-
Notifications
You must be signed in to change notification settings - Fork 1
/
flawfinder.ps
executable file
·1815 lines (1815 loc) · 103 KB
/
flawfinder.ps
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
%!PS-Adobe-3.0
%%Creator: groff version 1.22.3
%%CreationDate: Mon Jan 21 18:35:31 2019
%%DocumentNeededResources: font Times-Roman
%%+ font Times-Bold
%%+ font Times-Italic
%%+ font Symbol
%%DocumentSuppliedResources: procset grops 1.22 3
%%Pages: 14
%%PageOrder: Ascend
%%DocumentMedia: Default 595 842 0 () ()
%%Orientation: Portrait
%%EndComments
%%BeginDefaults
%%PageMedia: Default
%%EndDefaults
%%BeginProlog
%%BeginResource: procset grops 1.22 3
%!PS-Adobe-3.0 Resource-ProcSet
/setpacking where{
pop
currentpacking
true setpacking
}if
/grops 120 dict dup begin
/SC 32 def
/A/show load def
/B{0 SC 3 -1 roll widthshow}bind def
/C{0 exch ashow}bind def
/D{0 exch 0 SC 5 2 roll awidthshow}bind def
/E{0 rmoveto show}bind def
/F{0 rmoveto 0 SC 3 -1 roll widthshow}bind def
/G{0 rmoveto 0 exch ashow}bind def
/H{0 rmoveto 0 exch 0 SC 5 2 roll awidthshow}bind def
/I{0 exch rmoveto show}bind def
/J{0 exch rmoveto 0 SC 3 -1 roll widthshow}bind def
/K{0 exch rmoveto 0 exch ashow}bind def
/L{0 exch rmoveto 0 exch 0 SC 5 2 roll awidthshow}bind def
/M{rmoveto show}bind def
/N{rmoveto 0 SC 3 -1 roll widthshow}bind def
/O{rmoveto 0 exch ashow}bind def
/P{rmoveto 0 exch 0 SC 5 2 roll awidthshow}bind def
/Q{moveto show}bind def
/R{moveto 0 SC 3 -1 roll widthshow}bind def
/S{moveto 0 exch ashow}bind def
/T{moveto 0 exch 0 SC 5 2 roll awidthshow}bind def
/SF{
findfont exch
[exch dup 0 exch 0 exch neg 0 0]makefont
dup setfont
[exch/setfont cvx]cvx bind def
}bind def
/MF{
findfont
[5 2 roll
0 3 1 roll
neg 0 0]makefont
dup setfont
[exch/setfont cvx]cvx bind def
}bind def
/level0 0 def
/RES 0 def
/PL 0 def
/LS 0 def
/MANUAL{
statusdict begin/manualfeed true store end
}bind def
/PLG{
gsave newpath clippath pathbbox grestore
exch pop add exch pop
}bind def
/BP{
/level0 save def
1 setlinecap
1 setlinejoin
DEFS/BPhook known{DEFS begin BPhook end}if
72 RES div dup scale
LS{
90 rotate
}{
0 PL translate
}ifelse
1 -1 scale
}bind def
/EP{
level0 restore
showpage
}def
/DA{
newpath arcn stroke
}bind def
/SN{
transform
.25 sub exch .25 sub exch
round .25 add exch round .25 add exch
itransform
}bind def
/DL{
SN
moveto
SN
lineto stroke
}bind def
/DC{
newpath 0 360 arc closepath
}bind def
/TM matrix def
/DE{
TM currentmatrix pop
translate scale newpath 0 0 .5 0 360 arc closepath
TM setmatrix
}bind def
/RC/rcurveto load def
/RL/rlineto load def
/ST/stroke load def
/MT/moveto load def
/CL/closepath load def
/Fr{
setrgbcolor fill
}bind def
/setcmykcolor where{
pop
/Fk{
setcmykcolor fill
}bind def
}if
/Fg{
setgray fill
}bind def
/FL/fill load def
/LW/setlinewidth load def
/Cr/setrgbcolor load def
/setcmykcolor where{
pop
/Ck/setcmykcolor load def
}if
/Cg/setgray load def
/RE{
findfont
dup maxlength 1 index/FontName known not{1 add}if dict begin
{
1 index/FID ne
2 index/UniqueID ne
and
{def}{pop pop}ifelse
}forall
/Encoding exch def
dup/FontName exch def
currentdict end definefont pop
}bind def
/DEFS 0 def
/EBEGIN{
moveto
DEFS begin
}bind def
/EEND/end load def
/CNT 0 def
/level1 0 def
/PBEGIN{
/level1 save def
translate
div 3 1 roll div exch scale
neg exch neg exch translate
0 setgray
0 setlinecap
1 setlinewidth
0 setlinejoin
10 setmiterlimit
[]0 setdash
/setstrokeadjust where{
pop
false setstrokeadjust
}if
/setoverprint where{
pop
false setoverprint
}if
newpath
/CNT countdictstack def
userdict begin
/showpage{}def
/setpagedevice{}def
mark
}bind def
/PEND{
cleartomark
countdictstack CNT sub{end}repeat
level1 restore
}bind def
end def
/setpacking where{
pop
setpacking
}if
%%EndResource
%%EndProlog
%%BeginSetup
%%BeginFeature: *PageSize Default
<< /PageSize [ 595 842 ] /ImagingBBox null >> setpagedevice
%%EndFeature
%%IncludeResource: font Times-Roman
%%IncludeResource: font Times-Bold
%%IncludeResource: font Times-Italic
%%IncludeResource: font Symbol
grops begin/DEFS 1 dict def DEFS begin/u{.001 mul}bind def end/RES 72
def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron
/Zcaron/scaron/zcaron/Ydieresis/trademark/quotesingle/Euro/.notdef
/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef
/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef
/.notdef/.notdef/.notdef/space/exclam/quotedbl/numbersign/dollar/percent
/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen
/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon
/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O
/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/circumflex
/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y
/z/braceleft/bar/braceright/tilde/.notdef/quotesinglbase/guillemotleft
/guillemotright/bullet/florin/fraction/perthousand/dagger/daggerdbl
/endash/emdash/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/hungarumlaut
/dotaccent/breve/caron/ring/ogonek/quotedblleft/quotedblright/oe/lslash
/quotedblbase/OE/Lslash/.notdef/exclamdown/cent/sterling/currency/yen
/brokenbar/section/dieresis/copyright/ordfeminine/guilsinglleft
/logicalnot/minus/registered/macron/degree/plusminus/twosuperior
/threesuperior/acute/mu/paragraph/periodcentered/cedilla/onesuperior
/ordmasculine/guilsinglright/onequarter/onehalf/threequarters
/questiondown/Agrave/Aacute/Acircumflex/Atilde/Adieresis/Aring/AE
/Ccedilla/Egrave/Eacute/Ecircumflex/Edieresis/Igrave/Iacute/Icircumflex
/Idieresis/Eth/Ntilde/Ograve/Oacute/Ocircumflex/Otilde/Odieresis
/multiply/Oslash/Ugrave/Uacute/Ucircumflex/Udieresis/Yacute/Thorn
/germandbls/agrave/aacute/acircumflex/atilde/adieresis/aring/ae/ccedilla
/egrave/eacute/ecircumflex/edieresis/igrave/iacute/icircumflex/idieresis
/eth/ntilde/ograve/oacute/ocircumflex/otilde/odieresis/divide/oslash
/ugrave/uacute/ucircumflex/udieresis/yacute/thorn/ydieresis]def
/Times-Italic@0 ENC0/Times-Italic RE/Times-Bold@0 ENC0/Times-Bold RE
/Times-Roman@0 ENC0/Times-Roman RE
%%EndSetup
%%Page: 1 1
%%BeginPageSetup
BP
%%EndPageSetup
/F0 10/Times-Roman@0 SF(FLA)72 48 Q 134.71(WFINDER\(1\) Fla)-.9 F 134.71
(w\214nder FLA)-.15 F(WFINDER\(1\))-.9 E/F1 10.95/Times-Bold@0 SF -.219
(NA)72 84 S(ME).219 E F0<8d61>108 96 Q(w\214nder \255 le)-.15 E
(xically \214nd potential security \215a)-.15 E
(ws \("hits"\) in source code)-.15 E F1(SYNOPSIS)72 112.8 Q/F2 10
/Times-Bold@0 SF(\215aw\214nder)108 124.8 Q F0([)2.5 E F2(\255\255help)A
F0(|)A F2<ad68>A F0 2.5(][)C F2<adad76>-2.5 E(ersion)-.1 E F0 2.5(][)C
F2(\255\255listrules)-2.5 E F0(])A([)108 136.8 Q F2(\255\255allo)A
(wlink)-.1 E F0 2.5(][)C F2<adad66>-2.5 E(ollo)-.25 E(wdotdir)-.1 E F0
2.5(][)C F2(\255\255nolink)-2.5 E F0(])A([)108 148.8 Q F2
(\255\255patch=)A/F3 10/Times-Italic@0 SF(\214lename)A F0(|)A F2<ad50>A
F3(\214lename)2.5 E F0(])A([)108 160.8 Q F2(\255\255inputs)A F0(|)A F2
<ad49>A F0 2.5(][)C F2(\255\255minle)A -.1(ve)-.15 G(l=).1 E F3(X)A F0
(|)2.5 E F2<ad6d>2.5 E F3(X)2.5 E F0 2.5(][)2.5 G F2
(\255\255falsepositi)-2.5 E -.1(ve)-.1 G F0(|).1 E F2<ad46>A F0(])A([)
108 172.8 Q F2<adad6e65>A -.1(ve)-.15 G(rignor).1 E(e)-.18 E F0(|)A F2
<ad6e>A F0(])A([)108 184.8 Q F2<adad72>A(egex=)-.18 E F3 -1.07 -.9(PA T)
D(TERN).9 E F0(|)2.5 E F2<ad65>2.5 E F3 -1.07 -.9(PA T)2.5 H(TERN).9 E
