Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/fastjet-3.0.6+dfsg/include/fastjet/config.h Examining data/fastjet-3.0.6+dfsg/include/fastjet/config_win.h Examining data/fastjet-3.0.6+dfsg/src/RangeDefinition.cc Examining data/fastjet-3.0.6+dfsg/src/ClusterSequencePassiveArea.cc Examining data/fastjet-3.0.6+dfsg/src/ClusterSequenceArea.cc Examining data/fastjet-3.0.6+dfsg/src/LimitedWarning.cc Examining data/fastjet-3.0.6+dfsg/src/ClusterSequence_N2.cc Examining data/fastjet-3.0.6+dfsg/src/GhostedAreaSpec.cc Examining data/fastjet-3.0.6+dfsg/src/ClusterSequenceStructure.cc Examining data/fastjet-3.0.6+dfsg/src/Dnn4piCylinder.cc Examining data/fastjet-3.0.6+dfsg/src/MinHeap.cc Examining data/fastjet-3.0.6+dfsg/src/ClusterSequence.cc Examining data/fastjet-3.0.6+dfsg/src/PseudoJetStructureBase.cc Examining data/fastjet-3.0.6+dfsg/src/Dnn2piCylinder.cc Examining data/fastjet-3.0.6+dfsg/src/JetDefinition.cc Examining data/fastjet-3.0.6+dfsg/src/Selector.cc Examining data/fastjet-3.0.6+dfsg/src/CompositeJetStructure.cc Examining data/fastjet-3.0.6+dfsg/src/ClusterSequence_DumbN3.cc Examining data/fastjet-3.0.6+dfsg/src/Dnn3piCylinder.cc Examining data/fastjet-3.0.6+dfsg/src/ClusterSequence_Delaunay.cc Examining data/fastjet-3.0.6+dfsg/src/ClusterSequence_TiledN2.cc Examining data/fastjet-3.0.6+dfsg/src/AreaDefinition.cc Examining data/fastjet-3.0.6+dfsg/src/FunctionOfPseudoJet.cc Examining data/fastjet-3.0.6+dfsg/src/DnnPlane.cc Examining data/fastjet-3.0.6+dfsg/src/PseudoJet.cc Examining data/fastjet-3.0.6+dfsg/src/ClusterSequence1GhostPassiveArea.cc Examining data/fastjet-3.0.6+dfsg/src/ClusterSequenceActiveArea.cc Examining data/fastjet-3.0.6+dfsg/src/ClusterSequenceVoronoiArea.cc Examining data/fastjet-3.0.6+dfsg/src/BasicRandom.cc Examining data/fastjet-3.0.6+dfsg/src/ClusterSequence_CP2DChan.cc Examining data/fastjet-3.0.6+dfsg/src/Voronoi.cc Examining data/fastjet-3.0.6+dfsg/src/ClosestPair2D.cc Examining data/fastjet-3.0.6+dfsg/src/ClusterSequenceAreaBase.cc Examining data/fastjet-3.0.6+dfsg/src/ClusterSequenceActiveAreaExplicitGhosts.cc Examining data/fastjet-3.0.6+dfsg/src/Error.cc Examining data/fastjet-3.0.6+dfsg/tools/CASubJetTagger.cc Examining data/fastjet-3.0.6+dfsg/tools/MassDropTagger.cc Examining data/fastjet-3.0.6+dfsg/tools/Filter.cc Examining data/fastjet-3.0.6+dfsg/tools/GridMedianBackgroundEstimator.cc Examining data/fastjet-3.0.6+dfsg/tools/JHTopTagger.cc Examining data/fastjet-3.0.6+dfsg/tools/Pruner.cc Examining data/fastjet-3.0.6+dfsg/tools/TopTaggerBase.cc Examining data/fastjet-3.0.6+dfsg/tools/Subtractor.cc Examining data/fastjet-3.0.6+dfsg/tools/BackgroundEstimatorBase.cc Examining data/fastjet-3.0.6+dfsg/tools/JetMedianBackgroundEstimator.cc Examining data/fastjet-3.0.6+dfsg/tools/RestFrameNSubjettinessTagger.cc Examining data/fastjet-3.0.6+dfsg/fortran_wrapper/fastjetfortran.cc Examining data/fastjet-3.0.6+dfsg/plugins/TrackJet/TrackJetPlugin.cc Examining data/fastjet-3.0.6+dfsg/plugins/D0RunIICone/ConeSplitMerge.hpp Examining data/fastjet-3.0.6+dfsg/plugins/D0RunIICone/ProtoJet.hpp Examining data/fastjet-3.0.6+dfsg/plugins/D0RunIICone/D0RunIIConePlugin.cc Examining data/fastjet-3.0.6+dfsg/plugins/D0RunIICone/HepEntity.h Examining data/fastjet-3.0.6+dfsg/plugins/D0RunIICone/ILConeAlgorithm.hpp Examining data/fastjet-3.0.6+dfsg/plugins/D0RunIICone/ConeJetInfo.hpp Examining data/fastjet-3.0.6+dfsg/plugins/D0RunIICone/inline_maths.h Examining data/fastjet-3.0.6+dfsg/plugins/CMSIterativeCone/CMSIterativeConePlugin.cc Examining data/fastjet-3.0.6+dfsg/plugins/CMSIterativeCone/SortByEt.h Examining data/fastjet-3.0.6+dfsg/plugins/Jade/JadePlugin.cc Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/geom_2d.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/protocones.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/geom_2d.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/protocones.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/hash.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/momentum.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/split_merge.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/hash.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/geom_2d.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/momentum.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/split_merge.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/siscone.