAG_LEN];
	/* 62-71: Total length of image */
	char total_length[IMAGE_LEN];
	/* 72-83: Address in memory of CFE */
	char cfe__address[ADDRESS_LEN];
	/* 84-93: Size of CFE */
	char cfe_length[IMAGE_LEN];
	/* 94-105: Address in memory of image start

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 62 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	/* 62-71: Total length of image */
	char total_length[IMAGE_LEN];
	/* 72-83: Address in memory of CFE */
	char cfe__address[ADDRESS_LEN];
	/* 84-93: Size of CFE */
	char cfe_length[IMAGE_LEN];
	/* 94-105: Address in memory of image start
	 * (kernel for OpenWRT, rootfs for stock firmware)
	 */

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 64 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	/* 72-83: Address in memory of CFE */
	char cfe__address[ADDRESS_LEN];
	/* 84-93: Size of CFE */
	char cfe_length[IMAGE_LEN];
	/* 94-105: Address in memory of image start
	 * (kernel for OpenWRT, rootfs for stock firmware)
	 */
	char flash_image_start[ADDRESS_LEN];
	/* 106-115: Size of rootfs */

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 68 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	/* 94-105: Address in memory of image start
	 * (kernel for OpenWRT, rootfs for stock firmware)
	 */
	char flash_image_start[ADDRESS_LEN];
	/* 106-115: Size of rootfs */
	char root_length[IMAGE_LEN];
	/* 116-127: Address in memory of kernel */
	char kernel_address[ADDRESS_LEN];
	/* 128-137: Size of kernel */

Reported by FlawFinder.

drivers/bluetooth/btmrvl_sdio.c
20 issues
strcpy - Does not check for buffer overflows when copying to destination [MS-banned]
Security

Line: 1499 Column: 4 CWE codes: 120
Suggestion: Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused) 

              			strcpy(fw_dump_ptr, "========Start dump ");
			fw_dump_ptr += strlen("========Start dump ");

			strcpy(fw_dump_ptr, entry->mem_name);
			fw_dump_ptr += strlen(entry->mem_name);

			strcpy(fw_dump_ptr, "========\n");
			fw_dump_ptr += strlen("========\n");

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 537 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		helperbuf[2] = ((tx_len & 0x00ff0000) >> 16);
		helperbuf[3] = ((tx_len & 0xff000000) >> 24);

		memcpy(&helperbuf[SDIO_HEADER_LEN], &helper[hlprblknow],
				tx_len);

		/* Now send the data */
		ret = sdio_writesb(card->func, card->ioport, helperbuf,
				FIRMWARE_TRANSFER_NBLOCK * SDIO_BLOCK_SIZE);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 686 Column: 4 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              
			tx_blocks = DIV_ROUND_UP(txlen, blksz_dl);

			memcpy(fwbuf, &firmware[offset], txlen);
		}

		ret = sdio_writesb(card->func, card->ioport, fwbuf,
						tx_blocks * blksz_dl);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1127 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		if (!tmpbuf)
			return -ENOMEM;
		buf = (u8 *) ALIGN_ADDR(tmpbuf, BTSDIO_DMA_ALIGN);
		memcpy(buf, payload, nb);
	}

	sdio_claim_host(card->func);

	do {

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1247 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	struct btmrvl_sdio_card *card = priv->btmrvl_dev.card;
	int ret = 0;
	unsigned int reg, reg_start, reg_end;
	char buf[256], *ptr;
	u8 loop, func, data;
	int MAX_LOOP = 2;

	btmrvl_sdio_wakeup_fw(priv);
	sdio_claim_host(card->func);

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 1269 Column: 10 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              			reg_end = 0x09;
		}

		ptr += sprintf(ptr, "SDIO Func%d (%#x-%#x): ",
			       func, reg_start, reg_end);
		for (reg = reg_start; reg <= reg_end; reg++) {
			if (func == 0)
				data = sdio_f0_readb(card->func, reg, &ret);
			else

