Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/fspy-0.1.1/src/regmatch.c
Examining data/fspy-0.1.1/src/fspy.c
Examining data/fspy-0.1.1/src/regmatch.h
Examining data/fspy-0.1.1/src/stating.h
Examining data/fspy-0.1.1/src/adaptive.c
Examining data/fspy-0.1.1/src/diff.h
Examining data/fspy-0.1.1/src/numlen.h
Examining data/fspy-0.1.1/src/fsevents.c
Examining data/fspy-0.1.1/src/isnumber.h
Examining data/fspy-0.1.1/src/isnumber.c
Examining data/fspy-0.1.1/src/fsevents.h
Examining data/fspy-0.1.1/src/adaptive.h
Examining data/fspy-0.1.1/src/stating.c
Examining data/fspy-0.1.1/src/enumdirs.c
Examining data/fspy-0.1.1/src/enumdirs.h
Examining data/fspy-0.1.1/src/output.h
Examining data/fspy-0.1.1/src/fspy.h
Examining data/fspy-0.1.1/src/diff.c
Examining data/fspy-0.1.1/src/output.c
Examining data/fspy-0.1.1/src/numlen.c

FINAL RESULTS:

data/fspy-0.1.1/src/enumdirs.c:149:9:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
        strcat(path, ip_local);
data/fspy-0.1.1/src/enumdirs.c:155:9:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
        strcat(path, dp->d_name);
data/fspy-0.1.1/src/fspy.c:318:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(tmp_output_string, "%s", "[,T,], ,d,:,p,f");
data/fspy-0.1.1/src/fspy.c:447:11:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
          strcat(event->name, path);
data/fspy-0.1.1/src/fspy.c:195:15:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
  while((co = getopt_long(argc, argv, opt_str, long_opts, &opt_idx)) != -1) {
data/fspy-0.1.1/src/adaptive.c:98:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy((&lsptr[id])->path, path, strlen(path));
data/fspy-0.1.1/src/diff.c:117:23:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                      memcpy(&felsptr[i].statdat.st_size, &statdat->st_size, sizeof(off_t));
data/fspy-0.1.1/src/diff.c:122:23:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                      memcpy(&felsptr[i].statdat.st_atime, &statdat->st_atime, sizeof(time_t));
data/fspy-0.1.1/src/diff.c:127:23:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                      memcpy(&felsptr[i].statdat.st_mtime, &statdat->st_mtime, sizeof(time_t));
data/fspy-0.1.1/src/diff.c:132:23:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                      memcpy(&felsptr[i].statdat.st_ctime, &statdat->st_ctime, sizeof(time_t));
data/fspy-0.1.1/src/diff.c:137:23:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                      memcpy(&felsptr[i].statdat.st_mode, &statdat->st_mode, sizeof(mode_t));
data/fspy-0.1.1/src/diff.c:142:23:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                      memcpy(&felsptr[i].statdat.st_uid, &statdat->st_uid, sizeof(uid_t));
data/fspy-0.1.1/src/diff.c:147:23:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                      memcpy(&felsptr[i].statdat.st_gid, &statdat->st_gid, sizeof(gid_t));
data/fspy-0.1.1/src/diff.c:152:23:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                      memcpy(&felsptr[i].statdat.st_ino, &statdat->st_ino, sizeof(ino_t));
data/fspy-0.1.1/src/diff.c:157:23:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                      memcpy(&felsptr[i].statdat.st_dev, &statdat->st_dev, sizeof(dev_t));
data/fspy-0.1.1/src/enumdirs.c:63:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[64]={0};
data/fspy-0.1.1/src/enumdirs.c:65:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fd = open("/proc/sys/fs/inotify/max_user_watches", O_RDONLY);
data/fspy-0.1.1/src/enumdirs.c:73:10:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
  return atoi(buf);
data/fspy-0.1.1/src/enumdirs.c:113:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(lpath, lsptr[cnt].path, ELEMENT_SIZE);
data/fspy-0.1.1/src/enumdirs.c:128:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char path[ELEMENT_SIZE] = {0};
data/fspy-0.1.1/src/enumdirs.c:129:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char ip_local[ELEMENT_SIZE] = {0};
