$ rats --context src Entries in perl database: 33 Entries in python database: 62 Entries in c database: 334 Entries in php database: 55 Analyzing src/gui/menu.cpp Analyzing src/gui/button.cpp Analyzing src/gui/mousecursor.cpp Analyzing src/lisp/lisp.cpp Analyzing src/lisp/parser.cpp Analyzing src/lisp/writer.cpp Analyzing src/lisp/list_iterator.cpp Analyzing src/lisp/lexer.cpp Analyzing src/math/vector.cpp Analyzing src/control/joystickkeyboardcontroller.cpp Analyzing src/control/codecontroller.cpp Analyzing src/control/controller.cpp Analyzing src/level_transformer.cpp Analyzing src/shrinkfade.cpp Analyzing src/flip_level_transformer.cpp Analyzing src/tile_manager.cpp Analyzing src/audio/dummy_sound_source.cpp Analyzing src/audio/sound_manager.cpp Analyzing src/audio/openal_sound_source.cpp Analyzing src/audio/sound_file.cpp Analyzing src/audio/stream_sound_source.cpp Analyzing src/video/surface.cpp Analyzing src/video/image_texture.cpp Analyzing src/video/font.cpp Analyzing src/video/texture_manager.cpp Analyzing src/video/texture.cpp Analyzing src/video/drawing_context.cpp Analyzing src/game_object.cpp Analyzing src/fadeout.cpp Analyzing src/object_factory.cpp Analyzing src/moving_object.cpp Analyzing src/timer.cpp Analyzing src/mainloop.cpp Analyzing src/player_status.cpp Analyzing src/physic.cpp Analyzing src/log.cpp Analyzing src/world.cpp Analyzing src/title.cpp Analyzing src/main.cpp Analyzing src/sector.cpp Analyzing src/badguy/willowisp.cpp Analyzing src/badguy/skullyhop.cpp Analyzing src/badguy/flyingsnowball.cpp Analyzing src/badguy/yeti_stalactite.cpp Analyzing src/badguy/mrtree.cpp Analyzing src/badguy/dart.cpp Analyzing src/badguy/poisonivy.cpp Analyzing src/badguy/plant.cpp Analyzing src/badguy/nolok_01.cpp Analyzing src/badguy/darttrap.cpp Analyzing src/badguy/spidermite.cpp Analyzing src/badguy/kugelblitz.cpp Analyzing src/badguy/flame.cpp Analyzing src/badguy/yeti.cpp Analyzing src/badguy/angrystone.cpp Analyzing src/badguy/fish.cpp Analyzing src/badguy/spiky.cpp Analyzing src/badguy/mrrocket.cpp Analyzing src/badguy/zeekling.cpp Analyzing src/badguy/badguy.cpp Analyzing src/badguy/dispenser.cpp Analyzing src/badguy/mriceblock.cpp Analyzing src/badguy/sspiky.cpp Analyzing src/badguy/snowball.cpp Analyzing src/badguy/rocketexplosion.cpp Analyzing src/badguy/igel.cpp Analyzing src/badguy/bouncing_snowball.cpp Analyzing src/badguy/totem.cpp Analyzing src/badguy/bomb.cpp Analyzing src/badguy/jumpy.cpp Analyzing src/badguy/stalactite.cpp Analyzing src/badguy/mrbomb.cpp Analyzing src/badguy/snail.cpp Analyzing src/console.cpp Analyzing src/level.cpp Analyzing src/squirrel/sqdbg/sqrdbg.cpp Analyzing src/squirrel/sqdbg/sqdbgserver.cpp Analyzing src/squirrel/sqstdlib/sqstdaux.cpp Analyzing src/squirrel/sqstdlib/sqstdsystem.cpp Analyzing src/squirrel/sqstdlib/sqstdstring.cpp src/squirrel/sqstdlib/sqstdstring.cpp:204: warning: bad token `\' Analyzing src/squirrel/sqstdlib/sqstdio.cpp src/squirrel/sqstdlib/sqstdio.cpp:208: warning: bad token `\' Analyzing src/squirrel/sqstdlib/sqstdrex.cpp Analyzing src/squirrel/sqstdlib/sqstdstream.cpp src/squirrel/sqstdlib/sqstdstream.cpp:13: warning: bad token `\' src/squirrel/sqstdlib/sqstdstream.cpp:14: warning: bad token `\' src/squirrel/sqstdlib/sqstdstream.cpp:15: warning: bad token `\' src/squirrel/sqstdlib/sqstdstream.cpp:16: warning: bad token `\' src/squirrel/sqstdlib/sqstdstream.cpp:38: warning: bad token `\' Analyzing src/squirrel/sqstdlib/sqstdblob.cpp src/squirrel/sqstdlib/sqstdblob.cpp:16: warning: bad token `\' src/squirrel/sqstdlib/sqstdblob.cpp:17: warning: bad token `\' Analyzing src/squirrel/sqstdlib/sqstdmath.cpp src/squirrel/sqstdlib/sqstdmath.cpp:8: warning: bad token `\' src/squirrel/sqstdlib/sqstdmath.cpp:9: warning: bad token `\' src/squirrel/sqstdlib/sqstdmath.cpp:10: warning: bad token `\' src/squirrel/sqstdlib/sqstdmath.cpp:11: warning: bad token `\' src/squirrel/sqstdlib/sqstdmath.cpp:15: warning: bad token `\' src/squirrel/sqstdlib/sqstdmath.cpp:16: warning: bad token `\' src/squirrel/sqstdlib/sqstdmath.cpp:17: warning: bad token `\' src/squirrel/sqstdlib/sqstdmath.cpp:18: warning: bad token `\' src/squirrel/sqstdlib/sqstdmath.cpp:19: warning: bad token `\' Analyzing src/squirrel/squirrel/sqbaselib.cpp src/squirrel/squirrel/sqbaselib.cpp:577: warning: bad token `\' src/squirrel/squirrel/sqbaselib.cpp:578: warning: bad token `\' src/squirrel/squirrel/sqbaselib.cpp:579: warning: bad token `\' src/squirrel/squirrel/sqbaselib.cpp:580: warning: bad token `\' src/squirrel/squirrel/sqbaselib.cpp:581: warning: bad token `\' src/squirrel/squirrel/sqbaselib.cpp:582: warning: bad token `\' src/squirrel/squirrel/sqbaselib.cpp:583: warning: bad token `\' src/squirrel/squirrel/sqbaselib.cpp:584: warning: bad token `\' Analyzing src/squirrel/squirrel/sqclass.cpp Analyzing src/squirrel/squirrel/sqstate.cpp src/squirrel/squirrel/sqstate.cpp:30: warning: bad token `\' src/squirrel/squirrel/sqstate.cpp:34: warning: bad token `\' src/squirrel/squirrel/sqstate.cpp:35: warning: bad token `\' Analyzing src/squirrel/squirrel/sqlexer.cpp Analyzing src/squirrel/squirrel/sqfuncstate.cpp Analyzing src/squirrel/squirrel/sqtable.cpp Analyzing src/squirrel/squirrel/sqvm.cpp Analyzing src/squirrel/squirrel/sqmem.cpp Analyzing src/squirrel/squirrel/sqcompiler.cpp src/squirrel/squirrel/sqcompiler.cpp:38: warning: bad token `\' src/squirrel/squirrel/sqcompiler.cpp:42: warning: bad token `\' src/squirrel/squirrel/sqcompiler.cpp:43: warning: bad token `\' src/squirrel/squirrel/sqcompiler.cpp:44: warning: bad token `\' Analyzing src/squirrel/squirrel/sqdebug.cpp Analyzing src/squirrel/squirrel/sqapi.cpp src/squirrel/squirrel/sqapi.cpp:30: warning: bad token `\' src/squirrel/squirrel/sqapi.cpp:31: warning: bad token `\' Analyzing src/squirrel/squirrel/sqobject.cpp Analyzing src/options_menu.cpp Analyzing src/resources.cpp Analyzing src/trigger/secretarea_trigger.cpp Analyzing src/trigger/door.cpp Analyzing src/trigger/switch.cpp Analyzing src/trigger/scripttrigger.cpp Analyzing src/trigger/sequence_trigger.cpp Analyzing src/trigger/hatch.cpp Analyzing src/trigger/trigger_base.cpp Analyzing src/worldmap/sprite_change.cpp Analyzing src/worldmap/worldmap.cpp Analyzing src/worldmap/special_tile.cpp Analyzing src/worldmap/level.cpp Analyzing src/worldmap/tux.cpp Analyzing src/worldmap/teleporter.cpp Analyzing src/object/particlesystem.cpp Analyzing src/object/electrifier.cpp Analyzing src/object/moving_sprite.cpp Analyzing src/object/background.cpp Analyzing src/object/display_effect.cpp Analyzing src/object/gradient.cpp Analyzing src/object/scripted_object.cpp Analyzing src/object/infoblock.cpp Analyzing src/object/weak_block.cpp Analyzing src/object/platform.cpp Analyzing src/object/level_time.cpp Analyzing src/object/candle.cpp Analyzing src/object/powerup.cpp Analyzing src/object/hurting_platform.cpp Analyzing src/object/falling_coin.cpp Analyzing src/object/bullet.cpp Analyzing src/object/tilemap.cpp Analyzing src/object/gameobjs.cpp Analyzing src/object/oneup.cpp Analyzing src/object/path.cpp