Entries in c database: 310


Analyzing ../../CarbonSndPlayDB.c
Analyzing ../../Ctrl.c
Analyzing ../../Ctrl_EditBox.c
Analyzing ../../Ctrl_PageViewer.c
Analyzing ../../Ctrl_ScrollBar.c
Analyzing ../../Ctrl_Tab.c
Analyzing ../../EX_FileList.c
Analyzing ../../EX_browser.c
Analyzing ../../EX_browser_net.c
Analyzing ../../EX_browser_ping.c
Analyzing ../../EX_browser_sources.c
Analyzing ../../auth.c
Analyzing ../../cd_linux.c
Analyzing ../../cd_null.c
Analyzing ../../cd_win.c
Analyzing ../../cl_cam.c
Analyzing ../../cl_cmd.c
Analyzing ../../cl_demo.c
Analyzing ../../cl_ents.c
Analyzing ../../cl_input.c
Analyzing ../../cl_main.c
Analyzing ../../cl_nqdemo.c
Analyzing ../../cl_parse.c
Analyzing ../../cl_pred.c
Analyzing ../../cl_screen.c
Analyzing ../../cl_slist.c
Analyzing ../../cl_tcl.c
Analyzing ../../cl_tent.c
Analyzing ../../cl_view.c
Analyzing ../../cmd.c
Analyzing ../../cmodel.c
Analyzing ../../collision.c
Analyzing ../../com_msg.c
Analyzing ../../common.c
Analyzing ../../common_draw.c
Analyzing ../../config_manager.c
Analyzing ../../console.c
Analyzing ../../cpu.c
Analyzing ../../crc.c
Analyzing ../../cvar.c
Analyzing ../../d_edge.c
Analyzing ../../d_fill.c
Analyzing ../../d_init.c
Analyzing ../../d_modech.c
Analyzing ../../d_part.c
Analyzing ../../d_polyse.c
Analyzing ../../d_scan.c
Analyzing ../../d_sky.c
Analyzing ../../d_sprite.c
Analyzing ../../d_surf.c
Analyzing ../../d_vars.c
Analyzing ../../d_zpoint.c
Analyzing ../../demo_controls.c
Analyzing ../../document_rendering.c
Analyzing ../../ez_button.c
Analyzing ../../ez_controls.c
Analyzing ../../ez_label.c
Analyzing ../../ez_scrollbar.c
Analyzing ../../ez_scrollpane.c
Analyzing ../../ez_slider.c
Analyzing ../../ez_window.c
Analyzing ../../fchecks.c
Analyzing ../../fmod.c
Analyzing ../../fragstats.c
Analyzing ../../fs.c
Analyzing ../../gl_bloom.c
Analyzing ../../gl_draw.c
Analyzing ../../gl_framebuffer.c
Analyzing ../../gl_md3.c
Analyzing ../../gl_mesh.c
Analyzing ../../gl_model.c
Analyzing ../../gl_ngraph.c
Analyzing ../../gl_refrag.c
Analyzing ../../gl_rlight.c
Analyzing ../../gl_rmain.c
Analyzing ../../gl_rmisc.c
Analyzing ../../gl_rpart.c
Analyzing ../../gl_rsurf.c
Analyzing ../../gl_texture.c
Analyzing ../../gl_warp.c
Analyzing ../../hash.c
Analyzing ../../help.c
Analyzing ../../help_files.c
Analyzing ../../host.c
Analyzing ../../hud.c
Analyzing ../../hud_common.c
Analyzing ../../hud_editor.c
Analyzing ../../ignore.c
Analyzing ../../image.c
Analyzing ../../in_linux.c
Analyzing ../../in_mac.c
Analyzing ../../in_win.c
Analyzing ../../keymap.c
Analyzing ../../keymap_x11.c
Analyzing ../../keys.c
Analyzing ../../linux_glimp.c
Analyzing ../../linux_signals.c
Analyzing ../../localtime.c
Analyzing ../../localtime_linux.c
Analyzing ../../localtime_win.c
Analyzing ../../logging.c
Analyzing ../../mac_prefs.c
Analyzing ../../match_tools.c
Analyzing ../../mathlib.c
Analyzing ../../md4.c
Analyzing ../../menu.c
Analyzing ../../menu_demo.c
Analyzing ../../menu_ingame.c
Analyzing ../../menu_mp3player.c