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 1278 Column: 12 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              				data = sdio_readb(card->func, reg, &ret);

			if (!ret) {
				ptr += sprintf(ptr, "%02x ", data);
			} else {
				ptr += sprintf(ptr, "ERR");
				break;
			}
		}

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 1280 Column: 12 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              			if (!ret) {
				ptr += sprintf(ptr, "%02x ", data);
			} else {
				ptr += sprintf(ptr, "ERR");
				break;
			}
		}

		BT_INFO("%s", buf);

Reported by FlawFinder.

strcpy - Does not check for buffer overflows when copying to destination [MS-banned]
Security

Line: 1496 Column: 4 CWE codes: 120
Suggestion: Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused) 

              		struct memory_type_mapping *entry = &mem_type_mapping_tbl[idx];

		if (entry->mem_ptr) {
			strcpy(fw_dump_ptr, "========Start dump ");
			fw_dump_ptr += strlen("========Start dump ");

			strcpy(fw_dump_ptr, entry->mem_name);
			fw_dump_ptr += strlen(entry->mem_name);

Reported by FlawFinder.

strcpy - Does not check for buffer overflows when copying to destination [MS-banned]
Security

Line: 1502 Column: 4 CWE codes: 120
Suggestion: Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused) 

              			strcpy(fw_dump_ptr, entry->mem_name);
			fw_dump_ptr += strlen(entry->mem_name);

			strcpy(fw_dump_ptr, "========\n");
			fw_dump_ptr += strlen("========\n");

			memcpy(fw_dump_ptr, entry->mem_ptr, entry->mem_size);
			fw_dump_ptr += entry->mem_size;

Reported by FlawFinder.

drivers/edac/sb_edac.c
20 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1354 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	u32 mc_route_reg[KNL_MAX_CHAS];
	u32 edc_route_reg[KNL_MAX_CHAS];
	int edram_only;
	char edc_route_string[KNL_MAX_EDCS*2];
	char mc_route_string[KNL_MAX_CHANNELS*2];
	int cur_reg_start;
	int mc;
	int channel;
	int participants[KNL_MAX_CHANNELS];

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1355 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	u32 edc_route_reg[KNL_MAX_CHAS];
	int edram_only;
	char edc_route_string[KNL_MAX_EDCS*2];
	char mc_route_string[KNL_MAX_CHANNELS*2];
	int cur_reg_start;
	int mc;
	int channel;
	int participants[KNL_MAX_CHANNELS];

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 1955 Column: 3 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              	 * memory controller would generate an error on that range.
	 */
	if ((addr > (u64) pvt->tolm) && (addr < (1LL << 32))) {
		sprintf(msg, "Error at TOLM area, on addr 0x%08Lx", addr);
		return -EINVAL;
	}
	if (addr >= (u64)pvt->tohm) {
		sprintf(msg, "Error at MMIOH area, on addr 0x%016Lx", addr);
		return -EINVAL;

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 1959 Column: 3 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              		return -EINVAL;
	}
	if (addr >= (u64)pvt->tohm) {
		sprintf(msg, "Error at MMIOH area, on addr 0x%016Lx", addr);
		return -EINVAL;
	}

	/*
	 * Step 1) Get socket

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 1975 Column: 4 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              
		limit = pvt->info.sad_limit(reg);
		if (limit <= prv) {
			sprintf(msg, "Can't discover the memory socket");
			return -EINVAL;
		}
		if  (addr <= limit)
			break;
		prv = limit;

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 1983 Column: 3 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              		prv = limit;
	}
	if (n_sads == pvt->info.max_sad) {
		sprintf(msg, "Can't discover the memory socket");
		return -EINVAL;
	}
	dram_rule = reg;
	*area_type = show_dram_attr(pvt->info.dram_attr(dram_rule));
	interleave_mode = pvt->info.interleave_mode(dram_rule);

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 2027 Column: 4 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              		case 8:
			break;
		default:
			sprintf(msg, "Can't discover socket interleave");
			return -EINVAL;
		}
		*socket = sad_interleave[idx];
		edac_dbg(0, "SAD interleave index: %d (wayness %d) = CPU socket %d\n",
			 idx, sad_way, *socket);

