Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/flashbench-62/dev.c
Examining data/flashbench-62/dev.h
Examining data/flashbench-62/erase.c
Examining data/flashbench-62/flashbench.c
Examining data/flashbench-62/vm.c
Examining data/flashbench-62/vm.h

FINAL RESULTS:

data/flashbench-62/vm.c:320:4:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
			printf(size_y ? "\n" : " ");
data/flashbench-62/vm.h:100:41:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
#define pr_debug(...) do { if (verbose) printf(__VA_ARGS__); } while(0)
data/flashbench-62/vm.h:101:30:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
#define return_err(...) do { printf(__VA_ARGS__); return NULL; } while(0)
data/flashbench-62/flashbench.c:473:9:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
			bool random)
data/flashbench-62/flashbench.c:493:32:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
                            { (random ? O_OFF_RAND : O_OFF_LIN),
data/flashbench-62/flashbench.c:515:9:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
			bool random)
data/flashbench-62/flashbench.c:538:32:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
                            { (random ? O_OFF_RAND : O_OFF_LIN),
data/flashbench-62/flashbench.c:554:10:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
				bool random)
data/flashbench-62/flashbench.c:573:30:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
                            {random ? O_OFF_RAND : O_OFF_LIN, erasesize / blocksize, -1},
data/flashbench-62/flashbench.c:609:7:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
	bool random;
data/flashbench-62/flashbench.c:657:7:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
		c = getopt_long(argc, argv, "o:siafF:Ovrc:b:e:p", long_options, &optind);
data/flashbench-62/flashbench.c:805:26:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
				   args.fat_nr, args.random);
data/flashbench-62/flashbench.c:823:42:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
				  args.open_au_nr, args.offset, args.random);
data/flashbench-62/dev.c:125:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	dev->fd = open(filename, O_RDWR | O_DIRECT | O_SYNC | O_NOATIME);
data/flashbench-62/erase.c:14:11:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	int fd = open(argv[1], O_RDWR | O_DIRECT);
data/flashbench-62/flashbench.c:89:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char buf[8];
data/flashbench-62/flashbench.c:100:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char buf[8];
data/flashbench-62/flashbench.c:142:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char min[8], avg[8], max[8];
data/flashbench-62/flashbench.c:293:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char pre_s[8], on_s[8], post_s[8], diff_s[8];
data/flashbench-62/flashbench.c:672:26:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
			args->scatter_order = atoi(optarg);
data/flashbench-62/flashbench.c:676:25:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
			args->scatter_span = atoi(optarg);
data/flashbench-62/flashbench.c:688:27:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
			args->interval_order = atoi(optarg);
data/flashbench-62/flashbench.c:696:19:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
			args->fat_nr = atoi(optarg);
data/flashbench-62/flashbench.c:704:23:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
			args->open_au_nr = atoi(optarg);
data/flashbench-62/flashbench.c:720:18:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
			args->count = atoi(optarg);
data/flashbench-62/flashbench.c:724:22:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
			args->blocksize = atoi(optarg);
data/flashbench-62/flashbench.c:728:22:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
			args->erasesize = atoi(optarg);
data/flashbench-62/flashbench.c:768:9:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	return fopen(filename, "w+");
data/flashbench-62/vm.h:20:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char s[8];
data/flashbench-62/vm.c:276:11:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	for (x = strlen(out.s); x<7; x++)

ANALYSIS SUMMARY:

Hits = 30
Lines analyzed = 1906 in approximately 0.13 seconds (14830 lines/second)
Physical Source Lines of Code (SLOC) = 1501
Hits@level = [0]  52 [1]   1 [2]  16 [3]  10 [4]   3 [5]   0
Hits@level+ = [0+]  82 [1+]  30 [2+]  29 [3+]  13 [4+]   3 [5+]   0
Hits/KSLOC@level+ = [0+] 54.6302 [1+] 19.9867 [2+] 19.3205 [3+] 8.66089 [4+] 1.99867 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.