Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/fastjet-3.0.6+dfsg/include/fastjet/config.h
Examining data/fastjet-3.0.6+dfsg/include/fastjet/config_win.h
Examining data/fastjet-3.0.6+dfsg/src/RangeDefinition.cc
Examining data/fastjet-3.0.6+dfsg/src/ClusterSequencePassiveArea.cc
Examining data/fastjet-3.0.6+dfsg/src/ClusterSequenceArea.cc
Examining data/fastjet-3.0.6+dfsg/src/LimitedWarning.cc
Examining data/fastjet-3.0.6+dfsg/src/ClusterSequence_N2.cc
Examining data/fastjet-3.0.6+dfsg/src/GhostedAreaSpec.cc
Examining data/fastjet-3.0.6+dfsg/src/ClusterSequenceStructure.cc
Examining data/fastjet-3.0.6+dfsg/src/Dnn4piCylinder.cc
Examining data/fastjet-3.0.6+dfsg/src/MinHeap.cc
Examining data/fastjet-3.0.6+dfsg/src/ClusterSequence.cc
Examining data/fastjet-3.0.6+dfsg/src/PseudoJetStructureBase.cc
Examining data/fastjet-3.0.6+dfsg/src/Dnn2piCylinder.cc
Examining data/fastjet-3.0.6+dfsg/src/JetDefinition.cc
Examining data/fastjet-3.0.6+dfsg/src/Selector.cc
Examining data/fastjet-3.0.6+dfsg/src/CompositeJetStructure.cc
Examining data/fastjet-3.0.6+dfsg/src/ClusterSequence_DumbN3.cc
Examining data/fastjet-3.0.6+dfsg/src/Dnn3piCylinder.cc
Examining data/fastjet-3.0.6+dfsg/src/ClusterSequence_Delaunay.cc
Examining data/fastjet-3.0.6+dfsg/src/ClusterSequence_TiledN2.cc
Examining data/fastjet-3.0.6+dfsg/src/AreaDefinition.cc
Examining data/fastjet-3.0.6+dfsg/src/FunctionOfPseudoJet.cc
Examining data/fastjet-3.0.6+dfsg/src/DnnPlane.cc
Examining data/fastjet-3.0.6+dfsg/src/PseudoJet.cc
Examining data/fastjet-3.0.6+dfsg/src/ClusterSequence1GhostPassiveArea.cc
Examining data/fastjet-3.0.6+dfsg/src/ClusterSequenceActiveArea.cc
Examining data/fastjet-3.0.6+dfsg/src/ClusterSequenceVoronoiArea.cc
Examining data/fastjet-3.0.6+dfsg/src/BasicRandom.cc
Examining data/fastjet-3.0.6+dfsg/src/ClusterSequence_CP2DChan.cc
Examining data/fastjet-3.0.6+dfsg/src/Voronoi.cc
Examining data/fastjet-3.0.6+dfsg/src/ClosestPair2D.cc
Examining data/fastjet-3.0.6+dfsg/src/ClusterSequenceAreaBase.cc
Examining data/fastjet-3.0.6+dfsg/src/ClusterSequenceActiveAreaExplicitGhosts.cc
Examining data/fastjet-3.0.6+dfsg/src/Error.cc
Examining data/fastjet-3.0.6+dfsg/tools/CASubJetTagger.cc
Examining data/fastjet-3.0.6+dfsg/tools/MassDropTagger.cc
Examining data/fastjet-3.0.6+dfsg/tools/Filter.cc
Examining data/fastjet-3.0.6+dfsg/tools/GridMedianBackgroundEstimator.cc
Examining data/fastjet-3.0.6+dfsg/tools/JHTopTagger.cc
Examining data/fastjet-3.0.6+dfsg/tools/Pruner.cc
Examining data/fastjet-3.0.6+dfsg/tools/TopTaggerBase.cc
Examining data/fastjet-3.0.6+dfsg/tools/Subtractor.cc
Examining data/fastjet-3.0.6+dfsg/tools/BackgroundEstimatorBase.cc
Examining data/fastjet-3.0.6+dfsg/tools/JetMedianBackgroundEstimator.cc
Examining data/fastjet-3.0.6+dfsg/tools/RestFrameNSubjettinessTagger.cc
Examining data/fastjet-3.0.6+dfsg/fortran_wrapper/fastjetfortran.cc
Examining data/fastjet-3.0.6+dfsg/plugins/TrackJet/TrackJetPlugin.cc
Examining data/fastjet-3.0.6+dfsg/plugins/D0RunIICone/ConeSplitMerge.hpp
Examining data/fastjet-3.0.6+dfsg/plugins/D0RunIICone/ProtoJet.hpp
Examining data/fastjet-3.0.6+dfsg/plugins/D0RunIICone/D0RunIIConePlugin.cc
Examining data/fastjet-3.0.6+dfsg/plugins/D0RunIICone/HepEntity.h
Examining data/fastjet-3.0.6+dfsg/plugins/D0RunIICone/ILConeAlgorithm.hpp
Examining data/fastjet-3.0.6+dfsg/plugins/D0RunIICone/ConeJetInfo.hpp
Examining data/fastjet-3.0.6+dfsg/plugins/D0RunIICone/inline_maths.h
Examining data/fastjet-3.0.6+dfsg/plugins/CMSIterativeCone/CMSIterativeConePlugin.cc
Examining data/fastjet-3.0.6+dfsg/plugins/CMSIterativeCone/SortByEt.h
Examining data/fastjet-3.0.6+dfsg/plugins/Jade/JadePlugin.cc
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/geom_2d.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/protocones.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/geom_2d.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/protocones.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/hash.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/momentum.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/split_merge.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/hash.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/geom_2d.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/momentum.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/split_merge.