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 2080 Column: 3 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              	 */
	new_mci = get_mci_for_node_id(*socket, sad_ha);
	if (!new_mci) {
		sprintf(msg, "Struct for socket #%u wasn't initialized",
			*socket);
		return -EINVAL;
	}
	mci = new_mci;
	pvt = mci->pvt_info;

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 2096 Column: 4 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              		pci_read_config_dword(pci_ha, tad_dram_rule[n_tads], &reg);
		limit = TAD_LIMIT(reg);
		if (limit <= prv) {
			sprintf(msg, "Can't discover the memory channel");
			return -EINVAL;
		}
		if  (addr <= limit)
			break;
		prv = limit;

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 2104 Column: 3 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              		prv = limit;
	}
	if (n_tads == MAX_TAD) {
		sprintf(msg, "Can't discover the memory channel");
		return -EINVAL;
	}

	ch_way = TAD_CH(reg) + 1;
	sck_way = TAD_SOCK(reg);

Reported by FlawFinder.

include/uapi/linux/soundcard.h
20 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 154 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              typedef struct synth_control
{
	int devno;	/* Synthesizer # */
	char data[4000]; /* Device spesific command/data record */
}synth_control;

typedef struct remove_sample
{
	int devno;	/* Synthesizer # */

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 165 Column: 12 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              } remove_sample;

typedef struct seq_event_rec {
		unsigned char arr[8];
} seq_event_rec;

#define SNDCTL_TMR_TIMEBASE		_SIOWR('T', 1, int)
#define SNDCTL_TMR_START		_SIO  ('T', 2)
#define SNDCTL_TMR_STOP			_SIO  ('T', 3)

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 275 Column: 12 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              /*	New fields introduced in version 1.99.5	*/

       /* Envelope. Enabled by mode bit WAVE_ENVELOPES	*/
		unsigned char	env_rate[ 6 ];	 /* GUS HW ramping rate */
		unsigned char	env_offset[ 6 ]; /* 255 == 100% */

	/* 
	 * The tremolo, vibrato and scale info are not supported yet.
	 * Enable by setting the mode bits WAVE_TREMOLO, WAVE_VIBRATO or

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 276 Column: 12 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              
       /* Envelope. Enabled by mode bit WAVE_ENVELOPES	*/
		unsigned char	env_rate[ 6 ];	 /* GUS HW ramping rate */
		unsigned char	env_offset[ 6 ]; /* 255 == 100% */

	/* 
	 * The tremolo, vibrato and scale info are not supported yet.
	 * Enable by setting the mode bits WAVE_TREMOLO, WAVE_VIBRATO or
	 * WAVE_SCALE

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 299 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              		int		fractions;
		int		reserved1;
	        int		spare[2];
		char data[1];	/* The waveform data starts here */
	};

struct sysex_info {
		short key;		/* Use SYSEX_PATCH or MAUI_PATCH here */
#define SYSEX_PATCH	_PATCHKEY(0x05)

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 308 Column: 12 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              #define MAUI_PATCH	_PATCHKEY(0x06)
		short device_no;	/* Synthesizer number */
		int len;	/* Size of the sysex data in bytes */
		unsigned char data[1];	/* Sysex data starts here */
	};

/*
 * /dev/sequencer input events.
 *

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 469 Column: 18 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

               * Record for FM patches
 */

typedef unsigned char sbi_instr_data[32];

struct sbi_instrument {
		unsigned short	key;	/* FM_PATCH or OPL3_PATCH */
#define FM_PATCH	_PATCHKEY(0x01)
#define OPL3_PATCH	_PATCHKEY(0x03)

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 481 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	};

struct synth_info {	/* Read only */
		char	name[30];
		int	device;		/* 0-N. INITIALIZE BEFORE CALLING */
		int	synth_type;
#define SYNTH_TYPE_FM			0
#define SYNTH_TYPE_SAMPLE		1
#define SYNTH_TYPE_MIDI			2	/* Midi interface */

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 509 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	};

struct sound_timer_info {
		char name[32];
		int caps;
	};