F0(])A([)108 196.8 Q F2(\255\255context)A F0(|)A F2<ad63>A F0 5.559(][)C
F2(\255\255columns)-5.559 E F0(|)A F2<ad43>A F0 5.559(][)C F2
<adad637376>-5.559 E F0 5.558(][)C F2(\255\255dataonly)-5.558 E F0(|)A
F2<ad44>A F0 5.558(][)C F2(\255\255html)-5.558 E F0(|)A F2<ad48>A F0
5.558(][)C F2(\255\255immediate)-5.558 E F0(|)A F2(-i)A F0 5.558(][)C F2
(\255\255single-)-5.558 E(line)108 208.8 Q F0(|)A F2<ad53>A F0 2.5(][)C
F2(\255\255omittime)-2.5 E F0 2.5(][)C F2(\255\255quiet)-2.5 E F0(|)A F2
<ad51>A F0 2.5(][)C F2<adad657272>-2.5 E(or)-.18 E(-le)-.37 E -.1(ve)
-.15 G(l=).1 E F0(LEVEL])A([)108 220.8 Q F2(\255\255loadhitlist=)A F3(F)
A F0 2.5(][)C F2<adad7361>-2.5 E -.1(ve)-.25 G(hitlist=).1 E F3(F)A F0
2.5(][)C F2(\255\255diffhitlist=)-2.5 E F3(F)A F0(])A([)108 232.8 Q F2
<adad>A F0(])A F3 2.5([s)2.79 G(our)-2.5 E(ce code \214le or sour)-.37 E
(ce r)-.37 E(oot dir)-.45 E(ectory ]+)-.37 E F1(DESCRIPTION)72 249.6 Q
F0(Fla)108 261.6 Q 1.383(w\214nder searches through C/C++ source code l\
ooking for potential security \215a)-.15 F 3.883(ws. T)-.15 F 3.883(or)
-.8 G 1.384(un \215a)-3.883 F(w\214nder)-.15 E(,)-.4 E .509(simply gi)
108 273.6 R .809 -.15(ve \215)-.25 H -.15(aw).15 G .509
(\214nder a list of directories or \214les.).15 F -.15(Fo)5.508 G 3.008
(re).15 G .508(ach directory gi)-3.008 F -.15(ve)-.25 G .508
(n, all \214les that ha).15 F .808 -.15(ve C)-.2 H .508(/C++ \214le-).15
F 1.347(name e)108 285.6 R 1.348
(xtensions in that directory \(and its subdirectories, recursi)-.15 F
-.15(ve)-.25 G 1.348(ly\) will be e).15 F 3.848(xamined. Thus,)-.15 F
1.348(for most)3.848 F 1.03(projects, simply gi)108 297.6 R 1.33 -.15
(ve \215)-.25 H -.15(aw).15 G 1.03
(\214nder the name of the source code').15 F 3.53(st)-.55 G 1.03
(opmost directory \(use `)-3.53 F(`.)-.74 E 2.51 -.74('' f)-.7 H 1.03
(or the current).74 F .23(directory\), and \215a)108 309.6 R .23
(w\214nder will e)-.15 F .231(xamine all of the project')-.15 F 2.731
(sC)-.55 G .231(/C++ source code.)-2.731 F(Fla)5.231 E .231
(w\214nder does)-.15 F F3(not)2.731 E F0(require)2.731 E .819
(that you be able to b)108 321.6 R .819(uild your softw)-.2 F .819
(are, so it can be used e)-.1 F -.15(ve)-.25 G 3.319(nw).15 G .819
(ith incomplete source code.)-3.319 F .819(If you only)5.819 F -.1(wa)
108 333.6 S .162(nt to ha).1 F -.15(ve)-.2 G F3 -.15(ch)2.812 G(ang).15
E(es)-.1 E F0(re)2.662 E(vie)-.25 E .162(wed, sa)-.25 F .462 -.15
(ve a u)-.2 H .163(ni\214ed dif).15 F 2.663(fo)-.25 G 2.663(ft)-2.663 G
.163(hose changes \(created by GNU "dif)-2.663 F 2.663(f-)-.25 G .163
(u" or "svn dif)-2.663 F(f")-.25 E(or "git dif)108 345.6 Q
(f"\) in a patch \214le and use the \255\255patch \(\255P\) option.)-.25
E(Fla)108 362.4 Q .864(w\214nder will produce a list of `)-.15 F(`hits')
-.74 E 3.364('\()-.74 G .864(potential security \215a)-3.364 F .863
(ws, also called \214ndings\), sorted by risk; the)-.15 F 1.04
(riskiest hits are sho)108 374.4 R 1.04(wn \214rst.)-.25 F 1.04
(The risk le)6.04 F -.15(ve)-.25 G 3.54(li).15 G 3.541(ss)-3.54 G(ho)
-3.541 E 1.041(wn inside square brack)-.25 F 1.041(ets and v)-.1 F 1.041
(aries from 0, v)-.25 F 1.041(ery little)-.15 F .033
(risk, to 5, great risk.)108 386.4 R .033(This risk le)5.033 F -.15(ve)
-.25 G 2.533(ld).15 G .032(epends not only on the function, b)-2.533 F
.032(ut on the v)-.2 F .032(alues of the parameters of)-.25 F .225
(the function.)108 398.4 R -.15(Fo)5.225 G 2.725(re).15 G .225
(xample, constant strings are often less risk)-2.875 F 2.725(yt)-.15 G
.225(han fully v)-2.725 F .225(ariable strings in man)-.25 F 2.725(yc)
-.15 G(onte)-2.725 E(xts,)-.15 E 1.707(and in those conte)108 410.4 R
1.707(xts the hit will ha)-.15 F 2.007 -.15(ve a l)-.2 H -.25(ow).15 G
1.707(er risk le).25 F -.15(ve)-.25 G 4.207(l. Fla).15 F 1.707
(w\214nder kno)-.15 F 1.707(ws about gette)-.25 F 1.707(xt \(a common)
-.15 F .327(library for internationalized programs\) and will treat con\
stant strings passed through gette)108 422.4 R .328(xt as though the)
-.15 F(y)-.15 E .641
(were constant strings; this reduces the number of f)108 434.4 R .641
(alse hits in internationalized programs.)-.1 F(Fla)5.64 E .64
(w\214nder will)-.15 F .063(do the same sort of thing with _T\(\) and _\
TEXT\(\), common Microsoft macros for handling internationalized)108
446.4 R 3.47(programs. Fla)108 458.4 R .969
(w\214nder correctly ignores te)-.15 F .969
(xt inside comments and strings.)-.15 F .969(Normally \215a)5.969 F .969
(w\214nder sho)-.15 F .969(ws all)-.25 F .33(hits with a risk le)108
470.4 R -.15(ve)-.25 G 2.83(lo).15 G 2.83(fa)-2.83 G 2.83(tl)-2.83 G .33
(east 1, b)-2.83 F .33(ut you can use the \255\255minle)-.2 F -.15(ve)
-.25 G 2.83(lo).15 G .33(ption to sho)-2.83 F 2.83(wo)-.25 G .33
(nly hits with higher risk)-2.83 F(le)108 482.4 Q -.15(ve)-.25 G .506
(ls if you wish.).15 F .506(Hit descriptions also note the rele)5.506 F
-.25(va)-.25 G .506(nt Common W).25 F .505
(eakness Enumeration \(CWE\) identi-)-.8 F .347
(\214er\(s\) in parentheses, as discussed belo)108 494.4 R 4.147 -.65
(w. F)-.25 H(la).65 E .348(w\214nder is of)-.15 F .348
(\214cially CWE-Compatible.)-.25 F .348(Hit descriptions with)5.348 F
2.501("[MS-banned]" indicate functions that are in the banned list of f\
unctions released by Microsoft; see)108 506.4 R(http://msdn.microsoft.c\
om/en-us/library/bb288454.aspx for more information about banned functi\
ons.)108 518.4 Q .271(Not e)108 535.2 R -.15(ve)-.25 G .272
(ry hit \(aka \214nding\) is actually a security vulnerability).15 F
2.772(,a)-.65 G .272(nd not e)-2.772 F -.15(ve)-.25 G .272
(ry security vulnerability is neces-).15 F 1.249(sarily found.)108 547.2
R(Ne)6.249 E -.15(ve)-.25 G 1.249(rtheless, \215a).15 F 1.249
(w\214nder can be an aid in \214nding and remo)-.15 F 1.248
(ving security vulnerabilities.)-.15 F(A)6.248 E .502(common w)108 559.2
R .502(ay to use \215a)-.1 F .502(w\214nder is to \214rst apply \215a)
-.15 F .503(w\214nder to a set of source code and e)-.15 F .503
(xamine the highest-)-.15 F .562(risk items.)108 571.2 R .561
(Then, use \255\255inputs to e)5.562 F .561
(xamine the input locations, and check to mak)-.15 F 3.061(es)-.1 G .561
(ure that only le)-3.061 F -.05(ga)-.15 G 3.061(la).05 G(nd)-3.061 E
(safe input v)108 583.2 Q(alues are accepted from untrusted users.)-.25
E .892(Once you')108 600 R 1.192 -.15(ve a)-.5 H .892(udited a program,\
you can mark source code lines that are actually \214ne b).15 F .893
(ut cause spurious)-.2 F -.1(wa)108 612 S .923(rnings so that \215a).1 F
.923(w\214nder will stop complaining about them.)-.15 F 2.523 -.8(To m)
5.923 H .923(ark a line so that these w).8 F .922(arnings are)-.1 F
1.398(suppressed, put a specially-formatted comment either on the same \
line \(after the source code\) or all by)108 624 R(itself in the pre)108
636 Q(vious line.)-.25 E(The comment must ha)5 E .3 -.15(ve o)-.2 H
(ne of the tw).15 E 2.5(of)-.1 G(ollo)-2.5 E(wing formats:)-.25 E<83>108
652.8 Q(// Fla)144 652.8 Q(w\214nder: ignore)-.15 E<83>108 669.6 Q
(/* Fla)144 669.6 Q(w\214nder: ignore */)-.15 E -.15(Fo)108 686.4 S
2.814(rc).15 G(ompatibility')-2.814 E 2.813(ss)-.55 G(ak)-2.813 E .313
(e, you can replace "Fla)-.1 F .313(w\214nder:" with "ITS4:" or "RA)-.15