Analyzing src/object/rock.cpp Analyzing src/object/fireworks.cpp Analyzing src/object/coin.cpp Analyzing src/object/growup.cpp Analyzing src/object/unstable_tile.cpp Analyzing src/object/flower.cpp Analyzing src/object/particles.cpp Analyzing src/object/anchor_point.cpp Analyzing src/object/wind.cpp Analyzing src/object/star.cpp Analyzing src/object/skull_tile.cpp Analyzing src/object/text_object.cpp Analyzing src/object/sprite_particle.cpp Analyzing src/object/light.cpp Analyzing src/object/particlesystem_interactive.cpp Analyzing src/object/firefly.cpp Analyzing src/object/floating_image.cpp Analyzing src/object/camera.cpp Analyzing src/object/rainsplash.cpp Analyzing src/object/invisible_block.cpp Analyzing src/object/specialriser.cpp Analyzing src/object/path_walker.cpp Analyzing src/object/ambient_sound.cpp Analyzing src/object/block.cpp Analyzing src/object/player.cpp Analyzing src/file_system.cpp Analyzing src/statistics.cpp Analyzing src/physfs/physfs_stream.cpp Analyzing src/physfs/physfs_sdl.cpp Analyzing src/sprite/sprite_manager.cpp Analyzing src/sprite/sprite.cpp Analyzing src/sprite/sprite_data.cpp Analyzing src/tinygettext/findlocale.cpp Analyzing src/tinygettext/tinygettext.cpp Analyzing src/collision_grid.cpp Analyzing src/textscroller.cpp Analyzing src/gameconfig.cpp Analyzing src/tile.cpp Analyzing src/random_generator.cpp Analyzing src/scripting/squirrel_error.cpp Analyzing src/scripting/time_scheduler.cpp Analyzing src/scripting/platform.cpp Analyzing src/scripting/candle.cpp Analyzing src/scripting/functions.cpp Analyzing src/scripting/thread_queue.cpp Analyzing src/scripting/level.cpp Analyzing src/scripting/serialize.cpp Analyzing src/scripting/wrapper.cpp Analyzing src/scripting/floating_image.cpp Analyzing src/scripting/camera.cpp Analyzing src/scripting/squirrel_util.cpp Analyzing src/spawn_point.cpp Analyzing src/game_session.cpp Analyzing src/collision.cpp src/gui/menu.cpp:181: High: fixed size local buffer char str[1024]; src/lisp/parser.cpp:132: High: fixed size local buffer result->v.string = new char[translation.size()+1]; src/lisp/parser.cpp:136: High: fixed size local buffer result->v.string = new char[len]; src/lisp/parser.cpp:161: High: fixed size local buffer result->v.string = new char[len]; src/lisp/parser.cpp:168: High: fixed size local buffer result->v.string = new char[len]; src/audio/sound_manager.cpp:98: High: fixed size local buffer char* samples = new char[file->size]; src/audio/sound_file.cpp:73: High: fixed size local buffer char magic[4]; src/audio/sound_file.cpp:89: High: fixed size local buffer char chunkmagic[4]; src/audio/sound_file.cpp:336: High: fixed size local buffer char magic[4]; src/audio/stream_sound_source.cpp:114: High: fixed size local buffer char* bufferdata = new char[STREAMFRAGMENTSIZE]; src/video/font.cpp:134: High: fixed size local buffer char temp[1024]; src/video/texture_manager.cpp:162: High: fixed size local buffer saved_texture.pixels = new char[pixelssize]; src/mainloop.cpp:114: High: fixed size local buffer char str[60]; src/player_status.cpp:138: High: fixed size local buffer char str[60]; src/main.cpp:91: High: fixed size local buffer char* writedir = new char[strlen(userdir) + strlen(application) + 2]; src/main.cpp:97: High: fixed size local buffer char* mkdir = new char[strlen(application) + 2]; src/main.cpp:131: High: fixed size local buffer char* str = new char[strlen(d) + strlen(dirsep) + l + 1]; src/squirrel/sqdbg/sqrdbg.cpp:79: High: fixed size local buffer char