Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/rapidxml-1.13/rapidxml.hpp
Examining data/rapidxml-1.13/rapidxml_utils.hpp
Examining data/rapidxml-1.13/rapidxml_iterators.hpp
Examining data/rapidxml-1.13/rapidxml_print.hpp

FINAL RESULTS:

data/rapidxml-1.13/rapidxml.hpp:294:35:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
            static const unsigned char lookup_whitespace[256];              // Whitespace table
data/rapidxml-1.13/rapidxml.hpp:295:35:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
            static const unsigned char lookup_node_name[256];               // Node name table
data/rapidxml-1.13/rapidxml.hpp:296:35:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
            static const unsigned char lookup_text[256];                    // Text table
data/rapidxml-1.13/rapidxml.hpp:297:35:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
            static const unsigned char lookup_text_pure_no_ws[256];         // Text table
data/rapidxml-1.13/rapidxml.hpp:298:35:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
            static const unsigned char lookup_text_pure_with_ws[256];       // Text table
data/rapidxml-1.13/rapidxml.hpp:299:35:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
            static const unsigned char lookup_attribute_name[256];          // Attribute name table
data/rapidxml-1.13/rapidxml.hpp:300:35:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
            static const unsigned char lookup_attribute_data_1[256];        // Attribute data table with single quote
data/rapidxml-1.13/rapidxml.hpp:301:35:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
            static const unsigned char lookup_attribute_data_1_pure[256];   // Attribute data table with single quote
data/rapidxml-1.13/rapidxml.hpp:302:35:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
            static const unsigned char lookup_attribute_data_2[256];        // Attribute data table with double quotes
data/rapidxml-1.13/rapidxml.hpp:303:35:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
            static const unsigned char lookup_attribute_data_2_pure[256];   // Attribute data table with double quotes
data/rapidxml-1.13/rapidxml.hpp:304:35:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
            static const unsigned char lookup_digits[256];                  // Digits
data/rapidxml-1.13/rapidxml.hpp:305:35:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
            static const unsigned char lookup_upcase[256];                  // To uppercase conversion table for ASCII characters
data/rapidxml-1.13/rapidxml.hpp:636:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char m_static_memory[RAPIDXML_STATIC_POOL_SIZE];    // Static raw memory
data/rapidxml-1.13/rapidxml_utils.hpp:45:20:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
            stream.read(&m_data.front(), static_cast<streamsize>(size));

ANALYSIS SUMMARY:

Hits = 14
Lines analyzed = 3327 in approximately 0.09 seconds (37937 lines/second)
Physical Source Lines of Code (SLOC) = 2151
Hits@level = [0]   0 [1]   1 [2]  13 [3]   0 [4]   0 [5]   0
Hits@level+ = [0+]  14 [1+]  14 [2+]  13 [3+]   0 [4+]   0 [5+]   0
Hits/KSLOC@level+ = [0+] 6.5086 [1+] 6.5086 [2+] 6.0437 [3+]   0 [4+]   0 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.