F .313(TS:" in these specially-format-)-1.11 F .524(ted comments.)108
698.4 R .524(Since it')5.524 F 3.024(sp)-.55 G .524
(ossible that such lines are wrong, you can use the \255\255ne)-3.024 F
-.15(ve)-.25 G .525(rignore option, which).15 F .959(causes \215a)108
710.4 R .959(w\214nder to ne)-.15 F -.15(ve)-.25 G 3.459(ri).15 G .959
(gnore an)-3.459 F 3.459(yl)-.15 G .959
(ine no matter what the comment directi)-3.459 F -.15(ve)-.25 G 3.458
(ss).15 G .958(ay \(more confusingly)-3.458 F(,)-.65 E<adad6e65>108
722.4 Q -.15(ve)-.25 G(rignore ignores the ignores\).).15 E(Fla)72 768 Q
165.545(w\214nder 4)-.15 F(Apr 2018)2.5 E(1)206.225 E 0 Cg EP
%%Page: 2 2
%%BeginPageSetup
BP
%%EndPageSetup
/F0 10/Times-Roman@0 SF(FLA)72 48 Q 134.71(WFINDER\(1\) Fla)-.9 F 134.71
(w\214nder FLA)-.15 F(WFINDER\(1\))-.9 E(Fla)108 84 Q .701
(w\214nder uses an internal database called the `)-.15 F(`ruleset')-.74
E .702('; the ruleset identi\214es functions that are common)-.74 F
1.679(causes of security \215a)108 96 R 4.179(ws. The)-.15 F 1.679
(standard ruleset includes a lar)4.179 F 1.678(ge number of dif)-.18 F
1.678(ferent potential problems,)-.25 F .027
(including both general issues that can impact an)108 108 R 2.528(yC)
-.15 G .028(/C++ program, as well as a number of speci\214c Unix-lik)
-2.528 F(e)-.1 E 1.055(and W)108 120 R(indo)-.4 E 1.055
(ws functions that are especially problematic.)-.25 F 1.054
(The \255\255listrules option reports the list of current)6.054 F 1.074
(rules and their def)108 132 R 1.074(ault risk le)-.1 F -.15(ve)-.25 G
3.575(ls. As).15 F 1.075(noted abo)3.575 F -.15(ve)-.15 G 3.575(,e).15 G
-.15(ve)-3.825 G 1.075(ry potential security \215a).15 F 3.575(wf)-.15 G
1.075(ound in a gi)-3.575 F -.15(ve)-.25 G 3.575(ns).15 G(ource)-3.575 E
.401(code \214le \(matching an entry in the ruleset\) is called a `)108
144 R(`hit,)-.74 E 1.881 -.74('' a)-.7 H .401
(nd the set of hits found during an).74 F 2.901(yp)-.15 G(articular)
-2.901 E 1.288(run of the program is called the `)108 156 R(`hitlist.)
-.74 E 5.268 -.74('' H)-.7 H 1.288(itlists can be sa).74 F -.15(ve)-.2 G
3.788(d\().15 G 1.288(using \255\255sa)-3.788 F -.15(ve)-.2 G 1.289
(hitlist\), reloaded back for).15 F .965
(redisplay \(using \255\255loadhitlist\), and you can sho)108 168 R
3.465(wo)-.25 G .965(nly the hits that are dif)-3.465 F .965
(ferent from another run \(using)-.25 F<adad646966>108 180 Q
(fhitlist\).)-.25 E(Fla)108 196.8 Q .169
(w\214nder is a simple tool, leading to some fundamental pros and cons.)
-.15 F(Fla)5.169 E .169(w\214nder w)-.15 F .169(orks by doing simple)-.1
F(le)108 208.8 Q .235(xical tok)-.15 F .235
(enization \(skipping comments and correctly tok)-.1 F .235
(enizing strings\), looking for tok)-.1 F .234(en matches to the)-.1 F
.466(database \(particularly to \214nd function calls\).)108 220.8 R
(Fla)5.466 E .466(w\214nder is thus similar to RA)-.15 F .467
(TS and ITS4, which also use)-1.11 F .574(simple le)108 232.8 R .574
(xical tok)-.15 F 3.074(enization. Fla)-.1 F .574(w\214nder then e)-.15
F .574(xamines the te)-.15 F .573
(xt of the function parameters to estimate risk.)-.15 F(Unlik)108 244.8
Q 2.957(et)-.1 G .457(ools such as splint, gcc')-2.957 F 2.958(sw)-.55 G
.458(arning \215ags, and clang, \215a)-3.058 F .458(w\214nder does)-.15
F/F1 10/Times-Italic@0 SF(not)2.958 E F0 .458(use or ha)2.958 F .758
-.15(ve a)-.2 H .458(ccess to infor).15 F(-)-.2 E .053
(mation about control \215o)108 256.8 R 1.353 -.65(w, d)-.25 H .053
(ata \215o).65 F 1.353 -.65(w, o)-.25 H 2.553(rd).65 G .052
(ata types when searching for potential vulnerabilities or estimating)
-2.553 F .483(the le)108 268.8 R -.15(ve)-.25 G 2.983(lo).15 G 2.983(fr)
-2.983 G 2.983(isk. Thus,)-2.983 F<8d61>2.983 E .483
(w\214nder will necessarily produce man)-.15 F 2.983(yf)-.15 G .484
(alse positi)-3.083 F -.15(ve)-.25 G 2.984(sf).15 G .484
(or vulnerabilities and f)-2.984 F(ail)-.1 E .454(to report man)108
280.8 R 2.954(yv)-.15 G 2.954(ulnerabilities. On)-2.954 F .453
(the other hand, \215a)2.954 F .453
(w\214nder can \214nd vulnerabilities in programs that can-)-.15 F .254
(not be b)108 292.8 R .254(uilt or cannot be link)-.2 F 2.754(ed. It)-.1
F .254(can often w)2.754 F .255(ork with programs that cannot e)-.1 F
-.15(ve)-.25 G 2.755(nb).15 G 2.755(ec)-2.755 G .255
(ompiled \(at least by)-2.755 F .618(the re)108 304.8 R(vie)-.25 E(wer')
-.25 E 3.118(st)-.55 G 3.118(ools\). Fla)-3.118 F .618
(w\214nder also doesn')-.15 F 3.118(tg)-.18 G .618
(et as confused by macro de\214nitions and other oddities that)-3.118 F
.366(more sophisticated tools ha)108 316.8 R .667 -.15(ve t)-.2 H .367
(rouble with.).15 F(Fla)5.367 E .367
(w\214nder can also be useful as a simple introduction to static)-.15 F
(analysis tools in general, since it is easy to start using and easy to\
understand.)108 328.8 Q(An)108 345.6 Q 2.757<798c>-.15 G .257
(lename gi)-2.757 F -.15(ve)-.25 G 2.757(no).15 G 2.757(nt)-2.757 G .257
(he command line will be e)-2.757 F .257(xamined \(e)-.15 F -.15(ve)-.25
G 2.757(ni).15 G 2.757(fi)-2.757 G 2.756(td)-2.757 G(oesn')-2.756 E
2.756(th)-.18 G -2.25 -.2(av e)-2.756 H 2.756(au)2.956 G .256
(sual C/C++ \214lename)-2.756 F -.15(ex)108 357.6 S .197
(tension\); thus you can force \215a).15 F .197(w\214nder to e)-.15 F
.197(xamine an)-.15 F 2.697(ys)-.15 G .198
(peci\214c \214les you desire.)-2.697 F .198(While searching directo-)
5.198 F 1.603(ries recursi)108 369.6 R -.15(ve)-.25 G(ly).15 E 4.103
<2c8d>-.65 G -.15(aw)-4.103 G 1.603(\214nder only opens and e).15 F
1.602(xamines re)-.15 F 1.602(gular \214les that ha)-.15 F 1.902 -.15
(ve C)-.2 H 1.602(/C++ \214lename e).15 F(xtensions.)-.15 E(Fla)108
381.6 Q .916(w\214nder presumes that \214les are C/C++ \214les if the)
-.15 F 3.416(yh)-.15 G -2.25 -.2(av e)-3.416 H .916(the e)3.616 F .917
(xtensions ".c", ".h", ".ec", ".ecp", ".pgc",)-.15 F 1.297(".C", ".cpp"\
, ".CPP", ".cxx", ".c++", ".cc", ".CC", ".pcc", ".hpp", or ".H".)108
393.6 R 1.296(The \214lename `)6.296 F(`\255')-.74 E 3.796('m)-.74 G
1.296(eans the)-3.796 F .901(standard input.)108 405.6 R 2.501 -.8(To p)
5.901 H(re).8 E -.15(ve)-.25 G .901
(nt security problems, special \214les \(such as de).15 F .902
(vice special \214les and named pipes\))-.25 F 1.123(are al)108 417.6 R
-.1(wa)-.1 G 1.123(ys skipped, and by def).1 F 1.123
(ault symbolic links are skipped \(the \255\255allo)-.1 F 1.123
(wlink option follo)-.25 F 1.122(ws symbolic)-.25 F(links\).)108 429.6 Q
.375(After the list of hits is a brief summary of the results \(use -D \
to remo)108 446.4 R .675 -.15(ve t)-.15 H .375(his information\).).15 F
.375(It will sho)5.375 F 2.875(wt)-.25 G(he)-2.875 E .794
(number of hits, lines analyzed \(as reported by wc \255l\), and the ph)
108 458.4 R .793(ysical source lines of code \(SLOC\) ana-)-.05 F 3.262
(lyzed. A)108 470.4 R(ph)3.262 E .763
(ysical SLOC is a non-blank, non-comment line.)-.05 F .763
(It will then sho)5.763 F 3.263(wt)-.25 G .763
(he number of hits at each)-3.263 F(le)108 482.4 Q -.15(ve)-.25 G .242
(l; note that there will ne).15 F -.15(ve)-.25 G 2.742(rb).15 G 2.742
(eah)-2.742 G .241(it at a le)-2.742 F -.15(ve)-.25 G 2.741(ll).15 G
-.25(ow)-2.741 G .241(er than minle).25 F -.15(ve)-.25 G 2.741(l\().15 G
2.741(1b)-2.741 G 2.741(yd)-2.741 G(ef)-2.741 E 2.741
