Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/fprintd-1.90.1/pam/fingerprint-strings.h
Examining data/fprintd-1.90.1/pam/pam_fprintd.c
Examining data/fprintd-1.90.1/src/device.c
Examining data/fprintd-1.90.1/src/file_storage.c
Examining data/fprintd-1.90.1/src/file_storage.h
Examining data/fprintd-1.90.1/src/fprintd.h
Examining data/fprintd-1.90.1/src/main.c
Examining data/fprintd-1.90.1/src/manager.c
Examining data/fprintd-1.90.1/src/storage.h
Examining data/fprintd-1.90.1/utils/delete.c
Examining data/fprintd-1.90.1/utils/enroll.c
Examining data/fprintd-1.90.1/utils/list.c
Examining data/fprintd-1.90.1/utils/verify.c

FINAL RESULTS:

data/fprintd-1.90.1/pam/pam_fprintd.c:654:17:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
				max_tries = atoi (argv[i] + strlen (MAX_TRIES_MATCH));
data/fprintd-1.90.1/pam/pam_fprintd.c:665:15:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
				timeout = atoi (argv[i] + strlen (TIMEOUT_MATCH));
data/fprintd-1.90.1/src/file_storage.c:69:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char fingername[2];
data/fprintd-1.90.1/pam/pam_fprintd.c:74:30:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	return (strncmp (s, prefix, strlen (prefix)) == 0);
data/fprintd-1.90.1/pam/pam_fprintd.c:640:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
				value = argv[i] + strlen (DEBUG_MATCH);
data/fprintd-1.90.1/pam/pam_fprintd.c:653:60:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			} else if (str_has_prefix (argv[i], MAX_TRIES_MATCH) && strlen(argv[i]) == strlen (MAX_TRIES_MATCH) + 1) {
data/fprintd-1.90.1/pam/pam_fprintd.c:653:79:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			} else if (str_has_prefix (argv[i], MAX_TRIES_MATCH) && strlen(argv[i]) == strlen (MAX_TRIES_MATCH) + 1) {
data/fprintd-1.90.1/pam/pam_fprintd.c:654:33:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
				max_tries = atoi (argv[i] + strlen (MAX_TRIES_MATCH));
data/fprintd-1.90.1/pam/pam_fprintd.c:658:22:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
							    argv[i] + strlen (MAX_TRIES_MATCH), DEFAULT_MAX_TRIES);
data/fprintd-1.90.1/pam/pam_fprintd.c:664:58:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			} else if (str_has_prefix (argv[i], TIMEOUT_MATCH) && strlen(argv[i]) <= strlen (TIMEOUT_MATCH) + 2) {
data/fprintd-1.90.1/pam/pam_fprintd.c:664:77:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			} else if (str_has_prefix (argv[i], TIMEOUT_MATCH) && strlen(argv[i]) <= strlen (TIMEOUT_MATCH) + 2) {
data/fprintd-1.90.1/pam/pam_fprintd.c:665:31:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
				timeout = atoi (argv[i] + strlen (TIMEOUT_MATCH));
data/fprintd-1.90.1/src/file_storage.c:232:20:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		if (*ent == 0 || strlen(ent) != 1)

ANALYSIS SUMMARY:

Hits = 13
Lines analyzed = 3976 in approximately 0.13 seconds (31178 lines/second)
Physical Source Lines of Code (SLOC) = 2951
Hits@level = [0]   0 [1]  10 [2]   3 [3]   0 [4]   0 [5]   0
Hits@level+ = [0+]  13 [1+]  13 [2+]   3 [3+]   0 [4+]   0 [5+]   0
Hits/KSLOC@level+ = [0+] 4.40529 [1+] 4.40529 [2+] 1.0166 [3+]   0 [4+]   0 [5+]   0
Dot directories skipped = 2 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.