Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/libelfin-0.3/dwarf/abbrev.cc Examining data/libelfin-0.3/dwarf/attrs.cc Examining data/libelfin-0.3/dwarf/cursor.cc Examining data/libelfin-0.3/dwarf/die.cc Examining data/libelfin-0.3/dwarf/die_str_map.cc Examining data/libelfin-0.3/dwarf/dwarf.cc Examining data/libelfin-0.3/dwarf/elf.cc Examining data/libelfin-0.3/dwarf/expr.cc Examining data/libelfin-0.3/dwarf/line.cc Examining data/libelfin-0.3/dwarf/rangelist.cc Examining data/libelfin-0.3/dwarf/value.cc Examining data/libelfin-0.3/elf/elf.cc Examining data/libelfin-0.3/elf/mmap_loader.cc Examining data/libelfin-0.3/examples/dump-lines.cc Examining data/libelfin-0.3/examples/dump-sections.cc Examining data/libelfin-0.3/examples/dump-segments.cc Examining data/libelfin-0.3/examples/dump-syms.cc Examining data/libelfin-0.3/examples/dump-tree.cc Examining data/libelfin-0.3/examples/find-pc.cc Examining data/libelfin-0.3/test/example.c FINAL RESULTS: data/libelfin-0.3/elf/elf.cc:65:17: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char ei_magic[4]; data/libelfin-0.3/examples/dump-lines.cc:29:18: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). int fd = open(argv[1], O_RDONLY); data/libelfin-0.3/examples/dump-sections.cc:15:18: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). int fd = open(argv[1], O_RDONLY); data/libelfin-0.3/examples/dump-segments.cc:15:18: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). int fd = open(argv[1], O_RDONLY); data/libelfin-0.3/examples/dump-syms.cc:15:18: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). int fd = open(argv[1], O_RDONLY); data/libelfin-0.3/examples/dump-tree.cc:31:18: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). int fd = open(argv[1], O_RDONLY); data/libelfin-0.3/examples/find-pc.cc:73:18: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). int fd = open(argv[1], O_RDONLY); data/libelfin-0.3/dwarf/abbrev.cc:150:15: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). abbrev_entry::read(cursor *cur) data/libelfin-0.3/dwarf/die.cc:29:6: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). die::read(section_offset off) data/libelfin-0.3/dwarf/die.cc:131:11: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). d.read(off); data/libelfin-0.3/dwarf/die.cc:143:19: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). d.read(d.next); data/libelfin-0.3/dwarf/die.cc:157:19: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). d.read(sub->next); data/libelfin-0.3/dwarf/dwarf.cc:195:25: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). m->root.read(m->root_offset); data/libelfin-0.3/dwarf/dwarf.cc:243:22: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). while (entry.read(&c)) { data/libelfin-0.3/dwarf/dwarf.cc:349:25: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). m->type.read(m->type_offset); data/libelfin-0.3/dwarf/value.cc:197:19: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). d.read(off - base_cu->get_section_offset()); data/libelfin-0.3/dwarf/value.cc:215:11: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). d.read(off); ANALYSIS SUMMARY: Hits = 17 Lines analyzed = 3468 in approximately 0.08 seconds (41754 lines/second) Physical Source Lines of Code (SLOC) = 2705 Hits@level = [0] 35 [1] 10 [2] 7 [3] 0 [4] 0 [5] 0 Hits@level+ = [0+] 52 [1+] 17 [2+] 7 [3+] 0 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 19.2237 [1+] 6.28466 [2+] 2.5878 [3+] 0 [4+] 0 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.