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/siscone.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/siscone.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/vicinity.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/protocones.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/vicinity.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/hash.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/momentum.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/split_merge.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/reference.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/quadtree.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/reference.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/area.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/hash.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/geom_2d.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/momentum.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/siscone_error.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/split_merge.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/siscone.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/siscone.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/vicinity.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/circulator.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/quadtree.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/protocones.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/area.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/ranlux.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/ranlux.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/defines.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/vicinity.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/siscone_error.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/sample.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/times.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/main.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/test.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/area.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/spherical.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/options.h
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/options.cpp
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/SISConeSphericalPlugin.cc
Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/SISConePlugin.cc
Examining data/fastjet-3.0.6+dfsg/plugins/D0RunICone/D0RunIBaseConePlugin.cc
Examining data/fastjet-3.0.6+dfsg/plugins/D0RunICone/HepEntityIpre96.h
Examining data/fastjet-3.0.6+dfsg/plugins/D0RunICone/HepEntityI.h
Examining data/fastjet-3.0.6+dfsg/plugins/D0RunICone/ConeClusterAlgo.hpp
Examining data/fastjet-3.0.6+dfsg/plugins/D0RunICone/inline_maths.h
Examining data/fastjet-3.0.6+dfsg/plugins/GridJet/GridJetPlugin.cc
Examining data/fastjet-3.0.6+dfsg/plugins/PxCone/pxcone.h
Examining data/fastjet-3.0.6+dfsg/plugins/PxCone/PxConePlugin.cc
Examining data/fastjet-3.0.6+dfsg/plugins/NestedDefs/NestedDefsPlugin.cc
Examining data/fastjet-3.0.6+dfsg/plugins/EECambridge/EECambridgePlugin.cc
Examining data/fastjet-3.0.6+dfsg/example/11-filter.cc
Examining data/fastjet-3.0.6+dfsg/example/fastjet_areas.cc
Examining data/fastjet-3.0.6+dfsg/example/fastjet_example.cc
Examining data/fastjet-3.0.6+dfsg/example/04-constituents.cc
Examining data/fastjet-3.0.6+dfsg/example/14-groomers.cc
Examining data/fastjet-3.0.6+dfsg/example/ktjet_example.cc
Examining data/fastjet-3.0.6+dfsg/example/03-plugin.cc
Examining data/fastjet-3.0.6+dfsg/example/fastjet_timing_plugins.cc
Examining data/fastjet-3.0.6+dfsg/example/09-user_info.cc
Examining data/fastjet-3.0.6+dfsg/example/05-eplus_eminus.cc
Examining data/fastjet-3.0.6+dfsg/example/10-subjets.cc
Examining data/fastjet-3.0.6+dfsg/example/root/jet-plots.C
Examining data/fastjet-3.0.6+dfsg/example/01-basic.cc
Examining data/fastjet-3.0.6+dfsg/example/02-jetdef.cc
Examining data/fastjet-3.0.6+dfsg/example/13-boosted_top.cc
Examining data/fastjet-3.0.6+dfsg/example/08-selector.cc
Examining data/fastjet-3.0.6+dfsg/example/12-boosted_higgs.cc
Examining data/fastjet-3.0.6+dfsg/example/07-subtraction.cc
Examining data/fastjet-3.0.6+dfsg/example/ktjet_timing.cc
Examining data/fastjet-3.0.6+dfsg/example/06-area.cc
Examining data/fastjet-3.0.6+dfsg/example/CmdLine.cc

