Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_hungarian.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_french.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_arabic.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_nepali.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_russian.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_tamil.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_danish.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_dutch.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_portuguese.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_finnish.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_indonesian.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_catalan.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_swedish.c Examining data/r-cran-snowballc-0.7.0/src/api.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_norwegian.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_russian.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_norwegian.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_spanish.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_finnish.h Examining data/r-cran-snowballc-0.7.0/src/header.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_swedish.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_italian.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_french.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_german.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_basque.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_romanian.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_greek.c Examining data/r-cran-snowballc-0.7.0/src/SnowballC_init.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_porter.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_lithuanian.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_basque.c Examining data/r-cran-snowballc-0.7.0/src/modules_utf8.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_english.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_lithuanian.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_nepali.h Examining data/r-cran-snowballc-0.7.0/src/libstemmer_utf8.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_spanish.h Examining data/r-cran-snowballc-0.7.0/src/libstemmer.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_turkish.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_portuguese.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_english.c Examining data/r-cran-snowballc-0.7.0/src/api.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_irish.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_porter.c Examining data/r-cran-snowballc-0.7.0/src/stem.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_arabic.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_irish.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_romanian.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_hungarian.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_turkish.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_hindi.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_dutch.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_italian.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_indonesian.h Examining data/r-cran-snowballc-0.7.0/src/utilities.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_tamil.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_danish.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_hindi.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_german.c Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_greek.h Examining data/r-cran-snowballc-0.7.0/src/stem_UTF_8_catalan.c FINAL RESULTS: data/r-cran-snowballc-0.7.0/src/stem.c:15:74: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). const sb_symbol * stemmed = sb_stemmer_stem(stemmer, (sb_symbol *)str, strlen(str)); ANALYSIS SUMMARY: Hits = 1 Lines analyzed = 27341 in approximately 1.66 seconds (16473 lines/second) Physical Source Lines of Code (SLOC) = 25593 Hits@level = [0] 9 [1] 1 [2] 0 [3] 0 [4] 0 [5] 0 Hits@level+ = [0+] 10 [1+] 1 [2+] 0 [3+] 0 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 0.390732 [1+] 0.0390732 [2+] 0 [3+] 0 [4+] 0 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.