Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/arachne-pnr-0.1+20190728gitc40fb22/src/arachne-pnr.cc
Examining data/arachne-pnr-0.1+20190728gitc40fb22/src/blif.cc
Examining data/arachne-pnr-0.1+20190728gitc40fb22/src/chipdb.cc
Examining data/arachne-pnr-0.1+20190728gitc40fb22/src/configuration.cc
Examining data/arachne-pnr-0.1+20190728gitc40fb22/src/constant.cc
Examining data/arachne-pnr-0.1+20190728gitc40fb22/src/designstate.cc
Examining data/arachne-pnr-0.1+20190728gitc40fb22/src/global.cc
Examining data/arachne-pnr-0.1+20190728gitc40fb22/src/io.cc
Examining data/arachne-pnr-0.1+20190728gitc40fb22/src/line_parser.cc
Examining data/arachne-pnr-0.1+20190728gitc40fb22/src/location.cc
Examining data/arachne-pnr-0.1+20190728gitc40fb22/src/netlist.cc
Examining data/arachne-pnr-0.1+20190728gitc40fb22/src/pack.cc
Examining data/arachne-pnr-0.1+20190728gitc40fb22/src/pcf.cc
Examining data/arachne-pnr-0.1+20190728gitc40fb22/src/place.cc
Examining data/arachne-pnr-0.1+20190728gitc40fb22/src/route.cc
Examining data/arachne-pnr-0.1+20190728gitc40fb22/src/util.cc
Examining data/arachne-pnr-0.1+20190728gitc40fb22/tests/test_bv.cc
Examining data/arachne-pnr-0.1+20190728gitc40fb22/tests/test_us.cc

FINAL RESULTS:

data/arachne-pnr-0.1+20190728gitc40fb22/src/util.cc:134:26:  [5] (race) readlink:
  This accepts filename arguments; if an attacker can move those files or
  change the link content, a race condition results. Also, it does not
  terminate with ASCII NUL. (CWE-362, CWE-20). Reconsider approach.
        ssize_t buflen = readlink("/proc/self/exe", path, sizeof(path));
data/arachne-pnr-0.1+20190728gitc40fb22/src/pcf.cc:212:35:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
              missing_bits.insert(atoi(pin_name.substr(bracket+1).c_str()));
data/arachne-pnr-0.1+20190728gitc40fb22/src/util.cc:133:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char path[PATH_MAX];
data/arachne-pnr-0.1+20190728gitc40fb22/src/util.cc:145:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char path[PATH_MAX];
data/arachne-pnr-0.1+20190728gitc40fb22/src/util.cc:173:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char longpath[MAX_PATH + 1];
data/arachne-pnr-0.1+20190728gitc40fb22/src/util.cc:174:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char shortpath[MAX_PATH + 1];
data/arachne-pnr-0.1+20190728gitc40fb22/src/util.cc:177:9:  [2] (buffer) TCHAR:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        TCHAR shortpath[MAX_PATH + 1];
data/arachne-pnr-0.1+20190728gitc40fb22/src/util.cc:200:34:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                ssize_t buflen = strlen(DLInfo.dli_fname);

ANALYSIS SUMMARY:

Hits = 8
Lines analyzed = 10346 in approximately 0.30 seconds (34568 lines/second)
Physical Source Lines of Code (SLOC) = 8755
Hits@level = [0]   3 [1]   1 [2]   6 [3]   0 [4]   0 [5]   1
Hits@level+ = [0+]  11 [1+]   8 [2+]   7 [3+]   1 [4+]   1 [5+]   1
Hits/KSLOC@level+ = [0+] 1.25642 [1+] 0.913764 [2+] 0.799543 [3+] 0.11422 [4+] 0.11422 [5+] 0.11422
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.