Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/eclipse-platform-resources-4.17/bundles/org.eclipse.core.filesystem/natives/localfile.h Examining data/eclipse-platform-resources-4.17/bundles/org.eclipse.core.filesystem/natives/unix/unixfile.c Examining data/eclipse-platform-resources-4.17/bundles/org.eclipse.core.filesystem/natives/unix/unixfile.h Examining data/eclipse-platform-resources-4.17/bundles/org.eclipse.core.filesystem/natives/win32/localfile.c Examining data/eclipse-platform-resources-4.17/bundles/org.eclipse.core.resources/natives/ref.c Examining data/eclipse-platform-resources-4.17/bundles/org.eclipse.core.resources/natives/ref.h FINAL RESULTS: data/eclipse-platform-resources-4.17/bundles/org.eclipse.core.filesystem/natives/unix/unixfile.c:129:9: [5] (race) chmod: This accepts filename arguments; if an attacker can move those files, a race condition results. (CWE-362). Use fchmod( ) instead. code = chmod(name, mode); data/eclipse-platform-resources-4.17/bundles/org.eclipse.core.filesystem/natives/unix/unixfile.c:211:10: [5] (race) readlink: This accepts filename arguments; if an attacker can move those files or change the link content, a race condition results. Also, it does not terminate with ASCII NUL. (CWE-362, CWE-20). Reconsider approach. len = readlink((const char*)name, temp, PATH_MAX); data/eclipse-platform-resources-4.17/bundles/org.eclipse.core.filesystem/natives/unix/unixfile.c:76:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(result, temp, len * sizeof(jbyte)); data/eclipse-platform-resources-4.17/bundles/org.eclipse.core.filesystem/natives/unix/unixfile.c:207:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char temp[PATH_MAX+1]; data/eclipse-platform-resources-4.17/bundles/org.eclipse.core.filesystem/natives/win32/localfile.c:84:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(result, temp, n * sizeof(jbyte)); data/eclipse-platform-resources-4.17/bundles/org.eclipse.core.filesystem/natives/win32/localfile.c:137:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(result, temp, n * sizeof(jchar)); data/eclipse-platform-resources-4.17/bundles/org.eclipse.core.filesystem/natives/win32/localfile.c:156:7: [2] (buffer) MultiByteToWideChar: Requires maximum length in CHARACTERS, not bytes (CWE-120). MultiByteToWideChar( CP_ACP, 0, (LPCSTR)str, slen, NULL, 0 ); data/eclipse-platform-resources-4.17/bundles/org.eclipse.core.filesystem/natives/win32/localfile.c:158:9: [2] (buffer) MultiByteToWideChar: Requires maximum length in CHARACTERS, not bytes (CWE-120). if( MultiByteToWideChar( CP_ACP, 0, (LPCSTR)str, slen, data/eclipse-platform-resources-4.17/bundles/org.eclipse.core.resources/natives/ref.c:37:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(path + 4, temp, numberOfChars * sizeof(jchar)); data/eclipse-platform-resources-4.17/bundles/org.eclipse.core.resources/natives/ref.c:72:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(path, temp, numberOfChars * sizeof(jbyte)); data/eclipse-platform-resources-4.17/bundles/org.eclipse.core.filesystem/natives/win32/localfile.c:149:14: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). int slen = strlen(str); data/eclipse-platform-resources-4.17/bundles/org.eclipse.core.filesystem/natives/win32/localfile.c:276:6: [1] (buffer) wcslen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). wcslen(info.cFileName)); ANALYSIS SUMMARY: Hits = 12 Lines analyzed = 1744 in approximately 0.25 seconds (7059 lines/second) Physical Source Lines of Code (SLOC) = 926 Hits@level = [0] 0 [1] 2 [2] 8 [3] 0 [4] 0 [5] 2 Hits@level+ = [0+] 12 [1+] 12 [2+] 10 [3+] 2 [4+] 2 [5+] 2 Hits/KSLOC@level+ = [0+] 12.959 [1+] 12.959 [2+] 10.7991 [3+] 2.15983 [4+] 2.15983 [5+] 2.15983 Dot directories skipped = 18 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.