Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/airspyhf-1.6.8/libairspyhf/src/airspyhf.c
Examining data/airspyhf-1.6.8/libairspyhf/src/airspyhf.h
Examining data/airspyhf-1.6.8/libairspyhf/src/airspyhf_commands.h
Examining data/airspyhf-1.6.8/libairspyhf/src/iqbalancer.c
Examining data/airspyhf-1.6.8/libairspyhf/src/iqbalancer.h
Examining data/airspyhf-1.6.8/tools/src/airspyhf_calibrate.c
Examining data/airspyhf-1.6.8/tools/src/airspyhf_gpio.c
Examining data/airspyhf-1.6.8/tools/src/airspyhf_info.c
Examining data/airspyhf-1.6.8/tools/src/airspyhf_lib_version.c
Examining data/airspyhf-1.6.8/tools/src/airspyhf_rx.c

FINAL RESULTS:

data/airspyhf-1.6.8/tools/src/airspyhf_rx.c:59:9:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
#define snprintf _snprintf
data/airspyhf-1.6.8/tools/src/airspyhf_rx.c:59:18:  [4] (format) _snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
#define snprintf _snprintf
data/airspyhf-1.6.8/tools/src/airspyhf_calibrate.c:95:16:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while( (opt = getopt(argc, argv, "?hs:c:")) != EOF ) {
data/airspyhf-1.6.8/tools/src/airspyhf_gpio.c:69:16:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while( (opt = getopt(argc, argv, "s:0:1:2:3:h?")) != EOF ) {
data/airspyhf-1.6.8/tools/src/airspyhf_info.c:101:16:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while( (opt = getopt(argc, argv, "?hs:")) != EOF ) {
data/airspyhf-1.6.8/tools/src/airspyhf_rx.c:441:16:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while( (opt = getopt(argc, argv, "r:ws:f:a:n:g:l:t:m:dhz")) != EOF )
data/airspyhf-1.6.8/libairspyhf/src/airspyhf.c:70:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static const char str_prefix_serial_airspyhf[STR_PREFIX_SERIAL_AIRSPYHF_SIZE] =
data/airspyhf-1.6.8/libairspyhf/src/airspyhf.c:610:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char serial_number[AIRSPYHF_SERIAL_SIZE + 1];
data/airspyhf-1.6.8/libairspyhf/src/airspyhf.c:756:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char serial_number[AIRSPYHF_SERIAL_SIZE + 1];
data/airspyhf-1.6.8/libairspyhf/src/airspyhf.c:1018:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(buffer, device->supported_samplerates, len * sizeof(uint32_t));		
data/airspyhf-1.6.8/libairspyhf/src/airspyhf.c:1275:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(buffer, buf, MIN(length, sizeof(buf)));
data/airspyhf-1.6.8/libairspyhf/src/airspyhf.c:1361:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char version_local[MAX_VERSION_STRING_SIZE];
data/airspyhf-1.6.8/libairspyhf/src/airspyhf.c:1381:4:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			memcpy(version, version_local, length - 1);
data/airspyhf-1.6.8/libairspyhf/src/iqbalancer.c:256:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(fftPtr, iq + n, FFTBins * sizeof(complex_t));
data/airspyhf-1.6.8/libairspyhf/src/iqbalancer.c:473:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(iq_balancer->working_buffer + iq_balancer->working_buffer_pos, iq, count * sizeof(complex_t));
data/airspyhf-1.6.8/tools/src/airspyhf_info.c:45:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		char vstr[255]; // the size of buffer length has to be restricted to 1 byte
data/airspyhf-1.6.8/tools/src/airspyhf_rx.c:101:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char groupID[4]; /* 'RIFF' */
data/airspyhf-1.6.8/tools/src/airspyhf_rx.c:103:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char riffType[4]; /* 'WAVE'*/
data/airspyhf-1.6.8/tools/src/airspyhf_rx.c:109:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char chunkID[4]; /* 'fmt ' */
data/airspyhf-1.6.8/tools/src/airspyhf_rx.c:122:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char chunkID[4]; /* 'data' */
data/airspyhf-1.6.8/tools/src/airspyhf_rx.c:163:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char data[U64TOA_MAX_DIGIT+1];
data/airspyhf-1.6.8/tools/src/airspyhf_rx.c:558:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		char date_time[64];
data/airspyhf-1.6.8/tools/src/airspyhf_rx.c:559:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		char path_file[256];
data/airspyhf-1.6.8/tools/src/airspyhf_rx.c:699:14:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		if( !(fd = fopen(path, "wb")) ) {
data/airspyhf-1.6.8/tools/src/airspyhf_rx.c:748:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		char buf [64];
data/airspyhf-1.6.8/tools/src/airspyhf_rx.c:203:6:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	if( strlen(s) > 2 ) {
data/airspyhf-1.6.8/tools/src/airspyhf_rx.c:231:6:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	if( strlen(s) > 2 ) {
data/airspyhf-1.6.8/tools/src/airspyhf_rx.c:260:27:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	for(p1 = str, p2 = str + strlen(str) - 1; p2 > p1; ++p1, --p2)

ANALYSIS SUMMARY:

Hits = 28
Lines analyzed = 3698 in approximately 0.09 seconds (39614 lines/second)
Physical Source Lines of Code (SLOC) = 2819
Hits@level = [0] 100 [1]   3 [2]  19 [3]   4 [4]   2 [5]   0
Hits@level+ = [0+] 128 [1+]  28 [2+]  25 [3+]   6 [4+]   2 [5+]   0
Hits/KSLOC@level+ = [0+] 45.4062 [1+] 9.9326 [2+] 8.86839 [3+] 2.12841 [4+] 0.709471 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.