(ault\). Thus, "[0])-.1 F 2.741(0[)7.741 G 5.241(1] 9")-2.741 F .364
(means that at le)108 494.4 R -.15(ve)-.25 G 2.864(l0t).15 G .364
(here were 0 hits reported, and at le)-2.864 F -.15(ve)-.25 G 2.864(l1t)
.15 G .364(here were 9 hits reported.)-2.864 F .364(It will ne)5.364 F
.365(xt sho)-.15 F(w)-.25 E .251(the number of hits at a gi)108 506.4 R
-.15(ve)-.25 G 2.751(nl).15 G -2.15 -.25(ev e)-2.751 H 2.751(lo).25 G
2.751(rl)-2.751 G(ar)-2.751 E .251(ger \(so le)-.18 F -.15(ve)-.25 G
2.75(l3).15 G 2.75(+h)-2.75 G .25
(as the sum of the number of hits at le)-2.75 F -.15(ve)-.25 G 2.75(l3)
.15 G 2.75(,4)-2.75 G 2.75(,a)-2.75 G(nd)-2.75 E 2.784(5\). Thus,)108
518.4 R .284(an entry of "[0+])2.784 F .284(37" sho)5.284 F .284
(ws that at le)-.25 F -.15(ve)-.25 G 2.785(l0o).15 G 2.785(rh)-2.785 G
.285(igher there were 37 hits \(the 0+ entry will al)-2.785 F -.1(wa)-.1
G(ys).1 E 1.407(be the same as the "hits" number abo)108 530.4 R -.15
(ve)-.15 G 3.907(\). Hits).15 F 1.406(per KSLOC is ne)3.907 F 1.406
(xt sho)-.15 F 1.406(wn; this is each of the "le)-.25 F -.15(ve)-.25 G
3.906(lo).15 G(r)-3.906 E .34(higher" v)108 542.4 R .34
(alues multiplied by 1000 and di)-.25 F .34(vided by the ph)-.25 F .34
(ysical SLOC.)-.05 F .34(If symlinks were skipped, the count)5.34 F 1.59
(of those is reported.)108 554.4 R 1.589
(If hits were suppressed \(using the "ignore" directi)6.59 F 1.889 -.15
(ve i)-.25 H 4.089(ns).15 G 1.589(ource code comments as)-4.089 F .537
(described abo)108 566.4 R -.15(ve)-.15 G .537
(\), the number suppressed is reported.).15 F .538(The minimum risk le)
5.537 F -.15(ve)-.25 G 3.038(lt).15 G 3.038(ob)-3.038 G 3.038(ei)-3.038
G .538(ncluded in the report)-3.038 F 1.953(is displayed; by def)108
578.4 R 1.953(ault this is 1 \(use \255\255minle)-.1 F -.15(ve)-.25 G
4.452(lt).15 G 4.452(oc)-4.452 G 1.952(hange this\).)-4.452 F 1.952
(The summary ends with important)6.952 F .282(reminders: Not e)108 590.4
R -.15(ve)-.25 G .282(ry hit is necessarily a security vulnerability).15
F 2.783(,a)-.65 G .283(nd there may be other security vulnerabili-)
-2.783 F(ties not reported by the tool.)108 602.4 Q(Fla)108 619.2 Q
1.635(w\214nder can easily inte)-.15 F 1.635
(grate into a continuous inte)-.15 F 1.635(gration system.)-.15 F -1.1
(Yo)6.635 G 4.135(um)1.1 G 1.634(ight w)-4.135 F 1.634
(ant to check out the)-.1 F(\255\255error\255le)108 631.2 Q -.15(ve)-.25
G 2.5(lo).15 G(ption to help do that.)-2.5 E(Fla)108 648 Q
(w\214nder is released under the GNU GPL license v)-.15 E
(ersion 2 or later \(GPLv2+\).)-.15 E(Fla)108 664.8 Q .046(w\214nder w)
-.15 F .046(orks similarly to another program, ITS4, which is not fully\
open source softw)-.1 F .047(are \(as de\214ned in)-.1 F .188
(the Open Source De\214nition\) nor free softw)108 676.8 R .187
(are \(as de\214ned by the Free Softw)-.1 F .187(are F)-.1 F 2.687
(oundation\). The)-.15 F .187(author of)2.687 F(Fla)108 688.8 Q 1.222
(w\214nder has ne)-.15 F -.15(ve)-.25 G 3.722(rs).15 G 1.222(een ITS4')
-3.722 F 3.722(ss)-.55 G 1.222(ource code.)-3.722 F(Fla)6.222 E 1.222
(w\214nder is similar in man)-.15 F 3.723(yw)-.15 G 1.223(ays to RA)
-3.823 F 1.223(TS, if you are)-1.11 F -.1(fa)108 700.8 S(miliar with RA)
.1 E(TS.)-1.11 E(Fla)72 768 Q 165.545(w\214nder 4)-.15 F(Apr 2018)2.5 E
(2)206.225 E 0 Cg EP
%%Page: 3 3
%%BeginPageSetup
BP
%%EndPageSetup
/F0 10/Times-Roman@0 SF(FLA)72 48 Q 134.71(WFINDER\(1\) Fla)-.9 F 134.71
(w\214nder FLA)-.15 F(WFINDER\(1\))-.9 E/F1 10.95/Times-Bold@0 SF
(BRIEF TUT)72 84 Q(ORIAL)-.197 E F0(Here')108 96 Q 2.749(sab)-.55 G .249
(rief e)-2.749 F .249(xample of ho)-.15 F 2.749<778d>-.25 G -.15(aw)
-2.749 G .249(\214nder might be used.).15 F .249(Imagine that you ha)
5.249 F .549 -.15(ve t)-.2 H .249(he C/C++ source code for).15 F .861
(some program named xyzzy \(which you may or may not ha)108 108 R 1.161
-.15(ve w)-.2 H .861(ritten\), and you').15 F .862
(re searching for security)-.5 F .938(vulnerabilities \(so you can \214\
x them before customers encounter the vulnerabilities\).)108 120 R -.15
(Fo)5.938 G 3.438(rt).15 G .937(his tutorial, I')-3.438 F(ll)-.1 E
(assume that you')108 132 Q(re using a Unix-lik)-.5 E 2.5(es)-.1 G
(ystem, such as Linux, OpenBSD, or MacOS X.)-2.5 E .873
(If the source code is in a subdirectory named xyzzy)108 148.8 R 3.373
(,y)-.65 G .873(ou w)-3.373 F .874(ould probably start by opening a te)
-.1 F .874(xt windo)-.15 F(w)-.25 E .162(and using \215a)108 160.8 R
(w\214nder')-.15 E 2.662(sd)-.55 G(ef)-2.662 E .162(ault settings, to a\
nalyze the program and report a prioritized list of potential secu-)-.1
F(rity vulnerabilities \(the `)108 172.8 Q(`less')-.74 E 2.5('j)-.74 G
(ust mak)-2.5 E(es sure the results stay on the screen\):)-.1 E<8d61>144
184.8 Q(w\214nder xyzzy | less)-.15 E .615
(At this point, you will see a lar)108 213.6 R .616
(ge number of entries.)-.18 F .616
(Each entry has a \214lename, a colon, a line number)5.616 F 3.116(,a)
-.4 G .385(risk le)108 225.6 R -.15(ve)-.25 G 2.885(li).15 G 2.885(nb)
-2.885 G(rack)-2.885 E .385(ets \(where 5 is the most risk)-.1 F .385
(y\), a cate)-.15 F(gory)-.15 E 2.885(,t)-.65 G .385
(he name of the function, and a description of)-2.885 F(wh)108 237.6 Q
2.781<798d>-.05 G -.15(aw)-2.781 G .281
(\214nder thinks the line is a vulnerability).15 F 5.281(.F)-.65 G(la)
-5.281 E .281(w\214nder normally sorts by risk le)-.15 F -.15(ve)-.25 G
.282(l, sho).15 F .282(wing the riski-)-.25 F .071
(est items \214rst; if you ha)108 249.6 R .371 -.15(ve l)-.2 H .071
(imited time, it').15 F 2.571(sp)-.55 G .07(robably best to start w)
-2.571 F .07(orking on the riskiest items and continue)-.1 F .625
(until you run out of time.)108 261.6 R .625(If you w)5.625 F .625
(ant to limit the display to risks with only a certain risk le)-.1 F
-.15(ve)-.25 G 3.125(lo).15 G 3.125(rh)-3.125 G(igher)-3.125 E(,)-.4 E
1.099(use the \255\255minle)108 273.6 R -.15(ve)-.25 G 3.599(lo).15 G
3.599(ption. If)-3.599 F(you')3.599 E 1.099(re getting an e)-.5 F 1.098
(xtraordinary number of f)-.15 F 1.098(alse positi)-.1 F -.15(ve)-.25 G
3.598(sb).15 G 1.098(ecause v)-3.598 F(ariable)-.25 E .672
(names look lik)108 285.6 R 3.172(ed)-.1 G .672
(angerous function names, use the \255F option to remo)-3.172 F .973
-.15(ve r)-.15 H .673(eports about them.).15 F .673(If you don')5.673 F
(t)-.18 E 4.367
(understand the error message, please see documents such as the)108
297.6 R/F2 10/Times-Italic@0 SF(Secur)7.196 E 6.866(eP)-.37 G -1.7 -.45
(ro g)-6.866 H -.15(ra).45 G 4.366(mming HO).15 F(WT)-.5 E(O)-.18 E/F3
10/Symbol SF<e1>108 309.6 Q F0(https://dwheeler)A(.com/secure-programs)
-.55 E F3<f1>A F0 4.072(at https://dwheeler)6.572 F 4.072
(.com/secure-programs which pro)-.55 F 4.072(vides more)-.15 F
(information on writing secure programs.)108 321.6 Q .722
(Once you identify the problem and understand it, you can \214x it.)108
338.4 R .721(Occasionally you may w)5.722 F .721(ant to re-do the)-.1 F
.545(analysis, both because the line numbers will change)108 350.4 R F2
(and)3.045 E F0 .545(to mak)3.045 F 3.045(es)-.1 G .546(ure that the ne)
-3.045 F 3.046(wc)-.25 G .546(ode doesn')-3.046 F 3.046(ti)-.18 G
(ntroduce)-3.046 E(yet a dif)108 362.4 Q(ferent vulnerability)-.25 E(.)