Analyzing ../../menu_multiplayer.c
Analyzing ../../menu_options.c
Analyzing ../../menu_proxy.c
Analyzing ../../modules.c
Analyzing ../../movie.c
Analyzing ../../movie_avi.c
Analyzing ../../mp3_audacious.c
Analyzing ../../mp3_mpd.c
Analyzing ../../mp3_player.c
Analyzing ../../mp3_winamp.c
Analyzing ../../mp3_xmms.c
Analyzing ../../mp3_xmms2.c
Analyzing ../../mvd_autotrack.c
Analyzing ../../mvd_utils.c
Analyzing ../../mvd_xmlstats.c
Analyzing ../../net.c
Analyzing ../../net_chan.c
Analyzing ../../parser.c
Analyzing ../../pmove.c
Analyzing ../../pmovetst.c
Analyzing ../../pr_cmds.c
Analyzing ../../pr_edict.c
Analyzing ../../pr_exec.c
Analyzing ../../q_shared.c
Analyzing ../../qtv.c
Analyzing ../../r_aclip.c
Analyzing ../../r_alias.c
Analyzing ../../r_bsp.c
Analyzing ../../r_draw.c
Analyzing ../../r_edge.c
Analyzing ../../r_efrag.c
Analyzing ../../r_light.c
Analyzing ../../r_main.c
Analyzing ../../r_misc.c
Analyzing ../../r_model.c
Analyzing ../../r_part.c
Analyzing ../../r_rast.c
Analyzing ../../r_sky.c
Analyzing ../../r_sprite.c
Analyzing ../../r_surf.c
Analyzing ../../r_vars.c
Analyzing ../../rulesets.c
Analyzing ../../sbar.c
Analyzing ../../settings_page.c
Analyzing ../../sha1.c
Analyzing ../../skin.c
Analyzing ../../snd_alsa.c
Analyzing ../../snd_dma.c
Analyzing ../../snd_linux.c
Analyzing ../../snd_mac.c
Analyzing ../../snd_mem.c
Analyzing ../../snd_mix.c
Analyzing ../../snd_oss.c
Analyzing ../../snd_ov.c
Analyzing ../../snd_win.c
Analyzing ../../stats_grid.c
Analyzing ../../sv_ccmds.c
Analyzing ../../sv_ents.c
Analyzing ../../sv_init.c
Analyzing ../../sv_main.c
Analyzing ../../sv_master.c
Analyzing ../../sv_move.c
Analyzing ../../sv_nchan.c
Analyzing ../../sv_null.c
Analyzing ../../sv_phys.c
Analyzing ../../sv_save.c
Analyzing ../../sv_send.c
Analyzing ../../sv_sys_unix.c
Analyzing ../../sv_sys_win.c
Analyzing ../../sv_user.c
Analyzing ../../sv_world.c
Analyzing ../../sys_linux.c
Analyzing ../../sys_mac.c
Analyzing ../../sys_win.c
Analyzing ../../teamplay.c
Analyzing ../../textencoding.c
Analyzing ../../tp_msgs.c
Analyzing ../../tp_triggers.c
Analyzing ../../tr_init.c
Analyzing ../../utils.c
Analyzing ../../version.c
Analyzing ../../vfs_doomwad.c
Analyzing ../../vfs_gzip.c
Analyzing ../../vfs_mmap.c
Analyzing ../../vfs_os.c
Analyzing ../../vfs_pak.c
Analyzing ../../vfs_tar.c
Analyzing ../../vfs_tcp.c
Analyzing ../../vfs_zip.c
Analyzing ../../vid_common_gl.c
Analyzing ../../vid_glx.c
Analyzing ../../vid_mac.c
Analyzing ../../vid_svgalib.c
Analyzing ../../vid_wgl.c
Analyzing ../../vid_win.c
Analyzing ../../vid_x11.c
Analyzing ../../vx_camera.c
Analyzing ../../vx_coronas.c
Analyzing ../../vx_motiontrail.c
Analyzing ../../vx_stuff.c
Analyzing ../../vx_tracker.c
Analyzing ../../vx_vertexlights.c
Analyzing ../../wad.c
Analyzing ../../win_glimp.c
Analyzing ../../win_wndproc.c
Analyzing ../../xsd.c
Analyzing ../../xsd_command.c
Analyzing ../../xsd_document.c
Analyzing ../../xsd_variable.c
Analyzing ../../zone.c
Analyzing ../../zone2.c