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/siscone.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/vicinity.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/protocones.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/spherical/vicinity.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/hash.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/momentum.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/split_merge.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/reference.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/quadtree.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/reference.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/area.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/hash.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/geom_2d.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/momentum.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/siscone_error.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/split_merge.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/siscone.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/siscone.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/vicinity.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/circulator.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/quadtree.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/protocones.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/area.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/ranlux.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/ranlux.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/defines.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/vicinity.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/siscone/siscone_error.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/sample.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/times.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/main.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/test.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/area.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/spherical.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/options.h Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/options.cpp Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/SISConeSphericalPlugin.cc Examining data/fastjet-3.0.6+dfsg/plugins/SISCone/SISConePlugin.cc Examining data/fastjet-3.0.6+dfsg/plugins/D0RunICone/D0RunIBaseConePlugin.cc Examining data/fastjet-3.0.6+dfsg/plugins/D0RunICone/HepEntityIpre96.h Examining data/fastjet-3.0.6+dfsg/plugins/D0RunICone/HepEntityI.h Examining data/fastjet-3.0.6+dfsg/plugins/D0RunICone/ConeClusterAlgo.hpp Examining data/fastjet-3.0.6+dfsg/plugins/D0RunICone/inline_maths.h Examining data/fastjet-3.0.6+dfsg/plugins/GridJet/GridJetPlugin.cc Examining data/fastjet-3.0.6+dfsg/plugins/PxCone/pxcone.h Examining data/fastjet-3.0.6+dfsg/plugins/PxCone/PxConePlugin.cc Examining data/fastjet-3.0.6+dfsg/plugins/NestedDefs/NestedDefsPlugin.cc Examining data/fastjet-3.0.6+dfsg/plugins/EECambridge/EECambridgePlugin.cc Examining data/fastjet-3.0.6+dfsg/example/11-filter.cc Examining data/fastjet-3.0.6+dfsg/example/fastjet_areas.cc Examining data/fastjet-3.0.6+dfsg/example/fastjet_example.cc Examining data/fastjet-3.0.6+dfsg/example/04-constituents.cc Examining data/fastjet-3.0.6+dfsg/example/14-groomers.cc Examining data/fastjet-3.0.6+dfsg/example/ktjet_example.cc Examining data/fastjet-3.0.6+dfsg/example/03-plugin.cc Examining data/fastjet-3.0.6+dfsg/example/fastjet_timing_plugins.cc Examining data/fastjet-3.0.6+dfsg/example/09-user_info.cc Examining data/fastjet-3.0.6+dfsg/example/05-eplus_eminus.cc Examining data/fastjet-3.0.6+dfsg/example/10-subjets.cc Examining data/fastjet-3.0.6+dfsg/example/root/jet-plots.C Examining data/fastjet-3.0.6+dfsg/example/01-basic.cc Examining data/fastjet-3.0.6+dfsg/example/02-jetdef.cc Examining data/fastjet-3.0.6+dfsg/example/13-boosted_top.cc Examining data/fastjet-3.0.6+dfsg/example/08-selector.cc Examining data/fastjet-3.0.6+dfsg/example/12-boosted_higgs.cc Examining data/fastjet-3.0.6+dfsg/example/07-subtraction.cc Examining data/fastjet-3.0.6+dfsg/example/ktjet_timing.cc Examining data/fastjet-3.0.6+dfsg/example/06-area.cc Examining data/fastjet-3.0.6+dfsg/example/CmdLine.cc FINAL