Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/portsmf-0.1~svn20101010/algrd_internal.h Examining data/portsmf-0.1~svn20101010/allegro.h Examining data/portsmf-0.1~svn20101010/portsmf_test/portsmf_test.cpp Examining data/portsmf-0.1~svn20101010/allegroserial.cpp Examining data/portsmf-0.1~svn20101010/allegro.cpp Examining data/portsmf-0.1~svn20101010/trace.cpp Examining data/portsmf-0.1~svn20101010/allegrord.cpp Examining data/portsmf-0.1~svn20101010/allegrowr.cpp Examining data/portsmf-0.1~svn20101010/mfmidi.cpp Examining data/portsmf-0.1~svn20101010/allegrosmfrd.cpp Examining data/portsmf-0.1~svn20101010/apps/midicode.h Examining data/portsmf-0.1~svn20101010/apps/seq2midi.h Examining data/portsmf-0.1~svn20101010/apps/allegroconvert.cpp Examining data/portsmf-0.1~svn20101010/apps/seq2midi.cpp Examining data/portsmf-0.1~svn20101010/apps/allegroplay.cpp Examining data/portsmf-0.1~svn20101010/strparse.h Examining data/portsmf-0.1~svn20101010/trace.h Examining data/portsmf-0.1~svn20101010/allegrosmfwr.cpp Examining data/portsmf-0.1~svn20101010/mfmidi.h Examining data/portsmf-0.1~svn20101010/strparse.cpp Examining data/portsmf-0.1~svn20101010/algsmfrd_internal.h FINAL RESULTS: data/portsmf-0.1~svn20101010/allegro.cpp:48:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(h, s); data/portsmf-0.1~svn20101010/allegro.cpp:75:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(h + 1, name); data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:367:5: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(text, "%sfps:%02dh:%02dm:%02ds:%02d.%02df", data/portsmf-0.1~svn20101010/apps/allegroconvert.cpp:103:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(outfilename, filename); data/portsmf-0.1~svn20101010/mfmidi.cpp:72:12: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). (void) strcpy(buff,errmsg); data/portsmf-0.1~svn20101010/mfmidi.cpp:73:12: [4] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). (void) strcat(buff,s); data/portsmf-0.1~svn20101010/trace.cpp:23:5: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. printf(msg); data/portsmf-0.1~svn20101010/allegro.cpp:59:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(new_atoms, atoms, len * sizeof(Alg_attribute)); data/portsmf-0.1~svn20101010/allegro.cpp:646:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(new_events, events, len * sizeof(Alg_event_ptr)); data/portsmf-0.1~svn20101010/allegro.cpp:787:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(new_beats, beats, len * sizeof(Alg_beat)); data/portsmf-0.1~svn20101010/allegro.cpp:800:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&beats[i], beat, sizeof(Alg_beat)); data/portsmf-0.1~svn20101010/allegro.cpp:1382:13: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(new_buffer, buffer, len); // copy from old buffer data/portsmf-0.1~svn20101010/allegro.cpp:1991:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(new_time_sigs, time_sigs, len * sizeof(Alg_time_sig)); data/portsmf-0.1~svn20101010/allegro.cpp:2569:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(new_tracks, tracks, len * sizeof(Alg_track_ptr)); data/portsmf-0.1~svn20101010/allegro.cpp:2649:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(new_pending_events, pending_events, data/portsmf-0.1~svn20101010/allegro.h:632:9: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(newbuf, buffer, *len); data/portsmf-0.1~svn20101010/allegrord.cpp:445:12: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). return atoi(int_string); data/portsmf-0.1~svn20101010/allegrord.cpp:468:12: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). return atoi(int_string); data/portsmf-0.1~svn20101010/allegrord.cpp:648:19: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). int oct = atoi(octave.c_str()); data/portsmf-0.1~svn20101010/allegrord.cpp:743:28: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). param->r = atoi(r.c_str()); data/portsmf-0.1~svn20101010/allegrord.cpp:747:28: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). param->i = atoi(r.c_str()); data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:181:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char msg[80]; data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:183:9: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(msg, "file format %d not implemented", format); data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:270:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char name[32]; data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:272:5: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(name, "control%dr", control); data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:318:9: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(hexstr + 2 * i, "%02x", (0xFF & msg[i])); data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:342:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char text[128]; data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:344:5: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(text, "metamsic data, type 0x%x, ignored", type); data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:356:8: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static char *fpsstr[4] = {"24", "25", "29.97", "30"}; data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:363:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char