[*] Binary protection state of ubcom
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00400e4c_00400e4c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
37 - memset(&local_48,0,0x10)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00400e4c_00400e4c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
41 - memcpy(local_48.sa_data + 2,*phVar1->h_addr_list,4)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00400e4c_00400e4c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
46 - memset(auStack_680,0,0x600)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401530_00401530.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
39 - memset(&local_58,0,0x10)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401530_00401530.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
43 - memcpy(local_58.sa_data + 2,*phVar2->h_addr_list,4)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401530_00401530.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
48 - memset(&uStack_688,0,0x600)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401530_00401530.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-insecure-api-signal
Issue description:
The signal() API should be regarded as deprecated. When possible, sigaction() should be used instead, because it allows to precisely specify the desired behavior in case two signals arrive shortly after each other thus preventing many race conditions.
59 - signal(0xe,FUN_00401500)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401d40_00401d40.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
49 - memset(&local_d8,0,0x10)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401d40_00401d40.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
57 - memcpy(local_d8.sa_data + 2,*phVar5->h_addr_list,4)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401d40_00401d40.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
62 - memset(&uStack_728,0,0x600)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401d40_00401d40.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
71 - sVar6 = sendto(uVar3,&uStack_728,param_2,0,&local_d8,0x10)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401d40_00401d40.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-incorrect-unsigned-comparison
Issue description:
Checking if an unsigned variable is negative makes no sense and is usually a good indication that something is probably wrong with the code.
72 - if (((int)sVar6 < 0) || (sVar6 != param_2)) {
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401d40_00401d40.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-insecure-api-signal
Issue description:
The signal() API should be regarded as deprecated. When possible, sigaction() should be used instead, because it allows to precisely specify the desired behavior in case two signals arrive shortly after each other thus preventing many race conditions.
78 - signal(0xe,FUN_00401d10)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401d40_00401d40.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
94 - sVar8 = recvfrom(uVar3,&uStack_728,0x600,0,&sStack_40,local_30)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401d40_00401d40.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
94 - sVar8 = recvfrom(uVar3,&uStack_728,0x600,0,&sStack_40,local_30); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
58 - *(undefined4 *)(IPARRAY + iVar2 * 0x10 + 0xc))
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
63 - *(undefined4 *)(IPARRAY + iVar2 * 0x10 + 0xc))
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-insecure-api-strcpy-strcat
Issue description:
A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold, or when a program attempts to put data in a memory area outside of the boundaries of a buffer.
82 - strcpy(acStack_17c,IPTMP2)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
82 - strcpy(acStack_17c,IPTMP2); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-insecure-api-sprintf-vsprintf
Issue description:
A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold, or when a program attempts to put data in a memory area outside of the boundaries of a buffer.
91 - sprintf(acStack_118,"%s.1",acStack_17c)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
91 - sprintf(acStack_118,"%s.1",acStack_17c); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
127 - sprintf(acStack_b4,"rgdb -s /qos/bandwidth/upstream %i;submit QOS",local_10 >> 10)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
132 - sprintf(acStack_b4,"xmldbc -s /runtime/device/qos/bwup %i;service QOS restart",local_c >> 10)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-command-injection
Issue description:
The software constructs an OS command using externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command.
133 - system(acStack_b4)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
133 - system(acStack_b4); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
141 - scanf("%i",local_28)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-unchecked-ret-scanf
Issue description:
The software does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
141 - scanf("%i",local_28); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-insecure-api-strcpy-strcat
Issue description:
A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold, or when a program attempts to put data in a memory area outside of the boundaries of a buffer.
149 - strcpy(acStack_17c,IPTMP2)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
149 - strcpy(acStack_17c,IPTMP2); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-insecure-api-sprintf-vsprintf
Issue description:
A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold, or when a program attempts to put data in a memory area outside of the boundaries of a buffer.
