Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/libodsstream-0.7.9/src/ods2csv.cpp
Examining data/libodsstream-0.7.9/src/ods2csv.h
Examining data/libodsstream-0.7.9/src/odsstream/calcwriterinterface.h
Examining data/libodsstream-0.7.9/src/odsstream/odsdochandlerinterface.h
Examining data/libodsstream-0.7.9/src/odsstream/odsdocreader.cpp
Examining data/libodsstream-0.7.9/src/odsstream/odsdocreader.h
Examining data/libodsstream-0.7.9/src/odsstream/odsdocwriter.cpp
Examining data/libodsstream-0.7.9/src/odsstream/odsdocwriter.h
Examining data/libodsstream-0.7.9/src/odsstream/odsexception.h
Examining data/libodsstream-0.7.9/src/odsstream/qtablewriter.cpp
Examining data/libodsstream-0.7.9/src/odsstream/qtablewriter.h
Examining data/libodsstream-0.7.9/src/odsstream/reader/odscell.cpp
Examining data/libodsstream-0.7.9/src/odsstream/reader/odscell.h
Examining data/libodsstream-0.7.9/src/odsstream/saxreader/saxhandlercontentxml.cpp
Examining data/libodsstream-0.7.9/src/odsstream/saxreader/saxhandlercontentxml.h
Examining data/libodsstream-0.7.9/src/odsstream/tsvdirectorywriter.cpp
Examining data/libodsstream-0.7.9/src/odsstream/tsvdirectorywriter.h
Examining data/libodsstream-0.7.9/src/odsstream/tsvoutputstream.cpp
Examining data/libodsstream-0.7.9/src/odsstream/tsvoutputstream.h
Examining data/libodsstream-0.7.9/src/odsstream/tsvreader.cpp
Examining data/libodsstream-0.7.9/src/odsstream/tsvreader.h
Examining data/libodsstream-0.7.9/src/odsstream/writer/options/odscolorscale.cpp
Examining data/libodsstream-0.7.9/src/odsstream/writer/options/odscolorscale.h
Examining data/libodsstream-0.7.9/src/odsstream/writer/options/odstablecellstyle.cpp
Examining data/libodsstream-0.7.9/src/odsstream/writer/options/odstablecellstyle.h
Examining data/libodsstream-0.7.9/src/odsstream/writer/options/odstablecellstyleref.cpp
Examining data/libodsstream-0.7.9/src/odsstream/writer/options/odstablecellstyleref.h
Examining data/libodsstream-0.7.9/src/odsstream/writer/options/odstablesettings.cpp
Examining data/libodsstream-0.7.9/src/odsstream/writer/options/odstablesettings.h
Examining data/libodsstream-0.7.9/src/odsstream/writer/structure/contentxml.cpp
Examining data/libodsstream-0.7.9/src/odsstream/writer/structure/contentxml.h
Examining data/libodsstream-0.7.9/src/odsstream/writer/structure/manifestxml.cpp
Examining data/libodsstream-0.7.9/src/odsstream/writer/structure/manifestxml.h
Examining data/libodsstream-0.7.9/src/odsstream/writer/structure/metaxml.cpp
Examining data/libodsstream-0.7.9/src/odsstream/writer/structure/metaxml.h
Examining data/libodsstream-0.7.9/src/odsstream/writer/structure/settingsxml.cpp
Examining data/libodsstream-0.7.9/src/odsstream/writer/structure/settingsxml.h
Examining data/libodsstream-0.7.9/src/odsstream/writer/structure/stylesxml.cpp
Examining data/libodsstream-0.7.9/src/odsstream/writer/structure/stylesxml.h
Examining data/libodsstream-0.7.9/src/tsv2ods.cpp
Examining data/libodsstream-0.7.9/src/tsv2ods.h
Examining data/libodsstream-0.7.9/test/test_ods.cpp
Examining data/libodsstream-0.7.9/test/test_tsv.cpp
Examining data/libodsstream-0.7.9/test/test_zlib.cpp
FINAL RESULTS:
data/libodsstream-0.7.9/src/ods2csv.cpp:400:32: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
QLocale::setDefault(QLocale::system());
data/libodsstream-0.7.9/src/tsv2ods.cpp:289:32: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
QLocale::setDefault(QLocale::system());
data/libodsstream-0.7.9/src/ods2csv.cpp:322:28: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if(!input_stream.open(stdin, QIODevice::ReadOnly))
data/libodsstream-0.7.9/src/odsstream/odsdocreader.cpp:62:15: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if(!odsFile.open(QIODevice::ReadOnly))
data/libodsstream-0.7.9/src/odsstream/odsdocreader.cpp:77:14: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
_p_quaZip->open(QuaZip::mdUnzip);
data/libodsstream-0.7.9/src/odsstream/odsdocwriter.cpp:58:29: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
