Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/mergelog-4.5.1/src/mergelog.c FINAL RESULTS: data/mergelog-4.5.1/src/mergelog.c:47:16: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). #define myopen fopen data/mergelog-4.5.1/src/mergelog.c:59:1: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char *f_buf[MAX_FILES]; data/mergelog-4.5.1/src/mergelog.c:60:1: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char *f_cp[MAX_FILES]; data/mergelog-4.5.1/src/mergelog.c:61:1: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char *f_end[MAX_FILES]; data/mergelog-4.5.1/src/mergelog.c:98:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char *log_buffer[argc-1]; data/mergelog-4.5.1/src/mergelog.c:99:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char *log_scan[argc-1]; data/mergelog-4.5.1/src/mergelog.c:100:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char *log_month[argc-1]; data/mergelog-4.5.1/src/mergelog.c:101:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char ref_date_buf[DATE_SIZE+1]; data/mergelog-4.5.1/src/mergelog.c:102:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char *tmp_date_buf[argc-1]; data/mergelog-4.5.1/src/mergelog.c:105:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char month[3]; data/mergelog-4.5.1/src/mergelog.c:109:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char *trans_digits[60]; data/mergelog-4.5.1/src/mergelog.c:110:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char *trans_year[200]; data/mergelog-4.5.1/src/mergelog.c:111:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char months[24]="anebarprayunulugepctovec"; data/mergelog-4.5.1/src/mergelog.c:151:5: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(trans_digits[i],"%.2d",i); data/mergelog-4.5.1/src/mergelog.c:159:5: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(trans_year[i],"%.4d",1900+i); data/mergelog-4.5.1/src/mergelog.c:242:8: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(log_month[i],trans_digits[j],2); data/mergelog-4.5.1/src/mergelog.c:243:8: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(log_month[i]+2,months+2*j,2); data/mergelog-4.5.1/src/mergelog.c:244:8: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tmp_date_buf[i],log_date+8,4); data/mergelog-4.5.1/src/mergelog.c:245:8: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tmp_date_buf[i]+4,trans_digits[j],2); data/mergelog-4.5.1/src/mergelog.c:246:8: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tmp_date_buf[i]+6,log_date+1,2); data/mergelog-4.5.1/src/mergelog.c:247:8: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tmp_date_buf[i]+8,log_date+13,2); data/mergelog-4.5.1/src/mergelog.c:248:8: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tmp_date_buf[i]+10,log_date+16,2); data/mergelog-4.5.1/src/mergelog.c:249:8: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tmp_date_buf[i]+12,log_date+19,2); data/mergelog-4.5.1/src/mergelog.c:274:7: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(log_month[i],trans_digits[j],2); data/mergelog-4.5.1/src/mergelog.c:275:7: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(log_month[i]+2,months+2*j,2); data/mergelog-4.5.1/src/mergelog.c:276:7: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tmp_date_buf[i]+4,trans_digits[j],2); data/mergelog-4.5.1/src/mergelog.c:312:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(ref_date_buf,trans_year[date->tm_year],4); data/mergelog-4.5.1/src/mergelog.c:313:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(ref_date_buf+4,trans_digits[date->tm_mon],2); data/mergelog-4.5.1/src/mergelog.c:314:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(ref_date_buf+6,trans_digits[date->tm_mday],2); data/mergelog-4.5.1/src/mergelog.c:315:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(ref_date_buf+8,trans_digits[date->tm_hour],2); data/mergelog-4.5.1/src/mergelog.c:316:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(ref_date_buf+10,trans_digits[date->tm_min],2); data/mergelog-4.5.1/src/mergelog.c:317:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(ref_date_buf+12,trans_digits[date->tm_sec],2); data/mergelog-4.5.1/src/mergelog.c:332:7: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(ref_date_buf+12,trans_digits[date->tm_sec],2); data/mergelog-4.5.1/src/mergelog.c:338:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(ref_date_buf+10,trans_digits[date->tm_min],2); data/mergelog-4.5.1/src/mergelog.c:344:4: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(ref_date_buf+8,trans_digits[date->tm_hour],2); data/mergelog-4.5.1/src/mergelog.c:348:4: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(ref_date_buf,trans_year[date->tm_year],4); data/mergelog-4.5.1/src/mergelog.c:349:4: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(ref_date_buf+4,trans_digits[date->tm_mon],2); data/mergelog-4.5.1/src/mergelog.c:350:4: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(ref_date_buf+6,trans_digits[date->tm_mday],2); data/mergelog-4.5.1/src/mergelog.c:377:34: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. write(1,log_buffer[i],(size_t)((char *)memchr(log_buffer[i],0,BUFFER_SIZE)-log_buffer[i])); data/mergelog-4.5.1/src/mergelog.c:414:8: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tmp_date_buf[i]+4,log_month[i],2); data/mergelog-4.5.1/src/mergelog.c:416:8: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tmp_date_buf[i],log_date+8,4); data/mergelog-4.5.1/src/mergelog.c:417:8: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tmp_date_buf[i]+6,log_date+1,2); data/mergelog-4.5.1/src/mergelog.c:418:8: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tmp_date_buf[i]+8,log_date+13,2); data/mergelog-4.5.1/src/mergelog.c:419:8: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tmp_date_buf[i]+10,log_date+16,2); data/mergelog-4.5.1/src/mergelog.c:420:8: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tmp_date_buf[i]+12,log_date+19,2); data/mergelog-4.5.1/src/mergelog.c:427:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(log_month[i],trans_digits[j],2); data/mergelog-4.5.1/src/mergelog.c:428:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(log_month[i]+2,months+2*j,2); data/mergelog-4.5.1/src/mergelog.c:429:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tmp_date_buf[i]+4,trans_digits[j],2); data/mergelog-4.5.1/src/mergelog.c:431:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tmp_date_buf[i],log_date+8,4); data/mergelog-4.5.1/src/mergelog.c:432:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tmp_date_buf[i]+6,log_date+1,2); data/mergelog-4.5.1/src/mergelog.c:433:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tmp_date_buf[i]+8,log_date+13,2); data/mergelog-4.5.1/src/mergelog.c:434:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tmp_date_buf[i]+10,log_date+16,2); data/mergelog-4.5.1/src/mergelog.c:435:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tmp_date_buf[i]+12,log_date+19,2); ANALYSIS SUMMARY: Hits = 53 Lines analyzed = 450 in approximately 0.05 seconds (9985 lines/second) Physical Source Lines of Code (SLOC) = 269 Hits@level = [0] 9 [1] 0 [2] 53 [3] 0 [4] 0 [5] 0 Hits@level+ = [0+] 62 [1+] 53 [2+] 53 [3+] 0 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 230.483 [1+] 197.026 [2+] 197.026 [3+] 0 [4+] 0 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.