-.65 E .516(If you')108 379.2 R .816 -.15(ve d)-.5 H .516
(etermined that some line isn').15 F 3.016(tr)-.18 G .516
(eally a problem, and you')-3.016 F .516
(re sure of it, you can insert just before)-.5 F(or on the of)108 391.2
Q(fending line a comment lik)-.25 E(e)-.1 E(/* Fla)146.5 403.2 Q
(w\214nder: ignore */)-.15 E(to k)108 415.2 Q(eep them from sho)-.1 E
(wing up in the output.)-.25 E .397(Once you')108 432 R .697 -.15(ve d)
-.5 H .397(one that, you should go back and search for the program').15
F 2.898(si)-.55 G .398(nputs, to mak)-2.898 F 2.898(es)-.1 G .398
(ure that the pro-)-2.898 F .294(gram strongly \214lters an)108 444 R
2.793(yo)-.15 G 2.793(fi)-2.793 G .293(ts untrusted inputs.)-2.793 F
(Fla)5.293 E .293(w\214nder can identify man)-.15 F 2.793(yp)-.15 G .293
(rogram inputs by using the)-2.793 F(\255\255inputs option, lik)108 456
Q 2.5(et)-.1 G(his:)-2.5 E<8d61>144 468 Q
(w\214nder \255\255inputs xyzzy)-.15 E(Fla)108 484.8 Q .427
(w\214nder can inte)-.15 F .427(grate well with te)-.15 F .428
(xt editors and inte)-.15 F .428(grated de)-.15 F -.15(ve)-.25 G .428
(lopment en).15 F .428(vironments; see the e)-.4 F(xamples)-.15 E
(for more information.)108 496.8 Q(Fla)108 513.6 Q .574
(w\214nder includes man)-.15 F 3.074(yo)-.15 G .574
(ther options, including ones to create HTML v)-3.074 F .574
(ersions of the output \(useful for)-.15 F(prettier displays\).)108
525.6 Q(The ne)5 E(xt section describes those options in more detail.)
-.15 E F1(OPTIONS)72 554.4 Q F0(Fla)108 566.4 Q .187(w\214nder has a nu\
mber of options, which can be grouped into options that control its o)
-.15 F .187(wn documentation,)-.25 F 1.272
(select input data, select which hits to display)108 578.4 R 3.772(,s)
-.65 G 1.272(elect the output format, and perform hitlist management.)
-3.772 F .691(The commonly-used \215a)108 590.4 R .691(w\214nder option\
s support the standard option syntax de\214ned in the POSIX \(Issue 7,)
-.15 F .119(2013 Edition\) section `)108 602.4 R .119(`Utility Con)-.74
F -.15(ve)-.4 G(ntions').15 E 2.618('. Fla)-.74 F .118
(w\214nder also supports the GNU long options \(double-dash)-.15 F .128
(options of form \255\255)108 614.4 R F2(option)A F0 2.628(\)a)C 2.628
(sd)-2.628 G .128(e\214ned in the)-2.628 F F2 .128(GNU C Libr)2.628 F
.128(ary Refer)-.15 F .128(ence Manual)-.37 F F0 -.74(``)2.628 G .128
(Program Ar).74 F .128(gument Syntax)-.18 F(Con)108 626.4 Q -.15(ve)-.4
G(ntions').15 E 3.003('a)-.74 G(nd)-3.003 E F2 .503(GNU Coding Standar)
3.003 F(ds)-.37 E F0 -.74(``)3.003 G .502
(Standards for Command Line Interf).74 F(aces')-.1 E 3.002('. Long)-.74
F .502(option ar)3.002 F(gu-)-.18 E .456(ments can be pro)108 638.4 R
.457(vided as `)-.15 F(`--name=v)-.74 E(alue')-.25 E 2.957('o)-.74 G
2.957(r`)-2.957 G .457(`-name v)-3.697 F(alue')-.25 E 2.957('. All)-.74
F .457(options can be accessed using the more)2.957 F .229
(readable GNU long option con)108 650.4 R -.15(ve)-.4 G .229
(ntions; some less commonly used options can).15 F F2(only)2.728 E F0
.228(be accessed using long)2.728 F(option con)108 662.4 Q -.15(ve)-.4 G
(ntions.).15 E/F4 10/Times-Bold@0 SF(Documentation)87 691.2 Q
(\255\255help)108 703.2 Q F0(Fla)72 768 Q 165.545(w\214nder 4)-.15 F
(Apr 2018)2.5 E(3)206.225 E 0 Cg EP
%%Page: 4 4
%%BeginPageSetup
BP
%%EndPageSetup
/F0 10/Times-Roman@0 SF(FLA)72 48 Q 134.71(WFINDER\(1\) Fla)-.9 F 134.71
(w\214nder FLA)-.15 F(WFINDER\(1\))-.9 E/F1 10/Times-Bold@0 SF<ad68>108
84 Q F0(Sho)168 84 Q 2.5(wu)-.25 G(sage \(help\) information.)-2.5 E F1
<adad76>108 112.8 Q(ersion)-.1 E F0(Sho)168 112.8 Q(ws \(just\) the v)
-.25 E(ersion number and e)-.15 E(xits.)-.15 E F1(\255\255listrules)108
141.6 Q F0 2.074(List the terms \(tok)168 141.6 R 2.074
(ens\) that trigger further e)-.1 F 2.075(xamination, their def)-.15 F
2.075(ault risk le)-.1 F -.15(ve)-.25 G 2.075(l, and the).15 F(def)168
153.6 Q .03(ault w)-.1 F .03(arning \(including the CWE identi\214er\(s\
\), if applicable\), all tab-separated.)-.1 F .03(The terms)5.03 F .066
(are primarily names of potentially-dangerous functions.)168 165.6 R
.067(Note that the reported risk le)5.067 F -.15(ve)-.25 G 2.567(la).15
G(nd)-2.567 E -.1(wa)168 177.6 S
(rning for some speci\214c code may be dif).1 E(ferent than the def)-.25
E(ault, depending on ho)-.1 E 2.5(wt)-.25 G(he term)-2.5 E 1.304
(is used.)168 189.6 R 1.304(Combine with \255D if you do not w)6.304 F
1.304(ant the usual header)-.1 F 6.304(.F)-.55 G(la)-6.304 E 1.304
(w\214nder v)-.15 F 1.304(ersion 1.29)-.15 F
(changed the separator from spaces to tabs, and added the def)168 201.6
Q(ault w)-.1 E(arning \214eld.)-.1 E F1(Selecting Input Data)87 230.4 Q
(\255\255allo)108 242.4 Q(wlink)-.1 E F0(Allo)168 242.4 Q 2.674(wt)-.25
G .174(he use of symbolic links; normally symbolic links are skipped.)
