Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/downtimed-1.0/downtimes.c
Examining data/downtimed-1.0/downtimed.c
Examining data/downtimed-1.0/downtimedb.c
Examining data/downtimed-1.0/downtimedb.h

FINAL RESULTS:

data/downtimed-1.0/downtimed.c:739:14:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt(argc, argv, "Dd:Ff:l:p:s:Svh?")) != -1) {
data/downtimed-1.0/downtimes.c:237:14:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt(argc, argv, "d:f:n:s:uvh?")) != -1) {
data/downtimed-1.0/downtimed.c:312:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char str[1024];
data/downtimed-1.0/downtimed.c:316:12:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	if ((fp = fopen("/proc/stat", "r")) != NULL) {
data/downtimed-1.0/downtimed.c:367:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	if ((fd = open(cf_downtimedbfile, O_WRONLY | O_CREAT | O_APPEND,
data/downtimed-1.0/downtimed.c:504:13:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		if ((fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC,
data/downtimed-1.0/downtimed.c:520:14:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
			if ((fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC,
data/downtimed-1.0/downtimed.c:625:19:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		if ((cf_logfd = open(cf_log, O_WRONLY | O_APPEND | O_CREAT,
data/downtimed-1.0/downtimed.c:795:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char str[100];
data/downtimed-1.0/downtimed.c:804:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	if ((fd = open(cf_pidfile, O_WRONLY | O_CREAT, DEFFILEMODE)) < 0) {
data/downtimed-1.0/downtimed.c:904:24:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	if (!noclose && (fd = open(_PATH_DEVNULL, O_RDWR, 0)) != -1) {
data/downtimed-1.0/downtimedb.c:141:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	static char str[256];
data/downtimed-1.0/downtimedb.c:166:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	static char str[100];
data/downtimed-1.0/downtimes.c:104:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	if ((fd = open(cf_downtimedbfile, O_RDONLY)) < 0) {
data/downtimed-1.0/downtimed.c:200:2:  [1] (access) umask:
  Ensure that umask is given most restrictive possible setting (e.g., 066 or
  077) (CWE-732).
	umask(S_IWGRP | S_IWOTH);
data/downtimed-1.0/downtimed.c:676:29:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		if (write(cf_logfd, str2, strlen(str2)) < 0)
data/downtimed-1.0/downtimed.c:847:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	if (write(fd, str, strlen(str)) != strlen(str)) {
data/downtimed-1.0/downtimed.c:847:37:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	if (write(fd, str, strlen(str)) != strlen(str)) {
data/downtimed-1.0/downtimedb.c:93:13:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	if ((ret = read(fd, (void *)buf, sizeof(struct downtimedb)))
data/downtimed-1.0/downtimes.c:234:6:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	if (strlen(argv[0]) > 0 && argv[0][strlen(argv[0])-1] != 's')
data/downtimed-1.0/downtimes.c:234:37:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	if (strlen(argv[0]) > 0 && argv[0][strlen(argv[0])-1] != 's')

ANALYSIS SUMMARY:

Hits = 21
Lines analyzed = 1457 in approximately 0.08 seconds (17353 lines/second)
Physical Source Lines of Code (SLOC) = 900
Hits@level = [0]  20 [1]   7 [2]  12 [3]   2 [4]   0 [5]   0
Hits@level+ = [0+]  41 [1+]  21 [2+]  14 [3+]   2 [4+]   0 [5+]   0
Hits/KSLOC@level+ = [0+] 45.5556 [1+] 23.3333 [2+] 15.5556 [3+] 2.22222 [4+]   0 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.