data/fspy-0.1.1/src/enumdirs.c:131:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(ip_local, initial_path, strlen(initial_path));
data/fspy-0.1.1/src/enumdirs.c:164:11:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
          memcpy((&felsptr[delc_oa])->path, path, strlen(path));
data/fspy-0.1.1/src/enumdirs.c:165:11:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
          memcpy(&felsptr[delc_oa].statdat, &tmp_stat, sizeof(struct stat));
data/fspy-0.1.1/src/enumdirs.c:189:15:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
              memcpy((&lsptr[elc_oa])->path, path, strlen(path));
data/fspy-0.1.1/src/enumdirs.c:223:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy((&felsptr[delc_oa])->path, initial_path, strlen(initial_path));
data/fspy-0.1.1/src/enumdirs.c:224:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&felsptr[delc_oa].statdat, statdat, sizeof(struct stat));
data/fspy-0.1.1/src/enumdirs.c:230:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy((&lsptr[elc_oa])->path, initial_path, strlen(initial_path));
data/fspy-0.1.1/src/fsevents.c:38:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char desc[128]={0};
data/fspy-0.1.1/src/fsevents.c:42:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc,"file was accessed");
data/fspy-0.1.1/src/fsevents.c:45:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "file was modified");
data/fspy-0.1.1/src/fsevents.c:48:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "metadata changed");
data/fspy-0.1.1/src/fsevents.c:51:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "writeable file was closed");
data/fspy-0.1.1/src/fsevents.c:54:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "unwriteable file was closed");
data/fspy-0.1.1/src/fsevents.c:57:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "file was opened");
data/fspy-0.1.1/src/fsevents.c:60:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "file was moved from X");
data/fspy-0.1.1/src/fsevents.c:63:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "file was moved to Y");
data/fspy-0.1.1/src/fsevents.c:66:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "file was created");
data/fspy-0.1.1/src/fsevents.c:69:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "file was deleted");
data/fspy-0.1.1/src/fsevents.c:72:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "self was deleted");
data/fspy-0.1.1/src/fsevents.c:75:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "self was moved");
data/fspy-0.1.1/src/fsevents.c:78:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "backing fs was unmounted");
data/fspy-0.1.1/src/fsevents.c:81:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "event queued overflowed");
data/fspy-0.1.1/src/fsevents.c:84:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "file was ignored");
data/fspy-0.1.1/src/fsevents.c:87:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "dir was created");
data/fspy-0.1.1/src/fsevents.c:90:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "metadata changed");
data/fspy-0.1.1/src/fsevents.c:93:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "dir access (1)");
data/fspy-0.1.1/src/fsevents.c:96:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "dir access (2)");
data/fspy-0.1.1/src/fsevents.c:99:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "dir was deleted");
data/fspy-0.1.1/src/fsevents.c:102:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "UNKNOWN: %x", event);
data/fspy-0.1.1/src/fsevents.c:105:10:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  return memcpy(ptr, desc, strlen(desc));
data/fspy-0.1.1/src/fspy.c:161:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char    buf[BUF_LEN], *path, *lpath = NULL;
data/fspy-0.1.1/src/fspy.c:162:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char    pbuf[EVENT_SIZE + 4096];
data/fspy-0.1.1/src/fspy.c:163:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char    fpath[ELEMENT_SIZE * 2] = {0};
data/fspy-0.1.1/src/fspy.c:248:25:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
