Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/portsmf-0.1~svn20101010/algrd_internal.h
Examining data/portsmf-0.1~svn20101010/allegro.h
Examining data/portsmf-0.1~svn20101010/portsmf_test/portsmf_test.cpp
Examining data/portsmf-0.1~svn20101010/allegroserial.cpp
Examining data/portsmf-0.1~svn20101010/allegro.cpp
Examining data/portsmf-0.1~svn20101010/trace.cpp
Examining data/portsmf-0.1~svn20101010/allegrord.cpp
Examining data/portsmf-0.1~svn20101010/allegrowr.cpp
Examining data/portsmf-0.1~svn20101010/mfmidi.cpp
Examining data/portsmf-0.1~svn20101010/allegrosmfrd.cpp
Examining data/portsmf-0.1~svn20101010/apps/midicode.h
Examining data/portsmf-0.1~svn20101010/apps/seq2midi.h
Examining data/portsmf-0.1~svn20101010/apps/allegroconvert.cpp
Examining data/portsmf-0.1~svn20101010/apps/seq2midi.cpp
Examining data/portsmf-0.1~svn20101010/apps/allegroplay.cpp
Examining data/portsmf-0.1~svn20101010/strparse.h
Examining data/portsmf-0.1~svn20101010/trace.h
Examining data/portsmf-0.1~svn20101010/allegrosmfwr.cpp
Examining data/portsmf-0.1~svn20101010/mfmidi.h
Examining data/portsmf-0.1~svn20101010/strparse.cpp
Examining data/portsmf-0.1~svn20101010/algsmfrd_internal.h

FINAL RESULTS:

