Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/gdmap-0.8.1/src/preferences.h Examining data/gdmap-0.8.1/src/tree.h Examining data/gdmap-0.8.1/src/tree.c Examining data/gdmap-0.8.1/src/utils.h Examining data/gdmap-0.8.1/src/colors.h Examining data/gdmap-0.8.1/src/l_i18n.h Examining data/gdmap-0.8.1/src/utils.c Examining data/gdmap-0.8.1/src/gui_main.h Examining data/gdmap-0.8.1/src/gui_support.h Examining data/gdmap-0.8.1/src/about.h Examining data/gdmap-0.8.1/src/gui_support.c Examining data/gdmap-0.8.1/src/colors.c Examining data/gdmap-0.8.1/src/about.c Examining data/gdmap-0.8.1/src/preferences.c Examining data/gdmap-0.8.1/src/main.c Examining data/gdmap-0.8.1/src/gui_main.c FINAL RESULTS: data/gdmap-0.8.1/src/colors.c:161:24: [3] (buffer) g_get_home_dir: This function is synonymous with 'getenv("HOME")';it returns untrustable input if the environment can beset by an attacker. It can have any content and length, and the same variable can be set more than once (CWE-807, CWE-20). Check environment variables carefully before using them. const char* home = g_get_home_dir(); data/gdmap-0.8.1/src/colors.c:438:24: [3] (buffer) g_get_home_dir: This function is synonymous with 'getenv("HOME")';it returns untrustable input if the environment can beset by an attacker. It can have any content and length, and the same variable can be set more than once (CWE-807, CWE-20). Check environment variables carefully before using them. const char* home = g_get_home_dir(); data/gdmap-0.8.1/src/preferences.c:49:28: [3] (buffer) g_get_home_dir: This function is synonymous with 'getenv("HOME")';it returns untrustable input if the environment can beset by an attacker. It can have any content and length, and the same variable can be set more than once (CWE-807, CWE-20). Check environment variables carefully before using them. const char* home = g_get_home_dir(); data/gdmap-0.8.1/src/preferences.c:716:24: [3] (buffer) g_get_home_dir: This function is synonymous with 'getenv("HOME")';it returns untrustable input if the environment can beset by an attacker. It can have any content and length, and the same variable can be set more than once (CWE-807, CWE-20). Check environment variables carefully before using them. const char* home = g_get_home_dir(); data/gdmap-0.8.1/src/colors.c:208:13: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). r = atoi(attr); data/gdmap-0.8.1/src/colors.c:219:13: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). g = atoi(attr); data/gdmap-0.8.1/src/colors.c:230:13: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). b = atoi(attr); data/gdmap-0.8.1/src/preferences.c:58:18: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fd = fopen(filename, "w"); data/gdmap-0.8.1/src/utils.c:150:7: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(result+len, sep, add); data/gdmap-0.8.1/src/utils.c:153:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(result+len, text, l); data/gdmap-0.8.1/src/tree.c:168:25: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (dirname[strlen(dirname)-1] == '/') data/gdmap-0.8.1/src/utils.c:134:18: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). unsigned add = strlen(sep); data/gdmap-0.8.1/src/utils.c:141:12: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). len += strlen(text)+add; data/gdmap-0.8.1/src/utils.c:148:18: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). unsigned l = strlen(text); ANALYSIS SUMMARY: Hits = 14 Lines analyzed = 3695 in approximately 0.11 seconds (34187 lines/second) Physical Source Lines of Code (SLOC) = 2777 Hits@level = [0] 1 [1] 4 [2] 6 [3] 4 [4] 0 [5] 0 Hits@level+ = [0+] 15 [1+] 14 [2+] 10 [3+] 4 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 5.40151 [1+] 5.04141 [2+] 3.60101 [3+] 1.4404 [4+] 0 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.