Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/gnome-video-arcade-0.8.8/src/gva-mame.h
Examining data/gnome-video-arcade-0.8.8/src/gva-db.c
Examining data/gnome-video-arcade-0.8.8/src/gva-cell-renderer-pixbuf.h
Examining data/gnome-video-arcade-0.8.8/src/gva-db.h
Examining data/gnome-video-arcade-0.8.8/src/gva-util.h
Examining data/gnome-video-arcade-0.8.8/src/gva-error.c
Examining data/gnome-video-arcade-0.8.8/src/gva-mute-button.h
Examining data/gnome-video-arcade-0.8.8/src/gva-properties.h
Examining data/gnome-video-arcade-0.8.8/src/gva-nplayers.h
Examining data/gnome-video-arcade-0.8.8/src/gva-column-manager.h
Examining data/gnome-video-arcade-0.8.8/src/gva-main.h
Examining data/gnome-video-arcade-0.8.8/src/main.c
Examining data/gnome-video-arcade-0.8.8/src/gva-screen-saver.h
Examining data/gnome-video-arcade-0.8.8/src/gva-time.h
Examining data/gnome-video-arcade-0.8.8/src/gva-history.c
Examining data/gnome-video-arcade-0.8.8/src/gva-nplayers.c
Examining data/gnome-video-arcade-0.8.8/src/gva-main.c
Examining data/gnome-video-arcade-0.8.8/src/gva-error.h
Examining data/gnome-video-arcade-0.8.8/src/gva-tree-view.c
Examining data/gnome-video-arcade-0.8.8/src/gva-time.c
Examining data/gnome-video-arcade-0.8.8/src/gva-favorites.c
Examining data/gnome-video-arcade-0.8.8/src/gva-mute-button.c
Examining data/gnome-video-arcade-0.8.8/src/gva-column-manager.c
Examining data/gnome-video-arcade-0.8.8/src/gva-process.c
Examining data/gnome-video-arcade-0.8.8/src/gva-mame.c
Examining data/gnome-video-arcade-0.8.8/src/gva-ui.c
Examining data/gnome-video-arcade-0.8.8/src/gva-play-back.c
Examining data/gnome-video-arcade-0.8.8/src/gva-categories.c
Examining data/gnome-video-arcade-0.8.8/src/gva-mame-process.c
Examining data/gnome-video-arcade-0.8.8/src/gva-columns.h
Examining data/gnome-video-arcade-0.8.8/src/gva-audit.h
Examining data/gnome-video-arcade-0.8.8/src/gva-wnck.c
Examining data/gnome-video-arcade-0.8.8/src/gva-cell-renderer-pixbuf.c
Examining data/gnome-video-arcade-0.8.8/src/gva-input-file.c
Examining data/gnome-video-arcade-0.8.8/src/gva-game-store.c
Examining data/gnome-video-arcade-0.8.8/src/gva-game-store.h
Examining data/gnome-video-arcade-0.8.8/src/gva-common.h
Examining data/gnome-video-arcade-0.8.8/src/gva-util.c
Examining data/gnome-video-arcade-0.8.8/src/gva-audit.c
Examining data/gnome-video-arcade-0.8.8/src/gva-input-file.h
Examining data/gnome-video-arcade-0.8.8/src/gva-preferences.c
Examining data/gnome-video-arcade-0.8.8/src/gva-history.h
Examining data/gnome-video-arcade-0.8.8/src/gva-screen-saver.c
Examining data/gnome-video-arcade-0.8.8/src/gva-favorites.h
Examining data/gnome-video-arcade-0.8.8/src/gva-process.h
Examining data/gnome-video-arcade-0.8.8/src/gva-preferences.h
Examining data/gnome-video-arcade-0.8.8/src/gva-mame-process.h
Examining data/gnome-video-arcade-0.8.8/src/gva-properties.c
Examining data/gnome-video-arcade-0.8.8/src/gva-play-back.h
Examining data/gnome-video-arcade-0.8.8/src/gva-ui.h
Examining data/gnome-video-arcade-0.8.8/src/gva-tree-view.h
Examining data/gnome-video-arcade-0.8.8/src/gva-categories.h
Examining data/gnome-video-arcade-0.8.8/src/gva-wnck.h
Examining data/gnome-video-arcade-0.8.8/src/gva-columns.c

FINAL RESULTS:

data/gnome-video-arcade-0.8.8/src/gva-mame-process.c:41:9:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
        strcpy (copy, line);
data/gnome-video-arcade-0.8.8/src/gva-audit.c:270:36:  [3] (buffer) g_get_home_dir:
  This function is synonymous with 'getenv("HOME")';it returns untrustable
  input if the environment can beset by an attacker. It can have any content
  and length, and the same variable can be set more than once (CWE-807,
  CWE-20). Check environment variables carefully before using them.
                folder = g_strdup (g_get_home_dir ());
data/gnome-video-arcade-0.8.8/src/gva-time.c:30:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy (boxed_copy, boxed, sizeof (time_t));
data/gnome-video-arcade-0.8.8/src/gva-columns.c:145:18:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        length = strlen (bios);
data/gnome-video-arcade-0.8.8/src/gva-mame-process.c:40:26:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        copy = g_alloca (strlen (line) + 1);
data/gnome-video-arcade-0.8.8/src/gva-mame-process.c:43:13:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        if (strlen (g_strstrip (copy)) == 0)
data/gnome-video-arcade-0.8.8/src/gva-mame.c:83:46:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                buffer = g_string_sized_new (strlen (*p_string));
data/gnome-video-arcade-0.8.8/src/gva-mame.c:342:49:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                        gchar *cp = lines[ii] + strlen (config_key);
data/gnome-video-arcade-0.8.8/src/gva-nplayers.c:34:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        parsable = (strlen (string) >= 2) &&
data/gnome-video-arcade-0.8.8/src/gva-process.c:744:34:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                        length = strlen (data);
data/gnome-video-arcade-0.8.8/src/gva-properties.c:207:26:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                length = strlen (bios);
data/gnome-video-arcade-0.8.8/src/gva-tree-view.c:169:36:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        retval = (strncmp (s1, s2, strlen (s1)) != 0);

ANALYSIS SUMMARY:

Hits = 12
Lines analyzed = 18442 in approximately 0.56 seconds (33145 lines/second)
Physical Source Lines of Code (SLOC) = 11485
Hits@level = [0]   0 [1]   9 [2]   1 [3]   1 [4]   1 [5]   0
Hits@level+ = [0+]  12 [1+]  12 [2+]   3 [3+]   2 [4+]   1 [5+]   0
Hits/KSLOC@level+ = [0+] 1.04484 [1+] 1.04484 [2+] 0.26121 [3+] 0.17414 [4+] 0.0870701 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.