Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/tepl-5.0.0/tepl/tepl-abstract-factory.c
Examining data/tepl-5.0.0/tepl/tepl-abstract-factory.h
Examining data/tepl-5.0.0/tepl/tepl-application-window.c
Examining data/tepl-5.0.0/tepl/tepl-application-window.h
Examining data/tepl-5.0.0/tepl/tepl-application.c
Examining data/tepl-5.0.0/tepl/tepl-application.h
Examining data/tepl-5.0.0/tepl/tepl-buffer.c
Examining data/tepl-5.0.0/tepl/tepl-buffer.h
Examining data/tepl-5.0.0/tepl/tepl-close-confirm-dialog-single.c
Examining data/tepl-5.0.0/tepl/tepl-close-confirm-dialog-single.h
Examining data/tepl-5.0.0/tepl/tepl-file-chooser.c
Examining data/tepl-5.0.0/tepl/tepl-file-chooser.h
Examining data/tepl-5.0.0/tepl/tepl-file-loader.c
Examining data/tepl-5.0.0/tepl/tepl-file-loader.h
Examining data/tepl-5.0.0/tepl/tepl-file-saver.c
Examining data/tepl-5.0.0/tepl/tepl-file-saver.h
Examining data/tepl-5.0.0/tepl/tepl-file.c
Examining data/tepl-5.0.0/tepl/tepl-file.h
Examining data/tepl-5.0.0/tepl/tepl-fold-region.c
Examining data/tepl-5.0.0/tepl/tepl-fold-region.h
Examining data/tepl-5.0.0/tepl/tepl-goto-line-bar.c
Examining data/tepl-5.0.0/tepl/tepl-goto-line-bar.h
Examining data/tepl-5.0.0/tepl/tepl-gutter-renderer-folds.c
Examining data/tepl-5.0.0/tepl/tepl-gutter-renderer-folds.h
Examining data/tepl-5.0.0/tepl/tepl-icu.c
Examining data/tepl-5.0.0/tepl/tepl-icu.h
Examining data/tepl-5.0.0/tepl/tepl-info-bar.c
Examining data/tepl-5.0.0/tepl/tepl-info-bar.h
Examining data/tepl-5.0.0/tepl/tepl-init.c
Examining data/tepl-5.0.0/tepl/tepl-init.h
Examining data/tepl-5.0.0/tepl/tepl-io-error-info-bar.c
Examining data/tepl-5.0.0/tepl/tepl-io-error-info-bar.h
Examining data/tepl-5.0.0/tepl/tepl-io-error-info-bars.c
Examining data/tepl-5.0.0/tepl/tepl-io-error-info-bars.h
Examining data/tepl-5.0.0/tepl/tepl-iter.c
Examining data/tepl-5.0.0/tepl/tepl-iter.h
Examining data/tepl-5.0.0/tepl/tepl-macros.h
Examining data/tepl-5.0.0/tepl/tepl-menu-shell.c
Examining data/tepl-5.0.0/tepl/tepl-menu-shell.h
Examining data/tepl-5.0.0/tepl/tepl-metadata-attic.c
Examining data/tepl-5.0.0/tepl/tepl-metadata-attic.h
Examining data/tepl-5.0.0/tepl/tepl-metadata-manager.c
Examining data/tepl-5.0.0/tepl/tepl-metadata-manager.h
Examining data/tepl-5.0.0/tepl/tepl-metadata-parser.c
Examining data/tepl-5.0.0/tepl/tepl-metadata-parser.h
Examining data/tepl-5.0.0/tepl/tepl-metadata.c
Examining data/tepl-5.0.0/tepl/tepl-metadata.h
Examining data/tepl-5.0.0/tepl/tepl-notebook.c
Examining data/tepl-5.0.0/tepl/tepl-notebook.h
Examining data/tepl-5.0.0/tepl/tepl-panel.c
Examining data/tepl-5.0.0/tepl/tepl-panel.h
Examining data/tepl-5.0.0/tepl/tepl-progress-info-bar.c
Examining data/tepl-5.0.0/tepl/tepl-progress-info-bar.h
Examining data/tepl-5.0.0/tepl/tepl-signal-group.c
Examining data/tepl-5.0.0/tepl/tepl-signal-group.h
Examining data/tepl-5.0.0/tepl/tepl-statusbar.c
Examining data/tepl-5.0.0/tepl/tepl-statusbar.h
