Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/tkdnd-2.6/unix/tkUnixSelect.c
Examining data/tkdnd-2.6/unix/TkDND_XDND.c
Examining data/tkdnd-2.6/unix/Cursors.c
Examining data/tkdnd-2.6/win/OleDND.h
Examining data/tkdnd-2.6/win/TkDND_OleDND.cpp

FINAL RESULTS:

data/tkdnd-2.6/win/OleDND.h:732:17:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
                strcpy((char *) szTempStr, Tcl_GetStringResult(interp));
data/tkdnd-2.6/win/OleDND.h:741:17:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
                strcpy((char *) szTempStr, Tcl_GetStringResult(interp));
data/tkdnd-2.6/win/OleDND.h:1062:11:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
          strcpy(file_name, (char *) szTempStr);
data/tkdnd-2.6/win/OleDND.h:1064:11:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
          strcat(file_name, (char *) file_descriptor.cFileName);
data/tkdnd-2.6/win/TkDND_OleDND.cpp:216:13:  [4] (buffer) lstrcpyW:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
            lstrcpyW((LPWSTR) ptr_u, (LPWSTR) unicode);
data/tkdnd-2.6/win/TkDND_OleDND.cpp:285:15:  [4] (buffer) lstrcpyW:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
              lstrcpyW(CurPosition, pszFileName);
data/tkdnd-2.6/unix/TkDND_XDND.c:1427:24:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      data = (unsigned char *) Tcl_GetString(objv[7]);
data/tkdnd-2.6/unix/tkUnixSelect.c:102:13:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
            char buf[12];
data/tkdnd-2.6/unix/tkUnixSelect.c:104:6:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
	    sprintf(buf, "0x%04x", (unsigned short) *propPtr);
data/tkdnd-2.6/unix/tkUnixSelect.c:113:13:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
            char buf[12];
data/tkdnd-2.6/unix/tkUnixSelect.c:115:6:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
	    sprintf(buf, "0x%x", (unsigned int) *propPtr);
data/tkdnd-2.6/win/OleDND.h:427:5:  [2] (buffer) TCHAR:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    TCHAR szTempStr[80];
data/tkdnd-2.6/win/OleDND.h:453:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(dest, source, len);
data/tkdnd-2.6/win/OleDND.h:471:5:  [2] (buffer) TCHAR:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    TCHAR                szTempStr[MAX_PATH+2];
data/tkdnd-2.6/win/OleDND.h:531:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      char tmp[64];
data/tkdnd-2.6/win/OleDND.h:555:13:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
            sprintf(tmp, "0x%08x", fetc.cfFormat);
data/tkdnd-2.6/win/OleDND.h:935:11:  [2] (buffer) TCHAR:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
          TCHAR szFile[MAX_PATH+2];
data/tkdnd-2.6/win/OleDND.h:1060:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
          char file_name[MAX_PATH+1];
data/tkdnd-2.6/win/TkDND_OleDND.cpp:227:20:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
            ptr = (char *) GlobalLock(m_pstgmed[i].hGlobal);
data/tkdnd-2.6/win/TkDND_OleDND.cpp:228:13:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
            memcpy(ptr, Tcl_GetString(objv[4]), nDataLength);
data/tkdnd-2.6/win/TkDND_OleDND.cpp:279:37:  [2] (buffer) TCHAR:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
              TCHAR *pszFileName = (TCHAR *)
data/tkdnd-2.6/win/TkDND_OleDND.cpp:311:16:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        ptr = (char *) GlobalLock(m_pstgmed[i].hGlobal);
data/tkdnd-2.6/win/TkDND_OleDND.cpp:312:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(ptr, bytes, nDataLength);
data/tkdnd-2.6/win/OleDND.h:1063:11:  [1] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant character.
          strcat(file_name, "\\");

ANALYSIS SUMMARY:

Hits = 24
Lines analyzed = 3998 in approximately 0.13 seconds (30779 lines/second)
Physical Source Lines of Code (SLOC) = 3160
Hits@level = [0]  13 [1]   1 [2]  17 [3]   0 [4]   6 [5]   0
Hits@level+ = [0+]  37 [1+]  24 [2+]  23 [3+]   6 [4+]   6 [5+]   0
Hits/KSLOC@level+ = [0+] 11.7089 [1+] 7.59494 [2+] 7.27848 [3+] 1.89873 [4+] 1.89873 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.