temp[1024]; src/squirrel/sqdbg/sqdbgserver.cpp:382: High: fixed size local buffer static char stemp[MAX_BP_PATH]; src/squirrel/sqstdlib/sqstdio.cpp:219: High: fixed size local buffer static unsigned char byte_masks[5] = {0,0,0x1f,0x0f,0x07}; src/resources.cpp:73: High: fixed size local buffer char img_name[1024]; src/object/level_time.cpp:74: High: fixed size local buffer char str[60]; src/object/gameobjs.cpp:114: High: fixed size local buffer char str[10]; src/statistics.cpp:114: High: fixed size local buffer char caption_buf[128]; src/statistics.cpp:115: High: fixed size local buffer char stat_buf[128]; src/statistics.cpp:168: High: fixed size local buffer char str[128]; src/statistics.cpp:225: High: fixed size local buffer char buf[129]; src/tinygettext/tinygettext.cpp:52: High: fixed size local buffer char* out_orig = new char[out_len]; src/tinygettext/tinygettext.cpp:53: High: fixed size local buffer char* in_orig = new char[in_len+1]; src/scripting/squirrel_util.cpp:49: High: fixed size local buffer char buf[4096]; src/game_session.cpp:181: High: fixed size local buffer char buf[30]; // save the seed in the demo file src/game_session.cpp:204: High: fixed size local buffer char buf[30]; // recall the seed from the demo file src/game_session.cpp:221: High: fixed size local buffer char str[60]; Extra care should be taken to ensure that character arrays that are allocated on the stack are used safely. They are prime targets for buffer overflow attacks. src/gui/menu.cpp:183: High: sprintf sprintf(str,"%s ",input.c_str()); src/gui/menu.cpp:185: High: sprintf sprintf(str,"%s_",input.c_str()); src/main.cpp:94: High: sprintf sprintf(writedir, "%s.%s", userdir, application); src/main.cpp:98: High: sprintf sprintf(mkdir, ".%s", application); src/main.cpp:132: High: sprintf sprintf(str, "%s%s%s", d, dirsep, *i); src/statistics.cpp:119: High: sprintf sprintf(caption_buf, _("Max coins collected:")); src/statistics.cpp:123: High: sprintf sprintf(caption_buf, _("Max fragging:")); src/statistics.cpp:127: High: sprintf sprintf(caption_buf, _("Min time needed:")); src/statistics.cpp:136: High: sprintf sprintf(caption_buf, _("Max secrets found:")); src/statistics.cpp:171: High: sprintf sprintf(str, _("Max coins collected: %d / %d"), coins, total_coins); src/statistics.cpp:175: High: sprintf sprintf(str, _("Max fragging: %d / %d"), badguys, total_badguys); src/statistics.cpp:182: High: sprintf sprintf(str, _("Min time needed: %02d:%02d"), mins,secs); src/statistics.cpp:186: High: sprintf sprintf(str, _("Max secrets found: %d / %d"), secrets, total_secrets); Check to be sure that the format string passed as argument 2 to this function call does not come from an untrusted source that could have added formatting characters that the code is not prepared to handle. Additionally, the format string could contain `%s' without precision that could result in a buffer overflow. src/main.cpp:200: High: fprintf fprintf(stderr, _("Usage: %s [OPTIONS] [LEVELFILE]\n\n"), argv0); src/main.cpp:201: High: fprintf fprintf(stderr, Check to be sure that the non-constant format string passed as argument 2 to this function call does not come from an untrusted source that could have added formatting characters that the code is not prepared to handle. src/statistics.cpp:119: High: sprintf sprintf(caption_buf, _("Max coins collected:")); src/statistics.cpp:123: High: sprintf sprintf(caption_buf, _("Max fragging:")); src/statistics.cpp:127: High: sprintf sprintf(caption_buf, _("Min time needed:")); src/statistics.cpp:136: