Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/netty-4.1.48/resolver-dns-native-macos/src/main/c/dnsinfo.h
Examining data/netty-4.1.48/resolver-dns-native-macos/src/main/c/netty_resolver_dns_macos.c
Examining data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_linuxsocket.c
Examining data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_linuxsocket.h
Examining data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_native.c
Examining data/netty-4.1.48/transport-native-kqueue/src/main/c/netty_kqueue_bsdsocket.c
Examining data/netty-4.1.48/transport-native-kqueue/src/main/c/netty_kqueue_bsdsocket.h
Examining data/netty-4.1.48/transport-native-kqueue/src/main/c/netty_kqueue_eventarray.c
Examining data/netty-4.1.48/transport-native-kqueue/src/main/c/netty_kqueue_eventarray.h
Examining data/netty-4.1.48/transport-native-kqueue/src/main/c/netty_kqueue_native.c
Examining data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_buffer.c
Examining data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_buffer.h
Examining data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_errors.c
Examining data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_errors.h
Examining data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_filedescriptor.c
Examining data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_filedescriptor.h
Examining data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_jni.h
Examining data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_limits.c
Examining data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_limits.h
Examining data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_socket.c
Examining data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_socket.h
Examining data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_util.c
Examining data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_util.h

FINAL RESULTS:

