Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/boats-202008/animation/angleanimation.cpp
Examining data/boats-202008/animation/angleanimation.h
Examining data/boats-202008/animation/boatanimation.cpp
Examining data/boats-202008/animation/boatanimation.h
Examining data/boats-202008/animation/headinganimation.cpp
Examining data/boats-202008/animation/headinganimation.h
Examining data/boats-202008/animation/propertyanimation.cpp
Examining data/boats-202008/animation/propertyanimation.h
Examining data/boats-202008/animation/scenarioanimation.cpp
Examining data/boats-202008/animation/scenarioanimation.h
Examining data/boats-202008/animation/splineanimation.cpp
Examining data/boats-202008/animation/splineanimation.h
Examining data/boats-202008/animation/trackanimation.cpp
Examining data/boats-202008/animation/trackanimation.h
Examining data/boats-202008/boatapplication.cpp
Examining data/boats-202008/boatapplication.h
Examining data/boats-202008/boatproperties.cpp
Examining data/boats-202008/boatproperties.h
Examining data/boats-202008/boats.h
Examining data/boats-202008/boatsengine.cpp
Examining data/boats-202008/boatsengine.h
Examining data/boats-202008/commontypes.h
Examining data/boats-202008/enablestate.cpp
Examining data/boats-202008/enablestate.h
Examining data/boats-202008/gifwriter.cpp
Examining data/boats-202008/gifwriter.h
Examining data/boats-202008/graphicsview/arrow.cpp
Examining data/boats-202008/graphicsview/arrow.h
Examining data/boats-202008/graphicsview/boat.cpp
Examining data/boats-202008/graphicsview/boat.h
Examining data/boats-202008/graphicsview/boatanimation.cpp
Examining data/boats-202008/graphicsview/boatanimation.h
Examining data/boats-202008/graphicsview/bubble.cpp
Examining data/boats-202008/graphicsview/bubble.h
Examining data/boats-202008/graphicsview/flag.cpp
Examining data/boats-202008/graphicsview/flag.h
Examining data/boats-202008/graphicsview/gennaker.cpp
Examining data/boats-202008/graphicsview/gennaker.h
Examining data/boats-202008/graphicsview/laylines.cpp
Examining data/boats-202008/graphicsview/laylines.h
Examining data/boats-202008/graphicsview/mark.cpp
Examining data/boats-202008/graphicsview/mark.h
Examining data/boats-202008/graphicsview/point.cpp
Examining data/boats-202008/graphicsview/point.h
Examining data/boats-202008/graphicsview/polyline.cpp
Examining data/boats-202008/graphicsview/polyline.h
Examining data/boats-202008/graphicsview/sail.cpp
Examining data/boats-202008/graphicsview/sail.h
Examining data/boats-202008/graphicsview/situationscene.cpp
Examining data/boats-202008/graphicsview/situationscene.h
Examining data/boats-202008/graphicsview/situationview.cpp
Examining data/boats-202008/graphicsview/situationview.h
Examining data/boats-202008/graphicsview/spinnaker.cpp
Examining data/boats-202008/graphicsview/spinnaker.h
Examining data/boats-202008/graphicsview/track.cpp
Examining data/boats-202008/graphicsview/track.h
Examining data/boats-202008/itemviews/colorpickerwidget.cpp
Examining data/boats-202008/itemviews/colorpickerwidget.h
Examining data/boats-202008/itemviews/trackdelegate.cpp
Examining data/boats-202008/itemviews/trackdelegate.h
Examining data/boats-202008/itemviews/tracktablemodel.cpp
Examining data/boats-202008/itemviews/tracktablemodel.h
Examining data/boats-202008/itemviews/winddelegate.cpp
Examining data/boats-202008/itemviews/winddelegate.h
Examining data/boats-202008/itemviews/windtablemodel.cpp
Examining data/boats-202008/itemviews/windtablemodel.h
Examining data/boats-202008/main.cpp
Examining data/boats-202008/main_qml.cpp
Examining data/boats-202008/mainwindow.cpp
Examining data/boats-202008/mainwindow.h
Examining data/boats-202008/model/boatmodel.cpp