High: sprintf sprintf(caption_buf, _("Max secrets found:")); src/statistics.cpp:171: High: sprintf sprintf(str, _("Max coins collected: %d / %d"), coins, total_coins); src/statistics.cpp:175: High: sprintf sprintf(str, _("Max fragging: %d / %d"), badguys, total_badguys); src/statistics.cpp:182: High: sprintf sprintf(str, _("Min time needed: %02d:%02d"), mins,secs); src/statistics.cpp:186: High: sprintf sprintf(str, _("Max secrets found: %d / %d"), secrets, total_secrets); Check to be sure that the non-constant format string passed as argument 2 to this function call does not come from an untrusted source that could have added formatting characters that the code is not prepared to handle. src/tinygettext/findlocale.cpp:144: High: getenv env = getenv(name); src/tinygettext/tinygettext.cpp:185: High: getenv const char* lang = getenv( "SUPERTUX_LANG" ); Environment variables are highly untrustable input. They may be of any length, and contain any data. Do not make any assumptions regarding content or length. If at all possible avoid using them, and if it is necessary, sanitize them and truncate them to a reasonable length. src/tinygettext/tinygettext.cpp:54: High: strcpy strcpy(in_orig, text.c_str()); Check to be sure that argument 2 passed to this function call will not copy more data than can be handled, resulting in a buffer overflow. src/scripting/squirrel_util.cpp:52: High: vsprintf vsprintf(buf, str, arglist); Check to be sure that the non-constant format string passed as argument 2 to this function call does not come from an untrusted source that could have added formatting characters that the code is not prepared to handle. src/scripting/squirrel_util.cpp:52: High: vsprintf vsprintf(buf, str, arglist); Check to be sure that the format string passed as argument 2 to this function call does not come from an untrusted source that could have added formatting characters that the code is not prepared to handle. Additionally, the format string could contain `%s' without precision that could result in a buffer overflow. src/lisp/parser.cpp:86: Medium: read result->v.cons.car = read(); src/lisp/parser.cpp:96: Medium: read Parser::read() src/lisp/parser.cpp:147: Medium: read cur->v.cons.car = read(); src/lisp/lexer.cpp:58: Medium: read stream.read(buffer, BUFFER_SIZE); src/control/joystickkeyboardcontroller.cpp:142: Medium: read JoystickKeyboardController::read(const lisp::Lisp& lisp) src/audio/sound_manager.cpp:100: Medium: read file->read(samples, file->size); src/audio/sound_file.cpp:42: Medium: read size_t read(void* buffer, size_t buffer_size); src/audio/sound_file.cpp:162: Medium: read WavSoundFile::read(void* buffer, size_t buffer_size) src/audio/sound_file.cpp:201: Medium: read size_t read(void* buffer, size_t buffer_size); src/audio/sound_file.cpp:234: Medium: read OggSoundFile::read(void* _buffer, size_t buffer_size) src/audio/stream_sound_source.cpp:117: Medium: read bytesread += file->read(bufferdata + bytesread, src/player_status.cpp:106: Medium: read PlayerStatus::read(const lisp::Lisp& lisp) src/world.cpp:215: Medium: read player_status->read(*tux); src/squirrel/squirrel/sqobject.cpp:206: Medium: read if(size && read(up,dest,size) != size) { src/object/platform.cpp:47: Medium: read path->read(*pathLisp); src/object/path.cpp:45: Medium: read Path::read(const lisp::Lisp& reader) src/object/camera.cpp:90: Medium: read autoscroll_path->read(*pathLisp); src/gameconfig.cpp:83: Medium: read main_controller->read(*config_control_lisp); src/random_generator.cpp:363: