Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/gnome-screenshot-3.38.0/src/cheese-flash.c
Examining data/gnome-screenshot-3.38.0/src/cheese-flash.h
Examining data/gnome-screenshot-3.38.0/src/gnome-screenshot.c
Examining data/gnome-screenshot-3.38.0/src/screenshot-application.c
Examining data/gnome-screenshot-3.38.0/src/screenshot-application.h
Examining data/gnome-screenshot-3.38.0/src/screenshot-area-selection.c
Examining data/gnome-screenshot-3.38.0/src/screenshot-area-selection.h
Examining data/gnome-screenshot-3.38.0/src/screenshot-backend-shell.c
Examining data/gnome-screenshot-3.38.0/src/screenshot-backend-shell.h
Examining data/gnome-screenshot-3.38.0/src/screenshot-backend-x11.c
Examining data/gnome-screenshot-3.38.0/src/screenshot-backend-x11.h
Examining data/gnome-screenshot-3.38.0/src/screenshot-backend.c
Examining data/gnome-screenshot-3.38.0/src/screenshot-backend.h
Examining data/gnome-screenshot-3.38.0/src/screenshot-config.c
Examining data/gnome-screenshot-3.38.0/src/screenshot-config.h
Examining data/gnome-screenshot-3.38.0/src/screenshot-dialog.c
Examining data/gnome-screenshot-3.38.0/src/screenshot-dialog.h
Examining data/gnome-screenshot-3.38.0/src/screenshot-filename-builder.c
Examining data/gnome-screenshot-3.38.0/src/screenshot-filename-builder.h
Examining data/gnome-screenshot-3.38.0/src/screenshot-interactive-dialog.c
Examining data/gnome-screenshot-3.38.0/src/screenshot-interactive-dialog.h
Examining data/gnome-screenshot-3.38.0/src/screenshot-utils.c
Examining data/gnome-screenshot-3.38.0/src/screenshot-utils.h

FINAL RESULTS:

data/gnome-screenshot-3.38.0/src/screenshot-backend-shell.c:54:44:  [3] (random) g_random_int:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
  tmpname = g_strdup_printf ("scr-%d.png", g_random_int ());
data/gnome-screenshot-3.38.0/src/screenshot-filename-builder.c:56:30:  [3] (buffer) g_get_home_dir:
  This function is synonymous with 'getenv("HOME")';it returns untrustable
  input if the environment can beset by an attacker. It can have any content
  and length, and the same variable can be set more than once (CWE-807,
  CWE-20). Check environment variables carefully before using them.
    return g_build_filename (g_get_home_dir (), &path[1], NULL);
data/gnome-screenshot-3.38.0/src/screenshot-filename-builder.c:80:20:  [3] (buffer) g_get_home_dir:
  This function is synonymous with 'getenv("HOME")';it returns untrustable
  input if the environment can beset by an attacker. It can have any content
  and length, and the same variable can be set more than once (CWE-807,
  CWE-20). Check environment variables carefully before using them.
  return g_strdup (g_get_home_dir ());
data/gnome-screenshot-3.38.0/src/screenshot-application.c:82:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  static char * groups[2] = { "Graphics", NULL };
data/gnome-screenshot-3.38.0/src/screenshot-filename-builder.c:41:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char *base_paths[NUM_TESTS];

ANALYSIS SUMMARY:

Hits = 5
Lines analyzed = 3798 in approximately 0.19 seconds (20084 lines/second)
Physical Source Lines of Code (SLOC) = 2550
Hits@level = [0]   2 [1]   0 [2]   2 [3]   3 [4]   0 [5]   0
Hits@level+ = [0+]   7 [1+]   5 [2+]   5 [3+]   3 [4+]   0 [5+]   0
Hits/KSLOC@level+ = [0+] 2.7451 [1+] 1.96078 [2+] 1.96078 [3+] 1.17647 [4+]   0 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.