158 - sprintf(acStack_118,"%s.1",acStack_17c)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
158 - sprintf(acStack_118,"%s.1",acStack_17c); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00400e4c_00400e4c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
37 - memset(&local_48,0,0x10)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00400e4c_00400e4c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
41 - memcpy(local_48.sa_data + 2,*phVar1->h_addr_list,4)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00400e4c_00400e4c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
46 - memset(auStack_680,0,0x600)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401530_00401530.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
39 - memset(&local_58,0,0x10)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401530_00401530.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
43 - memcpy(local_58.sa_data + 2,*phVar2->h_addr_list,4)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401530_00401530.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
48 - memset(&uStack_688,0,0x600)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401530_00401530.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-insecure-api-signal
Issue description:
The signal() API should be regarded as deprecated. When possible, sigaction() should be used instead, because it allows to precisely specify the desired behavior in case two signals arrive shortly after each other thus preventing many race conditions.
59 - signal(0xe,FUN_00401500)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401d40_00401d40.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
49 - memset(&local_d8,0,0x10)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401d40_00401d40.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
57 - memcpy(local_d8.sa_data + 2,*phVar5->h_addr_list,4)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401d40_00401d40.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
62 - memset(&uStack_728,0,0x600)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401d40_00401d40.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
71 - sVar6 = sendto(uVar3,&uStack_728,param_2,0,&local_d8,0x10)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401d40_00401d40.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-incorrect-unsigned-comparison
Issue description:
Checking if an unsigned variable is negative makes no sense and is usually a good indication that something is probably wrong with the code.
72 - if (((int)sVar6 < 0) || (sVar6 != param_2)) {
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401d40_00401d40.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-insecure-api-signal
Issue description:
The signal() API should be regarded as deprecated. When possible, sigaction() should be used instead, because it allows to precisely specify the desired behavior in case two signals arrive shortly after each other thus preventing many race conditions.
78 - signal(0xe,FUN_00401d10)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401d40_00401d40.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
94 - sVar8 = recvfrom(uVar3,&uStack_728,0x600,0,&sStack_40,local_30)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/FUN_00401d40_00401d40.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
94 - sVar8 = recvfrom(uVar3,&uStack_728,0x600,0,&sStack_40,local_30); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
58 - *(undefined4 *)(IPARRAY + iVar2 * 0x10 + 0xc))
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
63 - *(undefined4 *)(IPARRAY + iVar2 * 0x10 + 0xc))
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-insecure-api-strcpy-strcat
Issue description:
A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold, or when a program attempts to put data in a memory area outside of the boundaries of a buffer.
82 - strcpy(acStack_17c,IPTMP2)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
82 - strcpy(acStack_17c,IPTMP2); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-insecure-api-sprintf-vsprintf
Issue description:
A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold, or when a program attempts to put data in a memory area outside of the boundaries of a buffer.
91 - sprintf(acStack_118,"%s.1",acStack_17c)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
91 - sprintf(acStack_118,"%s.1",acStack_17c); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
127 - sprintf(acStack_b4,"rgdb -s /qos/bandwidth/upstream %i;submit QOS",local_10 >> 10)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
132 - sprintf(acStack_b4,"xmldbc -s /runtime/device/qos/bwup %i;service QOS restart",local_c >> 10)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-command-injection
Issue description:
The software constructs an OS command using externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command.
133 - system(acStack_b4)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
133 - system(acStack_b4); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
141 - scanf("%i",local_28)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-unchecked-ret-scanf
Issue description:
The software does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
141 - scanf("%i",local_28); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-insecure-api-strcpy-strcat
Issue description:
A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold, or when a program attempts to put data in a memory area outside of the boundaries of a buffer.
149 - strcpy(acStack_17c,IPTMP2)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
149 - strcpy(acStack_17c,IPTMP2); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-insecure-api-sprintf-vsprintf
Issue description:
A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold, or when a program attempts to put data in a memory area outside of the boundaries of a buffer.
158 - sprintf(acStack_118,"%s.1",acStack_17c)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcom/main_00403240.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
158 - sprintf(acStack_118,"%s.1",acStack_17c); //possible issue identified - semgrep
