Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/midicsv-1.1+dfsg.1/version.h
Examining data/midicsv-1.1+dfsg.1/csv.c
Examining data/midicsv-1.1+dfsg.1/midio.c
Examining data/midicsv-1.1+dfsg.1/midio.h
Examining data/midicsv-1.1+dfsg.1/types.h
Examining data/midicsv-1.1+dfsg.1/csv.h
Examining data/midicsv-1.1+dfsg.1/midifile.h
Examining data/midicsv-1.1+dfsg.1/getopt.c
Examining data/midicsv-1.1+dfsg.1/midicsv.c
Examining data/midicsv-1.1+dfsg.1/getopt.h
Examining data/midicsv-1.1+dfsg.1/csvmidi.c

FINAL RESULTS:

data/midicsv-1.1+dfsg.1/csvmidi.c:376:2:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
	sprintf(errm, "%s out of range.  Value (%ld) outside limits of %ld to %ld",
data/midicsv-1.1+dfsg.1/csvmidi.c:551:13:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
            sprintf(errm, "Unknown record type: \"%s\"", f);
data/midicsv-1.1+dfsg.1/csvmidi.c:791:21:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
                    sprintf(errm, "Field 5 has invalid major/minor indicator \"%s\"", f);
data/midicsv-1.1+dfsg.1/csvmidi.c:404:17:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
    while ((n = getopt(argc, argv, "uvxz")) != -1) {
data/midicsv-1.1+dfsg.1/getopt.h:10:9:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
#define getopt(a, b, c) Getopt(a, b, c)
data/midicsv-1.1+dfsg.1/midicsv.c:398:17:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
    while ((n = getopt(argc, argv, "uv")) != -1) {
data/midicsv-1.1+dfsg.1/csvmidi.c:374:6:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    	char errm[256];
data/midicsv-1.1+dfsg.1/csvmidi.c:397:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char errm[256];
data/midicsv-1.1+dfsg.1/csvmidi.c:444:26:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
                    fp = fopen(argv[optind], "r");
data/midicsv-1.1+dfsg.1/csvmidi.c:455:26:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
                    fo = fopen(argv[optind], "wb");
data/midicsv-1.1+dfsg.1/csvmidi.c:481:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(mt.chunktype, MIDI_Track_Sentinel, sizeof mt.chunktype);
data/midicsv-1.1+dfsg.1/csvmidi.c:518:14:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
	    track = atoi(f);
data/midicsv-1.1+dfsg.1/csvmidi.c:528:16:  [2] (integer) atol:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
	    abstime = atol(f);
data/midicsv-1.1+dfsg.1/csvmidi.c:569:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(mh.chunktype, MIDI_Header_Sentinel, sizeof mh.chunktype);
data/midicsv-1.1+dfsg.1/midicsv.c:424:26:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
                    fp = fopen(argv[optind], "rb");
data/midicsv-1.1+dfsg.1/midicsv.c:435:26:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
                    fo = fopen(argv[optind], "w");
data/midicsv-1.1+dfsg.1/midifile.h:76:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char chunktype[4];                /* Chunk type: "MThd" */
data/midicsv-1.1+dfsg.1/midifile.h:88:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char chunktype[4];                /* Chunk type: "MTrk" */
data/midicsv-1.1+dfsg.1/midio.c:20:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char c[4];
data/midicsv-1.1+dfsg.1/midio.c:30:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char c[2];
data/midicsv-1.1+dfsg.1/csvmidi.c:320:17:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    while ((c = getc(fp)) >= 0) {
data/midicsv-1.1+dfsg.1/csvmidi.c:327:10:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	    c = getc(fp);
data/midicsv-1.1+dfsg.1/csvmidi.c:334:10:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	    c = getc(fp);
data/midicsv-1.1+dfsg.1/csvmidi.c:487:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	char *p = s + strlen(s);
data/midicsv-1.1+dfsg.1/midio.c:43:18:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    if ((value = getc(fp)) & 0x80) {
data/midicsv-1.1+dfsg.1/midio.c:46:36:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	    value = (value << 7) | ((ch = getc(fp)) & 0x7F);

ANALYSIS SUMMARY:

Hits = 26
Lines analyzed = 1901 in approximately 0.06 seconds (31378 lines/second)
Physical Source Lines of Code (SLOC) = 1304
Hits@level = [0]  77 [1]   6 [2]  14 [3]   3 [4]   3 [5]   0
Hits@level+ = [0+] 103 [1+]  26 [2+]  20 [3+]   6 [4+]   3 [5+]   0
Hits/KSLOC@level+ = [0+] 78.9877 [1+] 19.9387 [2+] 15.3374 [3+] 4.60123 [4+] 2.30061 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.