#define MIDI_CAP_MPU401		1		/* MPU-401 intelligent mode */

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 516 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              #define MIDI_CAP_MPU401		1		/* MPU-401 intelligent mode */

struct midi_info {
		char		name[30];
		int		device;		/* 0-N. INITIALIZE BEFORE CALLING */
		unsigned int	capabilities;	/* To be defined later */
		int		dev_type;
		int		dummies[18];	/* Reserve space */
	};

Reported by FlawFinder.

drivers/usb/storage/isd200.c
20 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 208 Column: 12 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              		unsigned char WriteData1F5;
		unsigned char WriteData1F6;
		unsigned char WriteData1F7;
		unsigned char Reserved[3];
	} generic;

	struct {
		unsigned char SignatureByte0;
		unsigned char SignatureByte1;

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 225 Column: 12 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              		unsigned char CylinderHighByte;
		unsigned char DeviceHeadByte;
		unsigned char StatusByte;
		unsigned char Reserved[3];
	} read;

	struct {
		unsigned char SignatureByte0;
		unsigned char SignatureByte1;

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 242 Column: 12 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              		unsigned char CylinderHighByte;
		unsigned char DeviceHeadByte;
		unsigned char CommandByte;
		unsigned char Reserved[3];
	} write;
};


/*

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 268 Column: 11 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	unsigned char Versions;
	unsigned char Format; 
	unsigned char AdditionalLength;
	unsigned char Reserved[2];
	unsigned char Capability;
	unsigned char VendorId[8];
	unsigned char ProductId[16];
	unsigned char ProductRevisionLevel[4];
	unsigned char VendorSpecific[20];

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 270 Column: 11 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	unsigned char AdditionalLength;
	unsigned char Reserved[2];
	unsigned char Capability;
	unsigned char VendorId[8];
	unsigned char ProductId[16];
	unsigned char ProductRevisionLevel[4];
	unsigned char VendorSpecific[20];
	unsigned char Reserved3[40];
} __attribute__ ((packed));

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 271 Column: 11 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	unsigned char Reserved[2];
	unsigned char Capability;
	unsigned char VendorId[8];
	unsigned char ProductId[16];
	unsigned char ProductRevisionLevel[4];
	unsigned char VendorSpecific[20];
	unsigned char Reserved3[40];
} __attribute__ ((packed));

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 272 Column: 11 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	unsigned char Capability;
	unsigned char VendorId[8];
	unsigned char ProductId[16];
	unsigned char ProductRevisionLevel[4];
	unsigned char VendorSpecific[20];
	unsigned char Reserved3[40];
} __attribute__ ((packed));

/*

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 273 Column: 11 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	unsigned char VendorId[8];
	unsigned char ProductId[16];
	unsigned char ProductRevisionLevel[4];
	unsigned char VendorSpecific[20];
	unsigned char Reserved3[40];
} __attribute__ ((packed));

/*
 * INQUIRY data buffer size

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 274 Column: 11 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	unsigned char ProductId[16];
	unsigned char ProductRevisionLevel[4];
	unsigned char VendorSpecific[20];
	unsigned char Reserved3[40];
} __attribute__ ((packed));

/*
 * INQUIRY data buffer size
 */

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 323 Column: 11 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	u16 *id;
	struct isd200_config ConfigData;
	unsigned char *RegsBuf;
	unsigned char ATARegs[8];
	unsigned char DeviceHead;
	unsigned char DeviceFlags;

	/* maximum number of LUNs supported */
	unsigned char MaxLUNs;

Reported by FlawFinder.

drivers/dma/s3c24xx-dma.c
20 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 241 Column: 22 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	struct soc_data				*sdata;
	void __iomem				*base;
	struct dma_device			slave;
	struct dma_device			memcpy;
	struct s3c24xx_dma_phy			*phy_chans;
};

/*
 * Physical channel handling

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 581 Column: 34 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	next = NULL;

	/* Find a waiting virtual channel for the next transfer. */
	list_for_each_entry(p, &s3cdma->memcpy.channels, vc.chan.device_node)
		if (p->state == S3C24XX_DMA_CHAN_WAITING) {
			next = p;
			break;
		}