-2.674 F(Don')5.173 E 2.673(tu)-.18 G .173(se this option)-2.673 F .354
(if you')168 254.4 R .354(re analyzing code by others; attack)-.5 F .355
(ers could do man)-.1 F 2.855(yt)-.15 G .355
(hings to cause problems for an)-2.855 F 1.084
(analysis with this option enabled.)168 266.4 R -.15(Fo)6.084 G 3.584
(re).15 G 1.084(xample, an attack)-3.734 F 1.084
(er could insert symbolic links to)-.1 F .326(\214les such as /etc/pass\
wd \(leaking information about the \214le\) or create a circular loop, \
which)168 278.4 R -.1(wo)168 290.4 S .429(uld cause \215a).1 F .429
(w\214nder to run `)-.15 F(`fore)-.74 E -.15(ve)-.25 G(r').15 E 2.929
('. Another)-.74 F .428(problem with enabling this option is that)2.928
F .542(if the same \214le is referenced multiple times using symbolic l\
inks, it will be analyzed multi-)168 302.4 R 1.525
(ple times \(and thus reported multiple times\).)168 314.4 R 1.525
(Note that \215a)6.525 F 1.525(w\214nder already includes some)-.15 F
2.956(protection ag)168 326.4 R 2.957
(ainst symbolic links to special \214le types such as de)-.05 F 2.957
(vice \214le types \(e.g.,)-.25 F(/de)168 338.4 Q 1.219
(v/zero or C:\\mystuf)-.25 F 3.719(f\\com1\). Note)-.25 F 1.218
(that for \215a)3.719 F 1.218(w\214nder v)-.15 F 1.218
(ersion 1.01 and before, this w)-.15 F(as)-.1 E(the def)168 350.4 Q
(ault.)-.1 E F1<adad66>108 379.2 Q(ollo)-.25 E(wdotdir)-.1 E F0 .57
(Enter directories whose names be)168 391.2 R .57(gin with ".".)-.15 F
.57(Normally such directories are ignored, since)5.57 F(the)168 403.2 Q
4.017(yn)-.15 G 1.517(ormally include v)-4.017 F 1.516
(ersion control pri)-.15 F -.25(va)-.25 G 1.516
(te data \(such as .git/ or .svn/\), b).25 F 1.516(uild metadata)-.2 F
(\(such as .mak)168 415.2 Q
(epp\), con\214guration information, and so on.)-.1 E F1(\255\255nolink)
108 444 Q F0 5.296(Ignored. Historically)168 444 R 2.796
(this disabled follo)5.296 F 2.796(wing symbolic links; this beha)-.25 F
2.797(vior is no)-.2 F 5.297(wt)-.25 G(he)-5.297 E(def)168 456 Q(ault.)
-.1 E F1(\255\255patch=)108 484.8 Q/F2 10/Times-Italic@0 SF(patc)A
(h\214le)-.15 E F1<ad50>108 501.6 Q F2(patc)2.5 E(h\214le)-.15 E F0 .228
(Examine the selected \214les or directories, b)168 501.6 R .227
(ut only report hits in lines that are added or modi-)-.2 F .567
(\214ed as described in the gi)168 513.6 R -.15(ve)-.25 G 3.067(np).15 G
.568(atch \214le.)-3.067 F .568
(The patch \214le must be in a recognized uni\214ed dif)5.568 F(f)-.25 E
2.294(format \(e.g., the output of GNU "dif)168 525.6 R 4.793(f-)-.25 G
4.793(uo)-4.793 G 2.293(ld ne)-4.793 F 2.293(w", "svn dif)-.25 F 2.293
(f", or "git dif)-.25 F 4.793(f[)-.25 G(commit]"\).)-4.793 E(Fla)168
537.6 Q .833(w\214nder assumes that the patch has already been applied \
to the \214les.)-.15 F .833(The patch \214le can)5.833 F 1.767
(also include changes to irrele)168 549.6 R -.25(va)-.25 G 1.767
(nt \214les \(the).25 F 4.267(yw)-.15 G 1.767(ill simply be ignored\).)
-4.267 F 1.767(The line numbers)6.767 F(gi)168 561.6 Q -.15(ve)-.25 G
2.731(ni).15 G 2.731(nt)-2.731 G .231(he patch \214le are used to deter\
mine which lines were changed, so if you ha)-2.731 F .532 -.15(ve m)-.2
H(odi-).15 E .498(\214ed the \214les since the patch \214le w)168 573.6
R .498(as created, re)-.1 F .497(generate the patch \214le \214rst.)-.15
F(Be)5.497 E -.1(wa)-.25 G .497(re that the).1 F .397
(\214le names of the ne)168 585.6 R 2.897<778c>-.25 G .397(les gi)-2.897
F -.15(ve)-.25 G 2.897(ni).15 G 2.897(nt)-2.897 G .398
(he patch \214le must match e)-2.897 F(xactly)-.15 E 2.898(,i)-.65 G
.398(ncluding upper/lo)-2.898 F(wer)-.25 E .045
(case, path pre\214x, and directory separator \(\\ vs. /\).)168 597.6 R
.045(Only uni\214ed dif)5.045 F 2.544(ff)-.25 G .044
(ormat is accepted \(GNU)-2.544 F(dif)168 609.6 Q .54(f, svn dif)-.25 F
.54(f, and git dif)-.25 F 3.04(fo)-.25 G .54(utput is okay\); if you ha)
-3.04 F .84 -.15(ve a d)-.2 H(if).15 E .54(ferent format, ag)-.25 F .54
(ain re)-.05 F .54(generate it)-.15 F 2.685(\214rst. Only)168 621.6 R
.185(hits that occur on resultant changed lines, or immediately abo)
2.685 F .485 -.15(ve a)-.15 H .185(nd belo).15 F 2.685(wt)-.25 G(hem,)
-2.685 E .043(are reported.)168 633.6 R .043
(This option implies \255\255ne)5.043 F -.15(ve)-.25 G(rignore.).15 E F1
-.65(Wa)5.043 G -.15(rn).65 G(ing).15 E F0 2.543(:D)C(o)-2.543 E F2(not)
2.543 E F0 .043(pass a patch \214le without)2.543 F(the)168 645.6 Q F1
<ad50>2.528 E F0 2.528(,b)C .028(ecause \215a)-2.528 F .027
(w\214nder will then try to treat the \214le as a source \214le.)-.15 F
.027(This will often w)5.027 F(ork,)-.1 E -.2(bu)168 657.6 S 3.348(tt).2
G .849(he line numbers will be relati)-3.348 F 1.149 -.15(ve t)-.25 H
3.349(ot).15 G .849(he be)-3.349 F .849
(ginning of the patch \214le, not the positions in)-.15 F .163
(the source code.)168 669.6 R .163(Note that you)5.163 F F1(must)2.663 E
F0 .162(also pro)2.662 F .162
(vide the actual \214les to analyze, and not just the)-.15 F .422
(patch \214le; when using)168 681.6 R F1<ad50>2.922 E F0 .423
(\214les are only reported if the)2.923 F 2.923(ya)-.15 G .423
(re both listed in the patch and also)-2.923 F
(listed \(directly or indirectly\) in the list of \214les to analyze.)
168 693.6 Q(Fla)72 768 Q 165.545(w\214nder 4)-.15 F(Apr 2018)2.5 E(4)
206.225 E 0 Cg EP
%%Page: 5 5
%%BeginPageSetup
BP
%%EndPageSetup
/F0 10/Times-Roman@0 SF(FLA)72 48 Q 134.71(WFINDER\(1\) Fla)-.9 F 134.71
(w\214nder FLA)-.15 F(WFINDER\(1\))-.9 E/F1 10/Times-Bold@0 SF
(Selecting Hits to Display)87 84 Q(\255\255inputs)108 96 Q<ad49>108
112.8 Q F0(Sho)144 112.8 Q 2.5(wo)-.25 G(nly functions that obtain data\
from outside the program; this also sets minle)-2.5 E -.15(ve)-.25 G
2.5(lt).15 G 2.5(o0)-2.5 G(.)-2.5 E F1(\255\255minle)108 141.6 Q -.1(ve)
-.15 G(l=).1 E/F2 10/Times-Italic@0 SF(X)A F1(-m)108 158.4 Q F2(X)2.5 E
F0 .499(Set minimum risk le)144 158.4 R -.15(ve)-.25 G 2.999(lt).15 G
2.999(oXf)-2.999 G .499(or inclusion in hitlist.)-2.999 F .499
(This can be from 0 \(`)5.499 F .499(`no risk')-.74 F .499('\) to 5 \(`)
-.74 F(`maxi-)-.74 E(mum risk')144 170.4 Q('\); the def)-.74 E
(ault is 1.)-.1 E F1(\255\255falsepositi)108 199.2 Q -.1(ve)-.1 G<ad46>
108 216 Q F0 .437(Do not include hits that are lik)144 216 R .437
(ely to be f)-.1 F .438(alse positi)-.1 F -.15(ve)-.25 G 2.938
(s. Currently).15 F 2.938(,t)-.65 G .438(his means that function names)
-2.938 F .992(are ignored if the)144 228 R(y')-.15 E .992(re not follo)
-.5 F .991(wed by "\(", and that declarations of character arrays aren')
-.25 F 3.491(tn)-.18 G(oted.)-3.491 E .466(Thus, if you ha)144 240 R
.766 -.15(ve u)-.2 H .466(se a v).15 F .466(ariable named "access" e)
-.25 F -.15(ve)-.25 G .466
(rywhere, this will eliminate references to this).15 F 1.839(ordinary v)
144 252 R 4.339(ariable. This)-.25 F(isn')4.339 E 4.339(tt)-.18 G 1.839
