Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/flatpak-xdg-utils-1.0.4/src/backport-autoptr.h Examining data/flatpak-xdg-utils-1.0.4/src/flatpak-spawn.c Examining data/flatpak-xdg-utils-1.0.4/src/xdg-email.c Examining data/flatpak-xdg-utils-1.0.4/src/xdg-open.c Examining data/flatpak-xdg-utils-1.0.4/tests/common.c Examining data/flatpak-xdg-utils-1.0.4/tests/common.h Examining data/flatpak-xdg-utils-1.0.4/tests/test-email.c Examining data/flatpak-xdg-utils-1.0.4/tests/test-open.c FINAL RESULTS: data/flatpak-xdg-utils-1.0.4/src/flatpak-spawn.c:504:21: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). int path_fd = open (paths[i], O_PATH|O_CLOEXEC|O_NOFOLLOW|O_RDONLY); data/flatpak-xdg-utils-1.0.4/src/xdg-email.c:376:12: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fd = open (path, O_PATH | O_CLOEXEC); data/flatpak-xdg-utils-1.0.4/src/xdg-open.c:109:12: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fd = open (path, O_RDONLY | O_CLOEXEC); data/flatpak-xdg-utils-1.0.4/src/flatpak-spawn.c:230:10: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). size = read (sfd, &info, sizeof (info)); data/flatpak-xdg-utils-1.0.4/src/xdg-email.c:126:53: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). g_ascii_strncasecmp (addresses[0], "mailto:", strlen ("mailto:")) == 0) data/flatpak-xdg-utils-1.0.4/src/xdg-email.c:145:36: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). strlen ("mailto:")) == 0) data/flatpak-xdg-utils-1.0.4/src/xdg-email.c:147:65: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). g_autofree gchar *rest = g_strdup (addresses[i] + strlen ("mailto:")); data/flatpak-xdg-utils-1.0.4/tests/common.c:54:11: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen (address_buffer) >= sizeof (address_buffer) - 1) data/flatpak-xdg-utils-1.0.4/tests/common.c:60:45: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). address_buffer + strlen (address_buffer), data/flatpak-xdg-utils-1.0.4/tests/common.c:61:54: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). sizeof (address_buffer) - strlen (address_buffer), ANALYSIS SUMMARY: Hits = 10 Lines analyzed = 3270 in approximately 0.12 seconds (27356 lines/second) Physical Source Lines of Code (SLOC) = 2522 Hits@level = [0] 0 [1] 7 [2] 3 [3] 0 [4] 0 [5] 0 Hits@level+ = [0+] 10 [1+] 10 [2+] 3 [3+] 0 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 3.96511 [1+] 3.96511 [2+] 1.18953 [3+] 0 [4+] 0 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.