Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/erlang-p1-xml-1.1.43/c_src/fxml.c
Examining data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c

FINAL RESULTS:

data/erlang-p1-xml-1.1.43/c_src/fxml.c:96:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(rbuf->b + rbuf->len, data, len);
data/erlang-p1-xml-1.1.43/c_src/fxml.c:272:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(output.data, rbuf->b, rbuf->len);
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:110:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(res, buf, buf_len);
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:121:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(bin->data, buf, buf_len);
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:131:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(str, buf, buf_len);
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:164:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  const char *parts[3];
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:213:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(buf->data, prefix, prefix_len);
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:215:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(buf->data + prefix_len + 1, name, name_len);
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:331:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(val_str, atts[i+1], val_len);
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:500:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(cdata.data, s, len);
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:513:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(children->cdata.data+old_size, s, len);
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:522:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(children->cdata.data, s, len);
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:668:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(c->name.data, "xmlns:", 6);
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:669:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(c->name.data + 6, prefix, len);
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:675:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(c->name.data, "xmlns", 5);
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:685:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(c->value.data, uri, len);
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:796:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(state->pid, pid, sizeof(ErlNifPid));
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:975:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(state->pid, &pid, sizeof(ErlNifPid));
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:1013:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      char buf[16];
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:96:7:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if (strlen(str) != buf_len)
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:253:30:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  return dup_to_term(env, s, strlen(s));
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:328:22:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    size_t val_len = strlen(atts[i+1]);
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:397:44:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
          tuple_val = dup_to_term(env, ns, strlen(ns));
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:400:57:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                                   dup_to_term(env, ns, strlen(ns)));
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:446:51:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                             dup_to_term(env, ns, strlen(ns)));
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:662:18:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    size_t len = strlen(prefix);
data/erlang-p1-xml-1.1.43/c_src/fxml_stream.c:678:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  size_t len = strlen(uri);

ANALYSIS SUMMARY:

Hits = 27
Lines analyzed = 1362 in approximately 0.04 seconds (32927 lines/second)
Physical Source Lines of Code (SLOC) = 1105
Hits@level = [0]   0 [1]   8 [2]  19 [3]   0 [4]   0 [5]   0
Hits@level+ = [0+]  27 [1+]  27 [2+]  19 [3+]   0 [4+]   0 [5+]   0
Hits/KSLOC@level+ = [0+] 24.4344 [1+] 24.4344 [2+] 17.1946 [3+]   0 [4+]   0 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.