      recursive_depth = atoi(tmp_recursive_depth);
data/fspy-0.1.1/src/fspy.c:390:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(path, (argv+optind)[0], strlen((argv+optind)[0]));
data/fspy-0.1.1/src/fspy.c:437:11:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
          memcpy(pbuf, buf, EVENT_SIZE);
data/fspy-0.1.1/src/fspy.c:440:13:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
            memcpy(pbuf, buf, EVENT_SIZE + event->len);
data/fspy-0.1.1/src/fspy.c:452:13:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
            strcat(lpath, "|PATH_LOOKUP_ERROR|");
data/fspy-0.1.1/src/fspy.h:64:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char path[ELEMENT_SIZE];
data/fspy-0.1.1/src/fspy.h:69:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char path[ELEMENT_SIZE];
data/fspy-0.1.1/src/output.c:51:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char desc_ptr[128] = {0};
data/fspy-0.1.1/src/output.c:53:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char fpath[ELEMENT_SIZE * 2] = {0};
data/fspy-0.1.1/src/stating.c:48:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char desc[128] = {0};
data/fspy-0.1.1/src/stating.c:52:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "block device");
data/fspy-0.1.1/src/stating.c:55:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "character device");
data/fspy-0.1.1/src/stating.c:58:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "directory");
data/fspy-0.1.1/src/stating.c:61:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "FIFO/pipe");
data/fspy-0.1.1/src/stating.c:64:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "symlink");
data/fspy-0.1.1/src/stating.c:67:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "regular file");
data/fspy-0.1.1/src/stating.c:70:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "socket");
data/fspy-0.1.1/src/stating.c:73:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(desc, "UNKNOWN: %u", (statdat->st_mode & S_IFMT));
data/fspy-0.1.1/src/stating.c:77:10:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  return memcpy(ptr, desc, strlen(desc));
data/fspy-0.1.1/src/stating.c:88:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char fpath[ELEMENT_SIZE * 2] = {0};
data/fspy-0.1.1/src/stating.c:105:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&sb, statdat, sizeof(struct stat));
data/fspy-0.1.1/src/adaptive.c:98:36:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  memcpy((&lsptr[id])->path, path, strlen(path));
data/fspy-0.1.1/src/diff.c:111:8:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if(strlen(mystr) == 1) {
data/fspy-0.1.1/src/enumdirs.c:67:5:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    read(fd, buf, 64);
data/fspy-0.1.1/src/enumdirs.c:131:34:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  memcpy(ip_local, initial_path, strlen(initial_path));
data/fspy-0.1.1/src/enumdirs.c:138:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if(ip_local[strlen(ip_local)-1] != '/')
data/fspy-0.1.1/src/enumdirs.c:139:5:  [1] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant character.
    strcat(ip_local, "/");
data/fspy-0.1.1/src/enumdirs.c:145:10:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      if(strlen(ip_local) > ELEMENT_SIZE) {
data/fspy-0.1.1/src/enumdirs.c:151:11:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      if((strlen(dp->d_name) + strlen(ip_local)) > ELEMENT_SIZE) {
data/fspy-0.1.1/src/enumdirs.c:151:32:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      if((strlen(dp->d_name) + strlen(ip_local)) > ELEMENT_SIZE) {
data/fspy-0.1.1/src/enumdirs.c:164:51:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
          memcpy((&felsptr[delc_oa])->path, path, strlen(path));
data/fspy-0.1.1/src/enumdirs.c:170:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
          if(path[strlen(path)-1] != '/')
data/fspy-0.1.1/src/enumdirs.c:171:13:  [1] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant character.