FINAL RESULTS:

data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/options.cpp:158:2:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
	strcpy(ev_name, optarg);
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/options.cpp:163:7:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
      strcpy(tmp, optarg);
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/options.cpp:194:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(ev_name, DEFAULT_EVENT);
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/options.cpp:108:17:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
    opt_param = getopt_long(argc, argv, "hvqN:R:f:p:n:e:s:", 
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/test.cpp:69:3:  [3] (random) srand:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
  srand(timestamp.tv_usec);
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/times.cpp:84:3:  [3] (random) srand:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
  srand(timestamp.tv_usec);
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/area.cpp:44:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char fline[512];
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/area.cpp:67:10:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  flux = fopen(opts.ev_name, "r");
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/area.cpp:74:11:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fpart = fopen("particles.dat", "w+");
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/area.cpp:109:10:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  flux = fopen("jets_with_area.dat", "w+");
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/main.cpp:43:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char fline[512];
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/main.cpp:66:10:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  flux = fopen(opts.ev_name, "r");
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/main.cpp:74:11:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fpart = fopen("particles.dat", "w+");
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/main.cpp:109:10:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  flux = fopen("jets.dat", "w+");
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/options.cpp:162:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      char tmp[512];
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/sample.cpp:46:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char fline[512];                // line to read from a file
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/sample.cpp:50:10:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  flux = fopen("events/single-event.dat", "r");
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/spherical.cpp:48:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char fline[512];                // line to read from a file
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/spherical.cpp:52:10:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  flux = fopen("events/single-event.dat", "r");
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/test.cpp:73:10:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  flux = fopen("particles.dat", "w+");
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/test.cpp:103:10:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  flux = fopen("protocones.dat", "w+");
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/times.cpp:86:10:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  flux = fopen("times.dat", "w+");
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/options.cpp:157:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	ev_name = new char[strlen(optarg)+1];
data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/options.cpp:193:24:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    ev_name = new char[strlen(DEFAULT_EVENT)+1];

ANALYSIS SUMMARY:

Hits = 24
Lines analyzed = 35727 in approximately 0.89 seconds (40235 lines/second)
Physical Source Lines of Code (SLOC) = 16440
Hits@level = [0] 112 [1]   2 [2]  16 [3]   3 [4]   3 [5]   0
Hits@level+ = [0+] 136 [1+]  24 [2+]  22 [3+]   6 [4+]   3 [5+]   0
Hits/KSLOC@level+ = [0+] 8.27251 [1+] 1.45985 [2+] 1.3382 [3+] 0.364964 [4+] 0.182482 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.