Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/acpitail-0.1/at.c Examining data/acpitail-0.1/error.h Examining data/acpitail-0.1/sched.c Examining data/acpitail-0.1/emit.c Examining data/acpitail-0.1/sched.h Examining data/acpitail-0.1/error.c Examining data/acpitail-0.1/emit.h FINAL RESULTS: data/acpitail-0.1/error.c:14:2: [4] (format) vsnprintf: If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134). Use a constant for the format specification. vsnprintf(buffer, sizeof(buffer), format, ap); data/acpitail-0.1/at.c:72:13: [3] (buffer) getopt: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. while((c = getopt(argc, argv, "B:A:Z:F:")) != -1) data/acpitail-0.1/at.c:77:38: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). set_interval(SCHED_BATT, scheds, atoi(optarg)); data/acpitail-0.1/at.c:81:41: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). set_interval(SCHED_ACSTATE, scheds, atoi(optarg)); data/acpitail-0.1/at.c:85:38: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). set_interval(SCHED_ZONE, scheds, atoi(optarg)); data/acpitail-0.1/at.c:89:37: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). set_interval(SCHED_FAN, scheds, atoi(optarg)); data/acpitail-0.1/error.c:10:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buffer[4096]; ANALYSIS SUMMARY: Hits = 7 Lines analyzed = 426 in approximately 0.02 seconds (24797 lines/second) Physical Source Lines of Code (SLOC) = 338 Hits@level = [0] 13 [1] 0 [2] 5 [3] 1 [4] 1 [5] 0 Hits@level+ = [0+] 20 [1+] 7 [2+] 7 [3+] 2 [4+] 1 [5+] 0 Hits/KSLOC@level+ = [0+] 59.1716 [1+] 20.7101 [2+] 20.7101 [3+] 5.91716 [4+] 2.95858 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.