Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/cuetools-1.4.1/src/lib/cd.c Examining data/cuetools-1.4.1/src/lib/cd.h Examining data/cuetools-1.4.1/src/lib/cdtext.c Examining data/cuetools-1.4.1/src/lib/cdtext.h Examining data/cuetools-1.4.1/src/lib/cue.h Examining data/cuetools-1.4.1/src/lib/cue_parse_prefix.h Examining data/cuetools-1.4.1/src/lib/cue_print.c Examining data/cuetools-1.4.1/src/lib/cuefile.c Examining data/cuetools-1.4.1/src/lib/cuefile.h Examining data/cuetools-1.4.1/src/lib/time.c Examining data/cuetools-1.4.1/src/lib/time.h Examining data/cuetools-1.4.1/src/lib/toc.h Examining data/cuetools-1.4.1/src/lib/toc_parse_prefix.h Examining data/cuetools-1.4.1/src/lib/toc_print.c Examining data/cuetools-1.4.1/src/tools/cuebreakpoints.c Examining data/cuetools-1.4.1/src/tools/cueconvert.c Examining data/cuetools-1.4.1/src/tools/cueprint.c FINAL RESULTS: data/cuetools-1.4.1/src/tools/cueprint.c:255:3: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. printf(conv, value.cval); data/cuetools-1.4.1/src/tools/cueprint.c:258:3: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. printf(conv, value.ival); data/cuetools-1.4.1/src/tools/cueprint.c:262:4: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. printf(conv, VALUE_UNSET); data/cuetools-1.4.1/src/tools/cueprint.c:264:4: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. printf(conv, value.sval); data/cuetools-1.4.1/src/tools/cuebreakpoints.c:149:20: [3] (buffer) getopt_long: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. while (-1 != (c = getopt_long(argc, argv, "hi:V", longopts, NULL))) { data/cuetools-1.4.1/src/tools/cueconvert.c:99:20: [3] (buffer) getopt_long: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. while (-1 != (c = getopt_long(argc, argv, "hi:o:V", longopts, NULL))) { data/cuetools-1.4.1/src/tools/cueprint.c:447:20: [3] (buffer) getopt_long: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. while (-1 != (c = getopt_long(argc, argv, "hi:n:d:t:V", longopts, NULL))) { data/cuetools-1.4.1/src/lib/cdtext.c:47:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy (new_cdtext, cdtext, sizeof(cdtext)); data/cuetools-1.4.1/src/lib/cuefile.c:28:27: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). } else if (NULL == (fp = fopen(name, "r"))) { data/cuetools-1.4.1/src/lib/cuefile.c:62:27: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). } else if (NULL == (fp = fopen(name, "w"))) { data/cuetools-1.4.1/src/lib/time.c:37:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static char msf[10]; data/cuetools-1.4.1/src/lib/time.c:41:2: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(msf, "%02d:%02d:%02d", minutes, seconds, frames); data/cuetools-1.4.1/src/tools/cueprint.c:464:14: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). trackno = atoi(optarg); data/cuetools-1.4.1/src/tools/cueprint.c:241:2: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(conv, start, length); data/cuetools-1.4.1/src/tools/cueprint.c:267:19: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). printf("%zu: ", strlen(conv)); data/cuetools-1.4.1/src/tools/cueprint.c:369:8: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). char *read; data/cuetools-1.4.1/src/tools/cueprint.c:375:18: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). while ('\0' != *read) { data/cuetools-1.4.1/src/tools/cueprint.c:376:16: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). if ('\\' == *read) { data/cuetools-1.4.1/src/tools/cueprint.c:379:13: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). switch (*read) { data/cuetools-1.4.1/src/tools/cueprint.c:406:15: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). *write = *read; data/cuetools-1.4.1/src/tools/cueprint.c:410:14: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). *write = *read; ANALYSIS SUMMARY: Hits = 21 Lines analyzed = 2213 in approximately 0.12 seconds (18206 lines/second) Physical Source Lines of Code (SLOC) = 1602 Hits@level = [0] 124 [1] 8 [2] 6 [3] 3 [4] 4 [5] 0 Hits@level+ = [0+] 145 [1+] 21 [2+] 13 [3+] 7 [4+] 4 [5+] 0 Hits/KSLOC@level+ = [0+] 90.5119 [1+] 13.1086 [2+] 8.11486 [3+] 4.36954 [4+] 2.49688 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.