Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/deepin-music-5.0.1+ds/src/interface/metasearchengine.h
Examining data/deepin-music-5.0.1+ds/src/interface/plugininterface.h
Examining data/deepin-music-5.0.1+ds/src/interface/searchmeta.h
Examining data/deepin-music-5.0.1+ds/src/libdmusic/libdmusic_global.h
Examining data/deepin-music-5.0.1+ds/src/libdmusic/mediameta.cpp
Examining data/deepin-music-5.0.1+ds/src/libdmusic/mediameta.h
Examining data/deepin-music-5.0.1+ds/src/libdmusic/metadetector.cpp
Examining data/deepin-music-5.0.1+ds/src/libdmusic/metadetector.h
Examining data/deepin-music-5.0.1+ds/src/libdmusic/musicmeta.h
Examining data/deepin-music-5.0.1+ds/src/libdmusic/net/geese.cpp
Examining data/deepin-music-5.0.1+ds/src/libdmusic/net/geese.h
Examining data/deepin-music-5.0.1+ds/src/libdmusic/playlistmeta.h
Examining data/deepin-music-5.0.1+ds/src/libdmusic/util/cueparser.cpp
Examining data/deepin-music-5.0.1+ds/src/libdmusic/util/cueparser.h
Examining data/deepin-music-5.0.1+ds/src/libdmusic/util/encodingdetector.cpp
Examining data/deepin-music-5.0.1+ds/src/libdmusic/util/encodingdetector.h
Examining data/deepin-music-5.0.1+ds/src/libdmusic/util/pinyinsearch.cpp
Examining data/deepin-music-5.0.1+ds/src/libdmusic/util/pinyinsearch.h
Examining data/deepin-music-5.0.1+ds/src/libdmusic/util/singleton.h
Examining data/deepin-music-5.0.1+ds/src/music-player/core/mediadatabase.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/core/mediadatabase.h
Examining data/deepin-music-5.0.1+ds/src/music-player/core/mediadatabasewriter.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/core/mediadatabasewriter.h
Examining data/deepin-music-5.0.1+ds/src/music-player/core/medialibrary.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/core/medialibrary.h
Examining data/deepin-music-5.0.1+ds/src/music-player/core/metasearchservice.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/core/metasearchservice.h
Examining data/deepin-music-5.0.1+ds/src/music-player/core/music.h
Examining data/deepin-music-5.0.1+ds/src/music-player/core/musicsettings.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/core/musicsettings.h
Examining data/deepin-music-5.0.1+ds/src/music-player/core/player.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/core/player.h
Examining data/deepin-music-5.0.1+ds/src/music-player/core/playlist.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/core/playlist.h
Examining data/deepin-music-5.0.1+ds/src/music-player/core/playlistmanager.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/core/playlistmanager.h
Examining data/deepin-music-5.0.1+ds/src/music-player/core/pluginmanager.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/core/pluginmanager.h
Examining data/deepin-music-5.0.1+ds/src/music-player/core/qplayer.h
Examining data/deepin-music-5.0.1+ds/src/music-player/core/util/filesystemwatcher.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/core/util/filesystemwatcher.h
Examining data/deepin-music-5.0.1+ds/src/music-player/core/util/global.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/core/util/global.h
Examining data/deepin-music-5.0.1+ds/src/music-player/core/util/inotifyengine.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/core/util/inotifyengine.h
Examining data/deepin-music-5.0.1+ds/src/music-player/core/util/lyric.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/core/util/lyric.h
Examining data/deepin-music-5.0.1+ds/src/music-player/core/util/threadpool.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/core/util/threadpool.h
Examining data/deepin-music-5.0.1+ds/src/music-player/main.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/musicapp.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/musicapp.h
Examining data/deepin-music-5.0.1+ds/src/music-player/presenter/presenter.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/presenter/presenter.h
Examining data/deepin-music-5.0.1+ds/src/music-player/presenter/presenter_p.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/footerwidget.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/footerwidget.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/helper/widgethellper.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/helper/widgethellper.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/importwidget.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/importwidget.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/loadwidget.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/loadwidget.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/lyricwidget.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/lyricwidget.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/mainframe.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/mainframe.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/mainwindow.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/mainwindow.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/musiclistwidget.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/musiclistwidget.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/playlistwidget.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/playlistwidget.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/closeconfirmdialog.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/closeconfirmdialog.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/cover.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/cover.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/ddropdown.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/ddropdown.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/delegate/lyriclinedelegate.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/delegate/lyriclinedelegate.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/delegate/musicitemdelegate.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/delegate/musicitemdelegate.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/delegate/musicitemdelegate_p.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/filter.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/filter.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/infodialog.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/infodialog.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/label.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/label.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/listview.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/listview.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/lyricview.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/lyricview.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/modebuttom.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/modebuttom.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/model/musiclistmodel.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/model/musiclistmodel.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/musiclistview.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/musiclistview.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/playlistitem.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/playlistitem.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/playlistview.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/playlistview.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/pushbutton.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/pushbutton.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/searchedit.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/searchedit.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/searchmetaitem.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/searchmetaitem.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/searchmetalist.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/searchmetalist.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/searchresult.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/searchresult.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/settingsdialog.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/slider.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/slider.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/soundvolume.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/soundvolume.h
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/titlebarwidget.cpp
Examining data/deepin-music-5.0.1+ds/src/music-player/view/widget/titlebarwidget.h
Examining data/deepin-music-5.0.1+ds/src/plugin/netease-meta-search/metaanalyzer.cpp
Examining data/deepin-music-5.0.1+ds/src/plugin/netease-meta-search/metaanalyzer.h
Examining data/deepin-music-5.0.1+ds/src/plugin/netease-meta-search/neteasemetasearch.cpp
Examining data/deepin-music-5.0.1+ds/src/plugin/netease-meta-search/neteasemetasearch.h
Examining data/deepin-music-5.0.1+ds/src/plugin/netease-meta-search/neteasemetasearch_global.h
FINAL RESULTS:
data/deepin-music-5.0.1+ds/src/libdmusic/mediameta.cpp:90:14: [4] (format) sprintf:
Potential format string problem (CWE-134). Make format string constant.
