Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/lm4tools-0.1.3/lm4flash/lm4flash.c
Examining data/lm4tools-0.1.3/lmicdiusb/gdb.c
Examining data/lm4tools-0.1.3/lmicdiusb/lmicdi.c
Examining data/lm4tools-0.1.3/lmicdiusb/lmicdi.h
Examining data/lm4tools-0.1.3/lmicdiusb/socket.c

FINAL RESULTS:

data/lm4tools-0.1.3/lm4flash/lm4flash.c:70:9:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
#define snprintf _snprintf
data/lm4tools-0.1.3/lm4flash/lm4flash.c:70:18:  [4] (format) _snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
#define snprintf _snprintf
data/lm4tools-0.1.3/lm4flash/lm4flash.c:222:9:  [4] (format) sprintf:
  Potential format string problem (CWE-134). Make format string constant.
	idx += sprintf(buf.c + idx, END "%02x", sum);
data/lm4tools-0.1.3/lm4flash/lm4flash.c:254:8:  [4] (format) sprintf:
  Potential format string problem (CWE-134). Make format string constant.
	idx = sprintf(buf.c, START "%s", prefix);
data/lm4tools-0.1.3/lm4flash/lm4flash.c:272:8:  [4] (format) sprintf:
  Potential format string problem (CWE-134). Make format string constant.
	idx = sprintf(buf.c, START "%s", prefix);
data/lm4tools-0.1.3/lm4flash/lm4flash.c:282:15:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
	size_t idx = snprintf(buf.c, BUF_SIZE, START "%s%08x%s",
data/lm4tools-0.1.3/lm4flash/lm4flash.c:291:15:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
	size_t idx = snprintf(buf.c, BUF_SIZE, START "%s%08x%s%08x%s",
data/lm4tools-0.1.3/lm4flash/lm4flash.c:383:15:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
	size_t idx = snprintf(buf.c, BUF_SIZE, START "x%x,%x", addr, (uint32_t)len);
data/lm4tools-0.1.3/lm4flash/lm4flash.c:411:8:  [4] (format) sprintf:
  Potential format string problem (CWE-134). Make format string constant.
	idx = sprintf(buf.c, START "qRcmd,");
data/lm4tools-0.1.3/lmicdiusb/lmicdi.h:80:33:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
                                fprintf(stderr, __VA_ARGS__);} \
data/lm4tools-0.1.3/lm4flash/lm4flash.c:795:16:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((opt = getopt(argc, argv, "VES:hvs:")) != -1) {
data/lm4tools-0.1.3/lm4flash/lm4flash.c:87:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char c[BUF_SIZE];
data/lm4tools-0.1.3/lm4flash/lm4flash.c:132:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char linebuf[PP_LINESIZE];
data/lm4tools-0.1.3/lm4flash/lm4flash.c:143:4:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
			sprintf(linebuf, "%04x : ", i);
data/lm4tools-0.1.3/lm4flash/lm4flash.c:148:3:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
		sprintf(linebuf + pos, "%02x", b[i]);
data/lm4tools-0.1.3/lm4flash/lm4flash.c:257:10:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
		idx += sprintf(buf.c + idx, "%02x", bytes[i]);
data/lm4tools-0.1.3/lm4flash/lm4flash.c:274:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(buf.c + idx, bytes, num_bytes);
data/lm4tools-0.1.3/lm4flash/lm4flash.c:331:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char by, rawbuf[1024], *buf = rawbuf;
data/lm4tools-0.1.3/lm4flash/lm4flash.c:333:2:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
	sprintf(strchr(prefix, ':') + 1, "%08x:", addr);
data/lm4tools-0.1.3/lm4flash/lm4flash.c:380:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char rawbuf[1024];
data/lm4tools-0.1.3/lm4flash/lm4flash.c:406:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char rawbuf[32];
data/lm4tools-0.1.3/lm4flash/lm4flash.c:414:10:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
		idx += sprintf(buf.c + idx, "%02x", cmd[i]);
data/lm4tools-0.1.3/lm4flash/lm4flash.c:598:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char descriptor_buffer[256];
data/lm4tools-0.1.3/lm4flash/lm4flash.c:766:6:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	f = fopen(rom_name, "rb");
data/lm4tools-0.1.3/lmicdiusb/lmicdi.c:54:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
unsigned char pResp[MSGSIZE];
data/lm4tools-0.1.3/lmicdiusb/lmicdi.c:62:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char pStr[256];
data/lm4tools-0.1.3/lmicdiusb/lmicdi.c:91:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char pStr[256];
data/lm4tools-0.1.3/lmicdiusb/lmicdi.c:109:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char pStr[256];
data/lm4tools-0.1.3/lmicdiusb/lmicdi.c:124:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
unsigned char pUsbResp[MSGSIZE];
data/lm4tools-0.1.3/lmicdiusb/socket.c:47:17:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static unsigned char pGdbReq[MSGSIZE];
data/lm4tools-0.1.3/lmicdiusb/socket.c:230:21:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    static unsigned char pMsg[MSGSIZE];
data/lm4tools-0.1.3/lm4flash/lm4flash.c:76:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
#define START_LEN strlen(START)
data/lm4tools-0.1.3/lm4flash/lm4flash.c:77:18:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
#define END_LEN (strlen(END) + 2)
data/lm4tools-0.1.3/lm4flash/lm4flash.c:251:28:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	if (START_LEN + (prefix ? strlen(prefix) : 0) + (2 * num_bytes) + END_LEN + 1 > BUF_SIZE)
data/lm4tools-0.1.3/lm4flash/lm4flash.c:269:28:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	if (START_LEN + (prefix ? strlen(prefix) : 0) + num_bytes + END_LEN + 1 > BUF_SIZE)
data/lm4tools-0.1.3/lm4flash/lm4flash.c:394:18:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	for (i = 0, j = strlen("+$OK:"); i < len; i++, j++) {
data/lm4tools-0.1.3/lm4flash/lm4flash.c:413:18:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	for (i = 0; i < strlen(cmd); i++)
data/lm4tools-0.1.3/lm4flash/lm4flash.c:426:11:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	for (i = strlen("+$"); rawbuf[i] != '#'; i += 2) {

ANALYSIS SUMMARY:

Hits = 38
Lines analyzed = 1983 in approximately 0.06 seconds (30656 lines/second)
Physical Source Lines of Code (SLOC) = 1229
Hits@level = [0]  40 [1]   7 [2]  20 [3]   1 [4]  10 [5]   0
Hits@level+ = [0+]  78 [1+]  38 [2+]  31 [3+]  11 [4+]  10 [5+]   0
Hits/KSLOC@level+ = [0+] 63.4662 [1+] 30.9194 [2+] 25.2238 [3+] 8.95037 [4+] 8.1367 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.