Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/perforate-1.2/zum.c

FINAL RESULTS:

data/perforate-1.2/zum.c:206:3:  [5] (race) chown:
  This accepts filename arguments; if an attacker can move those files, a
  race condition results. (CWE-362). Use fchown( ) instead.
  chown(file, st.st_uid, st.st_gid);
data/perforate-1.2/zum.c:207:6:  [5] (race) chmod:
  This accepts filename arguments; if an attacker can move those files, a
  race condition results. (CWE-362). Use fchmod( ) instead.
  if(chmod(file, st.st_mode) < 0)
data/perforate-1.2/zum.c:158:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(dest, "%s%s", file, suffix);
data/perforate-1.2/zum.c:145:13:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  if((fds = open(file, O_RDONLY)) < 0 || lstat(file, &st) < 0) {
data/perforate-1.2/zum.c:159:13:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  if((fdd = open(dest, O_RDWR|O_CREAT|O_EXCL, 0600)) < 0) {
data/perforate-1.2/zum.c:191:15:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    if((fds = open(file, O_RDWR)) < 0) {
data/perforate-1.2/zum.c:62:35:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  while(ret != NULL && (*lineptr)[strlen (*lineptr) - 1] != '\n')
data/perforate-1.2/zum.c:67:30:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      ret = fgets(*lineptr + strlen (*lineptr), GETLINE_CHUNK_SIZE, stream);
data/perforate-1.2/zum.c:70:17:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  return (ret ? strlen (*lineptr) : -1);
data/perforate-1.2/zum.c:157:17:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  dest = alloca(strlen(file) + sizeof(suffix));

ANALYSIS SUMMARY:

Hits = 10
Lines analyzed = 235 in approximately 0.01 seconds (16021 lines/second)
Physical Source Lines of Code (SLOC) = 178
Hits@level = [0]   2 [1]   4 [2]   3 [3]   0 [4]   1 [5]   2
Hits@level+ = [0+]  12 [1+]  10 [2+]   6 [3+]   3 [4+]   3 [5+]   2
Hits/KSLOC@level+ = [0+] 67.4157 [1+] 56.1798 [2+] 33.7079 [3+] 16.8539 [4+] 16.8539 [5+] 11.236
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.