(he def)-4.339 F 1.838(ault, because this also increases the lik)-.1 F
1.838(elihood of missing)-.1 F .367(important hits; in particular)144
264 R 2.867(,f)-.4 G .367
(unction names in #de\214ne clauses and calls through function pointers)
-2.867 F(will be missed.)144 276 Q F1<adad6e65>108 304.8 Q -.1(ve)-.15 G
(rignor).1 E(e)-.18 E(-n)108 321.6 Q F0(Ne)144 321.6 Q -.15(ve)-.25 G
2.5(ri).15 G(gnore security issues, e)-2.5 E -.15(ve)-.25 G 2.5(ni).15 G
2.5(ft)-2.5 G(he)-2.5 E 2.5(yh)-.15 G -2.25 -.2(av e)-2.5 H(an `)2.7 E
(`ignore')-.74 E 2.5('d)-.74 G(irecti)-2.5 E .3 -.15(ve i)-.25 H 2.5
(nac).15 G(omment.)-2.5 E F1<adad72>108 350.4 Q(egexp=)-.18 E F2 -1.07
-.9(PA T)D(TERN).9 E F1(-e)108 367.2 Q F2 -1.07 -.9(PA T)2.5 H(TERN).9 E
F0 .413(Only report hits with te)144 379.2 R .412
(xt that matches the re)-.15 F .412(gular e)-.15 F .412
(xpression pattern P)-.15 F -1.11(AT)-.92 G 2.912(TERN. F)1.11 F .412
(or e)-.15 F .412(xample, to)-.15 F 1.753
(only report hits containing the te)144 391.2 R 1.753
(xt "CWE-120", use `)-.15 F<60adad7265>-.74 E(ge)-.15 E 4.254(xC)-.15 G
(WE-120')-4.254 E 4.254('. These)-.74 F 1.754(option \215ag)4.254 F
(names are the same as grep.)144 403.2 Q F1(Selecting Output F)87 444 Q
(ormat)-.25 E(\255\255columns)108 456 Q<ad43>108 472.8 Q F0(Sho)168
472.8 Q 4.024(wt)-.25 G 1.524(he column number \(as well as the \214le \
name and line number\) of each hit; this is)-4.024 F(sho)168 484.8 Q
.609(wn after the line number by adding a colon and the column number i\
n the line \(the \214rst)-.25 F .562
(character in a line is column number 1\).)168 496.8 R .562
(This is useful for editors that can jump to speci\214c)5.562 F 1.374
(columns, or for inte)168 508.8 R 1.375
(grating with other tools \(such as those to further \214lter out f)-.15
F 1.375(alse posi-)-.1 F(ti)168 520.8 Q -.15(ve)-.25 G(s\).).15 E F1
(\255\255context)108 549.6 Q<ad63>108 566.4 Q F0(Sho)168 566.4 Q 4.25
(wc)-.25 G(onte)-4.25 E 1.75(xt, i.e., the line ha)-.15 F 1.749
(ving the "hit"/potential \215a)-.2 F 5.549 -.65(w. B)-.15 H 4.249(yd)
.65 G(ef)-4.249 E 1.749(ault the line is sho)-.1 F(wn)-.25 E
(immediately after the w)168 578.4 Q(arning.)-.1 E F1<adad637376>108
607.2 Q F0 .455(Generate output in comma-separated-v)168 607.2 R .455
(alue \(CSV\) format.)-.25 F .455(This is the recommended format)5.455 F
.023(for sending to other tools for processing.)168 619.2 R .023
(It will al)5.023 F -.1(wa)-.1 G .023(ys generate a header ro).1 F 1.323
-.65(w, f)-.25 H(ollo).65 E .023(wed by 0)-.25 F .857(or more data ro)
168 631.2 R .858(ws \(one data ro)-.25 F 3.358(wf)-.25 G .858
(or each hit\).)-3.358 F .858
(Selecting this option automatically enables)5.858 F 1.314
(\255\255quiet and \255\255dataonly)168 643.2 R 6.314(.T)-.65 G 1.314
(he headers are mostly self-e)-6.314 F(xplanatory)-.15 E 6.313(.")-.65 G
1.313(File" is the \214lename,)-6.313 F .164("Line" is the line number)
168 655.2 R 2.664(,")-.4 G .164
(Column" is the column \(starting from 1\), "Le)-2.664 F -.15(ve)-.25 G
.165(l" is the risk le).15 F -.15(ve)-.25 G(l).15 E .42
(\(0-5, 5 is riskiest\), "Cate)168 667.2 R .419
(gory" is the general \215a)-.15 F .419(w\214nder cate)-.15 F(gory)-.15
E 2.919(,")-.65 G .419(Name" is the name of the)-2.919 F 1.252
(triggering rule, "W)168 679.2 R 1.253(arning" is te)-.8 F 1.253(xt e)
-.15 F 1.253(xplaining wh)-.15 F 3.753(yi)-.05 G 3.753(ti)-3.753 G 3.753
(sah)-3.753 G 1.253(it \(\214nding\), "Suggestion" is te)-3.753 F(xt)
-.15 E .99(suggesting ho)168 691.2 R 3.49(wi)-.25 G 3.49(tm)-3.49 G .99
(ight be \214x)-3.49 F .99(ed, "Note" is other e)-.15 F .99
(xplanatory notes, "CWEs" is the list of)-.15 F .335
(one or more CWEs, "Conte)168 703.2 R .335
(xt" is the source code line triggering the hit, and "Fingerprint" is)
-.15 F .047(the SHA-256 hash of the conte)168 715.2 R .046
(xt once its leading and trailing whitespace ha)-.15 F .346 -.15(ve b)
-.2 H .046(een remo).15 F -.15(ve)-.15 G(d).15 E 1.054(\(the \214ngerpr\
int may help detect and eliminate later duplications\).)168 727.2 R
1.055(If you use Python3, the)6.055 F(Fla)72 768 Q 165.545(w\214nder 4)
-.15 F(Apr 2018)2.5 E(5)206.225 E 0 Cg EP
%%Page: 6 6
%%BeginPageSetup
BP
%%EndPageSetup
/F0 10/Times-Roman@0 SF(FLA)72 48 Q 134.71(WFINDER\(1\) Fla)-.9 F 134.71
(w\214nder FLA)-.15 F(WFINDER\(1\))-.9 E(hash is of the conte)168 84 Q
(xt when encoded as UTF-8.)-.15 E/F1 10/Times-Bold@0 SF
(\255\255dataonly)108 112.8 Q<ad44>108 129.6 Q F0(Don')168 129.6 Q 2.5
(td)-.18 G(isplay the header and footer)-2.5 E 5(.U)-.55 G
(se this along with \255\255quiet to see just the data itself.)-5 E F1
(\255\255html)108 158.4 Q<ad48>108 175.2 Q F0 -.15(Fo)168 175.2 S
(rmat the output as HTML instead of as simple te).15 E(xt.)-.15 E F1
(\255\255immediate)108 204 Q(-i)108 220.8 Q F0
(Immediately display hits \(don')168 220.8 Q 2.5(tj)-.18 G(ust w)-2.5 E
(ait until the end\).)-.1 E F1(\255\255singleline)108 249.6 Q(-S)108
266.4 Q F0 1.267(Display as single line of te)168 266.4 R 1.267
(xt output for each hit.)-.15 F 1.267
(Useful for interacting with compilation)6.267 F(tools.)168 278.4 Q F1
(\255\255omittime)108 307.2 Q F0 .82(Omit timing information.)168 307.2
R .82(This is useful for re)5.82 F .82(gression tests of \215a)-.15 F
.82(w\214nder itself, so that the)-.15 F(output doesn')168 319.2 Q 2.5
(tv)-.18 G(ary depending on ho)-2.75 E 2.5(wl)-.25 G
(ong the analysis tak)-2.5 E(es.)-.1 E F1(\255\255quiet)108 348 Q<ad51>
108 364.8 Q F0(Don')168 364.8 Q 3.153(td)-.18 G .652
(isplay status information \(i.e., which \214les are being e)-3.153 F
.652(xamined\) while the analysis is)-.15 F(going on.)168 376.8 Q F1
<adad657272>108 405.6 Q(or)-.18 E(-le)-.37 E -.1(ve)-.15 G(l=LEVEL).1 E
F0 1.48(Return a nonzero \(f)168 417.6 R 1.48
(alse\) error code if there is at least one hit of LEVEL or higher)-.1 F
6.48(.I)-.55 G 3.98(fa)-6.48 G(dif)168 429.6 Q .204(fhitlist is pro)-.25
F .203(vided, hits noted in it are ignored.)-.15 F .203
(This option can be useful within a contin-)5.203 F 1.791(uous inte)168
441.6 R 1.792(gration script, especially if you mark kno)-.15 F 1.792
(wn-okay lines as "\215a)-.25 F 1.792(w\214nder: ignore".)-.15 F 1.233
(Usually you w)168 453.6 R 1.233(ant le)-.1 F -.15(ve)-.25 G 3.733(lt)
.15 G 3.733(ob)-3.733 G 3.733(ef)-3.733 G 1.232
(airly high, such as 4 or 5.)-3.833 F 1.232(By def)6.232 F 1.232
(ault, \215a)-.1 F 1.232(w\214nder returns 0)-.15 F
(\(true\) on a successful run.)168 465.6 Q F1(Hitlist Management)87
494.4 Q<adad7361>108 506.4 Q -.1(ve)-.25 G(hitlist=).1 E/F2 10
/Times-Italic@0 SF(F)A F0(Sa)168 518.4 Q .3 -.15(ve a)-.2 H
(ll resulting hits \(the "hitlist"\) to F).15 E(.)-.8 E F1
(\255\255loadhitlist=)108 547.2 Q F2(F)A F0 .44
(Load the hitlist from F instead of analyzing source programs.)168 559.2
R -.8(Wa)5.44 G .44(rning: Do).8 F F2(not)2.94 E F0 .44(load hitlists)
2.94 F 2.707(from untrusted sources \(for security reasons\).)168 571.2
