Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/xfconf-4.14.4/common/xfconf-errors.c
Examining data/xfconf-4.14.4/common/xfconf-marshal.c
Examining data/xfconf-4.14.4/common/xfconf-marshal.h
Examining data/xfconf-4.14.4/common/xfconf-gdbus-bindings.c
Examining data/xfconf-4.14.4/common/xfconf-gdbus-bindings.h
Examining data/xfconf-4.14.4/common/xfconf-gvaluefuncs.c
Examining data/xfconf-4.14.4/common/xfconf-gvaluefuncs.h
Examining data/xfconf-4.14.4/common/xfconf-alias.h
Examining data/xfconf-4.14.4/common/xfconf-aliasdef.c
Examining data/xfconf-4.14.4/common/xfconf-common-private.h
Examining data/xfconf-4.14.4/common/xfconf-types.c
Examining data/xfconf-4.14.4/xfconf/xfconf-binding.h
Examining data/xfconf-4.14.4/xfconf/xfconf-channel.h
Examining data/xfconf-4.14.4/xfconf/xfconf-errors.h
Examining data/xfconf-4.14.4/xfconf/xfconf-types.h
Examining data/xfconf-4.14.4/xfconf/xfconf.h
Examining data/xfconf-4.14.4/xfconf/xfconf-binding.c
Examining data/xfconf-4.14.4/xfconf/xfconf-cache.c
Examining data/xfconf-4.14.4/xfconf/xfconf-cache.h
Examining data/xfconf-4.14.4/xfconf/xfconf-channel.c
Examining data/xfconf-4.14.4/xfconf/xfconf-private.h
Examining data/xfconf-4.14.4/xfconf/xfconf.c
Examining data/xfconf-4.14.4/xfconfd/main.c
Examining data/xfconf-4.14.4/xfconfd/xfconf-backend-factory.c
Examining data/xfconf-4.14.4/xfconfd/xfconf-backend-factory.h
Examining data/xfconf-4.14.4/xfconfd/xfconf-backend.c
Examining data/xfconf-4.14.4/xfconfd/xfconf-backend.h
Examining data/xfconf-4.14.4/xfconfd/xfconf-daemon.c
Examining data/xfconf-4.14.4/xfconfd/xfconf-daemon.h
Examining data/xfconf-4.14.4/xfconfd/xfconf-locking-utils.c
Examining data/xfconf-4.14.4/xfconfd/xfconf-locking-utils.h
Examining data/xfconf-4.14.4/xfconfd/xfconf-backend-perchannel-xml.c
Examining data/xfconf-4.14.4/xfconfd/xfconf-backend-perchannel-xml.h
Examining data/xfconf-4.14.4/xfconf-query/main.c
Examining data/xfconf-4.14.4/xfconf-perl/xfconfperl.h
Examining data/xfconf-4.14.4/tests/tests-common.h
Examining data/xfconf-4.14.4/tests/set-properties/t-set-arrayv.c
Examining data/xfconf-4.14.4/tests/set-properties/t-set-boolean.c
Examining data/xfconf-4.14.4/tests/set-properties/t-set-double.c
Examining data/xfconf-4.14.4/tests/set-properties/t-set-int.c
Examining data/xfconf-4.14.4/tests/set-properties/t-set-string.c
Examining data/xfconf-4.14.4/tests/set-properties/t-set-stringlist.c
Examining data/xfconf-4.14.4/tests/set-properties/t-set-uint64.c
Examining data/xfconf-4.14.4/tests/has-properties/t-has-arrayv.c
Examining data/xfconf-4.14.4/tests/has-properties/t-has-boolean.c
Examining data/xfconf-4.14.4/tests/has-properties/t-has-double.c
Examining data/xfconf-4.14.4/tests/has-properties/t-has-string.c
Examining data/xfconf-4.14.4/tests/has-properties/t-has-stringlist.c
Examining data/xfconf-4.14.4/tests/has-properties/t-has-uint64.c
Examining data/xfconf-4.14.4/tests/get-properties/t-get-arrayv.c
Examining data/xfconf-4.14.4/tests/get-properties/t-get-boolean.c
Examining data/xfconf-4.14.4/tests/get-properties/t-get-double.c
Examining data/xfconf-4.14.4/tests/get-properties/t-get-int.c
Examining data/xfconf-4.14.4/tests/get-properties/t-get-string.c
Examining data/xfconf-4.14.4/tests/get-properties/t-get-stringlist.c
Examining data/xfconf-4.14.4/tests/get-properties/t-get-uint64.c
Examining data/xfconf-4.14.4/tests/reset-properties/t-reset-arrayv.c
