Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/cksfv-1.3.14/src/cksfv.c
Examining data/cksfv-1.3.14/src/cksfv.h
Examining data/cksfv-1.3.14/src/crc32.c
Examining data/cksfv-1.3.14/src/newsfv.c
Examining data/cksfv-1.3.14/src/print.c
Examining data/cksfv-1.3.14/src/readsfv.c
Examining data/cksfv-1.3.14/win32/basename.c
Examining data/cksfv-1.3.14/win32/libgen.h

FINAL RESULTS:

data/cksfv-1.3.14/src/cksfv.c:122:6:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
	    strcpy(dir, sfvfile);
data/cksfv-1.3.14/src/readsfv.c:328:6:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
	    strcpy(filename, dirinfo->d_name);
data/cksfv-1.3.14/src/cksfv.c:47:18:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
    while ((ch = getopt(argc, argv, "icC:f:g:qvbrLs")) != -1)
data/cksfv-1.3.14/src/cksfv.c:38:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char dir[PATH_MAX] = ".";
data/cksfv-1.3.14/src/cksfv.c:39:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char sfvfile[PATH_MAX];
data/cksfv-1.3.14/src/crc32.c:96:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char buf[BUFFERSIZE];
data/cksfv-1.3.14/src/newsfv.c:48:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	if ((fd = open(fn, O_RDONLY | O_LARGEFILE | O_BINARY, 0)) < 0) {
data/cksfv-1.3.14/src/print.c:100:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char head[82], *p;
data/cksfv-1.3.14/src/readsfv.c:45:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char sfvname[PATH_MAX + 1];
data/cksfv-1.3.14/src/readsfv.c:65:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char buf[PATH_MAX + 256];	/* enough for name and checksum */
data/cksfv-1.3.14/src/readsfv.c:81:10:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    fd = fopen(fn, "r");
data/cksfv-1.3.14/src/readsfv.c:192:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	     open(filename, O_RDONLY | O_LARGEFILE | O_BINARY, 0)) < 0) {
data/cksfv-1.3.14/src/readsfv.c:197:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		    open(filename, O_RDONLY | O_LARGEFILE | O_BINARY, 0);
data/cksfv-1.3.14/src/readsfv.c:339:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char cwd[PATH_MAX + 1];
data/cksfv-1.3.14/src/readsfv.c:411:6:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	    char processdir[PATH_MAX];
data/cksfv-1.3.14/src/cksfv.c:59:6:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
	    strncpy(dir, optarg, sizeof(dir));
data/cksfv-1.3.14/src/cksfv.c:64:6:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
	    strncpy(sfvfile, optarg, sizeof(sfvfile));
data/cksfv-1.3.14/src/cksfv.c:69:6:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
	    strncpy(sfvfile, optarg, sizeof(sfvfile));
data/cksfv-1.3.14/src/cksfv.c:127:3:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
		strcpy(dir, ".");
data/cksfv-1.3.14/src/crc32.c:102:12:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	if ((nr = read(fd, buf, sizeof(buf))) < 0) {
data/cksfv-1.3.14/src/print.c:106:11:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    len = strlen(head);
data/cksfv-1.3.14/src/readsfv.c:118:12:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	linelen = strlen(buf);
data/cksfv-1.3.14/src/readsfv.c:169:6:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	if (strlen(filename) >= PATH_MAX) {
data/cksfv-1.3.14/src/readsfv.c:408:6:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		   strlen(dirinfo->d_name) > 4 &&
data/cksfv-1.3.14/src/readsfv.c:409:36:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		   (strcasecmp(dirinfo->d_name + strlen(dirinfo->d_name) - 4, ".sfv") == 0)) {
data/cksfv-1.3.14/win32/basename.c:57:9:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
		(void)strcpy(bname, ".");
data/cksfv-1.3.14/win32/basename.c:62:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	endp = path + strlen(path) - 1;
data/cksfv-1.3.14/win32/basename.c:68:9:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
		(void)strcpy(bname, "/");
data/cksfv-1.3.14/win32/basename.c:81:8:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
	(void)strncpy(bname, startp, endp - startp + 1);

ANALYSIS SUMMARY:

Hits = 29
Lines analyzed = 1117 in approximately 0.06 seconds (18605 lines/second)
Physical Source Lines of Code (SLOC) = 819
Hits@level = [0]  61 [1]  14 [2]  12 [3]   1 [4]   2 [5]   0
Hits@level+ = [0+]  90 [1+]  29 [2+]  15 [3+]   3 [4+]   2 [5+]   0
Hits/KSLOC@level+ = [0+] 109.89 [1+] 35.409 [2+] 18.315 [3+] 3.663 [4+] 2.442 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.