Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/rblcheck-20190930/rblcheck.c
Examining data/rblcheck-20190930/sites.h
Examining data/rblcheck-20190930/config.h

FINAL RESULTS:

data/rblcheck-20190930/rblcheck.c:149:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(ptr->site, sitename);
data/rblcheck-20190930/rblcheck.c:190:2:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
	sprintf(domain, "%d.%d.%d.%d.%s",
data/rblcheck-20190930/rblcheck.c:196:2:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
	sprintf(domain,
data/rblcheck-20190930/rblcheck.c:238:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(domain, "%d.%d.%d.%d.%s", d, c, b, a, rbldomain);
data/rblcheck-20190930/rblcheck.c:337:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(domain, addr);
data/rblcheck-20190930/rblcheck.c:339:5:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
    strcat(domain, rbldomain);
data/rblcheck-20190930/rblcheck.c:434:17:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
    while ((a = getopt(argc, argv, "qtlms:c?hv")) != EOF)
data/rblcheck-20190930/rblcheck.c:247:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char fixedans[PACKETSZ];
data/rblcheck-20190930/rblcheck.c:421:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char inbuf[RESULT_SIZE];
data/rblcheck-20190930/rblcheck.c:129:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    sitelen = strlen(sitename);
data/rblcheck-20190930/rblcheck.c:132:7:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	if ((strlen(ptr->site) == sitelen) &&
data/rblcheck-20190930/rblcheck.c:184:42:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    domain = NOFAIL(malloc(32 + 32 + 1 + strlen(rbldomain)));
data/rblcheck-20190930/rblcheck.c:235:33:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    domain = NOFAIL(malloc(17 + strlen(rbldomain)));
data/rblcheck-20190930/rblcheck.c:336:28:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    domain = NOFAIL(malloc(strlen(addr) + 1 + strlen(rbldomain) + 1));
data/rblcheck-20190930/rblcheck.c:336:47:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    domain = NOFAIL(malloc(strlen(addr) + 1 + strlen(rbldomain) + 1));
data/rblcheck-20190930/rblcheck.c:338:5:  [1] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant character.
    strcat(domain, ".");
data/rblcheck-20190930/rblcheck.c:398:31:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		   (opt->txt && response && strlen(response) && !opt->quiet ?
data/rblcheck-20190930/rblcheck.c:402:13:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
				       !strlen(response))) ? "" : "\n"));
data/rblcheck-20190930/rblcheck.c:508:9:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		inbuf[strlen(inbuf) - 1] = '\0';

ANALYSIS SUMMARY:

Hits = 19
Lines analyzed = 575 in approximately 0.04 seconds (13022 lines/second)
Physical Source Lines of Code (SLOC) = 374
Hits@level = [0]  13 [1]  10 [2]   2 [3]   1 [4]   6 [5]   0
Hits@level+ = [0+]  32 [1+]  19 [2+]   9 [3+]   7 [4+]   6 [5+]   0
Hits/KSLOC@level+ = [0+] 85.5615 [1+] 50.8021 [2+] 24.0642 [3+] 18.7166 [4+] 16.0428 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.