Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/gxtuner-3.0/cmdparser.cpp
Examining data/gxtuner-3.0/cmdparser.h
Examining data/gxtuner-3.0/config.h
Examining data/gxtuner-3.0/deskpager.cpp
Examining data/gxtuner-3.0/deskpager.h
Examining data/gxtuner-3.0/gtkknob.cc
Examining data/gxtuner-3.0/gtkknob.h
Examining data/gxtuner-3.0/gx_pitch_tracker.cpp
Examining data/gxtuner-3.0/gx_pitch_tracker.h
Examining data/gxtuner-3.0/gxtuner.cpp
Examining data/gxtuner-3.0/gxtuner.h
Examining data/gxtuner-3.0/jacktuner.cpp
Examining data/gxtuner-3.0/jacktuner.h
Examining data/gxtuner-3.0/main.cpp
Examining data/gxtuner-3.0/paintbox.cpp
Examining data/gxtuner-3.0/paintbox.h
Examining data/gxtuner-3.0/resources.c
Examining data/gxtuner-3.0/resources.h
Examining data/gxtuner-3.0/tuner.cpp
Examining data/gxtuner-3.0/tuner.h

FINAL RESULTS:

data/gxtuner-3.0/gtkknob.cc:67:3:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
		snprintf(s, 63, format[3-1], v);
data/gxtuner-3.0/gtkknob.cc:72:3:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
		snprintf(s, 63, format[2-1], v);
data/gxtuner-3.0/gtkknob.cc:77:3:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
		snprintf(s, 63, format[1-1], v);
data/gxtuner-3.0/gxtuner.cpp:785:9:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
        strcat(tuner->tempscaletranslatednames[n],scale3basenames[tuner->tempscaletranslated[n][0]]);
data/gxtuner-3.0/gtkknob.cc:201:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char s[64];
data/gxtuner-3.0/gx_pitch_tracker.cpp:291:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(m_input, &m_buffer[start], cnt * sizeof(*m_input));
data/gxtuner-3.0/gx_pitch_tracker.cpp:294:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&m_input[cnt], &m_buffer[start], (end - start) * sizeof(*m_input));
data/gxtuner-3.0/gx_pitch_tracker.cpp:405:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(m_fftwBufferTime, m_input, m_buffersize * sizeof(*m_fftwBufferTime));
data/gxtuner-3.0/gxtuner.cpp:840:25:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
                        strcat(tuner->tempscaletranslatednames[n],"ƐƖ");
data/gxtuner-3.0/gxtuner.cpp:845:25:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
                        strcat(tuner->tempscaletranslatednames[n],"13");
data/gxtuner-3.0/gxtuner.cpp:852:25:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
                        strcat(tuner->tempscaletranslatednames[n],"LƖ");
data/gxtuner-3.0/gxtuner.cpp:857:25:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
                        strcat(tuner->tempscaletranslatednames[n],"17");
data/gxtuner-3.0/gxtuner.cpp:864:25:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
                        strcat(tuner->tempscaletranslatednames[n],"6Ɩ");
data/gxtuner-3.0/gxtuner.cpp:869:25:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
                        strcat(tuner->tempscaletranslatednames[n],"19");
data/gxtuner-3.0/gxtuner.cpp:876:25:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
                        strcat(tuner->tempscaletranslatednames[n],"ƐS");
data/gxtuner-3.0/gxtuner.cpp:881:25:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
                        strcat(tuner->tempscaletranslatednames[n],"23");
data/gxtuner-3.0/gxtuner.cpp:888:25:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
                        strcat(tuner->tempscaletranslatednames[n],"6S");
data/gxtuner-3.0/gxtuner.cpp:893:25:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
                        strcat(tuner->tempscaletranslatednames[n],"29");
data/gxtuner-3.0/gxtuner.cpp:900:25:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
                        strcat(tuner->tempscaletranslatednames[n],"ƖƐ");
data/gxtuner-3.0/gxtuner.cpp:905:25:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
                        strcat(tuner->tempscaletranslatednames[n],"31");
data/gxtuner-3.0/gxtuner.cpp:1068:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char s[10];
data/gxtuner-3.0/gxtuner.cpp:1219:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char s[10];
data/gxtuner-3.0/jacktuner.cpp:103:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char buffer [100];
data/gxtuner-3.0/jacktuner.cpp:104:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf (buffer, " -x %i -y %i -w %i -l %i -p %f -t %f -d %i",x, y, w, l, p, t, d);
data/gxtuner-3.0/tuner.cpp:493:13:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
        x = atoi(cptr->cv(3).c_str());
data/gxtuner-3.0/tuner.cpp:498:13:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
        y = atoi(cptr->cv(4).c_str());
data/gxtuner-3.0/tuner.cpp:507:13:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
        x = atoi(cptr->cv(1).c_str());
data/gxtuner-3.0/tuner.cpp:510:13:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
        y = atoi(cptr->cv(2).c_str());
data/gxtuner-3.0/tuner.cpp:745:16:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
        desk = atoi(cptr->cv(8).c_str());
data/gxtuner-3.0/gxtuner.cpp:792:25:  [1] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant character.
                        strcat(tuner->tempscaletranslatednames[n],"♭");
data/gxtuner-3.0/gxtuner.cpp:797:25:  [1] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant character.
                        strcat(tuner->tempscaletranslatednames[n],"♯");
data/gxtuner-3.0/gxtuner.cpp:804:25:  [1] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant character.
                        strcat(tuner->tempscaletranslatednames[n],"-");
data/gxtuner-3.0/gxtuner.cpp:809:25:  [1] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant character.
                        strcat(tuner->tempscaletranslatednames[n],"+");
data/gxtuner-3.0/gxtuner.cpp:816:25:  [1] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant character.
                        strcat(tuner->tempscaletranslatednames[n],"L");
data/gxtuner-3.0/gxtuner.cpp:821:25:  [1] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant character.
                        strcat(tuner->tempscaletranslatednames[n],"7");
data/gxtuner-3.0/gxtuner.cpp:828:25:  [1] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant character.
                        strcat(tuner->tempscaletranslatednames[n],"↓");
data/gxtuner-3.0/gxtuner.cpp:833:25:  [1] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant character.
                        strcat(tuner->tempscaletranslatednames[n],"↑");
data/gxtuner-3.0/gxtuner.cpp:909:13:  [1] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant character.
            strcat(tuner->tempscaletranslatednames[n],"\0");
data/gxtuner-3.0/resources.c:1055:31:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  __pragma(section(".CRT$XCU",read)) \
data/gxtuner-3.0/resources.c:1063:31:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  __pragma(section(".CRT$XCU",read)) \
data/gxtuner-3.0/resources.c:1075:22:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  section(".CRT$XCU",read)
data/gxtuner-3.0/resources.c:1082:22:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  section(".CRT$XCU",read)

ANALYSIS SUMMARY:

Hits = 42
Lines analyzed = 6114 in approximately 0.24 seconds (25341 lines/second)
Physical Source Lines of Code (SLOC) = 4985
Hits@level = [0]  18 [1]  13 [2]  25 [3]   0 [4]   4 [5]   0
Hits@level+ = [0+]  60 [1+]  42 [2+]  29 [3+]   4 [4+]   4 [5+]   0
Hits/KSLOC@level+ = [0+] 12.0361 [1+] 8.42528 [2+] 5.81745 [3+] 0.802407 [4+] 0.802407 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.