data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_util.c:37:9:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
        strcpy(result, str);
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_util.c:43:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(result, prefix);
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_util.c:44:5:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
    strcat(result, str);
data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_linuxsocket.c:191:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(&mreq.imr_multiaddr, &groupIpAddr->sin_addr, sizeof(groupIpAddr->sin_addr));
data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_linuxsocket.c:192:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(&mreq.imr_interface, &interfaceIpAddr->sin_addr, sizeof(interfaceIpAddr->sin_addr));
data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_linuxsocket.c:203:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(&mreq6.ipv6mr_multiaddr, &groupIp6Addr->sin6_addr, sizeof(groupIp6Addr->sin6_addr));
data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_linuxsocket.c:249:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(&mreq.imr_multiaddr, &groupIpAddr->sin_addr, sizeof(groupIpAddr->sin_addr));
data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_linuxsocket.c:250:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(&mreq.imr_interface, &interfaceIpAddr->sin_addr, sizeof(interfaceIpAddr->sin_addr));
data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_linuxsocket.c:251:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(&mreq.imr_sourceaddr, &sourceIpAddr->sin_addr, sizeof(sourceIpAddr->sin_addr));
data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_linuxsocket.c:300:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(&mreq.imr_multiaddr, &groupIpAddr->sin_addr, sizeof(groupIpAddr->sin_addr));
data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_linuxsocket.c:301:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(&mreq.imr_interface, &interfaceIpAddr->sin_addr, sizeof(interfaceIpAddr->sin_addr));
data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_linuxsocket.c:312:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(&mreq6.ipv6mr_multiaddr, &groupIp6Addr->sin6_addr, sizeof(groupIp6Addr->sin6_addr));
data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_linuxsocket.c:360:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(&mreq.imr_multiaddr, &groupIpAddr->sin_addr, sizeof(groupIpAddr->sin_addr));
data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_linuxsocket.c:361:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(&mreq.imr_interface, &interfaceIpAddr->sin_addr, sizeof(interfaceIpAddr->sin_addr));
data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_linuxsocket.c:362:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(&mreq.imr_sourceaddr, &sourceIpAddr->sin_addr, sizeof(sourceIpAddr->sin_addr));
data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_linuxsocket.c:403:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(&((struct sockaddr_in *) &md5sig.tcpm_addr)->sin_addr, &ipaddr->sin_addr, sizeof(ipaddr->sin_addr));
data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_linuxsocket.c:407:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(&((struct sockaddr_in6 *) &md5sig.tcpm_addr)->sin6_addr, &ip6addr->sin6_addr, sizeof(ip6addr->sin6_addr));
data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_linuxsocket.c:721:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(dynamicMethods, fixed_method_table, sizeof(fixed_method_table));
data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_native.c:105:14:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    FILE *fd=fopen(property, "r");
data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_native.c:107:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      char buf[32] = {0x0};
data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_native.c:109:24:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
        *returnValue = atoi(buf);
data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_native.c:567:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(dynamicMethods, fixed_method_table, sizeof(fixed_method_table));
data/netty-4.1.48/transport-native-kqueue/src/main/c/netty_kqueue_bsdsocket.c:214:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(dynamicMethods, fixed_method_table, sizeof(fixed_method_table));
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_filedescriptor.c:98:15:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    int res = open(f_path, O_WRONLY | O_CREAT | O_TRUNC, 0666);
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_socket.c:136:18:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        unsigned char a[4];
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_socket.c:150:22:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
            unsigned char a[4];
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_socket.c:161:22:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
            unsigned char a[8];
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_socket.c:298:13:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
            memcpy(&(ip6addr->sin6_addr.s6_addr), addressBytes, 16);
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_socket.c:305:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(&(ipaddr->sin_addr.s_addr), addressBytes + 12, 4);
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_socket.c:342:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char cntrlbuf[64];
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_socket.c:399:17:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                memcpy (&daddr, CMSG_DATA(cmsg), sizeof (struct sockaddr_storage));
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_socket.c:679:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(addr.sun_path, socket_path, socket_path_len);
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_socket.c:706:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(addr.sun_path, socket_path, socket_path_len);
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_socket.c:726:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char control[CMSG_SPACE(sizeof(int))] = { 0 };
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_socket.c:727:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char iovecData[1];
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_socket.c:774:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char control[CMSG_SPACE(sizeof(int))] = { 0 };
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_socket.c:775:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char iovecData[1];
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_socket.c:1029:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(dynamicMethods, fixed_method_table, sizeof(fixed_method_table));
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_socket.c:1074:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char parameters[1024] = {0};
data/netty-4.1.48/transport-native-epoll/src/main/c/netty_epoll_native.c:182:9:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    if (read(fd, &timerFireCount, sizeof(uint64_t)) < 0) {
data/netty-4.1.48/transport-native-kqueue/src/main/c/netty_kqueue_bsdsocket.c:91:5:  [1] (buffer) strncat:
  Easily used incorrectly (e.g., incorrectly computing the correct maximum
  size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf,
  or automatically resizing strings.
    strncat(af.af_name, tmpString, sizeof(af.af_name) / sizeof(af.af_name[0]));
data/netty-4.1.48/transport-native-kqueue/src/main/c/netty_kqueue_bsdsocket.c:95:5:  [1] (buffer) strncat:
  Easily used incorrectly (e.g., incorrectly computing the correct maximum
  size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf,
  or automatically resizing strings.
    strncat(af.af_arg, tmpString, sizeof(af.af_arg) / sizeof(af.af_arg[0]));
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_filedescriptor.c:69:15:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
        res = read(fd, buffer + pos, (size_t) (limit - pos));
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_socket.c:437:85:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
static jint netty_unix_socket_shutdown(JNIEnv* env, jclass clazz, jint fd, jboolean read, jboolean write) {
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_socket.c:439:9:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    if (read && write) {
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_socket.c:441:16:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    } else if (read) {
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_util.c:34:54:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        if ((result = (char*) malloc(sizeof(char) * (strlen(str) + 1))) == NULL) {
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_util.c:40:50:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if ((result = (char*) malloc(sizeof(char) * (strlen(prefix) + strlen(str) + 1))) == NULL) {
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_util.c:40:67:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if ((result = (char*) malloc(sizeof(char) * (strlen(prefix) + strlen(str) + 1))) == NULL) {
data/netty-4.1.48/transport-native-unix-common/src/main/c/netty_unix_util.c:49:20:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    size_t s2len = strlen(s2);

ANALYSIS SUMMARY:

Hits = 50
Lines analyzed = 5099 in approximately 0.73 seconds (7023 lines/second)
Physical Source Lines of Code (SLOC) = 3756
Hits@level = [0]  12 [1]  11 [2]  36 [3]   0 [4]   3 [5]   0
Hits@level+ = [0+]  62 [1+]  50 [2+]  39 [3+]   3 [4+]   3 [5+]   0
Hits/KSLOC@level+ = [0+] 16.5069 [1+] 13.312 [2+] 10.3834 [3+] 0.798722 [4+] 0.798722 [5+]   0
Dot directories skipped = 2 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.