Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/libofa-0.9.3/include/ofa1/ofa.h
Examining data/libofa-0.9.3/lib/error_op.h
Examining data/libofa-0.9.3/lib/fftlib_op.h
Examining data/libofa-0.9.3/lib/fft_op.h
Examining data/libofa-0.9.3/lib/frametracker_op.h
Examining data/libofa-0.9.3/lib/signal_op.h
Examining data/libofa-0.9.3/lib/trackdata_op.h
Examining data/libofa-0.9.3/lib/trackframe_op.h
Examining data/libofa-0.9.3/lib/tracklist_op.h
Examining data/libofa-0.9.3/lib/fftlibw3_op.cpp
Examining data/libofa-0.9.3/lib/fft_op.cpp
Examining data/libofa-0.9.3/lib/frametracker_op.cpp
Examining data/libofa-0.9.3/lib/mainprint.cpp
Examining data/libofa-0.9.3/lib/trackdata_op.cpp
Examining data/libofa-0.9.3/lib/trackframe_op.cpp
Examining data/libofa-0.9.3/lib/tracklist_op.cpp
Examining data/libofa-0.9.3/lib/fftlibvdsp_op.cpp
Examining data/libofa-0.9.3/lib/JAMA/jama_svd.h
Examining data/libofa-0.9.3/lib/JAMA/tnt_array1d.h
Examining data/libofa-0.9.3/lib/JAMA/tnt_array1d_utils.h
Examining data/libofa-0.9.3/lib/JAMA/tnt_array2d.h
Examining data/libofa-0.9.3/lib/JAMA/tnt_array2d_utils.h
Examining data/libofa-0.9.3/lib/JAMA/tnt_math_utils.h
Examining data/libofa-0.9.3/lib/AFLIB/aflibConverter.cpp
Examining data/libofa-0.9.3/lib/AFLIB/aflibConverter.h
Examining data/libofa-0.9.3/lib/AFLIB/aflibConverterLargeFilter.h
Examining data/libofa-0.9.3/lib/AFLIB/aflibConverterSmallFilter.h
Examining data/libofa-0.9.3/lib/signal_op.cpp
Examining data/libofa-0.9.3/examples/protocol.h
Examining data/libofa-0.9.3/examples/example.cpp
Examining data/libofa-0.9.3/examples/protocol.cpp
Examining data/libofa-0.9.3/examples/uselame.cpp
Examining data/libofa-0.9.3/examples/wavefile.cpp
Examining data/libofa-0.9.3/debian/tests/test.cpp

FINAL RESULTS:

data/libofa-0.9.3/examples/example.cpp:29:6:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
	    strcpy(fext, p+1);
data/libofa-0.9.3/examples/protocol.cpp:232:5:  [4] (format) sprintf:
  Potential format string problem (CWE-134). Make format string constant.
    sprintf(buf, lookupByPrint ? request_format : request_format2, 
data/libofa-0.9.3/examples/uselame.cpp:36:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(cmd,"lame --decode \"%s\" fpTemp.wav", file);	
data/libofa-0.9.3/examples/uselame.cpp:59:9:  [4] (shell) execv:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
    if (execv(cmd, (char **) argv) == -1) {
data/libofa-0.9.3/examples/uselame.cpp:37:10:  [3] (shell) CreateProcess:
  This causes a new process to execute and is difficult to use safely
  (CWE-78). Specify the application path in the first argument, NOT as part
  of the second, or embedded spaces could allow an attacker to force a
  different program to run.
    if (!CreateProcess(NULL, // No module name (use command line).
data/libofa-0.9.3/examples/uselame.cpp:37:10:  [3] (shell) CreateProcess:
  This causes a new process to execute and is difficult to use safely
  (CWE-78). Specify the application path in the first argument, NOT as part
  of the second, or embedded spaces could allow an attacker to force a
  different program to run.
    if (!CreateProcess(NULL, // No module name (use command line).
data/libofa-0.9.3/examples/example.cpp:26:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char fext[100] = "";
data/libofa-0.9.3/examples/protocol.cpp:172:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char num[10];
data/libofa-0.9.3/examples/protocol.cpp:173:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(num, "%d", XML_GetCurrentLineNumber(parser));
data/libofa-0.9.3/examples/uselame.cpp:58:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char * argv[4] = {cmd, flag, file, temp};
data/libofa-0.9.3/examples/wavefile.cpp:19:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char tmp[4096];
data/libofa-0.9.3/examples/wavefile.cpp:47:14:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    int fd = open(file, O_RDONLY | O_BINARY);
data/libofa-0.9.3/examples/wavefile.cpp:49:14:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    int fd = open(file, O_RDONLY);
data/libofa-0.9.3/examples/wavefile.cpp:59:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char hdr[36];
data/libofa-0.9.3/examples/wavefile.cpp:110:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char b[8];
data/libofa-0.9.3/lib/mainprint.cpp:88:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char bytes[Dim * Res * 2 + 5];
data/libofa-0.9.3/lib/mainprint.cpp:276:8:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static char encodingTable[64] = {
data/libofa-0.9.3/lib/mainprint.cpp:286:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    static char out[758];
data/libofa-0.9.3/lib/mainprint.cpp:287:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char inbuf[3], outbuf[4];
data/libofa-0.9.3/examples/protocol.cpp:147:5:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
    strncpy(temp, (char *)charData, len);
data/libofa-0.9.3/examples/protocol.cpp:216:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    int bufSize = strlen(lookupByPrint ? request_format : request_format2) +
data/libofa-0.9.3/examples/protocol.cpp:223:49:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            ((info->getArtist().c_str() == 0) ? strlen(unknown) : info->getArtist().length()) +
data/libofa-0.9.3/examples/protocol.cpp:224:49:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            ((info->getTrack().c_str() == 0) ?  strlen(unknown) : info->getTrack().length()) +
data/libofa-0.9.3/examples/protocol.cpp:225:49:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            ((info->getAlbum().c_str() == 0) ?  strlen(unknown) : info->getAlbum().length()) +
data/libofa-0.9.3/examples/protocol.cpp:227:49:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            ((info->getGenre().c_str() == 0) ?  strlen(unknown) : info->getGenre().length()) +
data/libofa-0.9.3/examples/wavefile.cpp:25:10:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	int n = read(fd, tmp, x);

ANALYSIS SUMMARY:

Hits = 26
Lines analyzed = 26488 in approximately 0.37 seconds (72554 lines/second)
Physical Source Lines of Code (SLOC) = 24504
Hits@level = [0]  10 [1]   7 [2]  13 [3]   2 [4]   4 [5]   0
Hits@level+ = [0+]  36 [1+]  26 [2+]  19 [3+]   6 [4+]   4 [5+]   0
Hits/KSLOC@level+ = [0+] 1.46915 [1+] 1.06105 [2+] 0.775384 [3+] 0.244858 [4+] 0.163239 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.