Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/libbtbb-2018.12.R1/lib/src/bluetooth_le_packet.c
Examining data/libbtbb-2018.12.R1/lib/src/bluetooth_le_packet.h
Examining data/libbtbb-2018.12.R1/lib/src/bluetooth_packet.c
Examining data/libbtbb-2018.12.R1/lib/src/bluetooth_packet.h
Examining data/libbtbb-2018.12.R1/lib/src/bluetooth_piconet.c
Examining data/libbtbb-2018.12.R1/lib/src/bluetooth_piconet.h
Examining data/libbtbb-2018.12.R1/lib/src/btbb.h
Examining data/libbtbb-2018.12.R1/lib/src/companies.c
Examining data/libbtbb-2018.12.R1/lib/src/pcap-common.h
Examining data/libbtbb-2018.12.R1/lib/src/pcap.c
Examining data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c
Examining data/libbtbb-2018.12.R1/lib/src/pcapng-bt.h
Examining data/libbtbb-2018.12.R1/lib/src/pcapng.c
Examining data/libbtbb-2018.12.R1/lib/src/pcapng.h
Examining data/libbtbb-2018.12.R1/lib/src/sw_check_tables.h
Examining data/libbtbb-2018.12.R1/lib/src/uthash.h
Examining data/libbtbb-2018.12.R1/tests/test_fec23.c
Examining data/libbtbb-2018.12.R1/tests/test_header.c
Examining data/libbtbb-2018.12.R1/tests/test_syndromes.c
Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btatt/moduleinfo.h
Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btatt/packet-btatt.c
Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btbb/moduleinfo.h
Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btbb/packet-btbb.c
Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btbb/packet-btbrlmp.c
Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btbredr/moduleinfo.h
Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btbredr/packet-btbredr.c
Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btbredr/packet-btlmp.c
Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btle/moduleinfo.h
Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btle/packet-btle.c
Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btsm/moduleinfo.h
Examining data/libbtbb-2018.12.R1/wireshark/plugins-legacy/btsm/packet-btsm.c
Examining data/libbtbb-2018.12.R1/wireshark/plugins/btbb/moduleinfo.h
Examining data/libbtbb-2018.12.R1/wireshark/plugins/btbb/packet-btbb.c
Examining data/libbtbb-2018.12.R1/wireshark/plugins/btbb/packet-btbrlmp.c
Examining data/libbtbb-2018.12.R1/wireshark/plugins/btbredr/moduleinfo.h
Examining data/libbtbb-2018.12.R1/wireshark/plugins/btbredr/packet-btbredr.c
Examining data/libbtbb-2018.12.R1/wireshark/plugins/btbredr/packet-btlmp.c

FINAL RESULTS:

