Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/gimp-dds-3.0.1/ddswrite.c Examining data/gimp-dds-3.0.1/color.c Examining data/gimp-dds-3.0.1/dxt.h Examining data/gimp-dds-3.0.1/ddsread.c Examining data/gimp-dds-3.0.1/dds.h Examining data/gimp-dds-3.0.1/dds.c Examining data/gimp-dds-3.0.1/imath.h Examining data/gimp-dds-3.0.1/misc.c Examining data/gimp-dds-3.0.1/endian.h Examining data/gimp-dds-3.0.1/mipmap.c Examining data/gimp-dds-3.0.1/mktables.c Examining data/gimp-dds-3.0.1/mipmap.h Examining data/gimp-dds-3.0.1/dxt_tables.h Examining data/gimp-dds-3.0.1/misc.h Examining data/gimp-dds-3.0.1/ddsplugin.h Examining data/gimp-dds-3.0.1/color.h Examining data/gimp-dds-3.0.1/dxt.c Examining data/gimp-dds-3.0.1/vec.h FINAL RESULTS: data/gimp-dds-3.0.1/dds.h:156:4: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char fourcc[4]; data/gimp-dds-3.0.1/dds.h:190:16: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char pad[4 * 11]; data/gimp-dds-3.0.1/ddsread.c:97:9: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fp = fopen(filename, "rb"); data/gimp-dds-3.0.1/ddsread.c:450:13: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char buf[DDS_HEADERSIZE]; data/gimp-dds-3.0.1/ddsread.c:497:4: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[DDS_HEADERSIZE_DX10]; data/gimp-dds-3.0.1/ddsread.c:1055:10: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(pixels + n * drawable->width * d->gimp_bpp, data/gimp-dds-3.0.1/ddswrite.c:52:14: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static const char *cubemap_face_names[4][6] = data/gimp-dds-3.0.1/ddswrite.c:511:9: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fp = fopen(filename, "wb"); data/gimp-dds-3.0.1/ddswrite.c:884:13: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(dst, src, w * h * bpp); data/gimp-dds-3.0.1/ddswrite.c:963:13: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(fmtdst, src, w * h * bpp); data/gimp-dds-3.0.1/ddswrite.c:1088:13: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char hdr[DDS_HEADERSIZE], hdr10[DDS_HEADERSIZE_DX10]; data/gimp-dds-3.0.1/ddswrite.c:1096:13: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char zero[4] = {0, 0, 0, 0}; data/gimp-dds-3.0.1/dxt.c:831:13: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char colors[4][3], *maxcolor, *mincolor; data/gimp-dds-3.0.1/dxt.c:967:13: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char block[64], *p; data/gimp-dds-3.0.1/dxt.c:988:13: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char block[64], *p; data/gimp-dds-3.0.1/dxt.c:1010:13: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char block[64], *p; data/gimp-dds-3.0.1/dxt.c:1032:13: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char block[64], *p; data/gimp-dds-3.0.1/dxt.c:1053:13: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char block[64], *p; data/gimp-dds-3.0.1/dxt.c:1075:13: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char block[64], *p; data/gimp-dds-3.0.1/dxt.c:1207:13: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char colors[4][3]; data/gimp-dds-3.0.1/dxt.c:1365:13: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char block[16 * 4]; data/gimp-dds-3.0.1/dxt_tables.h:4:23: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static const unsigned char quantRB[256 + 16] = data/gimp-dds-3.0.1/dxt_tables.h:42:23: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static const unsigned char quantG[256 + 16] = data/gimp-dds-3.0.1/dxt_tables.h:80:23: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static const unsigned char omatch5[256][2] = data/gimp-dds-3.0.1/dxt_tables.h:148:23: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static const unsigned char omatch6[256][2] = data/gimp-dds-3.0.1/mipmap.c:913:4: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(dst, src, width * height * bpp); data/gimp-dds-3.0.1/mipmap.c:988:4: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(dst, src, width * height * depth * bpp); data/gimp-dds-3.0.1/mktables.c:53:13: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char expand5[32]; data/gimp-dds-3.0.1/mktables.c:54:13: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char expand6[64]; data/gimp-dds-3.0.1/mktables.c:55:13: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char quantRB[256 + 16]; data/gimp-dds-3.0.1/mktables.c:56:13: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char quantG[256 + 16]; data/gimp-dds-3.0.1/mktables.c:57:13: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char omatch5[256][2]; data/gimp-dds-3.0.1/mktables.c:58:13: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char omatch6[256][2]; data/gimp-dds-3.0.1/mktables.c:60:9: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fp = fopen("dxt_tables.h", "w"); ANALYSIS SUMMARY: Hits = 34 Lines analyzed = 7622 in approximately 0.27 seconds (28474 lines/second) Physical Source Lines of Code (SLOC) = 6087 Hits@level = [0] 23 [1] 0 [2] 34 [3] 0 [4] 0 [5] 0 Hits@level+ = [0+] 57 [1+] 34 [2+] 34 [3+] 0 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 9.36422 [1+] 5.58567 [2+] 5.58567 [3+] 0 [4+] 0 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.