Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/gxtuner-3.0/cmdparser.cpp Examining data/gxtuner-3.0/cmdparser.h Examining data/gxtuner-3.0/config.h Examining data/gxtuner-3.0/deskpager.cpp Examining data/gxtuner-3.0/deskpager.h Examining data/gxtuner-3.0/gtkknob.cc Examining data/gxtuner-3.0/gtkknob.h Examining data/gxtuner-3.0/gx_pitch_tracker.cpp Examining data/gxtuner-3.0/gx_pitch_tracker.h Examining data/gxtuner-3.0/gxtuner.cpp Examining data/gxtuner-3.0/gxtuner.h Examining data/gxtuner-3.0/jacktuner.cpp Examining data/gxtuner-3.0/jacktuner.h Examining data/gxtuner-3.0/main.cpp Examining data/gxtuner-3.0/paintbox.cpp Examining data/gxtuner-3.0/paintbox.h Examining data/gxtuner-3.0/resources.c Examining data/gxtuner-3.0/resources.h Examining data/gxtuner-3.0/tuner.cpp Examining data/gxtuner-3.0/tuner.h FINAL RESULTS: data/gxtuner-3.0/gtkknob.cc:67:3: [4] (format) snprintf: If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134). Use a constant for the format specification. snprintf(s, 63, format[3-1], v); data/gxtuner-3.0/gtkknob.cc:72:3: [4] (format) snprintf: If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134). Use a constant for the format specification. snprintf(s, 63, format[2-1], v); data/gxtuner-3.0/gtkknob.cc:77:3: [4] (format) snprintf: If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134). Use a constant for the format specification. snprintf(s, 63, format[1-1], v); data/gxtuner-3.0/gxtuner.cpp:785:9: [4] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). strcat(tuner->tempscaletranslatednames[n],scale3basenames[tuner->tempscaletranslated[n][0]]); data/gxtuner-3.0/gtkknob.cc:201:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char s[64]; data/gxtuner-3.0/gx_pitch_tracker.cpp:291:9: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(m_input, &m_buffer[start], cnt * sizeof(*m_input)); data/gxtuner-3.0/gx_pitch_tracker.cpp:294:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&m_input[cnt], &m_buffer[start], (end - start) * sizeof(*m_input)); data/gxtuner-3.0/gx_pitch_tracker.cpp:405:9: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(m_fftwBufferTime, m_input, m_buffersize * sizeof(*m_fftwBufferTime)); data/gxtuner-3.0/gxtuner.cpp:840:25: [2] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant string. strcat(tuner->tempscaletranslatednames[n],"ƐƖ"); data/gxtuner-3.0/gxtuner.cpp:845:25: [2] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant string. strcat(tuner->tempscaletranslatednames[n],"13"); data/gxtuner-3.0/gxtuner.cpp:852:25: [2] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant string. strcat(tuner->tempscaletranslatednames[n],"LƖ"); data/gxtuner-3.0/gxtuner.cpp:857:25: [2] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant string. strcat(tuner->tempscaletranslatednames[n],"17"); data/gxtuner-3.0/gxtuner.cpp:864:25: [2] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant string. strcat(tuner->tempscaletranslatednames[n],"6Ɩ"); data/gxtuner-3.0/gxtuner.cpp:869:25: [2] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant string. strcat(tuner->tempscaletranslatednames[n],"19"); data/gxtuner-3.0/gxtuner.cpp:876:25: [2] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant string. strcat(tuner->tempscaletranslatednames[n],"ƐS"); data/gxtuner-3.0/gxtuner.cpp:881:25: [2] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant string. strcat(tuner->tempscaletranslatednames[n],"23"); data/gxtuner-3.0/gxtuner.cpp:888:25: [2] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant string. strcat(tuner->tempscaletranslatednames[n],"6S"); data/gxtuner-3.0/gxtuner.cpp:893:25: [2] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant string. strcat(tuner->tempscaletranslatednames[n],"29"); data/gxtuner-3.0/gxtuner.cpp:900:25: [2] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant string. strcat(tuner->tempscaletranslatednames[n],"ƖƐ"); data/gxtuner-3.0/gxtuner.cpp:905:25: [2] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant string. strcat(tuner->tempscaletranslatednames[n],"31"); data/gxtuner-3.0/gxtuner.cpp:1068:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char s[10]; data/gxtuner-3.0/gxtuner.cpp:1219:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char s[10]; data/gxtuner-3.0/jacktuner.cpp:103:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buffer [100]; data/gxtuner-3.0/jacktuner.cpp:104:5: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf (buffer, " -x %i -y %i -w %i -l %i -p %f -t %f -d %i",x, y, w, l, p, t, d); data/gxtuner-3.0/tuner.cpp:493:13: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). x = atoi(cptr->cv(3).c_str()); data/gxtuner-3.0/tuner.cpp:498:13: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). y = atoi(cptr->cv(4).c_str()); data/gxtuner-3.0/tuner.cpp:507:13: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). x = atoi(cptr->cv(1).c_str()); data/gxtuner-3.0/tuner.cpp:510:13: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). y = atoi(cptr->cv(2).c_str()); data/gxtuner-3.0/tuner.cpp:745:16: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). desk = atoi(cptr->cv(8).c_str()); data/gxtuner-3.0/gxtuner.cpp:792:25: [1] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant character. strcat(tuner->tempscaletranslatednames[n],"♭"); data/gxtuner-3.0/gxtuner.cpp:797:25: [1] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant character. strcat(tuner->tempscaletranslatednames[n],"♯"); data/gxtuner-3.0/gxtuner.cpp:804:25: [1] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant character. strcat(tuner->tempscaletranslatednames[n],"-"); data/gxtuner-3.0/gxtuner.cpp:809:25: [1] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant character. strcat(tuner->tempscaletranslatednames[n],"+"); data/gxtuner-3.0/gxtuner.cpp:816:25: [1] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant character. strcat(tuner->tempscaletranslatednames[n],"L"); data/gxtuner-3.0/gxtuner.cpp:821:25: [1] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant character. strcat(tuner->tempscaletranslatednames[n],"7"); data/gxtuner-3.0/gxtuner.cpp:828:25: [1] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant character. strcat(tuner->tempscaletranslatednames[n],"↓"); data/gxtuner-3.0/gxtuner.cpp:833:25: [1] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant character. strcat(tuner->tempscaletranslatednames[n],"↑"); data/gxtuner-3.0/gxtuner.cpp:909:13: [1] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant character. strcat(tuner->tempscaletranslatednames[n],"\0"); data/gxtuner-3.0/resources.c:1055:31: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). __pragma(section(".CRT$XCU",read)) \ data/gxtuner-3.0/resources.c:1063:31: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). __pragma(section(".CRT$XCU",read)) \ data/gxtuner-3.0/resources.c:1075:22: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). section(".CRT$XCU",read) data/gxtuner-3.0/resources.c:1082:22: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). section(".CRT$XCU",read) ANALYSIS SUMMARY: Hits = 42 Lines analyzed = 6114 in approximately 0.24 seconds (25341 lines/second) Physical Source Lines of Code (SLOC) = 4985 Hits@level = [0] 18 [1] 13 [2] 25 [3] 0 [4] 4 [5] 0 Hits@level+ = [0+] 60 [1+] 42 [2+] 29 [3+] 4 [4+] 4 [5+] 0 Hits/KSLOC@level+ = [0+] 12.0361 [1+] 8.42528 [2+] 5.81745 [3+] 0.802407 [4+] 0.802407 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.