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1233 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              	/* acquire irqs and clocks for all physical channels */
	for (i = 0; i < pdata->num_phy_channels; i++) {
		struct s3c24xx_dma_phy *phy = &s3cdma->phy_chans[i];
		char clk_name[6];

		phy->id = i;
		phy->base = s3cdma->base + (i * sdata->stride);
		phy->host = s3cdma;

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 1252 Column: 4 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

              		}

		if (sdata->has_clocks) {
			sprintf(clk_name, "dma.%d", i);
			phy->clk = devm_clk_get(&pdev->dev, clk_name);
			if (IS_ERR(phy->clk) && sdata->has_clocks) {
				dev_err(&pdev->dev, "unable to acquire clock for channel %d, error %lu\n",
					i, PTR_ERR(phy->clk));
				continue;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1276 Column: 34 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	}

	/* Initialize memcpy engine */
	dma_cap_set(DMA_MEMCPY, s3cdma->memcpy.cap_mask);
	dma_cap_set(DMA_PRIVATE, s3cdma->memcpy.cap_mask);
	s3cdma->memcpy.dev = &pdev->dev;
	s3cdma->memcpy.device_free_chan_resources =
					s3c24xx_dma_free_chan_resources;
	s3cdma->memcpy.device_prep_dma_memcpy = s3c24xx_dma_prep_memcpy;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1277 Column: 35 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              
	/* Initialize memcpy engine */
	dma_cap_set(DMA_MEMCPY, s3cdma->memcpy.cap_mask);
	dma_cap_set(DMA_PRIVATE, s3cdma->memcpy.cap_mask);
	s3cdma->memcpy.dev = &pdev->dev;
	s3cdma->memcpy.device_free_chan_resources =
					s3c24xx_dma_free_chan_resources;
	s3cdma->memcpy.device_prep_dma_memcpy = s3c24xx_dma_prep_memcpy;
	s3cdma->memcpy.device_tx_status = s3c24xx_dma_tx_status;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1278 Column: 10 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	/* Initialize memcpy engine */
	dma_cap_set(DMA_MEMCPY, s3cdma->memcpy.cap_mask);
	dma_cap_set(DMA_PRIVATE, s3cdma->memcpy.cap_mask);
	s3cdma->memcpy.dev = &pdev->dev;
	s3cdma->memcpy.device_free_chan_resources =
					s3c24xx_dma_free_chan_resources;
	s3cdma->memcpy.device_prep_dma_memcpy = s3c24xx_dma_prep_memcpy;
	s3cdma->memcpy.device_tx_status = s3c24xx_dma_tx_status;
	s3cdma->memcpy.device_issue_pending = s3c24xx_dma_issue_pending;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1279 Column: 10 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	dma_cap_set(DMA_MEMCPY, s3cdma->memcpy.cap_mask);
	dma_cap_set(DMA_PRIVATE, s3cdma->memcpy.cap_mask);
	s3cdma->memcpy.dev = &pdev->dev;
	s3cdma->memcpy.device_free_chan_resources =
					s3c24xx_dma_free_chan_resources;
	s3cdma->memcpy.device_prep_dma_memcpy = s3c24xx_dma_prep_memcpy;
	s3cdma->memcpy.device_tx_status = s3c24xx_dma_tx_status;
	s3cdma->memcpy.device_issue_pending = s3c24xx_dma_issue_pending;
	s3cdma->memcpy.device_config = s3c24xx_dma_set_runtime_config;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1281 Column: 10 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	s3cdma->memcpy.dev = &pdev->dev;
	s3cdma->memcpy.device_free_chan_resources =
					s3c24xx_dma_free_chan_resources;
	s3cdma->memcpy.device_prep_dma_memcpy = s3c24xx_dma_prep_memcpy;
	s3cdma->memcpy.device_tx_status = s3c24xx_dma_tx_status;
	s3cdma->memcpy.device_issue_pending = s3c24xx_dma_issue_pending;
	s3cdma->memcpy.device_config = s3c24xx_dma_set_runtime_config;
	s3cdma->memcpy.device_terminate_all = s3c24xx_dma_terminate_all;
	s3cdma->memcpy.device_synchronize = s3c24xx_dma_synchronize;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1282 Column: 10 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	s3cdma->memcpy.device_free_chan_resources =
					s3c24xx_dma_free_chan_resources;
	s3cdma->memcpy.device_prep_dma_memcpy = s3c24xx_dma_prep_memcpy;
	s3cdma->memcpy.device_tx_status = s3c24xx_dma_tx_status;
	s3cdma->memcpy.device_issue_pending = s3c24xx_dma_issue_pending;
	s3cdma->memcpy.device_config = s3c24xx_dma_set_runtime_config;
	s3cdma->memcpy.device_terminate_all = s3c24xx_dma_terminate_all;
	s3cdma->memcpy.device_synchronize = s3c24xx_dma_synchronize;