Examining data/tepl-5.0.0/tepl/tepl-style-scheme-chooser-widget.c
Examining data/tepl-5.0.0/tepl/tepl-style-scheme-chooser-widget.h
Examining data/tepl-5.0.0/tepl/tepl-tab-group.c
Examining data/tepl-5.0.0/tepl/tepl-tab-group.h
Examining data/tepl-5.0.0/tepl/tepl-tab-label.c
Examining data/tepl-5.0.0/tepl/tepl-tab-label.h
Examining data/tepl-5.0.0/tepl/tepl-tab-loading.c
Examining data/tepl-5.0.0/tepl/tepl-tab-loading.h
Examining data/tepl-5.0.0/tepl/tepl-tab-saving.c
Examining data/tepl-5.0.0/tepl/tepl-tab-saving.h
Examining data/tepl-5.0.0/tepl/tepl-tab.c
Examining data/tepl-5.0.0/tepl/tepl-tab.h
Examining data/tepl-5.0.0/tepl/tepl-utils.c
Examining data/tepl-5.0.0/tepl/tepl-utils.h
Examining data/tepl-5.0.0/tepl/tepl-view.c
Examining data/tepl-5.0.0/tepl/tepl-view.h
Examining data/tepl-5.0.0/tepl/tepl-window-actions-edit.c
Examining data/tepl-5.0.0/tepl/tepl-window-actions-edit.h
Examining data/tepl-5.0.0/tepl/tepl-window-actions-file.c
Examining data/tepl-5.0.0/tepl/tepl-window-actions-file.h
Examining data/tepl-5.0.0/tepl/tepl-window-actions-search.c
Examining data/tepl-5.0.0/tepl/tepl-window-actions-search.h
Examining data/tepl-5.0.0/tepl/tepl.h
Examining data/tepl-5.0.0/tests/tepl-gutter-renderer-folds-sub.c
Examining data/tepl-5.0.0/tests/tepl-gutter-renderer-folds-sub.h
Examining data/tepl-5.0.0/tests/test-fold-region.c
Examining data/tepl-5.0.0/tests/test-gutter-renderer-folds.c
Examining data/tepl-5.0.0/tests/test-tab.c
Examining data/tepl-5.0.0/testsuite/tepl-test-utils.c
Examining data/tepl-5.0.0/testsuite/tepl-test-utils.h
Examining data/tepl-5.0.0/testsuite/test-file-loader.c
Examining data/tepl-5.0.0/testsuite/test-file-saver.c
Examining data/tepl-5.0.0/testsuite/test-file.c
Examining data/tepl-5.0.0/testsuite/test-fold-region.c
Examining data/tepl-5.0.0/testsuite/test-icu.c
Examining data/tepl-5.0.0/testsuite/test-info-bar.c
Examining data/tepl-5.0.0/testsuite/test-metadata-manager.c
Examining data/tepl-5.0.0/testsuite/test-metadata.c
Examining data/tepl-5.0.0/testsuite/test-notebook.c
Examining data/tepl-5.0.0/testsuite/test-utils.c
Examining data/tepl-5.0.0/tools/shared-mime-info-list-text-plain-globs/mime-type-is-text-plain.c
FINAL RESULTS:
data/tepl-5.0.0/tepl/tepl-utils.c:323:18: [3] (buffer) g_get_home_dir:
This function is synonymous with 'getenv("HOME")';it returns untrustable
input if the environment can beset by an attacker. It can have any content
and length, and the same variable can be set more than once (CWE-807,
CWE-20). Check environment variables carefully before using them.
tmp = (gchar *) g_get_home_dir ();
data/tepl-5.0.0/testsuite/test-file-loader.c:12:36: [3] (buffer) g_get_tmp_dir:
This function is synonymous with 'getenv("TMP")';it returns untrustable
input if the environment can beset by an attacker. It can have any content
and length, and the same variable can be set more than once (CWE-807,
CWE-20). Check environment variables carefully before using them.
