Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/vblade-24/ata.c
Examining data/vblade-24/bpf.c
Examining data/vblade-24/config.h
Examining data/vblade-24/config/u64.c
Examining data/vblade-24/fns.h
Examining data/vblade-24/freebsd.c
Examining data/vblade-24/linux.c
Examining data/vblade-24/linux.h
Examining data/vblade-24/dat.h
Examining data/vblade-24/aoe.c

FINAL RESULTS:

data/vblade-24/aoe.c:480:15:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((ch = getopt(argc, argv, "b:dsrm:o:l:")) != -1) {
data/vblade-24/aoe.c:25:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char config[Nconfig];
data/vblade-24/aoe.c:39:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char	serial[Nserial+1];
data/vblade-24/aoe.c:61:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(p->data, config, nconfig);
data/vblade-24/aoe.c:69:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(p->h.dst, &masks[i*Alen], Alen);
data/vblade-24/aoe.c:164:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(config, p->data, nconfig);
data/vblade-24/aoe.c:399:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char nip[4];
data/vblade-24/aoe.c:462:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char h[32];
data/vblade-24/aoe.c:483:13:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
			bufcnt = atoi(optarg);
data/vblade-24/aoe.c:519:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	bfd = open(argv[3], omode);
data/vblade-24/aoe.c:524:10:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
	shelf = atoi(argv[0]);
data/vblade-24/aoe.c:525:9:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
	slot = atoi(argv[1]);
data/vblade-24/ata.c:87:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char buf[64];
data/vblade-24/ata.c:98:2:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
	sprintf(buf, "V%d", VBLADE_VERSION);
data/vblade-24/bpf.c:118:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(bpf_program->bf_insns, insns, sizeof(insns));
data/vblade-24/dat.h:174:8:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
extern char	serial[Nserial+1];
data/vblade-24/freebsd.c:52:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char device[sizeof BPF_DEV];
data/vblade-24/freebsd.c:63:13:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		if ((fd = open(device, O_RDWR)) > 0)
data/vblade-24/freebsd.c:200:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
				memcpy(ea, LLADDR(sdl), ETHER_ADDR_LEN);
data/vblade-24/freebsd.c:245:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(buf, (void *)(pktbp + bh->bh_hdrlen),
data/vblade-24/freebsd.c:57:2:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
	strncpy(device, BPF_DEV, sizeof BPF_DEV);
data/vblade-24/freebsd.c:93:9:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
		(void)strncpy(ifr.ifr_name, eth,
data/vblade-24/freebsd.c:235:15:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
		if ((pktn = read(fd, pktbuf, pktbufsz)) < 0) {
data/vblade-24/linux.c:138:9:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	return read(fd, buf, sz);

ANALYSIS SUMMARY:

Hits = 24
Lines analyzed = 1577 in approximately 0.04 seconds (35529 lines/second)
Physical Source Lines of Code (SLOC) = 1308
Hits@level = [0]  16 [1]   4 [2]  19 [3]   1 [4]   0 [5]   0
Hits@level+ = [0+]  40 [1+]  24 [2+]  20 [3+]   1 [4+]   0 [5+]   0
Hits/KSLOC@level+ = [0+] 30.581 [1+] 18.3486 [2+] 15.2905 [3+] 0.764526 [4+]   0 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.