Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/gauche-gtk-0.6+git20160927/glgd/gauche-glgd.c
Examining data/gauche-gtk-0.6+git20160927/glgd/gauche-glgd.h
Examining data/gauche-gtk-0.6+git20160927/glgd/glgd.h
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdBitfield.c
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdBitfield.h
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdCam.c
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdCam.h
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdDefines.h
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdDraw.c
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdDraw.h
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdGraph.h
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdLink.c
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdLink.h
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdMatrix.c
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdMatrix.h
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdNode.c
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdNode.h
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdQuat.c
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdQuat.h
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdStroke.c
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdStroke.h
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdTexture.c
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdTexture.h
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdTypes.h
Examining data/gauche-gtk-0.6+git20160927/glgd/glgdGraph.c
Examining data/gauche-gtk-0.6+git20160927/gtkgl/gauche-gtkgl.c
Examining data/gauche-gtk-0.6+git20160927/gtkgl/gauche-gtkgl.h
Examining data/gauche-gtk-0.6+git20160927/src/gauche-gtk.c
Examining data/gauche-gtk-0.6+git20160927/src/gauche-gtk.h
Examining data/gauche-gtk-0.6+git20160927/src/test-native.c
FINAL RESULTS:
data/gauche-gtk-0.6+git20160927/glgd/glgdGraph.c:1853:9: [4] (format) vprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
vprintf(fmt, ap);
data/gauche-gtk-0.6+git20160927/glgd/glgdMatrix.c:66:9: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
printf(s_mtxFmt, mtx[ndx], mtx[ndx+1], mtx[ndx+2], mtx[ndx+3]);
data/gauche-gtk-0.6+git20160927/glgd/glgdStroke.c:712:14: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
rc = vsnprintf(str, 255, fmt, ap);
data/gauche-gtk-0.6+git20160927/glgd/glgdMatrix.c:21:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char s_mtxFmt[32] = "|%7.4f %7.4f %7.4f %12.4f|\n";
data/gauche-gtk-0.6+git20160927/glgd/glgdNode.h:30:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char label[GLGDNODE_LABEL_MAX];
data/gauche-gtk-0.6+git20160927/glgd/glgdStroke.c:703:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[256];
data/gauche-gtk-0.6+git20160927/src/gauche-gtk.c:1431:14: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
if (pts) memcpy(r->elements, pts, sizeof(GdkPoint[1])*npts);
data/gauche-gtk-0.6+git20160927/src/gauche-gtk.c:1445:15: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
if (segs) memcpy(r->elements, segs, sizeof(GdkSegment[1])*nsegs);
data/gauche-gtk-0.6+git20160927/src/gauche-gtk.c:1459:16: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
if (rects) memcpy(r->elements, rects, sizeof(GdkRectangle[1])*nrects);
data/gauche-gtk-0.6+git20160927/src/gauche-gtk.c:1473:17: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
if (colors) memcpy(r->elements, colors, sizeof(GdkColor[1])*ncolors);
data/gauche-gtk-0.6+git20160927/glgd/glgdNode.c:91:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
slen = strlen(node->label) * stroke->pointSize[0];
data/gauche-gtk-0.6+git20160927/glgd/glgdNode.c:226:9: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(node->label, label, GLGDNODE_LABEL_MAX-1);
ANALYSIS SUMMARY:
Hits = 12
Lines analyzed = 9258 in approximately 0.25 seconds (36910 lines/second)
Physical Source Lines of Code (SLOC) = 7097
Hits@level = [0] 8 [1] 2 [2] 7 [3] 0 [4] 3 [5] 0
Hits@level+ = [0+] 20 [1+] 12 [2+] 10 [3+] 3 [4+] 3 [5+] 0
Hits/KSLOC@level+ = [0+] 2.81809 [1+] 1.69086 [2+] 1.40905 [3+] 0.422714 [4+] 0.422714 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.