Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/texlive-base-2020.20200925/texmf-dist/doc/latex/metaplot/examples/metacontour.cc
Examining data/texlive-base-2020.20200925/texmf-dist/doc/latex/metaplot/examples/metacontour.h
Examining data/texlive-base-2020.20200925/texmf-dist/doc/latex/metaplot/examples/cpoint.h
Examining data/texlive-base-2020.20200925/texmf-dist/doc/latex/metaplot/examples/cap1.cc
Examining data/texlive-base-2020.20200925/texmf-dist/doc/latex/metaplot/examples/capillary.cc
Examining data/texlive-base-2020.20200925/texmf-dist/doc/latex/metaplot/examples/metacontour_main.cc
Examining data/texlive-base-2020.20200925/texmf-dist/doc/latex/metaplot/examples/cpoint.cc
Examining data/texlive-base-2020.20200925/texmf-dist/doc/generic/xypic/support/pnmrawtopcropwhite.c
Examining data/texlive-base-2020.20200925/texmf-dist/doc/fonts/eurosym/eurosym.cpp
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/SimpleDemoOGDF.c++
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/module/module_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/layered/SplitHeuristic_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/layered/SiftingHeuristic_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/layered/LongestPathRanking_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/layered/layered_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/layered/OptimalRanking_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/layered/SugiyamaLayout_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/layered/FastSimpleHierarchyLayout_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/layered/BarycenterHeuristic_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/layered/MedianHeuristic_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/layered/GreedyInsertHeuristic_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/layered/FastHierarchyLayout_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/layered/GreedyCycleRemoval_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/layered/CoffmanGrahamRanking_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/layered/DfsAcyclicSubgraph_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/planarity/PlanarizationLayout_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/planarity/planarity_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/ogdf_script.c++
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/energybased/multilevelmixer/SolarPlacer_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/energybased/multilevelmixer/ZeroPlacer_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/energybased/multilevelmixer/CirclePlacer_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/energybased/multilevelmixer/IndependentSetMerger_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/energybased/multilevelmixer/EdgeCoverMerger_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/energybased/multilevelmixer/SolarMerger_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/energybased/multilevelmixer/LocalBiconnectedMerger_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/energybased/multilevelmixer/MatchingMerger_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/energybased/multilevelmixer/multilevelmixer_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/energybased/multilevelmixer/RandomPlacer_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/energybased/multilevelmixer/MedianPlacer_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/energybased/multilevelmixer/BarycenterPlacer_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/energybased/multilevelmixer/RandomMerger_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/energybased/energybased_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/energybased/FastMultipoleEmbedder_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/energybased/FMMMLayout_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/energybased/SpringEmbedderKK_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/energybased/SpringEmbedderFRExact_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/energybased/GEMLayout_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/energybased/SpringEmbedderFR_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/energybased/MultilevelLayout_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/InterfaceFromOGDF.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/misclayout/CircularLayout_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/misclayout/misclayout_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/misclayout/BalloonLayout_script.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/InterfaceFromOGDF.c++
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/interface/c/InterfaceFromC.c
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/interface/c/InterfaceFromC++.c++
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/interface/c/InterfaceFromC.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/interface/c/InterfaceFromC++.h
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/examples/c/SimpleDemoC.c
Examining data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/examples/c/SimpleDemoCPlusPlus.c++

FINAL RESULTS:

data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/interface/c/InterfaceFromC.c:203:16:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
  char* copy = strcpy((char*) malloc(strlen(s)+1), s);
data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/interface/c/InterfaceFromC.c:234:18:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    char* copy = strcpy((char*) malloc(strlen(s)+1), s);
data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/interface/c/InterfaceFromC.c:270:18:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
	p->strings[i] = strcpy((char*) malloc(strlen(s)+1), s);
data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/interface/c/InterfaceFromC.c:560:32:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
  edge->path->strings[start] = strcpy((char*) malloc(strlen(s)+1), s);
data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/ogdf/c/layered/SiftingHeuristic_script.h:22:32:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
	h->strategy(SiftingHeuristic::random);
data/texlive-base-2020.20200925/texmf-dist/doc/fonts/eurosym/eurosym.cpp:33:13:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    FILE *f=fopen ("eurosym.fig", "wt");
data/texlive-base-2020.20200925/texmf-dist/doc/generic/xypic/support/pnmrawtopcropwhite.c:85:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char magic[MAGICSIZE];
data/texlive-base-2020.20200925/texmf-dist/doc/generic/xypic/support/pnmrawtopcropwhite.c:54:17:  [1] (buffer) getchar:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    switch (c = getchar()) {
data/texlive-base-2020.20200925/texmf-dist/doc/generic/xypic/support/pnmrawtopcropwhite.c:65:17:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    switch (c = getc(stdin)) {
data/texlive-base-2020.20200925/texmf-dist/doc/generic/xypic/support/pnmrawtopcropwhite.c:118:7:  [1] (buffer) getchar:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  if (getchar() != '\n')
data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/interface/c/InterfaceFromC.c:203:38:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  char* copy = strcpy((char*) malloc(strlen(s)+1), s);
data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/interface/c/InterfaceFromC.c:234:40:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    char* copy = strcpy((char*) malloc(strlen(s)+1), s);
data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/interface/c/InterfaceFromC.c:270:40:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	p->strings[i] = strcpy((char*) malloc(strlen(s)+1), s);
data/texlive-base-2020.20200925/texmf-dist/source/generic/pgf/c/graphdrawing/pgf/gd/interface/c/InterfaceFromC.c:560:54:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  edge->path->strings[start] = strcpy((char*) malloc(strlen(s)+1), s);

ANALYSIS SUMMARY:

Hits = 14
Lines analyzed = 5013 in approximately 1.27 seconds (3946 lines/second)
Physical Source Lines of Code (SLOC) = 3261
Hits@level = [0]   9 [1]   7 [2]   2 [3]   1 [4]   4 [5]   0
Hits@level+ = [0+]  23 [1+]  14 [2+]   7 [3+]   5 [4+]   4 [5+]   0
Hits/KSLOC@level+ = [0+] 7.05305 [1+] 4.29316 [2+] 2.14658 [3+] 1.53327 [4+] 1.22662 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.