Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/fonts-roboto-0~20170802/third_party/fontcrunch/quadopt.cc
Examining data/fonts-roboto-0~20170802/third_party/spiro/font/blend.c
Examining data/fonts-roboto-0~20170802/third_party/spiro/font/segment.c
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/bezctx.c
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/bezctx.h
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/bezctx_hittest.c
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/bezctx_hittest.h
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/bezctx_intf.h
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/bezctx_libart.c
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/bezctx_libart.h
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/bezctx_ps.c
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/bezctx_ps.h
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/bezctx_quartz.c
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/bezctx_quartz.h
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/bezctx_x3.c
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/bezctx_x3.h
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/carbon_main.c
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/cornu.c
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/cornu.h
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/image.c
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/image.h
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/pe_view.c
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/pe_view.h
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/plate.c
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/plate.h
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/ppedit.c
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/ppedit_gtk1.c
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/sexp.c
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/sexp.h
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/spiro.c
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/spiro.h
Examining data/fonts-roboto-0~20170802/third_party/spiro/ppedit/zmisc.h
Examining data/fonts-roboto-0~20170802/third_party/spiro/x3/test.c
Examining data/fonts-roboto-0~20170802/third_party/spiro/x3/x3.h
Examining data/fonts-roboto-0~20170802/third_party/spiro/x3/x3carbon.c
Examining data/fonts-roboto-0~20170802/third_party/spiro/x3/x3common.c
Examining data/fonts-roboto-0~20170802/third_party/spiro/x3/x3common.h
Examining data/fonts-roboto-0~20170802/third_party/spiro/x3/x3gtk.c
Examining data/fonts-roboto-0~20170802/third_party/spiro/x3/x3win32.c

FINAL RESULTS:

data/fonts-roboto-0~20170802/third_party/spiro/ppedit/ppedit.c:236:2:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
	sprintf(str, "%s %s", name, desc);
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/ppedit.c:238:2:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
	strcpy(str, name);
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/ppedit_gtk1.c:375:2:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
	sprintf(str, "%s %s", name, desc);
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/ppedit_gtk1.c:377:2:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
	strcpy(str, name);
data/fonts-roboto-0~20170802/third_party/spiro/x3/x3gtk.c:305:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(tmp, shortcut);
data/fonts-roboto-0~20170802/third_party/spiro/x3/x3gtk.c:313:6:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
	    strcpy(tmp + len - 1, asciinames[c]);
data/fonts-roboto-0~20170802/third_party/fontcrunch/quadopt.cc:467:5:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	is.open(argv[1]);
data/fonts-roboto-0~20170802/third_party/fontcrunch/quadopt.cc:479:5:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	os.open(argv[2]);
data/fonts-roboto-0~20170802/third_party/spiro/font/blend.c:31:16:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    FILE *fi = fopen(fn, "rb");
data/fonts-roboto-0~20170802/third_party/spiro/font/blend.c:33:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char buf[256];
data/fonts-roboto-0~20170802/third_party/spiro/font/blend.c:317:6:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	    memcpy(scores2, scores, n_pgm * sizeof(int));
data/fonts-roboto-0~20170802/third_party/spiro/font/segment.c:151:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[256];
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/image.c:38:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char line[256];
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/image.c:76:15:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    FILE *f = fopen(fn, "rb");
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/image.c:77:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char buf[256];
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/image.c:130:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(dest_line + 3 * left_pad, img_line + 3 * img_off, 3 * img_run);
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/plate.c:83:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(nsp->kt, sp->kt, nsp->n_kt * sizeof(knot));
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/plate.c:405:15:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    FILE *f = fopen(fn, "w");
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/plate.c:510:15:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    FILE *f = fopen(fn, "r");
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/ppedit.c:233:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char str[256];
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/ppedit.c:469:15:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    FILE *f = fopen("/tmp/foo.ps", "w");
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/ppedit_gtk1.c:372:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char str[256];
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/ppedit_gtk1.c:771:15:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    FILE *f = fopen("/tmp/foo.ps", "w");
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/sexp.h:3:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char tokbuf[256];
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/spiro.c:729:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(m + nmat, m, sizeof(bandmat) * nmat);
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/spiro.c:730:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(m + 2 * nmat, m, sizeof(bandmat) * nmat);
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/spiro.c:731:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(v + nmat, v, sizeof(double) * nmat);
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/spiro.c:732:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(v + 2 * nmat, v, sizeof(double) * nmat);
data/fonts-roboto-0~20170802/third_party/spiro/x3/test.c:98:6:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	    char mname[16];
data/fonts-roboto-0~20170802/third_party/spiro/x3/test.c:103:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		char name[16];
data/fonts-roboto-0~20170802/third_party/spiro/x3/x3carbon.c:26:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char *x3multicharstr(UInt32 mc, char buf[5])
data/fonts-roboto-0~20170802/third_party/spiro/x3/x3carbon.c:26:33:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char *x3multicharstr(UInt32 mc, char buf[5])
data/fonts-roboto-0~20170802/third_party/spiro/x3/x3carbon.c:153:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char multicharbuf[5];
data/fonts-roboto-0~20170802/third_party/spiro/x3/x3gtk.c:299:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char tmp[256];
data/fonts-roboto-0~20170802/third_party/spiro/x3/x3gtk.c:308:6:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	    memcpy(tmp + i, "<ctl>", 5);
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/sexp.c:95:6:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	c = getc(sr->f);
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/sexp.c:101:7:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
		c = getc(sr->f);
data/fonts-roboto-0~20170802/third_party/spiro/ppedit/sexp.c:110:10:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	    c = getc(sr->f);
data/fonts-roboto-0~20170802/third_party/spiro/x3/x3carbon.c:15:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    int len = strlen(s);
data/fonts-roboto-0~20170802/third_party/spiro/x3/x3carbon.c:996:63:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    CGContextShowTextAtPoint(dc->ctx, point.x, point.y, text, strlen(text));
data/fonts-roboto-0~20170802/third_party/spiro/x3/x3gtk.c:303:11:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    len = strlen(shortcut);
data/fonts-roboto-0~20170802/third_party/spiro/x3/x3gtk.c:312:12:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	    len + strlen(asciinames[c]) < sizeof(tmp))

ANALYSIS SUMMARY:

Hits = 42
Lines analyzed = 9532 in approximately 0.70 seconds (13625 lines/second)
Physical Source Lines of Code (SLOC) = 7852
Hits@level = [0]  79 [1]   7 [2]  29 [3]   0 [4]   6 [5]   0
Hits@level+ = [0+] 121 [1+]  42 [2+]  35 [3+]   6 [4+]   6 [5+]   0
Hits/KSLOC@level+ = [0+] 15.4101 [1+] 5.34896 [2+] 4.45746 [3+] 0.764137 [4+] 0.764137 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.