[*] Binary protection state of sw_tcpip.ko
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled REL No RPATH No RUNPATH Symbols
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/printsrdsentry_from123_00010710.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-format-string-bugs
Issue description:
The software uses a function that accepts a format string as an argument, but the format string originates from an external source. This can lead to buffer overflows, denial of service, or data representation problems.
18 - printk(&_LC9)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/fastnathash_proc_read_00010a58.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-format-string-bugs
Issue description:
The software uses a function that accepts a format string as an argument, but the format string originates from an external source. This can lead to buffer overflows, denial of service, or data representation problems.
16 - printk(&_LC15)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/fastnathash_proc_read_00010a58.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-format-string-bugs
Issue description:
The software uses a function that accepts a format string as an argument, but the format string originates from an external source. This can lead to buffer overflows, denial of service, or data representation problems.
27 - printk(puVar2)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/fastnathash_proc_read_00010a58.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-format-string-bugs
Issue description:
The software uses a function that accepts a format string as an argument, but the format string originates from an external source. This can lead to buffer overflows, denial of service, or data representation problems.
33 - printk(&_LC9)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_alloc_entry_00011360.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
7 - __s = (void *)kmem_cache_alloc(sw_turbo_net_cache,0x20)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_alloc_entry_00011360.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
12 - memset(__s,0,4)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/init_module_00011cbc.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
19 - proc_mkdir("fastnat",0)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_init_autoqos_00011a84.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
8 - __s = (undefined4 *)kmem_cache_alloc(0x1d324,0xd0)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_init_autoqos_00011a84.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
10 - memset(__s,0,0x10)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_init_forskip_000119c8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
8 - __s = (void *)kmem_cache_alloc(0x1d324,0xd0)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_init_forskip_000119c8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
10 - memset(__s,0,0x34)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_init_formqos_00011c00.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
8 - __s = (void *)kmem_cache_alloc(0x1d3e4,0xd0)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_init_formqos_00011c00.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
10 - memset(__s,0,0x11c)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_add_NAT_entry_0001191c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
37 - cVar10 = *(char *)(param_1 + 0x32)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_add_NAT_entry_0001191c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
128 - sVar3 = *(short *)((int)piVar6 + 0x3e)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_add_NAT_entry_0001191c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
184 - cVar10 = *(char *)((int)piVar6 + 0x49)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_write_forskip_00011ed4.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
20 - iVar1 = sscanf(param_2,"%d-%d")
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_conntrack_setup_000113d4.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
25 - cVar8 = *(char *)(param_1 + 0x32)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_conntrack_setup_000113d4.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
150 - sVar3 = *(short *)((int)piVar15 + 0x3e)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_conntrack_setup_000113d4.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
206 - cVar8 = *(char *)((int)piVar15 + 0x49)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/write_proc_mingone_00011e3c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
5 - sscanf(param_2,"%d")
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/write_proc_mingone_00011e3c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-unchecked-ret-scanf
Issue description:
The software does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
5 - sscanf(param_2,"%d"); //possible issue identified - semgrep
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_write_autoqos_00011fd4.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
20 - iVar1 = sscanf(param_2,"%d %d %d",&local_20,&local_1c,local_18)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_write_formqos_00012098.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
29 - &local_20,&local_1c,local_18), iVar1 == 7)) && (-1 < local_30)) &&
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/read_proc_mingone_0001221c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
8 - iVar1 = sprintf(param_1,"%d
")
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_read_forskip_0001226c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
15 - iVar2 = sprintf(__s,"%d-%d
")
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_read_forskip_0001226c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-pointer-subtraction
Issue description:
The software subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.
19 - return (int)__s - (int)param_1
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/cleanup_module_000125b8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
29 - proc_cleanup_system()
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_read_formqos_000123b4.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
27 - (uint)*(ushort *)(iVar5 + 0xd4),(uint)*(ushort *)(iVar5 + 0x98))
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_read_formqos_000123b4.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-pointer-subtraction
Issue description:
The software subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.
33 - return (int)__s - (int)param_1
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_read_autoqos_0001231c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
10 - iVar1 = sprintf(param_1,"%d
")
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_read_autoqos_0001231c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
12 - iVar1 = sprintf(__s,"upbwK=%d
")
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_read_autoqos_0001231c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
13 - iVar2 = sprintf(__s + iVar1,"downbwK=%d
")
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/blacklist_init_000126f0.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
8 - piVar1 = (int *)kmem_cache_alloc(0x1d324,0xd0)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/blacklist_init_000126f0.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
17 - iVar2 = __kmalloc(param_1 * 0x14,0xd0)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/blacklist_init_000126f0.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
31 - memset((void *)*piVar1,0,param_1 * 0x14)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
104 - sVar4 = *(short *)(iVar9 + 0x16)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
105 - sVar3 = *(short *)(iVar9 + 0x14)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
114 - sVar3 = *(short *)(*(int *)(param_1 + 0x9c) + 0x14)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
115 - sVar4 = *(short *)(*(int *)(param_1 + 0x9c) + 0x16)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-format-string-bugs
Issue description:
The software uses a function that accepts a format string as an argument, but the format string originates from an external source. This can lead to buffer overflows, denial of service, or data representation problems.
