Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/parole-1.0.5/data/interfaces/plugins_ui.h
Examining data/parole-1.0.5/data/interfaces/playlist_ui.h
Examining data/parole-1.0.5/data/interfaces/mediachooser_ui.h
Examining data/parole-1.0.5/data/interfaces/parole_ui.h
Examining data/parole-1.0.5/data/interfaces/open-location_ui.h
Examining data/parole-1.0.5/data/interfaces/save-playlist_ui.h
Examining data/parole-1.0.5/data/interfaces/parole-settings_ui.h
Examining data/parole-1.0.5/data/interfaces/shortcuts_ui.h
Examining data/parole-1.0.5/src/parole-mediachooser.h
Examining data/parole-1.0.5/src/dbus/parole-dbus.c
Examining data/parole-1.0.5/src/dbus/parole-dbus.h
Examining data/parole-1.0.5/src/parole-clutter.c
Examining data/parole-1.0.5/src/parole-conf.h
Examining data/parole-1.0.5/src/parole-conf.c
Examining data/parole-1.0.5/src/main.c
Examining data/parole-1.0.5/src/parole-plugin-player.c
Examining data/parole-1.0.5/src/parole-subtitle-encoding.h
Examining data/parole-1.0.5/src/enum-gtypes.c
Examining data/parole-1.0.5/src/parole-vis.h
Examining data/parole-1.0.5/src/enum-gtypes.h
Examining data/parole-1.0.5/src/parole-utils.c
Examining data/parole-1.0.5/src/parole-button.c
Examining data/parole-1.0.5/src/parole-plugins-manager.c
Examining data/parole-1.0.5/src/parole-mediachooser.c
Examining data/parole-1.0.5/src/parole-about.h
Examining data/parole-1.0.5/src/parole-medialist.c
Examining data/parole-1.0.5/src/parole-conf-dialog.h
Examining data/parole-1.0.5/src/parole-clutter.h
Examining data/parole-1.0.5/src/parole-builder.c
Examining data/parole-1.0.5/src/parole-medialist.h
Examining data/parole-1.0.5/src/parole-disc.c
Examining data/parole-1.0.5/src/parole-subtitle-encoding.c
Examining data/parole-1.0.5/src/common/parole-rc-utils.h
Examining data/parole-1.0.5/src/common/parole-powermanager.c
Examining data/parole-1.0.5/src/common/parole-common.c
Examining data/parole-1.0.5/src/common/parole-screensaver.c
Examining data/parole-1.0.5/src/common/parole-screensaver.h
Examining data/parole-1.0.5/src/common/parole-rc-utils.c
Examining data/parole-1.0.5/src/common/parole-powermanager.h
Examining data/parole-1.0.5/src/common/parole-common.h
Examining data/parole-1.0.5/src/parole-about.c
Examining data/parole-1.0.5/src/org.parole.media.list.h
Examining data/parole-1.0.5/src/parole-shortcuts.h
Examining data/parole-1.0.5/src/parole-vis.c
Examining data/parole-1.0.5/src/gst/gstmarshal.h
Examining data/parole-1.0.5/src/gst/gst-enum-types.c
Examining data/parole-1.0.5/src/gst/gst-enum-types.h
Examining data/parole-1.0.5/src/gst/gstmarshal.c
Examining data/parole-1.0.5/src/gst/parole-gst.c
Examining data/parole-1.0.5/src/gst/parole-gst.h
Examining data/parole-1.0.5/src/parole-player.c
Examining data/parole-1.0.5/src/parole-module.c
Examining data/parole-1.0.5/src/parole-plugin-player.h
Examining data/parole-1.0.5/src/parole-disc.h
Examining data/parole-1.0.5/src/plugins/tray/tray-provider.h
Examining data/parole-1.0.5/src/plugins/tray/tray-plugin.c
Examining data/parole-1.0.5/src/plugins/tray/tray-provider.c
Examining data/parole-1.0.5/src/plugins/notify/notify-provider.h
Examining data/parole-1.0.5/src/plugins/notify/notify-plugin.c
Examining data/parole-1.0.5/src/plugins/notify/notify-provider.c
Examining data/parole-1.0.5/src/plugins/sample/sample-plugin.c
Examining data/parole-1.0.5/src/plugins/sample/sample-provider.h
Examining data/parole-1.0.5/src/plugins/sample/sample-provider.c
Examining data/parole-1.0.5/src/plugins/mpris2/mpris2-plugin.c
Examining data/parole-1.0.5/src/plugins/mpris2/mpris2-provider.c
Examining data/parole-1.0.5/src/plugins/mpris2/mpris2-provider.h
Examining data/parole-1.0.5/src/gmarshal.h