text.sprintf("%.1fB", sizeByte / 1.0);
data/deepin-music-5.0.1+ds/src/libdmusic/mediameta.cpp:94:14: [4] (format) sprintf:
Potential format string problem (CWE-134). Make format string constant.
text.sprintf("%.1fK", sizeByte / 1024.0);
data/deepin-music-5.0.1+ds/src/libdmusic/mediameta.cpp:98:14: [4] (format) sprintf:
Potential format string problem (CWE-134). Make format string constant.
text.sprintf("%.1fM", sizeByte / 1024.0 / 1024.0);
data/deepin-music-5.0.1+ds/src/libdmusic/mediameta.cpp:101:10: [4] (format) sprintf:
Potential format string problem (CWE-134). Make format string constant.
text.sprintf("%.1fG", sizeByte / 1024.0 / 1024.0 / 1024.0);
data/deepin-music-5.0.1+ds/src/libdmusic/metadetector.cpp:68:50: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
auto localeCode = localeCodes.value(QLocale::system().name());
data/deepin-music-5.0.1+ds/src/libdmusic/metadetector.cpp:149:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[buflen];
data/deepin-music-5.0.1+ds/src/libdmusic/metadetector.cpp:187:21: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (cueFile.open(QIODevice::ReadOnly)) {
data/deepin-music-5.0.1+ds/src/libdmusic/util/cueparser.cpp:201:18: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!cueFile.open(QIODevice::ReadOnly)) {
data/deepin-music-5.0.1+ds/src/music-player/core/mediadatabase.cpp:46:13: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!db.open()) {
data/deepin-music-5.0.1+ds/src/music-player/core/metasearchservice.cpp:98:27: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
coverFile.open(QIODevice::WriteOnly);
data/deepin-music-5.0.1+ds/src/music-player/core/metasearchservice.cpp:115:23: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
lyricFile.open(QIODevice::WriteOnly);
data/deepin-music-5.0.1+ds/src/music-player/core/metasearchservice.cpp:154:19: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (coverFile.open(QIODevice::ReadOnly)) {
data/deepin-music-5.0.1+ds/src/music-player/core/metasearchservice.cpp:163:19: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (lyricFile.open(QIODevice::ReadOnly)) {
data/deepin-music-5.0.1+ds/src/music-player/core/metasearchservice.cpp:237:23: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
coverFile.open(QIODevice::WriteOnly);
data/deepin-music-5.0.1+ds/src/music-player/core/metasearchservice.cpp:259:19: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
lyricFile.open(QIODevice::WriteOnly);
data/deepin-music-5.0.1+ds/src/plugin/netease-meta-search/neteasemetasearch.cpp:77:10: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
file.open(QIODevice::WriteOnly);
data/deepin-music-5.0.1+ds/src/libdmusic/util/encodingdetector.cpp:70:29: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (lang == NULL || strlen(lang) == 0) {
data/deepin-music-5.0.1+ds/src/music-player/core/util/inotifyengine.cpp:113:21: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
auto readSize = read(d->m_inotifyFd, buffer.data(), buffSize);
ANALYSIS SUMMARY:
Hits = 18
Lines analyzed = 18733 in approximately 0.46 seconds (40956 lines/second)
Physical Source Lines of Code (SLOC) = 12631
Hits@level = [0] 0 [1] 2 [2] 11 [3] 0 [4] 5 [5] 0
Hits@level+ = [0+] 18 [1+] 18 [2+] 16 [3+] 5 [4+] 5 [5+] 0
Hits/KSLOC@level+ = [0+] 1.42507 [1+] 1.42507 [2+] 1.26672 [3+] 0.395851 [4+] 0.395851 [5+] 0
Dot directories skipped = 2 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.