Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/gtranslator-3.38.0/plugins/alternate-language/gtr-alternate-language-panel.c
Examining data/gtranslator-3.38.0/plugins/alternate-language/gtr-alternate-language-panel.h
Examining data/gtranslator-3.38.0/plugins/alternate-language/gtr-alternate-language-plugin.c
Examining data/gtranslator-3.38.0/plugins/alternate-language/gtr-alternate-language-plugin.h
Examining data/gtranslator-3.38.0/plugins/dictionary/gtr-dict-panel.c
Examining data/gtranslator-3.38.0/plugins/dictionary/gtr-dict-panel.h
Examining data/gtranslator-3.38.0/plugins/dictionary/gtr-dictionary-plugin.c
Examining data/gtranslator-3.38.0/plugins/dictionary/gtr-dictionary-plugin.h
Examining data/gtranslator-3.38.0/plugins/dictionary/gtr-gdict-sidebar.c
Examining data/gtranslator-3.38.0/plugins/dictionary/gtr-gdict-sidebar.h
Examining data/gtranslator-3.38.0/plugins/fullscreen/gtr-fullscreen-plugin.c
Examining data/gtranslator-3.38.0/plugins/fullscreen/gtr-fullscreen-plugin.h
Examining data/gtranslator-3.38.0/plugins/glossary/glossary-panel.c
Examining data/gtranslator-3.38.0/plugins/glossary/glossary-panel.h
Examining data/gtranslator-3.38.0/plugins/insert-params/gtr-insert-params-plugin.c
Examining data/gtranslator-3.38.0/plugins/insert-params/gtr-insert-params-plugin.h
Examining data/gtranslator-3.38.0/src/codeview/gtr-codeview.c
Examining data/gtranslator-3.38.0/src/codeview/gtr-codeview.h
Examining data/gtranslator-3.38.0/src/codeview/gtr-viewer.c
Examining data/gtranslator-3.38.0/src/codeview/gtr-viewer.h
Examining data/gtranslator-3.38.0/src/gtr-actions-app.c
Examining data/gtranslator-3.38.0/src/gtr-actions-app.h
Examining data/gtranslator-3.38.0/src/gtr-actions-documents.c
Examining data/gtranslator-3.38.0/src/gtr-actions-edit.c
Examining data/gtranslator-3.38.0/src/gtr-actions-file.c
Examining data/gtranslator-3.38.0/src/gtr-actions-go.c
Examining data/gtranslator-3.38.0/src/gtr-actions-search.c
Examining data/gtranslator-3.38.0/src/gtr-actions-view.c
Examining data/gtranslator-3.38.0/src/gtr-actions.h
Examining data/gtranslator-3.38.0/src/gtr-application.c
Examining data/gtranslator-3.38.0/src/gtr-application.h
Examining data/gtranslator-3.38.0/src/gtr-assistant.c
Examining data/gtranslator-3.38.0/src/gtr-assistant.h
Examining data/gtranslator-3.38.0/src/gtr-close-button.c
Examining data/gtranslator-3.38.0/src/gtr-close-button.h
Examining data/gtranslator-3.38.0/src/gtr-close-confirmation-dialog.c
Examining data/gtranslator-3.38.0/src/gtr-close-confirmation-dialog.h
Examining data/gtranslator-3.38.0/src/gtr-context.c
Examining data/gtranslator-3.38.0/src/gtr-context.h
Examining data/gtranslator-3.38.0/src/gtr-debug.h
Examining data/gtranslator-3.38.0/src/gtr-dirs.c
Examining data/gtranslator-3.38.0/src/gtr-dirs.h
Examining data/gtranslator-3.38.0/src/gtr-dl-teams.c
Examining data/gtranslator-3.38.0/src/gtr-dl-teams.h
Examining data/gtranslator-3.38.0/src/gtr-file-dialogs.c
Examining data/gtranslator-3.38.0/src/gtr-file-dialogs.h
Examining data/gtranslator-3.38.0/src/gtr-filter-selection.c
Examining data/gtranslator-3.38.0/src/gtr-filter-selection.h
Examining data/gtranslator-3.38.0/src/gtr-header-dialog.c
Examining data/gtranslator-3.38.0/src/gtr-header-dialog.h
Examining data/gtranslator-3.38.0/src/gtr-header.c
Examining data/gtranslator-3.38.0/src/gtr-header.h
Examining data/gtranslator-3.38.0/src/gtr-history-entry.c
Examining data/gtranslator-3.38.0/src/gtr-history-entry.h
Examining data/gtranslator-3.38.0/src/gtr-io-error-info-bar.c
Examining data/gtranslator-3.38.0/src/gtr-io-error-info-bar.h
Examining data/gtranslator-3.38.0/src/gtr-jump-dialog.c
Examining data/gtranslator-3.38.0/src/gtr-jump-dialog.h
Examining data/gtranslator-3.38.0/src/gtr-lang-button.c
Examining data/gtranslator-3.38.0/src/gtr-lang-button.h
Examining data/gtranslator-3.38.0/src/gtr-language.c
