Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/butteraugli-0~20170116/butteraugli/butteraugli.cc Examining data/butteraugli-0~20170116/butteraugli/butteraugli.h Examining data/butteraugli-0~20170116/butteraugli/butteraugli_main.cc FINAL RESULTS: data/butteraugli-0~20170116/butteraugli/butteraugli.cc:61:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(aligned - kPointerSize, &allocated, kPointerSize); data/butteraugli-0~20170116/butteraugli/butteraugli.cc:72:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&allocated, aligned - kPointerSize, kPointerSize); data/butteraugli-0~20170116/butteraugli/butteraugli.h:322:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(to, from, other.ysize() * other.bytes_per_row()); data/butteraugli-0~20170116/butteraugli/butteraugli.h:352:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(row_to, row_from, xsize * sizeof(T)); data/butteraugli-0~20170116/butteraugli/butteraugli.h:365:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(row_to, row_from, xsize * sizeof(T)); data/butteraugli-0~20170116/butteraugli/butteraugli_main.cc:279:13: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). FILE* f = fopen(filename, "rb"); data/butteraugli-0~20170116/butteraugli/butteraugli_main.cc:284:12: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char magic[2]; data/butteraugli-0~20170116/butteraugli/butteraugli_main.cc:412:24: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). FILE* const fmap = fopen(argv[3], "wb"); ANALYSIS SUMMARY: Hits = 8 Lines analyzed = 2589 in approximately 0.09 seconds (28471 lines/second) Physical Source Lines of Code (SLOC) = 2107 Hits@level = [0] 18 [1] 0 [2] 8 [3] 0 [4] 0 [5] 0 Hits@level+ = [0+] 26 [1+] 8 [2+] 8 [3+] 0 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 12.3398 [1+] 3.79687 [2+] 3.79687 [3+] 0 [4+] 0 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.