            strcat(path, "/");
data/fspy-0.1.1/src/enumdirs.c:185:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            if(strlen(path) > ELEMENT_SIZE) {
data/fspy-0.1.1/src/enumdirs.c:189:52:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
              memcpy((&lsptr[elc_oa])->path, path, strlen(path));
data/fspy-0.1.1/src/enumdirs.c:223:53:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    memcpy((&felsptr[delc_oa])->path, initial_path, strlen(initial_path));
data/fspy-0.1.1/src/enumdirs.c:230:48:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  memcpy((&lsptr[elc_oa])->path, initial_path, strlen(initial_path));
data/fspy-0.1.1/src/fsevents.c:105:28:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  return memcpy(ptr, desc, strlen(desc));
data/fspy-0.1.1/src/fspy.c:247:49:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if(isnumber(tmp_recursive_depth) == TRUE && strlen(tmp_recursive_depth) < (numlen(MAXRECURDEPTH) + 1)) {
data/fspy-0.1.1/src/fspy.c:262:8:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if(strlen(tmp_filter_string) > MAXREGEXLEN) {
data/fspy-0.1.1/src/fspy.c:276:8:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if(strlen(tmp_ifilter_string) > MAXREGEXLEN) {
data/fspy-0.1.1/src/fspy.c:290:8:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if(strlen(tmp_type_string) > MAXTYPELEN) {
data/fspy-0.1.1/src/fspy.c:296:49:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        if((strstr(twhitelst, tsp) == NULL) || (strlen(tsp) > 1)) {
data/fspy-0.1.1/src/fspy.c:309:8:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if(strlen(tmp_output_string) > MAXOUTSTRLEN) {
data/fspy-0.1.1/src/fspy.c:323:8:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if(strlen(tmp_diff_string) > MAXDIFFSTRLEN) {
data/fspy-0.1.1/src/fspy.c:329:54:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        if((strstr(dbasewhitelist, tsp) == NULL) || (strlen(tsp) > 1)) {
data/fspy-0.1.1/src/fspy.c:339:57:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        if((strstr(tmp_output_string, tsp) == NULL) || (strlen(tsp) > 1)) {
data/fspy-0.1.1/src/fspy.c:386:6:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if(strlen((argv+optind)[0]) > ELEMENT_SIZE) {
data/fspy-0.1.1/src/fspy.c:390:36:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    memcpy(path, (argv+optind)[0], strlen((argv+optind)[0]));
data/fspy-0.1.1/src/fspy.c:396:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      if(path[strlen(path)-1] != '/')
data/fspy-0.1.1/src/fspy.c:397:9:  [1] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant character.
        strcat(path, "/");
data/fspy-0.1.1/src/fspy.c:429:16:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    if((len += read(fd, buf + len, BUF_LEN - len)) < 0) {
data/fspy-0.1.1/src/fspy.c:466:20:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
          if(fpath[strlen(fpath)-1] != '/')
data/fspy-0.1.1/src/fspy.c:467:13:  [1] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant character.
            strcat(fpath, "/");
data/fspy-0.1.1/src/output.c:66:8:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if(strlen(mystr) == 1) {
data/fspy-0.1.1/src/output.c:90:58:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        case  'A':  ctp = ctime(&statdat->st_atime); ctp[strlen(ctp) - 1] = '\0';
data/fspy-0.1.1/src/output.c:93:58:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        case  'M':  ctp = ctime(&statdat->st_mtime); ctp[strlen(ctp) - 1] = '\0';
data/fspy-0.1.1/src/output.c:96:58:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        case  'S':  ctp = ctime(&statdat->st_ctime); ctp[strlen(ctp) - 1] = '\0';
data/fspy-0.1.1/src/output.c:100:49:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                    ctp = ctime(&currtime); ctp[strlen(ctp) - 1] = '\0';
data/fspy-0.1.1/src/stating.c:77:28:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  return memcpy(ptr, desc, strlen(desc));
data/fspy-0.1.1/src/stating.c:109:8:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if(strlen(mystr) == 1) {

ANALYSIS SUMMARY:

Hits = 115
Lines analyzed = 2252 in approximately 0.12 seconds (18978 lines/second)
Physical Source Lines of Code (SLOC) = 1281
Hits@level = [0]  92 [1]  40 [2]  70 [3]   1 [4]   4 [5]   0
Hits@level+ = [0+] 207 [1+] 115 [2+]  75 [3+]   5 [4+]   4 [5+]   0
Hits/KSLOC@level+ = [0+] 161.593 [1+] 89.7736 [2+] 58.548 [3+] 3.9032 [4+] 3.12256 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.