return g_file_new_build_filename (g_get_tmp_dir (), "tepl-file-loader-test", NULL);
data/tepl-5.0.0/testsuite/test-file-saver.c:11:36: [3] (buffer) g_get_tmp_dir:
This function is synonymous with 'getenv("TMP")';it returns untrustable
input if the environment can beset by an attacker. It can have any content
and length, and the same variable can be set more than once (CWE-807,
CWE-20). Check environment variables carefully before using them.
return g_file_new_build_filename (g_get_tmp_dir (), "tepl-file-saver-test", NULL);
data/tepl-5.0.0/testsuite/test-file-saver.c:17:36: [3] (buffer) g_get_tmp_dir:
This function is synonymous with 'getenv("TMP")';it returns untrustable
input if the environment can beset by an attacker. It can have any content
and length, and the same variable can be set more than once (CWE-807,
CWE-20). Check environment variables carefully before using them.
return g_file_new_build_filename (g_get_tmp_dir (), "tepl-file-saver-test~", NULL);
data/tepl-5.0.0/testsuite/test-file.c:81:40: [3] (buffer) g_get_tmp_dir:
This function is synonymous with 'getenv("TMP")';it returns untrustable
input if the environment can beset by an attacker. It can have any content
and length, and the same variable can be set more than once (CWE-807,
CWE-20). Check environment variables carefully before using them.
location = g_file_new_build_filename (g_get_tmp_dir (), "tepl-test-file", NULL);
data/tepl-5.0.0/testsuite/test-file.c:277:27: [3] (buffer) g_get_tmp_dir:
This function is synonymous with 'getenv("TMP")';it returns untrustable
input if the environment can beset by an attacker. It can have any content
and length, and the same variable can be set more than once (CWE-807,
CWE-20). Check environment variables carefully before using them.
path = g_build_filename (g_get_tmp_dir (), "tepl-test-file", NULL);
data/tepl-5.0.0/testsuite/test-file.c:332:31: [3] (buffer) g_get_tmp_dir:
This function is synonymous with 'getenv("TMP")';it returns untrustable
input if the environment can beset by an attacker. It can have any content
and length, and the same variable can be set more than once (CWE-807,
CWE-20). Check environment variables carefully before using them.
new_path = g_build_filename (g_get_tmp_dir (), "tepl-test-file-2", NULL);
data/tepl-5.0.0/testsuite/test-metadata-manager.c:36:40: [3] (buffer) g_get_tmp_dir:
This function is synonymous with 'getenv("TMP")';it returns untrustable
input if the environment can beset by an attacker. It can have any content
and length, and the same variable can be set more than once (CWE-807,
CWE-20). Check environment variables carefully before using them.
tmp_file = g_file_new_build_filename (g_get_tmp_dir (), "tepl-test-metadata-manager.xml", NULL);
data/tepl-5.0.0/testsuite/test-utils.c:149:25: [3] (buffer) g_get_home_dir:
This function is synonymous with 'getenv("HOME")';it returns untrustable
input if the environment can beset by an attacker. It can have any content
and length, and the same variable can be set more than once (CWE-807,
CWE-20). Check environment variables carefully before using them.
const gchar *homedir = g_get_home_dir ();
data/tepl-5.0.0/tepl/tepl-file-saver.c:550:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen (task_data->buffer_content),
data/tepl-5.0.0/tepl/tepl-utils.c:38:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
length = strlen (string);
data/tepl-5.0.0/tepl/tepl-utils.c:241:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
length = strlen (filename);
data/tepl-5.0.0/tepl/tepl-utils.c:348:52: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
gchar *res = g_strdup_printf ("~/%s", filename + strlen (home));
data/tepl-5.0.0/tepl/tepl-utils.c:451:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
hier_part_end = p + strlen (p);
data/tepl-5.0.0/testsuite/tepl-test-utils.c:18:6: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen (content),
ANALYSIS SUMMARY:
Hits = 15
Lines analyzed = 18885 in approximately 0.38 seconds (49094 lines/second)
Physical Source Lines of Code (SLOC) = 11974
Hits@level = [0] 0 [1] 6 [2] 0 [3] 9 [4] 0 [5] 0
Hits@level+ = [0+] 15 [1+] 15 [2+] 9 [3+] 9 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 1.25271 [1+] 1.25271 [2+] 0.751629 [3+] 0.751629 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.