Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/lv2dynparam1-2/audiolock.c
Examining data/lv2dynparam1-2/audiolock.h
Examining data/lv2dynparam1-2/helpers.c
Examining data/lv2dynparam1-2/helpers.h
Examining data/lv2dynparam1-2/hint_set.c
Examining data/lv2dynparam1-2/hint_set.h
Examining data/lv2dynparam1-2/host/host.c
Examining data/lv2dynparam1-2/host/host.h
Examining data/lv2dynparam1-2/host/host_callbacks.c
Examining data/lv2dynparam1-2/host/host_callbacks.h
Examining data/lv2dynparam1-2/host/internal.h
Examining data/lv2dynparam1-2/list.h
Examining data/lv2dynparam1-2/log.c
Examining data/lv2dynparam1-2/log.h
Examining data/lv2dynparam1-2/lv2_rtmempool.h
Examining data/lv2dynparam1-2/lv2dynparam.h
Examining data/lv2dynparam1-2/memory_atomic.c
Examining data/lv2dynparam1-2/memory_atomic.h
Examining data/lv2dynparam1-2/plugin/group.c
Examining data/lv2dynparam1-2/plugin/internal.h
Examining data/lv2dynparam1-2/plugin/parameter.c
Examining data/lv2dynparam1-2/plugin/plugin.c
Examining data/lv2dynparam1-2/plugin/plugin.h

FINAL RESULTS:

data/lv2dynparam1-2/host/host.c:731:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(new_last_ptr, *last_ptr_ptr);
data/lv2dynparam1-2/host/host.c:870:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(value_str, "%c%s", SERIALIZE_TYPE_CHAR_BOOLEAN, parameter_ptr->value.boolean ? "true" : "false");
data/lv2dynparam1-2/host/host.c:890:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(value_buffer + 1, value_enum);
data/lv2dynparam1-2/log.c:35:3:  [4] (format) vprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
  vprintf(format, arglist);
data/lv2dynparam1-2/helpers.c:49:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(dest, source, size);
data/lv2dynparam1-2/helpers.c:70:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(dest, source, size);
data/lv2dynparam1-2/host/host.c:743:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(*last_ptr_ptr, string, len);
data/lv2dynparam1-2/host/host.c:806:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char separator[2] = {SERIALIZE_SEPARATOR_CHAR, '\0'};
data/lv2dynparam1-2/host/host.c:809:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char value_str[100];
data/lv2dynparam1-2/host/host.c:874:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(value_str, "%c%f", SERIALIZE_TYPE_CHAR_FLOAT, parameter_ptr->value.fpoint);
data/lv2dynparam1-2/host/host.c:894:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(value_str, "%c%i", SERIALIZE_TYPE_CHAR_INT, parameter_ptr->value.integer);
data/lv2dynparam1-2/host/internal.h:40:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char name[LV2DYNPARAM_MAX_STRING_SIZE];
data/lv2dynparam1-2/host/internal.h:55:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char name[LV2DYNPARAM_MAX_STRING_SIZE];
data/lv2dynparam1-2/host/internal.h:57:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char type_uri[LV2DYNPARAM_MAX_STRING_SIZE];
data/lv2dynparam1-2/host/internal.h:83:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char name[LV2DYNPARAM_MAX_STRING_SIZE];
data/lv2dynparam1-2/plugin/group.c:83:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(group_ptr->name, name, name_size);
data/lv2dynparam1-2/plugin/group.c:257:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(buffer, group_ptr->name, s);
data/lv2dynparam1-2/plugin/internal.h:47:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char name[LV2DYNPARAM_MAX_STRING_SIZE];
data/lv2dynparam1-2/plugin/internal.h:64:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char name[LV2DYNPARAM_MAX_STRING_SIZE];
data/lv2dynparam1-2/plugin/parameter.c:102:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(buffer, uri, s);
data/lv2dynparam1-2/plugin/parameter.c:116:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(buffer, parameter_ptr->name, s);
data/lv2dynparam1-2/plugin/parameter.c:364:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(param_ptr->name, name, name_size);
data/lv2dynparam1-2/plugin/parameter.c:463:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(param_ptr->name, name, name_size);
data/lv2dynparam1-2/plugin/parameter.c:589:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(param_ptr->name, name, name_size);
data/lv2dynparam1-2/plugin/parameter.c:703:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(param_ptr->name, name, name_size);
data/lv2dynparam1-2/helpers.c:41:10:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  size = strlen(source) + 1;
data/lv2dynparam1-2/helpers.c:62:10:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  size = strlen(source) + 1;
data/lv2dynparam1-2/host/host.c:398:29:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    component = component + strlen(component) + 1;
data/lv2dynparam1-2/host/host.c:715:9:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  len = strlen(string);
data/lv2dynparam1-2/host/host.c:880:27:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    value_buffer = malloc(strlen(value_enum) + 2);
data/lv2dynparam1-2/host/host.c:983:9:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  len = strlen(component);
data/lv2dynparam1-2/plugin/group.c:51:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  name_size = strlen(name) + 1;
data/lv2dynparam1-2/plugin/group.c:251:7:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  s = strlen(group_ptr->name) + 1;
data/lv2dynparam1-2/plugin/parameter.c:98:7:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  s = strlen(uri) + 1;
data/lv2dynparam1-2/plugin/parameter.c:112:7:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  s = strlen(parameter_ptr->name) + 1;
data/lv2dynparam1-2/plugin/parameter.c:306:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  name_size = strlen(name) + 1;
data/lv2dynparam1-2/plugin/parameter.c:403:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  name_size = strlen(name) + 1;
data/lv2dynparam1-2/plugin/parameter.c:511:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  name_size = strlen(name) + 1;
data/lv2dynparam1-2/plugin/parameter.c:643:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  name_size = strlen(name) + 1;

ANALYSIS SUMMARY:

Hits = 39
Lines analyzed = 7177 in approximately 0.20 seconds (36566 lines/second)
Physical Source Lines of Code (SLOC) = 4352
Hits@level = [0]   2 [1]  14 [2]  21 [3]   0 [4]   4 [5]   0
Hits@level+ = [0+]  41 [1+]  39 [2+]  25 [3+]   4 [4+]   4 [5+]   0
Hits/KSLOC@level+ = [0+] 9.42096 [1+] 8.9614 [2+] 5.74449 [3+] 0.919118 [4+] 0.919118 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.