Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/logtools-0.13e/clfdomainsplit.cpp
Examining data/logtools-0.13e/clfmerge.cpp
Examining data/logtools-0.13e/clfsplit.cpp
Examining data/logtools-0.13e/funnel.cpp
Examining data/logtools-0.13e/logprn.cpp
Examining data/logtools-0.13e/logtools.h

FINAL RESULTS:

data/logtools-0.13e/clfmerge.cpp:95:3:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
  strcpy(&m_date[4], m);
data/logtools-0.13e/clfmerge.cpp:137:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(m_line, &m_lineBuf[start_url + 1]);
data/logtools-0.13e/funnel.cpp:38:11:  [4] (shell) popen:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
    ret = popen(ptr, "w");
data/logtools-0.13e/logprn.cpp:107:20:  [4] (shell) popen:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
        FILE *fp = popen(argv[3], "w");
data/logtools-0.13e/clfdomainsplit.cpp:183:24:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
  while(-1 != (int_c = getopt(argc, argv, "c:d:i:o:v")) )
data/logtools-0.13e/clfmerge.cpp:219:24:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
  while(-1 != (int_c = getopt(argc, argv, "b:hdv")) )
data/logtools-0.13e/clfsplit.cpp:207:24:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
  while(-1 != (int_c = getopt(argc, argv, "d:i:f:s:")) )
data/logtools-0.13e/clfdomainsplit.cpp:43:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(tmp, buf, len);
data/logtools-0.13e/clfdomainsplit.cpp:106:14:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  FILE *fp = fopen(configFile, "r");
data/logtools-0.13e/clfdomainsplit.cpp:112:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[1024];
data/logtools-0.13e/clfdomainsplit.cpp:120:31:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
      cfg.significant_parts = atoi(buf);
data/logtools-0.13e/clfdomainsplit.cpp:195:19:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
        defFile = fopen(optarg, "a");
data/logtools-0.13e/clfdomainsplit.cpp:203:17:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
        input = fopen(optarg, "r");
data/logtools-0.13e/clfdomainsplit.cpp:228:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[4096];
data/logtools-0.13e/clfdomainsplit.cpp:312:14:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  FILE *fp = fopen(dom.c_str(), "a");
data/logtools-0.13e/clfmerge.cpp:37:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  int open(const char *name, bool domain_mangling);
data/logtools-0.13e/clfmerge.cpp:55:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char m_date[17];
data/logtools-0.13e/clfmerge.cpp:56:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char m_lineBuf[BUF_SIZE];
data/logtools-0.13e/clfmerge.cpp:57:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char m_lineBuf2[BUF_SIZE + 7];
data/logtools-0.13e/clfmerge.cpp:89:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(m_date, &m_lineBuf[i + 8], 4);
data/logtools-0.13e/clfmerge.cpp:90:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char mon[4];
data/logtools-0.13e/clfmerge.cpp:91:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(mon, &m_lineBuf[i + 4], 3);
data/logtools-0.13e/clfmerge.cpp:96:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(&m_date[6], &m_lineBuf[i + 1], 2);
data/logtools-0.13e/clfmerge.cpp:97:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(&m_date[8], &m_lineBuf[i + 13], 8);
data/logtools-0.13e/clfmerge.cpp:122:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(m_lineBuf2, &m_lineBuf[end_webname + 1], start_url - end_webname);
data/logtools-0.13e/clfmerge.cpp:126:7:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
      strcpy(m_line, "http://");
data/logtools-0.13e/clfmerge.cpp:128:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(m_line, m_lineBuf, end_webname);
data/logtools-0.13e/clfmerge.cpp:143:14:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
int LogFile::open(const char *name, bool domain_mangling)
data/logtools-0.13e/clfmerge.cpp:146:10:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  m_fp = fopen(name, "r");
data/logtools-0.13e/clfmerge.cpp:230:21:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
        map_items = atoi(optarg);
data/logtools-0.13e/clfmerge.cpp:262:33:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    int rc = items[item_count]->open(argv[i], domain_mangling);
data/logtools-0.13e/clfsplit.cpp:58:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  static char buf[30];
data/logtools-0.13e/clfsplit.cpp:59:3:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
  sprintf(buf, "%d.%d.%d.%d", ip >> 24, (ip >> 16) % 256, (ip >> 8) % 256, ip % 256);
data/logtools-0.13e/clfsplit.cpp:97:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char tmp[16];
data/logtools-0.13e/clfsplit.cpp:117:18:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  FILE *output = fopen(file, mode);
data/logtools-0.13e/clfsplit.cpp:131:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[4096];
data/logtools-0.13e/clfsplit.cpp:135:10:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    fp = fopen(opt, "r");
data/logtools-0.13e/clfsplit.cpp:181:30:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
          unsigned int sub = atoi(&item[i + 1]);
data/logtools-0.13e/clfsplit.cpp:221:17:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
        input = fopen(optarg, "r");
data/logtools-0.13e/clfsplit.cpp:241:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[4096];
data/logtools-0.13e/funnel.cpp:33:11:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    ret = fopen(ptr, mode);
data/logtools-0.13e/funnel.cpp:60:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[8192];
data/logtools-0.13e/logprn.cpp:42:18:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
  time_t delay = atoi(pbuf);
data/logtools-0.13e/logprn.cpp:45:15:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    maxWait = atoi(maxBuf);
data/logtools-0.13e/logprn.cpp:96:18:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
        int fd = open(argv[1], O_RDONLY);
data/logtools-0.13e/logprn.cpp:113:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char buf[4096];
data/logtools-0.13e/clfdomainsplit.cpp:118:8:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if(strlen(buf) && buf[0] != '#')
data/logtools-0.13e/clfdomainsplit.cpp:369:5:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    read(childFiledes[0], &c, 1);
data/logtools-0.13e/clfmerge.cpp:87:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if(i + 21 > strlen(m_lineBuf))
data/logtools-0.13e/clfmerge.cpp:120:8:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if(strlen(&m_lineBuf[start_url]) < 6) return 1;
data/logtools-0.13e/clfmerge.cpp:320:41:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
          if(printf("%s\n", tmp) != int(strlen(tmp) + 1))
data/logtools-0.13e/clfmerge.cpp:332:39:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        if(printf("%s\n", tmp) != int(strlen(tmp) + 1))
data/logtools-0.13e/clfmerge.cpp:345:39:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        if(printf("%s\n", tmp) != int(strlen(tmp) + 1))
data/logtools-0.13e/clfsplit.cpp:98:3:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
  strncpy(tmp, n, sizeof(tmp) - 1);
data/logtools-0.13e/funnel.cpp:71:19:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  while( int(rc = read(0, buf, sizeof(buf)) ) > 0 && count > 0)
data/logtools-0.13e/logprn.cpp:114:22:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
        while( (rc = read(fd, buf, sizeof(buf))) > 0)

ANALYSIS SUMMARY:

Hits = 56
Lines analyzed = 1280 in approximately 0.05 seconds (27047 lines/second)
Physical Source Lines of Code (SLOC) = 1124
Hits@level = [0]  45 [1]  10 [2]  39 [3]   3 [4]   4 [5]   0
Hits@level+ = [0+] 101 [1+]  56 [2+]  46 [3+]   7 [4+]   4 [5+]   0
Hits/KSLOC@level+ = [0+] 89.8577 [1+] 49.8221 [2+] 40.9253 [3+] 6.22776 [4+] 3.55872 [5+]   0
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.