Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/libtsm-3/external/wcwidth.c
Examining data/libtsm-3/external/wcwidth.h
Examining data/libtsm-3/external/xkbcommon-keysyms.h
Examining data/libtsm-3/src/libtsm.h
Examining data/libtsm-3/src/libtsm_int.h
Examining data/libtsm-3/src/shl_array.h
Examining data/libtsm-3/src/shl_htable.c
Examining data/libtsm-3/src/shl_htable.h
Examining data/libtsm-3/src/shl_llog.h
Examining data/libtsm-3/src/tsm_screen.c
Examining data/libtsm-3/src/tsm_unicode.c
Examining data/libtsm-3/src/tsm_vte.c
Examining data/libtsm-3/src/tsm_vte_charsets.c
Examining data/libtsm-3/test/test_common.h
Examining data/libtsm-3/test/test_htable.c

FINAL RESULTS:

data/libtsm-3/src/shl_llog.h:82:37:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
static inline __attribute__((format(printf, 8, 9)))
data/libtsm-3/src/shl_llog.h:123:37:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
static inline __attribute__((format(printf, 4, 5)))
data/libtsm-3/src/shl_array.h:145:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(((uint8_t*)arr->data) + arr->element_size * arr->length,
data/libtsm-3/src/tsm_screen.c:385:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(&con->lines[con->margin_top + (max - num)],
data/libtsm-3/src/tsm_screen.c:443:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(&con->lines[con->margin_top],
data/libtsm-3/src/tsm_screen.c:481:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(&line->cells[x].attr, attr, sizeof(*attr));
data/libtsm-3/src/tsm_screen.c:1001:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(&con->def_attr, attr, sizeof(*attr));
data/libtsm-3/src/tsm_screen.c:1447:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(&con->lines[con->cursor_y],
data/libtsm-3/src/tsm_screen.c:1487:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(&con->lines[con->cursor_y + (max - num)],
data/libtsm-3/src/tsm_unicode.c:267:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(buf, ptr, s * sizeof(uint32_t));
data/libtsm-3/src/tsm_unicode.c:285:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(nval, buf, s * sizeof(uint32_t));
data/libtsm-3/src/tsm_vte.c:1499:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char buf[64];
data/libtsm-3/src/tsm_vte.c:2240:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char val, u8[4];
data/libtsm-3/test/test_htable.c:33:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char huge_padding[16384];
data/libtsm-3/test/test_htable.c:35:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char paaaaaadding[16384];
data/libtsm-3/test/test_htable.c:38:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char more_padding[32768];

ANALYSIS SUMMARY:

Hits = 16
Lines analyzed = 11237 in approximately 0.36 seconds (30908 lines/second)
Physical Source Lines of Code (SLOC) = 8427
Hits@level = [0]   1 [1]   0 [2]  14 [3]   0 [4]   2 [5]   0
Hits@level+ = [0+]  17 [1+]  16 [2+]  16 [3+]   2 [4+]   2 [5+]   0
Hits/KSLOC@level+ = [0+] 2.01733 [1+] 1.89866 [2+] 1.89866 [3+] 0.237332 [4+] 0.237332 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.