data/portsmf-0.1~svn20101010/allegro.cpp:48:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(h, s);
data/portsmf-0.1~svn20101010/allegro.cpp:75:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(h + 1, name);
data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:367:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(text, "%sfps:%02dh:%02dm:%02ds:%02d.%02df", 
data/portsmf-0.1~svn20101010/apps/allegroconvert.cpp:103:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(outfilename, filename);
data/portsmf-0.1~svn20101010/mfmidi.cpp:72:12:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    (void) strcpy(buff,errmsg);
data/portsmf-0.1~svn20101010/mfmidi.cpp:73:12:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
    (void) strcat(buff,s);
data/portsmf-0.1~svn20101010/trace.cpp:23:5:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
    printf(msg);
data/portsmf-0.1~svn20101010/allegro.cpp:59:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(new_atoms, atoms, len * sizeof(Alg_attribute));
data/portsmf-0.1~svn20101010/allegro.cpp:646:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(new_events, events, len * sizeof(Alg_event_ptr));
data/portsmf-0.1~svn20101010/allegro.cpp:787:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(new_beats, beats, len * sizeof(Alg_beat));
data/portsmf-0.1~svn20101010/allegro.cpp:800:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&beats[i], beat, sizeof(Alg_beat));
data/portsmf-0.1~svn20101010/allegro.cpp:1382:13:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
            memcpy(new_buffer, buffer, len); // copy from old buffer
data/portsmf-0.1~svn20101010/allegro.cpp:1991:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(new_time_sigs, time_sigs, len * sizeof(Alg_time_sig));
data/portsmf-0.1~svn20101010/allegro.cpp:2569:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(new_tracks, tracks, len * sizeof(Alg_track_ptr));
data/portsmf-0.1~svn20101010/allegro.cpp:2649:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(new_pending_events, pending_events, 
data/portsmf-0.1~svn20101010/allegro.h:632:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(newbuf, buffer, *len);
data/portsmf-0.1~svn20101010/allegrord.cpp:445:12:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    return atoi(int_string);
data/portsmf-0.1~svn20101010/allegrord.cpp:468:12:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    return atoi(int_string);
data/portsmf-0.1~svn20101010/allegrord.cpp:648:19:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
        int oct = atoi(octave.c_str());
data/portsmf-0.1~svn20101010/allegrord.cpp:743:28:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
                param->r = atoi(r.c_str());
data/portsmf-0.1~svn20101010/allegrord.cpp:747:28:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
                param->i = atoi(r.c_str());
data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:181:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char msg[80];
data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:183:9:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
        sprintf(msg, "file format %d not implemented", format);
data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:270:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char name[32];
data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:272:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(name, "control%dr", control);
data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:318:9:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
        sprintf(hexstr + 2 * i, "%02x", (0xFF & msg[i]));
data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:342:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char text[128];
data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:344:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(text, "metamsic data, type 0x%x, ignored", type);
data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:356:8:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static char *fpsstr[4] = {"24", "25", "29.97", "30"};
data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:363:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char text[32];
data/portsmf-0.1~svn20101010/allegrosmfrd.cpp:422:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(h, s, len);
data/portsmf-0.1~svn20101010/allegrosmfwr.cpp:307:21:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
      int ctrlnum = atoi(name + 7);
data/portsmf-0.1~svn20101010/allegrosmfwr.cpp:354:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char smpteoffset[5];
data/portsmf-0.1~svn20101010/apps/allegroconvert.cpp:66:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char outfilename[256];
data/portsmf-0.1~svn20101010/apps/allegroconvert.cpp:112:9:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
        strcpy(ext, ".gro");
data/portsmf-0.1~svn20101010/apps/allegroconvert.cpp:122:9:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
        strcpy(ext, ".mid");
data/portsmf-0.1~svn20101010/apps/allegroplay.cpp:83:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char input[80];
data/portsmf-0.1~svn20101010/apps/seq2midi.cpp:109:23:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
        int control = atoi(u->get_attribute() + 7);
data/portsmf-0.1~svn20101010/mfmidi.cpp:44:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char b[4];
data/portsmf-0.1~svn20101010/mfmidi.cpp:45:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char buff[32];
data/portsmf-0.1~svn20101010/mfmidi.cpp:259:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char buff[32];
data/portsmf-0.1~svn20101010/mfmidi.cpp:261:12:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    (void) sprintf(buff,"unexpected byte: 0x%02x",c);
data/portsmf-0.1~svn20101010/mfmidi.cpp:482:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(newmess, oldmess, oldleng);
data/portsmf-0.1~svn20101010/portsmf_test/portsmf_test.cpp:755:11:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    ofile.open("after-33.alg",  ios::out | ios::binary);
data/portsmf-0.1~svn20101010/trace.cpp:15:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char msg[256];
data/portsmf-0.1~svn20101010/allegro.cpp:47:24:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    char *h = new char[strlen(s) + 1];
data/portsmf-0.1~svn20101010/allegro.cpp:74:24:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    char *h = new char[strlen(name) + 2];
data/portsmf-0.1~svn20101010/allegro.cpp:96:27:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    char attr_type = name[strlen(name) - 1];
data/portsmf-0.1~svn20101010/allegro.cpp:427:14:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    return a[strlen(a) - 1];
data/portsmf-0.1~svn20101010/allegro.cpp:1488:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    long len = strlen(parm->attr_name()) + 8;
data/portsmf-0.1~svn20101010/allegro.cpp:1498:36:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        ser_write_buf.check_buffer(strlen(parm->s) + 1);
data/portsmf-0.1~svn20101010/allegro.cpp:1510:36:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        ser_write_buf.check_buffer(strlen(parm->a) + 1);
data/portsmf-0.1~svn20101010/allegrord.cpp:699:9:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
        strncpy(r, s.c_str() + i + 1, (len - i) - 2);
data/portsmf-0.1~svn20101010/allegrosmfwr.cpp:206:26:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    out_file->put((char) strlen(update->parameter.s));
data/portsmf-0.1~svn20101010/allegrosmfwr.cpp:266:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    int len = strlen(msg) / 2;
data/portsmf-0.1~svn20101010/allegrosmfwr.cpp:353:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        int len = strlen(s);
data/portsmf-0.1~svn20101010/apps/allegroconvert.cpp:92:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    int len = strlen(filename);
data/portsmf-0.1~svn20101010/apps/allegroconvert.cpp:108:33:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            ext = outfilename + strlen(outfilename) - 4;
data/portsmf-0.1~svn20101010/apps/allegroconvert.cpp:110:33:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            ext = outfilename + strlen(outfilename);
data/portsmf-0.1~svn20101010/apps/allegroconvert.cpp:118:33:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            ext = outfilename + strlen(outfilename) - 4;
data/portsmf-0.1~svn20101010/apps/allegroconvert.cpp:120:33:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            ext = outfilename + strlen(outfilename);
data/portsmf-0.1~svn20101010/apps/allegroplay.cpp:64:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        int len = strlen(filename);
data/portsmf-0.1~svn20101010/mfmidi.cpp:42:12:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    assert(strlen(s) == 4); // must be "MThd" or "MTrk"
data/portsmf-0.1~svn20101010/portsmf_test/portsmf_test.cpp:765:5:  [1] (buffer) getchar:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    getchar();
data/portsmf-0.1~svn20101010/strparse.cpp:56:24:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    int length = (int) strlen(str);

ANALYSIS SUMMARY:

Hits = 65
Lines analyzed = 8650 in approximately 0.21 seconds (40400 lines/second)
Physical Source Lines of Code (SLOC) = 6250
Hits@level = [0]  80 [1]  20 [2]  38 [3]   0 [4]   7 [5]   0
Hits@level+ = [0+] 145 [1+]  65 [2+]  45 [3+]   7 [4+]   7 [5+]   0
Hits/KSLOC@level+ = [0+] 23.2 [1+] 10.4 [2+] 7.2 [3+] 1.12 [4+] 1.12 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.