Reported by FlawFinder.

drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32_parse.h
20 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 88 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              static inline int cxgb4_fill_ipv4_src_ip(struct ch_filter_specification *f,
					 __be32 val, __be32 mask)
{
	memcpy(&f->val.fip[0],  &val,  sizeof(u32));
	memcpy(&f->mask.fip[0], &mask, sizeof(u32));

	return 0;
}

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 89 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              					 __be32 val, __be32 mask)
{
	memcpy(&f->val.fip[0],  &val,  sizeof(u32));
	memcpy(&f->mask.fip[0], &mask, sizeof(u32));

	return 0;
}

static inline int cxgb4_fill_ipv4_dst_ip(struct ch_filter_specification *f,

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 97 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              static inline int cxgb4_fill_ipv4_dst_ip(struct ch_filter_specification *f,
					 __be32 val, __be32 mask)
{
	memcpy(&f->val.lip[0],  &val,  sizeof(u32));
	memcpy(&f->mask.lip[0], &mask, sizeof(u32));

	return 0;
}

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 98 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              					 __be32 val, __be32 mask)
{
	memcpy(&f->val.lip[0],  &val,  sizeof(u32));
	memcpy(&f->mask.lip[0], &mask, sizeof(u32));

	return 0;
}

static const struct cxgb4_match_field cxgb4_ipv4_fields[] = {

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 134 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              static inline int cxgb4_fill_ipv6_src_ip0(struct ch_filter_specification *f,
					  __be32 val, __be32 mask)
{
	memcpy(&f->val.fip[0],  &val,  sizeof(u32));
	memcpy(&f->mask.fip[0], &mask, sizeof(u32));

	return 0;
}

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 135 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              					  __be32 val, __be32 mask)
{
	memcpy(&f->val.fip[0],  &val,  sizeof(u32));
	memcpy(&f->mask.fip[0], &mask, sizeof(u32));

	return 0;
}

static inline int cxgb4_fill_ipv6_src_ip1(struct ch_filter_specification *f,

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 143 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              static inline int cxgb4_fill_ipv6_src_ip1(struct ch_filter_specification *f,
					  __be32 val, __be32 mask)
{
	memcpy(&f->val.fip[4],  &val,  sizeof(u32));
	memcpy(&f->mask.fip[4], &mask, sizeof(u32));

	return 0;
}

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 144 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              					  __be32 val, __be32 mask)
{
	memcpy(&f->val.fip[4],  &val,  sizeof(u32));
	memcpy(&f->mask.fip[4], &mask, sizeof(u32));

	return 0;
}

static inline int cxgb4_fill_ipv6_src_ip2(struct ch_filter_specification *f,

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 152 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              static inline int cxgb4_fill_ipv6_src_ip2(struct ch_filter_specification *f,
					  __be32 val, __be32 mask)
{
	memcpy(&f->val.fip[8],  &val,  sizeof(u32));
	memcpy(&f->mask.fip[8], &mask, sizeof(u32));

	return 0;
}

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 153 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              					  __be32 val, __be32 mask)
{
	memcpy(&f->val.fip[8],  &val,  sizeof(u32));
	memcpy(&f->mask.fip[8], &mask, sizeof(u32));

	return 0;
}

static inline int cxgb4_fill_ipv6_src_ip3(struct ch_filter_specification *f,

Reported by FlawFinder.