Examining data/parole-1.0.5/src/parole-shortcuts.c
Examining data/parole-1.0.5/src/parole-module.h
Examining data/parole-1.0.5/src/parole-conf-dialog.c
Examining data/parole-1.0.5/src/parole-open-location.c
Examining data/parole-1.0.5/src/parole-open-location.h
Examining data/parole-1.0.5/src/gmarshal.c
Examining data/parole-1.0.5/src/org.parole.media.player.h
Examining data/parole-1.0.5/src/misc/parole-provider-player.h
Examining data/parole-1.0.5/src/misc/parole-pl-parser.c
Examining data/parole-1.0.5/src/misc/parole-marshal.h
Examining data/parole-1.0.5/src/misc/parole-marshal.c
Examining data/parole-1.0.5/src/misc/parole-provider-plugin.h
Examining data/parole-1.0.5/src/misc/parole.h
Examining data/parole-1.0.5/src/misc/parole-debug.h
Examining data/parole-1.0.5/src/misc/parole-provider-player.c
Examining data/parole-1.0.5/src/misc/parole-filters.c
Examining data/parole-1.0.5/src/misc/parole-enum-types.c
Examining data/parole-1.0.5/src/misc/parole-stream.h
Examining data/parole-1.0.5/src/misc/parole-filters.h
Examining data/parole-1.0.5/src/misc/parole-stream.c
Examining data/parole-1.0.5/src/misc/parole-enum-types.h
Examining data/parole-1.0.5/src/misc/parole-pl-parser.h
Examining data/parole-1.0.5/src/misc/parole-file.h
Examining data/parole-1.0.5/src/misc/parole-debug.c
Examining data/parole-1.0.5/src/misc/parole-file.c
Examining data/parole-1.0.5/src/misc/parole-provider-plugin.c
Examining data/parole-1.0.5/src/parole-player.h
Examining data/parole-1.0.5/src/parole-builder.h
Examining data/parole-1.0.5/src/parole-plugins-manager.h
Examining data/parole-1.0.5/src/parole-utils.h
Examining data/parole-1.0.5/src/parole-button.h
FINAL RESULTS:
data/parole-1.0.5/src/common/parole-screensaver.c:78:18: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
returncode = system(cmd);
data/parole-1.0.5/src/common/parole-screensaver.c:92:18: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
returncode = system(cmd);
data/parole-1.0.5/src/parole-medialist.c:1722:42: [3] (random) g_random_int_range:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
path_str = g_strdup_printf("%i", g_random_int_range(0, nch));
data/parole-1.0.5/src/common/parole-rc-utils.c:85:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen(history, "a");
data/parole-1.0.5/src/misc/parole-pl-parser.c:673:9: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
f = fopen(filename, "w");
data/parole-1.0.5/src/parole-disc.c:314:15: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((fd = open(device, O_RDONLY)) < 0) {
data/parole-1.0.5/src/parole-medialist.c:178:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *history[3];
data/parole-1.0.5/src/parole-player.c:700:23: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
gint chapter_id = atoi((char*)g_object_get_data(G_OBJECT(widget), "chapter-id"));
data/parole-1.0.5/src/parole-utils.c:406:15: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((fd = open(device, O_RDONLY)) < 0) {
data/parole-1.0.5/src/misc/parole-file.c:222:26: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if ( strlen(title_s) ) {
data/parole-1.0.5/src/parole-open-location.c:82:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if ( !location || strlen (location) == 0)
data/parole-1.0.5/src/parole-utils.c:221:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(name);
ANALYSIS SUMMARY:
Hits = 12
Lines analyzed = 26397 in approximately 0.70 seconds (37950 lines/second)
Physical Source Lines of Code (SLOC) = 17749
Hits@level = [0] 13 [1] 3 [2] 6 [3] 1 [4] 2 [5] 0
Hits@level+ = [0+] 25 [1+] 12 [2+] 9 [3+] 3 [4+] 2 [5+] 0
Hits/KSLOC@level+ = [0+] 1.40853 [1+] 0.676094 [2+] 0.507071 [3+] 0.169024 [4+] 0.112682 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.