R 2.707(These are internally implemented using)7.707 F(Python')168 583.2
Q 3.708(s")-.55 G 1.208(pickle" f)-3.708 F(acility)-.1 E 3.708(,w)-.65 G
1.208(hich trusts the input.)-3.708 F 1.209
(Note that stored hitlists often cannot be)6.208 F 2.652
(read when using an older v)168 595.2 R 2.652
(ersion of Python, in particular)-.15 F 5.152(,i)-.4 G 5.152(fs)-5.152 G
-2.25 -.2(av e)-5.152 H 2.652(hitlist w).2 F 2.652(as used b)-.1 F(ut)
-.2 E<8d61>168 607.2 Q 1.435(w\214nder w)-.15 F 1.436
(as run using Python 3, the hitlist can')-.1 F 3.936(tb)-.18 G 3.936(el)
-3.936 G 1.436(oaded by running \215a)-3.936 F 1.436(w\214nder with)-.15
F(Python 2.)168 619.2 Q F1(\255\255diffhitlist=)108 648 Q F2(F)A F0(Sho)
168 660 Q 3.54(wo)-.25 G 1.039(nly hits \(loaded or analyzed\) not in F)
-3.54 F 6.039(.F)-.8 G -.1(wa)-2.5 G 3.539(sp).1 G 1.039
(resumably created pre)-3.539 F 1.039(viously using)-.25 F<adad7361>168
672 Q -.15(ve)-.2 G 2.865(hitlist. W).15 F .365(arning: Do)-.8 F F2(not)
2.866 E F0(dif)2.866 E 2.866(fh)-.25 G .366
(itlists from untrusted sources \(for security reasons\).)-2.866 F(If)
5.366 E .668(the \255\255loadhitlist option is not pro)168 684 R .668
(vided, this will sho)-.15 F 3.168(wt)-.25 G .668
(he hits in the analyzed source code)-3.168 F .143
(\214les that were not pre)168 696 R .144(viously stored in F)-.25 F
5.144(.I)-.8 G 2.644(fu)-5.144 G .144
(sed along with \255\255loadhitlist, this will sho)-2.644 F 2.644(wt)
-.25 G(he)-2.644 E .095(hits in the loaded hitlist not in F)168 708 R
5.094(.T)-.8 G .094(he dif)-5.094 F .094(ference algorithm is conserv)
-.25 F(ati)-.25 E -.15(ve)-.25 G 2.594(;h).15 G .094(its are only con-)
-2.594 F .683(sidered the `)168 720 R(`same')-.74 E 3.183('i)-.74 G
3.183(ft)-3.183 G(he)-3.183 E 3.183(yh)-.15 G -2.25 -.2(av e)-3.183 H
.683(the same \214lename, line number)3.383 F 3.183(,c)-.4 G .683
(olumn position, function)-3.183 F(Fla)72 768 Q 165.545(w\214nder 4)-.15
F(Apr 2018)2.5 E(6)206.225 E 0 Cg EP
%%Page: 7 7
%%BeginPageSetup
BP
%%EndPageSetup
/F0 10/Times-Roman@0 SF(FLA)72 48 Q 134.71(WFINDER\(1\) Fla)-.9 F 134.71
(w\214nder FLA)-.15 F(WFINDER\(1\))-.9 E(name, and risk le)168 84 Q -.15
(ve)-.25 G(l.).15 E/F1 10/Times-Bold@0 SF(Character Encoding)87 112.8 Q
F0(Fla)108 124.8 Q .871(w\214nder presumes that the character encoding \
your system uses is also the character encoding used by)-.15 F 1.355
(your source \214les.)108 136.8 R(Ev)6.355 E 1.355(en if this isn')-.15
F 3.856(tc)-.18 G 1.356(orrect, if you run \215a)-3.856 F 1.356
(w\214nder with Python 2 these non-conformities)-.15 F
(often do not impact processing in practice.)108 148.8 Q(Ho)108 172.8 Q
(we)-.25 E -.15(ve)-.25 G 1.328 -.4(r, i).15 H 3.028(fy).4 G .528
(ou run \215a)-3.028 F .528
(w\214nder with Python 3, this can be a problem.)-.15 F .528(Python 3 w)
5.528 F .528(ants the w)-.1 F .527(orld to al)-.1 F -.1(wa)-.1 G(ys).1 E
1.464(use encodings perfectly correctly)108 184.8 R 3.964(,e)-.65 G -.15
(ve)-4.214 G 1.464(rywhere, e).15 F -.15(ve)-.25 G 3.964(nt).15 G 1.464
(hough the w)-3.964 F 1.464(orld often doesn')-.1 F 3.965(tc)-.18 G
1.465(are what Python 3)-3.965 F -.1(wa)108 196.8 S 2.845(nts. This).1 F
.345(is a problem e)2.845 F -.15(ve)-.25 G 2.845(ni).15 G 2.845(ft)
-2.845 G .345(he non-conforming te)-2.845 F .345
(xt is in comments or strings \(where it often doesn')-.15 F(t)-.18 E
2.986(matter\). Python)108 208.8 R 2.986(3f)2.986 G .486(ails to pro)
-3.086 F .486(vide useful b)-.15 F .486
(uilt-ins to deal with the messiness of the real w)-.2 F .487
(orld, so it')-.1 F 2.987(sn)-.55 G(on-)-2.987 E(tri)108 220.8 Q
(vial to deal with this problem without depending on e)-.25 E
(xternal libraries \(which we')-.15 E(re trying to a)-.5 E -.2(vo)-.2 G
(id\).).2 E 2.5(As)108 244.8 S
(ymptom of this problem is if you run \215a)-2.5 E
(w\214nder and you see an error message lik)-.15 E 2.5(et)-.1 G(his:)
-2.5 E/F2 10/Times-Italic@0 SF(UnicodeDecodeErr)108 268.8 Q
(or: 'utf-8' codec can')-.45 E 2.5(td)-.3 G
(ecode byte ... in position ...: in)-2.5 E(valid continuation byte)-.4 E
F0(If this happens to you, there are se)108 292.8 Q -.15(ve)-.25 G
(ral options.).15 E .463(The \214rst option is to con)108 316.8 R -.15
(ve)-.4 G .462
(rt the encoding of the \214les to be analyzed so that it').15 F 2.962
(sas)-.55 G .462(ingle encoding \(usually)-2.962 F 1.128
(the system encoding\).)108 328.8 R -.15(Fo)6.128 G 3.628(re).15 G 1.128
(xample, the program "icon)-3.778 F 1.128(v" can be used to con)-.4 F
-.15(ve)-.4 G 1.128(rt encodings.).15 F 1.128(This w)6.128 F(orks)-.1 E
.258(well if some \214les ha)108 340.8 R .558 -.15(ve o)-.2 H .258
(ne encoding, and some ha).15 F .558 -.15(ve a)-.2 H(nother).15 E 2.758
(,b)-.4 G .258(ut the)-2.958 F 2.758(ya)-.15 G .258
(re consistent within a single \214le.)-2.758 F(If)5.257 E .07
(the \214les ha)108 352.8 R .37 -.15(ve e)-.2 H .07
(ncoding errors, you').15 F .07(ll ha)-.1 F .37 -.15(ve t)-.2 H 2.57
<6f8c>.15 G 2.57(xt)-2.57 G 2.57(hem. I)-2.57 F .07
(strongly recommend using the UTF-8 encoding for)2.57 F
(all source code and in the system itself; if you do that, man)108 364.8
Q 2.5(yp)-.15 G(roblems disappear)-2.5 E(.)-.55 E .366
(The second option is to tell \215a)108 388.8 R .366
(w\214nder what the encoding of the \214les is.)-.15 F .366
(E.G., you can set the LANG en)5.366 F(vi-)-.4 E .549(ronment v)108
400.8 R 3.049(ariable. Y)-.25 F .549
(ou can set PYTHONIOENCODING to the encoding you w)-1.1 F .55
(ant your output to be in, if)-.1 F(that')108 412.8 Q 2.5(sd)-.55 G(if)
-2.5 E 2.5(ferent. This)-.25 F(in theory w)2.5 E(ould w)-.1 E(ork, b)-.1
E(ut I ha)-.2 E -.15(ve)-.2 G(n').15 E 2.5(th)-.18 G
(ad much success with this.)-2.5 E(The third option is to run \215a)108
436.8 Q(w\214nder using Python 2 instead of Python 3.)-.15 E(E.g., "p)5
E(ython2 \215a)-.1 E(w\214nder ...".)-.15 E/F3 10.95/Times-Bold@0 SF
(EXAMPLES)72 465.6 Q F0 .226(Here are v)108 477.6 R .226(arious e)-.25 F
.226(xamples of ho)-.15 F 2.725(wt)-.25 G 2.725(oi)-2.725 G -1.9 -.4
(nv o)-2.725 H .425 -.1(ke \215).4 H -.15(aw).1 G(\214nder).15 E 5.225
(.T)-.55 G .225(he \214rst e)-5.225 F .225(xamples sho)-.15 F 2.725(wv)
-.25 G .225(arious simple command-)-2.975 F 1.273(line options.)108
489.6 R(Fla)6.273 E 1.273(w\214nder is designed to w)-.15 F 1.274
(ork well with te)-.1 F 1.274(xt editors and inte)-.15 F 1.274
(grated de)-.15 F -.15(ve)-.25 G 1.274(lopment en).15 F(viron-)-.4 E
(ments, so the ne)108 501.6 Q(xt sections sho)-.15 E 2.5(wh)-.25 G .5
-.25(ow t)-2.5 H 2.5(oi).25 G(nte)-2.5 E(grate \215a)-.15 E
(w\214nder into vim and emacs.)-.15 E F1(Simple command-line options)87
530.4 Q(\215aw\214nder /usr/sr)108 542.4 Q(c/linux-3.16)-.18 E F0 1.705
(Examine all the C/C++ \214les in the directory /usr/src/linux-3.16 and\
all its subdirectories)168 554.4 R(\(recursi)168 566.4 Q -.15(ve)-.25 G