Medium: read if (read(fd, state, len) == len) done = 1; Check buffer boundaries if calling this function in a loop and make sure you are not in danger of writing past the allocated space. src/main.cpp:295: Medium: srand config->random_seed = systemRandom.srand(config->random_seed); src/squirrel/sqstdlib/sqstdmath.cpp:26: Medium: srand srand((unsigned int)i); src/random_generator.cpp:54: Medium: srand int RandomGenerator::srand(int x) { src/game_session.cpp:151: Medium: srand config->random_seed = systemRandom.srand(newSeed); Standard random number generators should not be used to generate randomness used for security reasons. For security sensitive randomness a crytographic randomness generator that provides sufficient entropy should be used. src/squirrel/squirrel/sqmem.cpp:7: Medium: realloc void *sq_vm_realloc(void *p, SQUnsignedInteger oldsize, SQUnsignedInteger size){ return realloc(p, size); } Don't use on memory intended to be secure, because the old structure will not be zeroed out. src/tinygettext/tinygettext.cpp:626: Medium: getchar inline int getchar(std::istream& in) src/tinygettext/tinygettext.cpp:645: Medium: getchar while((c = getchar(in)) != EOF) src/tinygettext/tinygettext.cpp:662: Medium: getchar } while((c = getchar(in)) != EOF && !isspace(c)); src/tinygettext/tinygettext.cpp:670: Medium: getchar while((c = getchar(in)) != EOF) src/tinygettext/tinygettext.cpp:689: Medium: getchar c = getchar(in); Check buffer boundaries if calling this function in a loop and make sure you are not in danger of writing past the allocated space. src/random_generator.cpp:59: Medium: srandom srandom(x); src/random_generator.cpp:314: Medium: srandom void RandomGenerator::srandom(unsigned long x) src/random_generator.cpp:372: Medium: srandom srandom(tv.tv_sec ^ tv.tv_usec); src/random_generator.cpp:449: Medium: srandom srandom(seed); Standard random number generators should not be used to generate randomness used for security reasons. For security sensitive randomness a crytographic randomness generator that provides sufficient entropy should be used. src/random_generator.cpp:63: Medium: random int RandomGenerator::rand() { return random(); } src/random_generator.cpp:67: Medium: random return RandomGenerator::random() % v; src/random_generator.cpp:77: Medium: random while ((rv = (double)RandomGenerator::random() / RAND_MAX * v) >= v) src/random_generator.cpp:330: Medium: random for (i = 0; i < lim; i++) random(); src/random_generator.cpp:531: Medium: random long RandomGenerator::random() Standard random number generators should not be used to generate randomness used for security reasons. For security sensitive randomness a crytographic randomness generator that provides sufficient entropy should be used. src/random_generator.cpp:404: Medium: initstate char * RandomGenerator::initstate(unsigned long seed, char *arg_state, long n) Standard random number generators should not be used to generate randomness used for security reasons. For security sensitive randomness a crytographic randomness generator that provides sufficient entropy should be used. src/random_generator.cpp:476: Medium: setstate char * RandomGenerator::setstate(char *arg_state) Standard random number generators should not be used to generate randomness used for security reasons. For security sensitive randomness a crytographic randomness generator that provides sufficient entropy should be used. Total lines analyzed: 43435 Total time 0.690439 seconds 62909 lines per second arvid@tux ~/src/supertux $