Examining data/gtranslator-3.38.0/src/gtr-language.h
Examining data/gtranslator-3.38.0/src/gtr-languages-fetcher.c
Examining data/gtranslator-3.38.0/src/gtr-languages-fetcher.h
Examining data/gtranslator-3.38.0/src/gtr-message-container.c
Examining data/gtranslator-3.38.0/src/gtr-message-container.h
Examining data/gtranslator-3.38.0/src/gtr-message-table-model.c
Examining data/gtranslator-3.38.0/src/gtr-message-table-model.h
Examining data/gtranslator-3.38.0/src/gtr-message-table.c
Examining data/gtranslator-3.38.0/src/gtr-message-table.h
Examining data/gtranslator-3.38.0/src/gtr-msg.c
Examining data/gtranslator-3.38.0/src/gtr-msg.h
Examining data/gtranslator-3.38.0/src/gtr-notebook.c
Examining data/gtranslator-3.38.0/src/gtr-notebook.h
Examining data/gtranslator-3.38.0/src/gtr-po.c
Examining data/gtranslator-3.38.0/src/gtr-po.h
Examining data/gtranslator-3.38.0/src/gtr-preferences-dialog.c
Examining data/gtranslator-3.38.0/src/gtr-preferences-dialog.h
Examining data/gtranslator-3.38.0/src/gtr-profile-dialog.c
Examining data/gtranslator-3.38.0/src/gtr-profile-dialog.h
Examining data/gtranslator-3.38.0/src/gtr-profile-manager.c
Examining data/gtranslator-3.38.0/src/gtr-profile-manager.h
Examining data/gtranslator-3.38.0/src/gtr-profile.c
Examining data/gtranslator-3.38.0/src/gtr-profile.h
Examining data/gtranslator-3.38.0/src/gtr-progress.c
Examining data/gtranslator-3.38.0/src/gtr-progress.h
Examining data/gtranslator-3.38.0/src/gtr-projects.c
Examining data/gtranslator-3.38.0/src/gtr-projects.h
Examining data/gtranslator-3.38.0/src/gtr-search-bar.c
Examining data/gtranslator-3.38.0/src/gtr-search-bar.h
Examining data/gtranslator-3.38.0/src/gtr-settings.c
Examining data/gtranslator-3.38.0/src/gtr-settings.h
Examining data/gtranslator-3.38.0/src/gtr-tab-activatable.c
Examining data/gtranslator-3.38.0/src/gtr-tab-activatable.h
Examining data/gtranslator-3.38.0/src/gtr-tab-label.c
Examining data/gtranslator-3.38.0/src/gtr-tab-label.h
Examining data/gtranslator-3.38.0/src/gtr-tab.c
Examining data/gtranslator-3.38.0/src/gtr-tab.h
Examining data/gtranslator-3.38.0/src/gtr-utils.c
Examining data/gtranslator-3.38.0/src/gtr-utils.h
Examining data/gtranslator-3.38.0/src/gtr-view.c
Examining data/gtranslator-3.38.0/src/gtr-view.h
Examining data/gtranslator-3.38.0/src/gtr-window-activatable.c
Examining data/gtranslator-3.38.0/src/gtr-window-activatable.h
Examining data/gtranslator-3.38.0/src/gtr-window.c
Examining data/gtranslator-3.38.0/src/gtr-window.h
Examining data/gtranslator-3.38.0/src/main.c
Examining data/gtranslator-3.38.0/src/translation-memory/gda/gda-utils.c
Examining data/gtranslator-3.38.0/src/translation-memory/gda/gda-utils.h
Examining data/gtranslator-3.38.0/src/translation-memory/gda/gtr-gda.c
Examining data/gtranslator-3.38.0/src/translation-memory/gda/gtr-gda.h
Examining data/gtranslator-3.38.0/src/translation-memory/gtr-translation-memory-dialog.c
Examining data/gtranslator-3.38.0/src/translation-memory/gtr-translation-memory-dialog.h
Examining data/gtranslator-3.38.0/src/translation-memory/gtr-translation-memory-ui.c
Examining data/gtranslator-3.38.0/src/translation-memory/gtr-translation-memory-ui.h
Examining data/gtranslator-3.38.0/src/translation-memory/gtr-translation-memory-utils.c
Examining data/gtranslator-3.38.0/src/translation-memory/gtr-translation-memory-utils.h
Examining data/gtranslator-3.38.0/src/translation-memory/gtr-translation-memory.c
Examining data/gtranslator-3.38.0/src/translation-memory/gtr-translation-memory.h
FINAL RESULTS:
data/gtranslator-3.38.0/src/gtr-actions-file.c:331:34: [3] (buffer) g_get_home_dir:
This function is synonymous with 'getenv("HOME")';it returns untrustable
input if the environment can beset by an attacker. It can have any content
and length, and the same variable can be set more than once (CWE-807,
CWE-20). Check environment variables carefully before using them.