Examining data/boats-202008/model/boatmodel.h
Examining data/boats-202008/model/markmodel.cpp
Examining data/boats-202008/model/markmodel.h
Examining data/boats-202008/model/pointmodel.cpp
Examining data/boats-202008/model/pointmodel.h
Examining data/boats-202008/model/polylinemodel.cpp
Examining data/boats-202008/model/polylinemodel.h
Examining data/boats-202008/model/positionmodel.cpp
Examining data/boats-202008/model/positionmodel.h
Examining data/boats-202008/model/situationmodel.cpp
Examining data/boats-202008/model/situationmodel.h
Examining data/boats-202008/model/trackmodel.cpp
Examining data/boats-202008/model/trackmodel.h
Examining data/boats-202008/model/windmodel.cpp
Examining data/boats-202008/model/windmodel.h
Examining data/boats-202008/situationprint.cpp
Examining data/boats-202008/situationprint.h
Examining data/boats-202008/situationwidget.cpp
Examining data/boats-202008/situationwidget.h
Examining data/boats-202008/statemachine.cpp
Examining data/boats-202008/statemachine.h
Examining data/boats-202008/trace.cpp
Examining data/boats-202008/trace.h
Examining data/boats-202008/undocommands.cpp
Examining data/boats-202008/undocommands.h
Examining data/boats-202008/xmlsituationreader.cpp
Examining data/boats-202008/xmlsituationreader.h
Examining data/boats-202008/xmlsituationwriter.cpp
Examining data/boats-202008/xmlsituationwriter.h
FINAL RESULTS:
data/boats-202008/mainwindow.cpp:120:33: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
createTranslations(QLocale::system().name());
data/boats-202008/boatproperties.cpp:40:15: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!file.open(QFile::ReadOnly | QFile::Text)) {
data/boats-202008/boatsengine.cpp:94:15: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!file.open(QFile::ReadOnly | QFile::Text)) {
data/boats-202008/boatsengine.cpp:140:15: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!file.open(QFile::WriteOnly | QFile::Text)) {
data/boats-202008/gifwriter.cpp:63:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char nameExtension[11] = { 'N','E','T','S','C','A','P','E','2','.','0' };
data/boats-202008/gifwriter.cpp:64:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char loopExtension[3] = { 1, 0, 0 };
data/boats-202008/gifwriter.cpp:71:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char gifExtension[4] = { 0, 8, 0, 0 };
data/boats-202008/mainwindow.cpp:1396:18: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (file.open(QFile::ReadOnly | QFile::Text)) {
data/boats-202008/mainwindow.cpp:1456:15: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!file.open(QFile::WriteOnly | QFile::Text)) {
data/boats-202008/mainwindow.cpp:1589:15: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!file.open(QFile::WriteOnly | QFile::Text)) {
data/boats-202008/mainwindow.cpp:1650:19: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!file.open(QFile::WriteOnly)) {
data/boats-202008/boatsengine.cpp:103:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!reader.read(&file)) {
data/boats-202008/xmlsituationreader.cpp:47:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
bool XmlSituationReader::read(QIODevice *device) {
data/boats-202008/xmlsituationreader.h:42:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
bool read(QIODevice *device);
ANALYSIS SUMMARY:
Hits = 14
Lines analyzed = 16914 in approximately 0.52 seconds (32781 lines/second)
Physical Source Lines of Code (SLOC) = 11129
Hits@level = [0] 0 [1] 3 [2] 10 [3] 0 [4] 1 [5] 0
Hits@level+ = [0+] 14 [1+] 14 [2+] 11 [3+] 1 [4+] 1 [5+] 0
Hits/KSLOC@level+ = [0+] 1.25797 [1+] 1.25797 [2+] 0.988409 [3+] 0.0898553 [4+] 0.0898553 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.