RESULTS: data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/options.cpp:158:2: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(ev_name, optarg); data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/options.cpp:163:7: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(tmp, optarg); data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/options.cpp:194:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(ev_name, DEFAULT_EVENT); data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/options.cpp:108:17: [3] (buffer) getopt_long: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. opt_param = getopt_long(argc, argv, "hvqN:R:f:p:n:e:s:", data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/test.cpp:69:3: [3] (random) srand: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. srand(timestamp.tv_usec); data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/times.cpp:84:3: [3] (random) srand: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. srand(timestamp.tv_usec); data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/area.cpp:44:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char fline[512]; data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/area.cpp:67:10: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). flux = fopen(opts.ev_name, "r"); data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/area.cpp:74:11: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fpart = fopen("particles.dat", "w+"); data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/area.cpp:109:10: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). flux = fopen("jets_with_area.dat", "w+"); data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/main.cpp:43:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char fline[512]; data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/main.cpp:66:10: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). flux = fopen(opts.ev_name, "r"); data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/main.cpp:74:11: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fpart = fopen("particles.dat", "w+"); data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/main.cpp:109:10: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). flux = fopen("jets.dat", "w+"); data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/options.cpp:162:7: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char tmp[512]; data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/sample.cpp:46:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char fline[512]; // line to read from a file data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/sample.cpp:50:10: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). flux = fopen("events/single-event.dat", "r"); data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/spherical.cpp:48:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char fline[512]; // line to read from a file data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/spherical.cpp:52:10: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). flux = fopen("events/single-event.dat", "r"); data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/test.cpp:73:10: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). flux = fopen("particles.dat", "w+"); data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/test.cpp:103:10: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). flux = fopen("protocones.dat", "w+"); data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/times.cpp:86:10: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). flux = fopen("times.dat", "w+"); data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/options.cpp:157:21: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). ev_name = new char[strlen(optarg)+1]; data/fastjet-3.0.6+dfsg/plugins/SISCone/siscone/examples/options.cpp:193:24: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). ev_name = new char[strlen(DEFAULT_EVENT)+1]; ANALYSIS SUMMARY: Hits = 24 Lines analyzed = 35727 in approximately 0.89 seconds (40235 lines/second) Physical Source Lines of Code (SLOC) = 16440 Hits@level = [0] 112 [1] 2 [2] 16 [3] 3 [4] 3 [5] 0 Hits@level+ = [0+] 136 [1+] 24 [2+] 22 [3+] 6 [4+] 3 [5+] 0 Hits/KSLOC@level+ = [0+] 8.27251 [1+] 1.45985 [2+] 1.3382 [3+] 0.364964 [4+] 0.182482 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.