g_get_home_dir ());
data/gtranslator-3.38.0/src/gtr-message-table-model.c:310:18: [3] (random) g_random_int:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
model->stamp = g_random_int ();
data/gtranslator-3.38.0/src/translation-memory/gda/gtr-gda.c:599:9: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf (word_id, "word%d", i);
data/gtranslator-3.38.0/src/codeview/gtr-codeview.c:152:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
result[strlen (result) - 2] = '\0';
data/gtranslator-3.38.0/src/codeview/gtr-codeview.c:175:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
i = str_found + strlen (escaped);
data/gtranslator-3.38.0/src/codeview/gtr-viewer.c:291:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
lang_string += strlen (LANG_STRING);
data/gtranslator-3.38.0/src/gtr-actions-search.c:324:54: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
gtk_text_buffer_insert_at_cursor (buffer, replace, strlen (replace));
data/gtranslator-3.38.0/src/gtr-actions-search.c:366:47: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen (selected_text),
data/gtranslator-3.38.0/src/gtr-actions-search.c:367:47: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen (unescaped_search_text))
data/gtranslator-3.38.0/src/gtr-header.c:362:35: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
email = g_strndup (space + 2, strlen (space) - 3);
data/gtranslator-3.38.0/src/gtr-header.c:429:35: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
email = g_strndup (space + 2, strlen (space) - 3);
data/gtranslator-3.38.0/src/gtr-po.c:764:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
filename[strlen (filename) - 4] = '\0';
data/gtranslator-3.38.0/src/gtr-preferences-dialog.c:705:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (!strlen (font))
data/gtranslator-3.38.0/src/gtr-search-bar.c:309:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
new_len = strlen (escaped_text);
data/gtranslator-3.38.0/src/gtr-utils.c:289:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
length = strlen (text);
data/gtranslator-3.38.0/src/gtr-utils.c:345:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
length = strlen (text);
data/gtranslator-3.38.0/src/gtr-utils.c:433:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len_s1 = strlen (normalized_s1);
data/gtranslator-3.38.0/src/gtr-utils.c:434:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len_s2 = strlen (normalized_s2);
data/gtranslator-3.38.0/src/gtr-utils.c:515:7: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strlen (new_str) >= 30)
data/gtranslator-3.38.0/src/gtr-utils.c:538:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
length = strlen (text);
data/gtranslator-3.38.0/src/gtr-view.c:827:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
replace_text_len = strlen (replace_text);
data/gtranslator-3.38.0/src/translation-memory/gda/gda-utils.c:121:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
strlen (string), -1, lang, attrs, char_len + 1);
ANALYSIS SUMMARY:
Hits = 22
Lines analyzed = 30683 in approximately 0.62 seconds (49235 lines/second)
Physical Source Lines of Code (SLOC) = 20548
Hits@level = [0] 1 [1] 19 [2] 1 [3] 2 [4] 0 [5] 0
Hits@level+ = [0+] 23 [1+] 22 [2+] 3 [3+] 2 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 1.11933 [1+] 1.07066 [2+] 0.146 [3+] 0.0973331 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.