drivers/net/wireless/atmel/at76c50x-usb.c
20 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 298 Column: 11 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              
struct dfu_status {
	unsigned char status;
	unsigned char poll_timeout[3];
	unsigned char state;
	unsigned char string;
} __packed;

static inline int at76_is_intersil(enum board_type board)

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 440 Column: 4 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              			at76_dbg(DBG_DFU, "DFU IDLE");

			bsize = min_t(int, size, FW_BLOCK_SIZE);
			memcpy(block, buf, bsize);
			at76_dbg(DBG_DFU, "int fw, size left = %5d, "
				 "bsize = %4d, blockno = %2d", size, bsize,
				 blockno);
			ret =
			    at76_load_int_fw_block(udev, blockno, block, bsize);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 620 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              					       sizeof(hwcfg->i));
		if (ret < 0)
			goto exit;
		memcpy(priv->mac_addr, hwcfg->i.mac_addr, ETH_ALEN);
		priv->regulatory_domain = hwcfg->i.regulatory_domain;
	} else if (at76_is_503rfmd(priv->board_type)) {
		ret = at76_get_hw_cfg(priv->udev, hwcfg, sizeof(hwcfg->r3));
		if (ret < 0)
			goto exit;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 626 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		ret = at76_get_hw_cfg(priv->udev, hwcfg, sizeof(hwcfg->r3));
		if (ret < 0)
			goto exit;
		memcpy(priv->mac_addr, hwcfg->r3.mac_addr, ETH_ALEN);
		priv->regulatory_domain = hwcfg->r3.regulatory_domain;
	} else {
		ret = at76_get_hw_cfg(priv->udev, hwcfg, sizeof(hwcfg->r5));
		if (ret < 0)
			goto exit;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 632 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              		ret = at76_get_hw_cfg(priv->udev, hwcfg, sizeof(hwcfg->r5));
		if (ret < 0)
			goto exit;
		memcpy(priv->mac_addr, hwcfg->r5.mac_addr, ETH_ALEN);
		priv->regulatory_domain = hwcfg->r5.regulatory_domain;
	}

exit:
	kfree(hwcfg);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 733 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	cmd_buf->cmd = cmd;
	cmd_buf->reserved = 0;
	cmd_buf->size = cpu_to_le16(buf_size);
	memcpy(cmd_buf->data, buf, buf_size);

	at76_dbg_dump(DBG_CMD, cmd_buf, sizeof(struct at76_command) + buf_size,
		      "issuing command %s (0x%02x)",
		      at76_get_cmd_string(cmd), cmd);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1283 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	/* for fw >= 0.100, the device needs an extra empty block */
	do {
		bsize = min_t(int, size, FW_BLOCK_SIZE);
		memcpy(block, buf, bsize);
		at76_dbg(DBG_DEVSTART,
			 "ext fw, size left = %5d, bsize = %4d, blockno = %2d",
			 size, bsize, blockno);
		ret = at76_load_ext_fw_block(udev, blockno, block, bsize);
		if (ret != bsize) {

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1398 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	ccfg->rts_threshold = cpu_to_le16(priv->rts_threshold);
	ccfg->fragmentation_threshold = cpu_to_le16(priv->frag_threshold);

	memcpy(ccfg->basic_rate_set, hw_rates, 4);
	/* jal: really needed, we do a set_mib for autorate later ??? */
	ccfg->auto_rate_fallback = (priv->txrate == TX_RATE_AUTO ? 1 : 0);
	ccfg->channel = priv->channel;
	ccfg->privacy_invoked = priv->wep_enabled;
	memcpy(ccfg->current_ssid, priv->essid, IW_ESSID_MAX_SIZE);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1403 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	ccfg->auto_rate_fallback = (priv->txrate == TX_RATE_AUTO ? 1 : 0);
	ccfg->channel = priv->channel;
	ccfg->privacy_invoked = priv->wep_enabled;
	memcpy(ccfg->current_ssid, priv->essid, IW_ESSID_MAX_SIZE);
	ccfg->ssid_len = priv->essid_size;

	ccfg->wep_default_key_id = priv->wep_key_id;
	memcpy(ccfg->wep_default_key_value, priv->wep_keys,
	       sizeof(priv->wep_keys));