Examining data/xfconf-4.14.4/tests/reset-properties/t-reset-boolean.c
Examining data/xfconf-4.14.4/tests/reset-properties/t-reset-double.c
Examining data/xfconf-4.14.4/tests/reset-properties/t-reset-int.c
Examining data/xfconf-4.14.4/tests/reset-properties/t-reset-string.c
Examining data/xfconf-4.14.4/tests/reset-properties/t-reset-stringlist.c
Examining data/xfconf-4.14.4/tests/reset-properties/t-reset-uint64.c
Examining data/xfconf-4.14.4/tests/property-changed-signal/t-string-changed-signal.c
Examining data/xfconf-4.14.4/tests/property-changed-signal/t-string-changed-signal-detailed.c
Examining data/xfconf-4.14.4/tests/object-bindings/t-object-bindings.c
Examining data/xfconf-4.14.4/gsettings-backend/xfconf-giomodule.c
Examining data/xfconf-4.14.4/gsettings-backend/xfconf-gsettings-backend.c
Examining data/xfconf-4.14.4/gsettings-backend/xfconf-gsettings-backend.h
FINAL RESULTS:
data/xfconf-4.14.4/common/xfconf-types.c:69:20: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
dest = atoi(g_value_get_string(src_value));
data/xfconf-4.14.4/xfconf/xfconf.c:201:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ns->member_types, member_types, sizeof(GType) * n_members);
data/xfconf-4.14.4/xfconfd/xfconf-backend-perchannel-xml.c:1555:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(state->cur_text + cur_len, text, text_len);
data/xfconf-4.14.4/xfconfd/xfconf-backend-perchannel-xml.c:1911:10: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fp = fopen(filename_tmp, "w");
data/xfconf-4.14.4/xfconf-query/main.c:110:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if ((gint) strlen(propname) > *size)
data/xfconf-4.14.4/xfconf-query/main.c:111:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
*size = strlen(propname);
data/xfconf-4.14.4/xfconf/xfconf-cache.c:1028:39: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
rdata.property_base_len = strlen(rdata.property_base);
data/xfconf-4.14.4/xfconf/xfconf-channel.c:400:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
property += strlen(channel->property_base);
data/xfconf-4.14.4/xfconfd/xfconf-backend-perchannel-xml.c:699:55: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
gchar *channel_name = g_strndup(name, strlen(name) - 4);
data/xfconf-4.14.4/xfconfd/xfconf-backend-perchannel-xml.c:1071:46: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
maj_ver_len = p ? (gsize)(p - version) : strlen(version);
data/xfconf-4.14.4/xfconfd/xfconf-backend-perchannel-xml.c:1072:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(maj_ver_len != strlen(FILE_VERSION_MAJOR)
data/xfconf-4.14.4/xfconfd/xfconf-backend-perchannel-xml.c:1553:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
gint cur_len = strlen(state->cur_text);
data/xfconf-4.14.4/xfconfd/xfconf-backend-perchannel-xml.c:1838:53: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
escaped_name = g_markup_escape_text(prop->name, strlen(prop->name));
ANALYSIS SUMMARY:
Hits = 13
Lines analyzed = 16411 in approximately 0.36 seconds (45734 lines/second)
Physical Source Lines of Code (SLOC) = 10827
Hits@level = [0] 2 [1] 9 [2] 4 [3] 0 [4] 0 [5] 0
Hits@level+ = [0+] 15 [1+] 13 [2+] 4 [3+] 0 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 1.38543 [1+] 1.2007 [2+] 0.369447 [3+] 0 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.