data/libbtbb-2018.12.R1/lib/src/uthash.h:286:29:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
#define HASH_OOPS(...) do { fprintf(stderr,__VA_ARGS__); exit(-1); } while (0)
data/libbtbb-2018.12.R1/lib/src/bluetooth_le_packet.c:348:78:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
static void _dump_addr(const char *name, const uint8_t *buf, int offset, int random) {
data/libbtbb-2018.12.R1/lib/src/bluetooth_le_packet.c:353:20:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
	printf(" (%s)\n", random ? "random" : "public");
data/libbtbb-2018.12.R1/lib/src/bluetooth_le_packet.c:285:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy((*pkt)->symbols, stream, MAX_LE_SYMBOLS);
data/libbtbb-2018.12.R1/lib/src/bluetooth_packet.c:1147:4:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
			char corrected[80];
data/libbtbb-2018.12.R1/lib/src/bluetooth_packet.c:1183:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char header[18];
data/libbtbb-2018.12.R1/lib/src/bluetooth_packet.c:1184:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char unwhitened[18];
data/libbtbb-2018.12.R1/lib/src/bluetooth_packet.c:1203:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char header[18];
data/libbtbb-2018.12.R1/lib/src/bluetooth_packet.h:71:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char packet_header[18];
data/libbtbb-2018.12.R1/lib/src/bluetooth_packet.h:76:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char payload_header[16];
data/libbtbb-2018.12.R1/lib/src/bluetooth_packet.h:99:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char payload[MAX_PAYLOAD_LENGTH];
data/libbtbb-2018.12.R1/lib/src/bluetooth_packet.h:110:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char symbols[MAX_SYMBOLS];
data/libbtbb-2018.12.R1/lib/src/bluetooth_piconet.c:30:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char perm_table[0x20][0x20][0x200];
data/libbtbb-2018.12.R1/lib/src/pcap.c:59:20:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	FILE *pcap_file = fopen(filename, "w");
data/libbtbb-2018.12.R1/lib/src/pcap.c:163:10:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		(void) memcpy( &pkt->bredr_bb_header.bredr_payload[0], payload, caplen );
data/libbtbb-2018.12.R1/lib/src/pcap.c:308:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	(void) memcpy( &pkt->le_packet[0], lepkt, incl_len );
data/libbtbb-2018.12.R1/lib/src/pcap.c:412:10:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		(void) memcpy( &pcap_pkt.le_packet[0], &pkt->symbols[0], incl_len);
data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:38:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		char libname[8];
data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:139:4:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
			char desc[256];
data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:222:10:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		(void) memcpy( &pkt->bredr_bb_header.bredr_payload[0], payload, caplen );
data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:242:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char payload_bytes[caplen];
data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:383:4:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
			char desc[256];
data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:456:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	(void) memcpy( &pkt->le_packet[0], lepkt, caplen );
data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:508:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	(void) memcpy( &cropt.connection_info.pdu.bytes[0], pdu, 34 );
data/libbtbb-2018.12.R1/lib/src/pcapng.c:57:15:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	handle->fd = open( filename, O_RDWR|O_CREAT|O_EXCL, S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP );
data/libbtbb-2018.12.R1/lib/src/pcapng.c:201:11:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			(void) memcpy( dest, &padopt, sizeof( padopt ) );
data/libbtbb-2018.12.R1/lib/src/pcapng.c:210:11:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			(void) memcpy( dest, &padopt, sizeof( padopt ) );
data/libbtbb-2018.12.R1/lib/src/pcapng.c:238:11:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			(void) memcpy( dest, section_option, copysz );
data/libbtbb-2018.12.R1/lib/src/pcapng.c:245:11:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			(void) memcpy( dest, &padopt, sizeof( padopt ) );
data/libbtbb-2018.12.R1/lib/src/pcapng.c:268:11:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			(void) memcpy( dest, interface_option, copysz );
data/libbtbb-2018.12.R1/lib/src/pcapng.c:275:11:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			(void) memcpy( dest, &padopt, sizeof( padopt ) );
data/libbtbb-2018.12.R1/tests/test_fec23.c:38:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char input[20][15] = {
data/libbtbb-2018.12.R1/tests/test_fec23.c:63:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char output[20][15] = {
data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:146:11:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
			(void) strncpy( &ifopt.desc[0], interface_desc, 256 );
data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:148:33:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			ifopt.header.option_length = strlen( ifopt.desc );
data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:390:11:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
			(void) strncpy( &ifopt.desc[0], interface_desc, 256 );
data/libbtbb-2018.12.R1/lib/src/pcapng-bt.c:392:33:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			ifopt.header.option_length = strlen( ifopt.desc );
data/libbtbb-2018.12.R1/lib/src/uthash.h:262:41:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    HASH_FIND(hh,head,findstr,(unsigned)strlen(findstr),out)
data/libbtbb-2018.12.R1/lib/src/uthash.h:264:34:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    HASH_ADD(hh,head,strfield[0],strlen(add->strfield),add)
data/libbtbb-2018.12.R1/lib/src/uthash.h:266:48:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    HASH_REPLACE(hh,head,strfield[0],(unsigned)strlen(add->strfield),add,replaced)

ANALYSIS SUMMARY:

Hits = 40
Lines analyzed = 24723 in approximately 0.67 seconds (36864 lines/second)
Physical Source Lines of Code (SLOC) = 20112
Hits@level = [0] 145 [1]   7 [2]  30 [3]   2 [4]   1 [5]   0
Hits@level+ = [0+] 185 [1+]  40 [2+]  33 [3+]   3 [4+]   1 [5+]   0
Hits/KSLOC@level+ = [0+] 9.19849 [1+] 1.98886 [2+] 1.64081 [3+] 0.149165 [4+] 0.0497216 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.