RATS results.


Severity: High
Issue: fixed size global buffer
Extra care should be taken to ensure that character arrays that are allocated on the stack are used safely. They are prime targets for buffer overflow attacks.
Severity: High
Issue: fscanf
Check to be sure that the format string passed as argument 2 to this function call does not come from an untrusted source that could have added formatting characters that the code is not prepared to handle. Additionally, the format string could contain `%s' without precision that could result in a buffer overflow.
Severity: High
Issue: CreateProcess
Many program execution commands under Windows will search the path for a program if you do not explicitly specify a full path to the file. This can allow trojans to be executed instead. Also, be sure to specify a file extension, since otherwise multiple extensions will be tried by the operating system, providing another opportunity for trojans.
Severity: High
Issue: CreateProcess
Argument 3 to this function call should be checked to ensure that it does not come from an untrusted source without first verifying that it contains nothing dangerous.
Severity: High
Issue: strcpy
Check to be sure that argument 2 passed to this function call will not copy more data than can be handled, resulting in a buffer overflow.
Severity: High
Issue: gethostbyname
DNS results can easily be forged by an attacker (or arbitrarily set to large values, etc), and should not be trusted.
Severity: High
Issue: gethostbyaddr
DNS results can easily be forged by an attacker (or arbitrarily set to large values, etc), and should not be trusted.
Severity: High
Issue: GetTempPath
GetTempPath() may return the current directory or the windows directory. Be careful what you place in these locations. Important files may be overwritten, and trojan DLL's may be dropped in these locations. Never use a user-input filename when writing to a location given by GetTempPath().
Severity: High
Issue: getenv
Environment variables are highly untrustable input. They may be of any length, and contain any data. Do not make any assumptions regarding content or length. If at all possible avoid using them, and if it is necessary, sanitize them and truncate them to a reasonable length.
Severity: High
Issue: fprintf
Check to be sure that the non-constant format string passed as argument 2 to this function call does not come from an untrusted source that could have added formatting characters that the code is not prepared to handle.
Severity: High
Issue: LoadLibrary
LoadLibrary will search several places for a library if no path is specified, allowing trojan DLL's to be inserted elsewhere even if the intended DLL is correctly protected from overwriting. Make sure to specify the full path.
Severity: High
Issue: vprintf
Check to be sure that the non-constant format string passed as argument 1 to this function call does not come from an untrusted source that could have added formatting characters that the code is not prepared to handle.
Severity: High
Issue: realpath
Be sure the destination buffer is at least MAXPATHLEN big. This function may still internally overflow a static buffer, try to avoid using it. If you must, check the size the path your pass in is no longer than MAXPATHLEN
Severity: High
Issue: umask
umask() can easily be used to create files with unsafe priviledges. It should be set to restrictive values.
Severity: High
Issue: vsprintf
Check to be sure that the non-constant format string passed as argument 2 to this function call does not come from an untrusted source that could have added formatting characters that the code is not prepared to handle.
Severity: High
Issue: vsprintf
Check to be sure that the format string passed as argument 2 to this function call does not come from an untrusted source that could have added formatting characters that the code is not prepared to handle. Additionally, the format string could contain `%s' without precision that could result in a buffer overflow.
Severity: High
Issue: strcat
Check to be sure that argument 2 passed to this function call will not copy more data than can be handled, resulting in a buffer overflow.
Severity: High
Issue: sprintf
Check to be sure that the format string passed as argument 2 to this function call does not come from an untrusted source that could have added formatting characters that the code is not prepared to handle. Additionally, the format string could contain `%s' without precision that could result in a buffer overflow.
Severity: Medium
Issue: getc
Check buffer boundaries if calling this function in a loop and make sure you are not in danger of writing past the allocated space.
Severity: Medium
Issue: GetTempFileName
Many calls for generating temporary file names are insecure (susceptible to race conditions). Use a securely generated file name, for example, by pulling 64 bits of randomness from /dev/random, base 64 encoding it and using that as a file suffix.
Severity: Medium
Issue: tempnam
Many calls for generating temporary file names are insecure (susceptible to race conditions). Use a securely generated file name, for example, by pulling 64 bits of randomness from /dev/random, base 64 encoding it and using that as a file suffix.
Severity: Medium
Issue: fgetc
Check buffer boundaries if calling this function in a loop and make sure you are not in danger of writing past the allocated space.
Severity: Medium
Issue: read
Check buffer boundaries if calling this function in a loop and make sure you are not in danger of writing past the allocated space.
Severity: Medium
Issue: signal
When setting signal handlers, do not use the same function to handle multiple signals. There exists the possibility a race condition will result if 2 or more different signals are sent to the process at nearly the same time. Also, when writing signal handlers, it is best to do as little as possible in them. The best strategy is to use the signal handler to set a flag, that another part of the program tests and performs the appropriate action(s) when it is set. See also: http://razor.bindview.com/publish/papers/signals.txt
Severity: Medium
Issue: srand
Standard random number generators should not be used to generate randomness used for security reasons. For security sensitive randomness a crytographic randomness generator that provides sufficient entropy should be used.
Severity: Medium
Issue: realloc
Don't use on memory intended to be secure, because the old structure will not be zeroed out.
Severity: Medium
Issue: getlogin
The results of this call are easy to forge.
Severity: Medium
Issue: stat
A potential TOCTOU (Time Of Check, Time Of Use) vulnerability exists. This is the first line where a check has occured. The following line(s) contain uses that may match up with this check: 132 (open) , 147 (open) , 189 (mkdir)
Severity: Medium
Issue: tmpfile
Many calls for generating temporary file names are insecure (susceptible to race conditions). Use a securely generated file name, for example, by pulling 64 bits of randomness from /dev/random, base 64 encoding it and using that as a file suffix.
Severity: Medium
Issue: random
Standard random number generators should not be used to generate randomness used for security reasons. For security sensitive randomness a crytographic randomness generator that provides sufficient entropy should be used.
Severity: Medium
Issue: srandom
Standard random number generators should not be used to generate randomness used for security reasons. For security sensitive randomness a crytographic randomness generator that provides sufficient entropy should be used.

Inputs detected at the following points



Total lines analyzed: 181957
Total time 0.000000 seconds
0 lines per second