text[32]; data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:422:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(h, s, len); data/portsmf-0.1~svn20101010/allegrosmfwr.cpp:307:21: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). int ctrlnum = atoi(name + 7); data/portsmf-0.1~svn20101010/allegrosmfwr.cpp:354:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char smpteoffset[5]; data/portsmf-0.1~svn20101010/apps/allegroconvert.cpp:66:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char outfilename[256]; data/portsmf-0.1~svn20101010/apps/allegroconvert.cpp:112:9: [2] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). Risk is low because the source is a constant string. strcpy(ext, ".gro"); data/portsmf-0.1~svn20101010/apps/allegroconvert.cpp:122:9: [2] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). Risk is low because the source is a constant string. strcpy(ext, ".mid"); data/portsmf-0.1~svn20101010/apps/allegroplay.cpp:83:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char input[80]; data/portsmf-0.1~svn20101010/apps/seq2midi.cpp:109:23: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). int control = atoi(u->get_attribute() + 7); data/portsmf-0.1~svn20101010/mfmidi.cpp:44:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char b[4]; data/portsmf-0.1~svn20101010/mfmidi.cpp:45:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buff[32]; data/portsmf-0.1~svn20101010/mfmidi.cpp:259:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buff[32]; data/portsmf-0.1~svn20101010/mfmidi.cpp:261:12: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. (void) sprintf(buff,"unexpected byte: 0x%02x",c); data/portsmf-0.1~svn20101010/mfmidi.cpp:482:9: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(newmess, oldmess, oldleng); data/portsmf-0.1~svn20101010/portsmf_test/portsmf_test.cpp:755:11: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). ofile.open("after-33.alg", ios::out | ios::binary); data/portsmf-0.1~svn20101010/trace.cpp:15:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char msg[256]; data/portsmf-0.1~svn20101010/allegro.cpp:47:24: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). char *h = new char[strlen(s) + 1]; data/portsmf-0.1~svn20101010/allegro.cpp:74:24: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). char *h = new char[strlen(name) + 2]; data/portsmf-0.1~svn20101010/allegro.cpp:96:27: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). char attr_type = name[strlen(name) - 1]; data/portsmf-0.1~svn20101010/allegro.cpp:427:14: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). return a[strlen(a) - 1]; data/portsmf-0.1~svn20101010/allegro.cpp:1488:16: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). long len = strlen(parm->attr_name()) + 8; data/portsmf-0.1~svn20101010/allegro.cpp:1498:36: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). ser_write_buf.check_buffer(strlen(parm->s) + 1); data/portsmf-0.1~svn20101010/allegro.cpp:1510:36: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). ser_write_buf.check_buffer(strlen(parm->a) + 1); data/portsmf-0.1~svn20101010/allegrord.cpp:699:9: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(r, s.c_str() + i + 1, (len - i) - 2); data/portsmf-0.1~svn20101010/allegrosmfwr.cpp:206:26: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). out_file->put((char) strlen(update->parameter.s)); data/portsmf-0.1~svn20101010/allegrosmfwr.cpp:266:15: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). int len = strlen(msg) / 2; data/portsmf-0.1~svn20101010/allegrosmfwr.cpp:353:19: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). int len = strlen(s); data/portsmf-0.1~svn20101010/apps/allegroconvert.cpp:92:15: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). int len = strlen(filename); data/portsmf-0.1~svn20101010/apps/allegroconvert.cpp:108:33: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). ext = outfilename + strlen(outfilename) - 4; data/portsmf-0.1~svn20101010/apps/allegroconvert.cpp:110:33: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). ext = outfilename + strlen(outfilename); data/portsmf-0.1~svn20101010/apps/allegroconvert.cpp:118:33: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). ext = outfilename + strlen(outfilename) - 4; data/portsmf-0.1~svn20101010/apps/allegroconvert.cpp:120:33: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). ext = outfilename + strlen(outfilename); data/portsmf-0.1~svn20101010/apps/allegroplay.cpp:64:19: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). int len = strlen(filename); data/portsmf-0.1~svn20101010/mfmidi.cpp:42:12: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). assert(strlen(s) == 4); // must be "MThd" or "MTrk" data/portsmf-0.1~svn20101010/portsmf_test/portsmf_test.cpp:765:5: [1] (buffer) getchar: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). getchar(); data/portsmf-0.1~svn20101010/strparse.cpp:56:24: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). int length = (int) strlen(str); ANALYSIS SUMMARY: Hits = 65 Lines analyzed = 8650 in approximately 0.21 seconds (40400 lines/second) Physical Source Lines of Code (SLOC) = 6250 Hits@level = [0] 80 [1] 20 [2] 38 [3] 0 [4] 7 [5] 0 Hits@level+ = [0+] 145 [1+] 65 [2+] 45 [3+] 7 [4+] 7 [5+] 0 Hits/KSLOC@level+ = [0+] 23.2 [1+] 10.4 [2+] 7.2 [3+] 1.12 [4+] 1.12 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.