Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/dleyna-server-0.6.0/libdleyna/server/async.c
Examining data/dleyna-server-0.6.0/libdleyna/server/async.h
Examining data/dleyna-server-0.6.0/libdleyna/server/client.h
Examining data/dleyna-server-0.6.0/libdleyna/server/control-point-server.h
Examining data/dleyna-server-0.6.0/libdleyna/server/device.c
Examining data/dleyna-server-0.6.0/libdleyna/server/device.h
Examining data/dleyna-server-0.6.0/libdleyna/server/ifaddrs.h
Examining data/dleyna-server-0.6.0/libdleyna/server/interface.h
Examining data/dleyna-server-0.6.0/libdleyna/server/manager.c
Examining data/dleyna-server-0.6.0/libdleyna/server/manager.h
Examining data/dleyna-server-0.6.0/libdleyna/server/path.c
Examining data/dleyna-server-0.6.0/libdleyna/server/path.h
Examining data/dleyna-server-0.6.0/libdleyna/server/props.c
Examining data/dleyna-server-0.6.0/libdleyna/server/props.h
Examining data/dleyna-server-0.6.0/libdleyna/server/search.c
Examining data/dleyna-server-0.6.0/libdleyna/server/search.h
Examining data/dleyna-server-0.6.0/libdleyna/server/server.c
Examining data/dleyna-server-0.6.0/libdleyna/server/server.h
Examining data/dleyna-server-0.6.0/libdleyna/server/sort.c
Examining data/dleyna-server-0.6.0/libdleyna/server/sort.h
Examining data/dleyna-server-0.6.0/libdleyna/server/task.c
Examining data/dleyna-server-0.6.0/libdleyna/server/task.h
Examining data/dleyna-server-0.6.0/libdleyna/server/upnp.h
Examining data/dleyna-server-0.6.0/libdleyna/server/xml-util.c
Examining data/dleyna-server-0.6.0/libdleyna/server/xml-util.h
Examining data/dleyna-server-0.6.0/libdleyna/server/upnp.c
Examining data/dleyna-server-0.6.0/server/daemon.c
Examining data/dleyna-server-0.6.0/test/dbus/dms-info.c

FINAL RESULTS:

data/dleyna-server-0.6.0/libdleyna/server/device.c:658:29:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
		info->max_wake_on_delay = atoi(wake_on_delay);
data/dleyna-server-0.6.0/libdleyna/server/device.c:900:8:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
		id = atoi(str_array[pos++]);
data/dleyna-server-0.6.0/libdleyna/server/device.c:928:8:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
		id = atoi(str_array[pos++]);
data/dleyna-server-0.6.0/libdleyna/server/device.c:2473:9:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
	return atoi(version);
data/dleyna-server-0.6.0/libdleyna/server/device.c:5666:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(device->icon.bytes, msg->response_body->data,
data/dleyna-server-0.6.0/libdleyna/server/device.c:6050:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char host[NI_MAXHOST];
data/dleyna-server-0.6.0/libdleyna/server/path.c:135:3:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
		sprintf(&retval[i << 1], "%0x", (guint8) id[i]);
data/dleyna-server-0.6.0/libdleyna/server/props.c:662:13:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
				value = atoi(str);
data/dleyna-server-0.6.0/libdleyna/server/device.c:663:36:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	if ((info->device_uuid == NULL || strlen(info->device_uuid) > 70) ||
data/dleyna-server-0.6.0/libdleyna/server/device.c:664:36:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	    (info->mac_address == NULL || strlen(info->mac_address) != 17) ||
data/dleyna-server-0.6.0/libdleyna/server/device.c:693:29:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	doc = xmlParseMemory(info, strlen(info) + 1);
data/dleyna-server-0.6.0/libdleyna/server/device.c:5903:8:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	len = strlen(hex_str);
data/dleyna-server-0.6.0/libdleyna/server/path.c:35:24:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	unsigned int offset = strlen(DLEYNA_SERVER_PATH) + 1;
data/dleyna-server-0.6.0/libdleyna/server/path.c:54:28:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	unsigned int object_len = strlen(object_name);
data/dleyna-server-0.6.0/libdleyna/server/path.c:129:26:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	unsigned int data_len = strlen(id);
data/dleyna-server-0.6.0/libdleyna/server/props.c:655:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		str = cap_str + strlen("srs-rt-retention-period-");
data/dleyna-server-0.6.0/libdleyna/server/search.c:47:35:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	unsigned int search_string_len = strlen(search_string);
data/dleyna-server-0.6.0/libdleyna/server/search.c:77:10:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			value[strlen(value) - 1] = 0;
data/dleyna-server-0.6.0/libdleyna/server/search.c:87:10:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			value[strlen(value) - 1] = 0;
data/dleyna-server-0.6.0/libdleyna/server/search.c:98:10:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			value[strlen(value) - 1] = 0;

ANALYSIS SUMMARY:

Hits = 20
Lines analyzed = 14921 in approximately 0.28 seconds (52537 lines/second)
Physical Source Lines of Code (SLOC) = 11277
Hits@level = [0]  13 [1]  12 [2]   8 [3]   0 [4]   0 [5]   0
Hits@level+ = [0+]  33 [1+]  20 [2+]   8 [3+]   0 [4+]   0 [5+]   0
Hits/KSLOC@level+ = [0+] 2.92631 [1+] 1.77352 [2+] 0.709409 [3+]   0 [4+]   0 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.