Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/bitlbee-facebook-1.2.1/facebook/facebook-api.c Examining data/bitlbee-facebook-1.2.1/facebook/facebook-api.h Examining data/bitlbee-facebook-1.2.1/facebook/facebook-data.c Examining data/bitlbee-facebook-1.2.1/facebook/facebook-data.h Examining data/bitlbee-facebook-1.2.1/facebook/facebook-glib.h Examining data/bitlbee-facebook-1.2.1/facebook/facebook-http.c Examining data/bitlbee-facebook-1.2.1/facebook/facebook-http.h Examining data/bitlbee-facebook-1.2.1/facebook/facebook-id.h Examining data/bitlbee-facebook-1.2.1/facebook/facebook-json.c Examining data/bitlbee-facebook-1.2.1/facebook/facebook-json.h Examining data/bitlbee-facebook-1.2.1/facebook/facebook-mqtt.c Examining data/bitlbee-facebook-1.2.1/facebook/facebook-mqtt.h Examining data/bitlbee-facebook-1.2.1/facebook/facebook-thrift.c Examining data/bitlbee-facebook-1.2.1/facebook/facebook-thrift.h Examining data/bitlbee-facebook-1.2.1/facebook/facebook-util.c Examining data/bitlbee-facebook-1.2.1/facebook/facebook-util.h Examining data/bitlbee-facebook-1.2.1/facebook/facebook.c FINAL RESULTS: data/bitlbee-facebook-1.2.1/facebook/facebook-api.c:2070:21: [3] (random) g_random_int: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. priv->mid = g_random_int(); data/bitlbee-facebook-1.2.1/facebook/facebook-api.c:2824:50: [3] (random) g_random_int: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. mid = FB_API_MSGID(g_get_real_time() / 1000, g_random_int()); data/bitlbee-facebook-1.2.1/facebook/facebook-util.c:252:13: [3] (random) g_rand_int_range: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. j = g_rand_int_range(rand, 0, charc); data/bitlbee-facebook-1.2.1/facebook/facebook-mqtt.c:868:9: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(data, priv->bytes->data + priv->pos, size); data/bitlbee-facebook-1.2.1/facebook/facebook-thrift.c:136:9: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(data, priv->bytes->data + priv->pos, size); data/bitlbee-facebook-1.2.1/facebook/facebook-thrift.c:192:9: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(value, &i64, size); data/bitlbee-facebook-1.2.1/facebook/facebook-thrift.c:514:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&i64, &value, size); data/bitlbee-facebook-1.2.1/facebook/facebook.c:464:30: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if ((gc == NULL) && (open != 0)) { data/bitlbee-facebook-1.2.1/facebook/facebook-api.c:2073:9: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(priv->cid) > 20) { data/bitlbee-facebook-1.2.1/facebook/facebook-api.c:2621:33: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). g_return_val_if_fail(len == strlen(decoded), users); data/bitlbee-facebook-1.2.1/facebook/facebook-api.c:2903:51: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). bytes = g_byte_array_new_take((guint8 *) msg, strlen(msg)); data/bitlbee-facebook-1.2.1/facebook/facebook-http.c:410:30: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if ((header != NULL) && (strlen(header) > 0)) { data/bitlbee-facebook-1.2.1/facebook/facebook-http.c:423:28: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if ((body != NULL) && (strlen(body) > 0)) { data/bitlbee-facebook-1.2.1/facebook/facebook-http.c:493:16: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). size = strlen(prms); data/bitlbee-facebook-1.2.1/facebook/facebook-json.c:262:16: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). size = strlen(data); data/bitlbee-facebook-1.2.1/facebook/facebook-mqtt.c:987:12: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). size = strlen(value); data/bitlbee-facebook-1.2.1/facebook/facebook-thrift.c:576:12: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). size = strlen(value); data/bitlbee-facebook-1.2.1/facebook/facebook-util.c:281:12: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). size = strlen(str); data/bitlbee-facebook-1.2.1/facebook/facebook.c:659:17: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(thrd->topic) > 20) { ANALYSIS SUMMARY: Hits = 19 Lines analyzed = 13329 in approximately 0.25 seconds (53331 lines/second) Physical Source Lines of Code (SLOC) = 7955 Hits@level = [0] 0 [1] 11 [2] 5 [3] 3 [4] 0 [5] 0 Hits@level+ = [0+] 19 [1+] 19 [2+] 8 [3+] 3 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 2.38843 [1+] 2.38843 [2+] 1.00566 [3+] 0.377121 [4+] 0 [5+] 0 Dot directories skipped = 2 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.