212 - printk(&_LC47)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-format-string-bugs
Issue description:
The software uses a function that accepts a format string as an argument, but the format string originates from an external source. This can lead to buffer overflows, denial of service, or data representation problems.
228 - printk(&_LC48)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-format-string-bugs
Issue description:
The software uses a function that accepts a format string as an argument, but the format string originates from an external source. This can lead to buffer overflows, denial of service, or data representation problems.
391 - printk(&_LC51)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-format-string-bugs
Issue description:
The software uses a function that accepts a format string as an argument, but the format string originates from an external source. This can lead to buffer overflows, denial of service, or data representation problems.
403 - printk(&_LC52)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
528 - memcpy(puVar23 + 0xb,(void *)(iVar20 + 0x24),(uint)*(byte *)(*(int *)(iVar20 + 0xc) + 0xfc))
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
533 - memcpy(puVar23 + 0xb,(void *)(iVar21 + 0x14),0x10)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
676 - sVar4 = *(short *)((int)puVar23 + 0x46)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
679 - sVar4 = *(short *)((int)puVar23 + 0x46)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
706 - memcpy((void *)(*(int *)(param_1 + 0x9c) + -0x10),puVar23 + 0xb,0x10)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
713 - cVar13 = *(char *)((int)puVar23 + 0x49)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
718 - cVar13 = *(char *)((int)puVar23 + 0x49)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/blacklist_init_000126f0.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
8 - piVar1 = (int *)kmem_cache_alloc(0x1d324,0xd0)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/blacklist_init_000126f0.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
17 - iVar2 = __kmalloc(param_1 * 0x14,0xd0)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/blacklist_init_000126f0.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
31 - memset((void *)*piVar1,0,param_1 * 0x14)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/cleanup_module_000125b8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
29 - proc_cleanup_system()
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/fastnathash_proc_read_00010a58.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-format-string-bugs
Issue description:
The software uses a function that accepts a format string as an argument, but the format string originates from an external source. This can lead to buffer overflows, denial of service, or data representation problems.
16 - printk(&_LC15)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/fastnathash_proc_read_00010a58.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-format-string-bugs
Issue description:
The software uses a function that accepts a format string as an argument, but the format string originates from an external source. This can lead to buffer overflows, denial of service, or data representation problems.
27 - printk(puVar2)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/fastnathash_proc_read_00010a58.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-format-string-bugs
Issue description:
The software uses a function that accepts a format string as an argument, but the format string originates from an external source. This can lead to buffer overflows, denial of service, or data representation problems.
33 - printk(&_LC9)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/init_module_00011cbc.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
19 - proc_mkdir("fastnat",0)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/printsrdsentry_from123_00010710.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-format-string-bugs
Issue description:
The software uses a function that accepts a format string as an argument, but the format string originates from an external source. This can lead to buffer overflows, denial of service, or data representation problems.
18 - printk(&_LC9)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_init_autoqos_00011a84.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
8 - __s = (undefined4 *)kmem_cache_alloc(0x1d324,0xd0)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_init_autoqos_00011a84.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
10 - memset(__s,0,0x10)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_init_formqos_00011c00.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
8 - __s = (void *)kmem_cache_alloc(0x1d3e4,0xd0)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_init_formqos_00011c00.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
10 - memset(__s,0,0x11c)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_init_forskip_000119c8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
8 - __s = (void *)kmem_cache_alloc(0x1d324,0xd0)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_init_forskip_000119c8.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
10 - memset(__s,0,0x34)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_read_autoqos_0001231c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
10 - iVar1 = sprintf(param_1,"%d
")
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_read_autoqos_0001231c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
12 - iVar1 = sprintf(__s,"upbwK=%d
")
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_read_autoqos_0001231c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
13 - iVar2 = sprintf(__s + iVar1,"downbwK=%d
")
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_read_formqos_000123b4.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
27 - (uint)*(ushort *)(iVar5 + 0xd4),(uint)*(ushort *)(iVar5 + 0x98))
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_read_formqos_000123b4.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-pointer-subtraction
Issue description:
The software subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.