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1407 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              	ccfg->ssid_len = priv->essid_size;

	ccfg->wep_default_key_id = priv->wep_key_id;
	memcpy(ccfg->wep_default_key_value, priv->wep_keys,
	       sizeof(priv->wep_keys));

	ccfg->short_preamble = priv->preamble_type;
	ccfg->beacon_period = cpu_to_le16(priv->beacon_period);

Reported by FlawFinder.

tools/bpf/bpftool/main.c
20 issues
strcat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 338 Column: 4 CWE codes: 120
Suggestion: Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused) 

              				goto err_close;
			}
			buf[strlen(buf) - 2] = '\0';
			strcat(buf, contline);
		}

		n_argc = make_args(buf, n_argv, BATCH_ARG_NB_MAX, lines);
		if (!n_argc)
			continue;

Reported by FlawFinder.

getopt_long - Some older implementations do not protect against internal buffer overflows
Security

Line: 416 Column: 16 CWE codes: 120 20
Suggestion: Check implementation on installation, or limit the size of all string inputs 

              	hash_init(link_table.table);

	opterr = 0;
	while ((opt = getopt_long(argc, argv, "VhpjfLmndB:",
				  options, NULL)) >= 0) {
		switch (opt) {
		case 'V':
			return do_version(argc, argv);
		case 'h':

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 159 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              {
	unsigned int count = 0;
	const char *ref;
	char msg[256];
	va_list ap;

	snprintf(msg, sizeof(msg), "ambiguous prefix: '%s' could be '", arg);
	va_start(ap, arg);
	while ((ref = va_arg(ap, const char *))) {

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 274 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              
static int do_batch(int argc, char **argv)
{
	char buf[BATCH_LINE_LEN_MAX], contline[BATCH_LINE_LEN_MAX];
	char *n_argv[BATCH_ARG_NB_MAX];
	unsigned int lines = 0;
	int n_argc;
	FILE *fp;
	char *cp;

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 275 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              static int do_batch(int argc, char **argv)
{
	char buf[BATCH_LINE_LEN_MAX], contline[BATCH_LINE_LEN_MAX];
	char *n_argv[BATCH_ARG_NB_MAX];
	unsigned int lines = 0;
	int n_argc;
	FILE *fp;
	char *cp;
	int err = 0;

Reported by FlawFinder.

fopen - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 298 Column: 8 CWE codes: 362 

              	if (!strcmp(*argv, "-"))
		fp = stdin;
	else
		fp = fopen(*argv, "r");
	if (!fp) {
		p_err("Can't open file (%s): %s", *argv, strerror(errno));
		return -1;
	}

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 148 Column: 20 CWE codes: 126 

              {
	if (!pfx)
		return false;
	if (strlen(str) < strlen(pfx))
		return false;

	return !memcmp(str, pfx, strlen(pfx));
}

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 148 Column: 6 CWE codes: 126 

              {
	if (!pfx)
		return false;
	if (strlen(str) < strlen(pfx))
		return false;

	return !memcmp(str, pfx, strlen(pfx));
}

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 151 Column: 27 CWE codes: 126 

              	if (strlen(str) < strlen(pfx))
		return false;

	return !memcmp(str, pfx, strlen(pfx));
}

/* Last argument MUST be NULL pointer */
int detect_common_prefix(const char *arg, ...)
{

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 169 Column: 41 CWE codes: 126 

              			continue;
		count++;
		if (count > 1)
			strncat(msg, "' or '", sizeof(msg) - strlen(msg) - 1);
		strncat(msg, ref, sizeof(msg) - strlen(msg) - 1);
	}
	va_end(ap);
	strncat(msg, "'", sizeof(msg) - strlen(msg) - 1);

Reported by FlawFinder.