[*] Binary protection state of ubcfg
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/FUN_00400b3c_00400b3c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
14 - iVar2 = strncmp((char *)piVar3[1],param_2,(size_t)(pcVar1 + (1 - (int)param_2)))
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/FUN_00400a28_00400a28.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
11 - puVar1 = (undefined4 *)malloc(8)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/FUN_00400a28_00400a28.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
11 - puVar1 = (undefined4 *)malloc(8); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/FUN_00400a28_00400a28.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-unchecked-ret-malloc
Issue description:
The software does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
26 - pcVar5 = strdup(param_2)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
22 - memset(local_128 + 2,0,0xfd)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
51 - memset(local_128,0,0xff)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
55 - strncpy(local_128,pcVar6,sVar3)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-unterminated-string-strncpy
Issue description:
If there is no NUL character byte in the first n bytes of the source string, strncpy() and stpncpy() do not NUL-terminate the destination buffer. If the program does not explicitly terminate the destination buffer, this will almost certainly result in information disclosure, and possibly a buffer overflow condition.
55 - strncpy(local_128,pcVar6,sVar3); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
56 - strcat(local_128,"=")
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
84 - pcVar6 = (char *)fopen("/dev/mtdblock/4","r")
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
89 - memset(&env_buf,0,0x3ffc)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
90 - sVar3 = fread(&env_buf,0x3ffc,1,(FILE *)pcVar6)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
90 - sVar3 = fread(&env_buf,0x3ffc,1,(FILE *)pcVar6); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
90 - sVar3 = fread(&env_buf,0x3ffc,1,(FILE *)pcVar6); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
98 - sVar3 = strlen(&DAT_004120f4 + iVar2)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
101 - iVar2 = iVar2 + sVar3 + 1
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-unchecked-ret-malloc
Issue description:
The software does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
122 - pcVar6 = strdup(pcVar6)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
177 - memset(&env_buf,0,0x3ffc)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
182 - strncpy(&DAT_004120f4 + iVar2,pcVar6,sVar3 + 1)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-unterminated-string-strncpy
Issue description:
If there is no NUL character byte in the first n bytes of the source string, strncpy() and stpncpy() do not NUL-terminate the destination buffer. If the program does not explicitly terminate the destination buffer, this will almost certainly result in information disclosure, and possibly a buffer overflow condition.
182 - strncpy(&DAT_004120f4 + iVar2,pcVar6,sVar3 + 1); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
183 - sVar3 = strlen((char *)puVar8[1])
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
184 - iVar2 = sVar3 + 1 + iVar2
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
187 - __s = fopen("/dev/mtdblock/4","w")
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
192 - sVar3 = fwrite(&env_buf,0x3ffc,1,__s)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/FUN_00400a28_00400a28.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
11 - puVar1 = (undefined4 *)malloc(8)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/FUN_00400a28_00400a28.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
11 - puVar1 = (undefined4 *)malloc(8); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/FUN_00400a28_00400a28.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-unchecked-ret-malloc
Issue description:
The software does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
26 - pcVar5 = strdup(param_2)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/FUN_00400b3c_00400b3c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
14 - iVar2 = strncmp((char *)piVar3[1],param_2,(size_t)(pcVar1 + (1 - (int)param_2)))
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
22 - memset(local_128 + 2,0,0xfd)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
51 - memset(local_128,0,0xff)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
55 - strncpy(local_128,pcVar6,sVar3)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-unterminated-string-strncpy
Issue description:
If there is no NUL character byte in the first n bytes of the source string, strncpy() and stpncpy() do not NUL-terminate the destination buffer. If the program does not explicitly terminate the destination buffer, this will almost certainly result in information disclosure, and possibly a buffer overflow condition.
55 - strncpy(local_128,pcVar6,sVar3); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
56 - strcat(local_128,"=")
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
84 - pcVar6 = (char *)fopen("/dev/mtdblock/4","r")
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
89 - memset(&env_buf,0,0x3ffc)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
90 - sVar3 = fread(&env_buf,0x3ffc,1,(FILE *)pcVar6)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
90 - sVar3 = fread(&env_buf,0x3ffc,1,(FILE *)pcVar6); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
90 - sVar3 = fread(&env_buf,0x3ffc,1,(FILE *)pcVar6); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
98 - sVar3 = strlen(&DAT_004120f4 + iVar2)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
101 - iVar2 = iVar2 + sVar3 + 1
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-unchecked-ret-malloc
Issue description:
The software does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
122 - pcVar6 = strdup(pcVar6)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
177 - memset(&env_buf,0,0x3ffc)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
182 - strncpy(&DAT_004120f4 + iVar2,pcVar6,sVar3 + 1)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-unterminated-string-strncpy
Issue description:
If there is no NUL character byte in the first n bytes of the source string, strncpy() and stpncpy() do not NUL-terminate the destination buffer. If the program does not explicitly terminate the destination buffer, this will almost certainly result in information disclosure, and possibly a buffer overflow condition.
182 - strncpy(&DAT_004120f4 + iVar2,pcVar6,sVar3 + 1); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
183 - sVar3 = strlen((char *)puVar8[1])
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
184 - iVar2 = sVar3 + 1 + iVar2
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
187 - __s = fopen("/dev/mtdblock/4","w")
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_ubcfg/main_00400bd8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
192 - sVar3 = fwrite(&env_buf,0x3ffc,1,__s)