33 - return (int)__s - (int)param_1
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_read_forskip_0001226c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
15 - iVar2 = sprintf(__s,"%d-%d
")
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_read_forskip_0001226c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-pointer-subtraction
Issue description:
The software subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.
19 - return (int)__s - (int)param_1
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_write_autoqos_00011fd4.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
20 - iVar1 = sscanf(param_2,"%d %d %d",&local_20,&local_1c,local_18)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_write_formqos_00012098.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
29 - &local_20,&local_1c,local_18), iVar1 == 7)) && (-1 < local_30)) &&
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/proc_write_forskip_00011ed4.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
20 - iVar1 = sscanf(param_2,"%d-%d")
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/read_proc_mingone_0001221c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
8 - iVar1 = sprintf(param_1,"%d
")
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_add_NAT_entry_0001191c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
37 - cVar10 = *(char *)(param_1 + 0x32)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_add_NAT_entry_0001191c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
128 - sVar3 = *(short *)((int)piVar6 + 0x3e)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_add_NAT_entry_0001191c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
184 - cVar10 = *(char *)((int)piVar6 + 0x49)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_alloc_entry_00011360.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
7 - __s = (void *)kmem_cache_alloc(sw_turbo_net_cache,0x20)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_alloc_entry_00011360.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
12 - memset(__s,0,4)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_conntrack_setup_000113d4.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
25 - cVar8 = *(char *)(param_1 + 0x32)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_conntrack_setup_000113d4.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
150 - sVar3 = *(short *)((int)piVar15 + 0x3e)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_conntrack_setup_000113d4.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
206 - cVar8 = *(char *)((int)piVar15 + 0x49)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
104 - sVar4 = *(short *)(iVar9 + 0x16)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
105 - sVar3 = *(short *)(iVar9 + 0x14)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
114 - sVar3 = *(short *)(*(int *)(param_1 + 0x9c) + 0x14)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
115 - sVar4 = *(short *)(*(int *)(param_1 + 0x9c) + 0x16)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-format-string-bugs
Issue description:
The software uses a function that accepts a format string as an argument, but the format string originates from an external source. This can lead to buffer overflows, denial of service, or data representation problems.
212 - printk(&_LC47)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-format-string-bugs
Issue description:
The software uses a function that accepts a format string as an argument, but the format string originates from an external source. This can lead to buffer overflows, denial of service, or data representation problems.
228 - printk(&_LC48)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-format-string-bugs
Issue description:
The software uses a function that accepts a format string as an argument, but the format string originates from an external source. This can lead to buffer overflows, denial of service, or data representation problems.
391 - printk(&_LC51)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-format-string-bugs
Issue description:
The software uses a function that accepts a format string as an argument, but the format string originates from an external source. This can lead to buffer overflows, denial of service, or data representation problems.
403 - printk(&_LC52)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
528 - memcpy(puVar23 + 0xb,(void *)(iVar20 + 0x24),(uint)*(byte *)(*(int *)(iVar20 + 0xc) + 0xfc))
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
533 - memcpy(puVar23 + 0xb,(void *)(iVar21 + 0x14),0x10)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
676 - sVar4 = *(short *)((int)puVar23 + 0x46)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
679 - sVar4 = *(short *)((int)puVar23 + 0x46)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-signed-unsigned-conversion
Issue description:
The software uses a signed primitive and performs a cast to an unsigned primitive, or uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value. When the result of a function is to be used as a size parameter, using negative return values can have unexpected results. Although less frequent an issue, unsigned-to-signed conversion can be the precursor to buffer underwrite conditions. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
706 - memcpy((void *)(*(int *)(param_1 + 0x9c) + -0x10),puVar23 + 0xb,0x10)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
713 - cVar13 = *(char *)((int)puVar23 + 0x49)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/sw_net_rx_action_00012810.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-integer-truncation
Issue description:
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.
718 - cVar13 = *(char *)((int)puVar23 + 0x49)
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/write_proc_mingone_00011e3c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-interesting-api-calls
Issue description:
Locate all calls to interesting and potentially insecure API functions (candidate points). The auditor can backtrace from these candidate points to find pathways allowing access from untrusted input.
5 - sscanf(param_2,"%d")
[+] Identified source function: /logs/s16_ghidra_decompile_checks/haruspex_sw_tcpip.ko/write_proc_mingone_00011e3c.c
Semgrep rule: external.semgrep-rules-0xdea.rules.c.raptor-unchecked-ret-scanf
Issue description:
The software does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
5 - sscanf(param_2,"%d"); //possible issue identified - semgrep