bool open_ok = _p_quaZip->open(QuaZip::mdCreate);
data/libodsstream-0.7.9/src/odsstream/odsdocwriter.cpp:77:11: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
outFile.open(QIODevice::WriteOnly, info, NULL, crc, 0, 0, true);
data/libodsstream-0.7.9/src/odsstream/tsvdirectorywriter.cpp:102:16: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if(_p_ofile->open(QIODevice::WriteOnly))
data/libodsstream-0.7.9/src/odsstream/tsvreader.cpp:83:15: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if(!tsvFile.open(QIODevice::ReadOnly | QFile::Text))
data/libodsstream-0.7.9/src/odsstream/writer/structure/contentxml.cpp:34:12: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
_outFile.open(QIODevice::WriteOnly, info);
data/libodsstream-0.7.9/src/odsstream/writer/structure/manifestxml.cpp:32:11: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
outFile.open(QIODevice::WriteOnly, info);
data/libodsstream-0.7.9/src/odsstream/writer/structure/metaxml.cpp:112:11: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
outFile.open(QIODevice::WriteOnly, info);
data/libodsstream-0.7.9/src/odsstream/writer/structure/settingsxml.cpp:117:12: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
out_file.open(QIODevice::WriteOnly, info);
data/libodsstream-0.7.9/src/odsstream/writer/structure/stylesxml.cpp:91:11: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
outFile.open(QIODevice::WriteOnly, info);
data/libodsstream-0.7.9/test/test_zlib.cpp:13:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char version[2];
data/libodsstream-0.7.9/test/test_zlib.cpp:14:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char bit_flag[2];
data/libodsstream-0.7.9/test/test_zlib.cpp:15:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char compression_method[2];
data/libodsstream-0.7.9/test/test_zlib.cpp:16:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char last_modification_time[2];
data/libodsstream-0.7.9/test/test_zlib.cpp:17:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char last_modification_date[2];
data/libodsstream-0.7.9/test/test_zlib.cpp:18:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char crc[4];
data/libodsstream-0.7.9/test/test_zlib.cpp:33:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char zip_header_buffer[30];
data/libodsstream-0.7.9/test/test_zlib.cpp:55:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char word[255];
data/libodsstream-0.7.9/test/test_zlib.cpp:144:12: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if(!file.open(QIODevice::ReadOnly))
data/libodsstream-0.7.9/test/test_zlib.cpp:39:13: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
p_device->read(zip_header_buffer, sizeof(char[30]));
data/libodsstream-0.7.9/test/test_zlib.cpp:47:8: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
std::strncpy(zip_header.crc, zip_header_buffer + 14, 4);
data/libodsstream-0.7.9/test/test_zlib.cpp:56:8: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
std::strncpy(word, zip_header.crc, 4);
data/libodsstream-0.7.9/test/test_zlib.cpp:70:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
p_device->read(&one_byte, sizeof(char));
data/libodsstream-0.7.9/test/test_zlib.cpp:97:13: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
p_device->read(word, sizeof(char[zip_header.extra_field_length]));
data/libodsstream-0.7.9/test/test_zlib.cpp:109:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
p_device->read(&one_byte, sizeof(char));
data/libodsstream-0.7.9/test/test_zlib.cpp:126:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
p_device->read(&one_byte, sizeof(char));
ANALYSIS SUMMARY:
Hits = 30
Lines analyzed = 7253 in approximately 0.26 seconds (28423 lines/second)
Physical Source Lines of Code (SLOC) = 4311
Hits@level = [0] 0 [1] 7 [2] 21 [3] 0 [4] 2 [5] 0
Hits@level+ = [0+] 30 [1+] 30 [2+] 23 [3+] 2 [4+] 2 [5+] 0
Hits/KSLOC@level+ = [0+] 6.95894 [1+] 6.95894 [2+] 5.33519 [3+] 0.463929 [4+] 0.463929 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.