Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/hachu-0.21-29-gdf26f4a/hachu.c

FINAL RESULTS:

data/hachu-0.21-29-gdf26f4a/hachu.c:2625:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(buf+strlen(buf), "%c%d%c%d%s", f%BW+'a', f/BW+ONE, t%BW+'a', t/BW+ONE,  promoChar);
data/hachu-0.21-29-gdf26f4a/hachu.c:2856:18:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
      if(reason) sprintf(tail, " {%s}", reason); else *tail = 0;
data/hachu-0.21-29-gdf26f4a/hachu.c:2874:9:  [4] (buffer) sscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function.
        sscanf(inBuf, "%s", command);
data/hachu-0.21-29-gdf26f4a/hachu.c:2936:13:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
            sprintf(ponderMoveText, "%s\n", MoveToText(ponderMove, 0)); // for detecting ponder hits
data/hachu-0.21-29-gdf26f4a/hachu.c:3022:14:  [4] (buffer) sscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function.
          if(sscanf(inBuf+7, "Tsume=%s", command) == 1) {
data/hachu-0.21-29-gdf26f4a/hachu.c:3081:13:  [4] (buffer) sscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function.
            sscanf(inBuf+8, "%s", command);
data/hachu-0.21-29-gdf26f4a/hachu.c:138:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char depth[5];
data/hachu-0.21-29-gdf26f4a/hachu.c:139:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char flag[5];
data/hachu-0.21-29-gdf26f4a/hachu.c:140:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char age[4];
data/hachu-0.21-29-gdf26f4a/hachu.c:152:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  signed char range[8];
data/hachu-0.21-29-gdf26f4a/hachu.c:164:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char *array, *IDs, fenArray[4000], startPos[4000], *reason, checkStack[300];
data/hachu-0.21-29-gdf26f4a/hachu.c:627:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char fireFlags[10]; // flags for Fire-Demon presence (last two are dummies, which stay 0, for compactify)
data/hachu-0.21-29-gdf26f4a/hachu.c:707:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  signed char range[8];
data/hachu-0.21-29-gdf26f4a/hachu.c:745:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
unsigned char distance[2*BSIZE];      // distance table
data/hachu-0.21-29-gdf26f4a/hachu.c:746:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char promoBoard[BSIZE]; // flags to indicate promotion zones
data/hachu-0.21-29-gdf26f4a/hachu.c:747:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
unsigned char rawFire[BSIZE+2*BWMAX]; // flags to indicate squares controlled by Fire Demons
data/hachu-0.21-29-gdf26f4a/hachu.c:748:8:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
signed char PST[7*BSIZE];
data/hachu-0.21-29-gdf26f4a/hachu.c:952:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char name[3], prince = 0;
data/hachu-0.21-29-gdf26f4a/hachu.c:1241:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char map[49]; // 7x7 map for area movers
data/hachu-0.21-29-gdf26f4a/hachu.c:1244:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char rows[9];
data/hachu-0.21-29-gdf26f4a/hachu.c:2604:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  static char buf[50];
data/hachu-0.21-29-gdf26f4a/hachu.c:2607:16:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
  if(f == t) { sprintf(buf, "@@@@"); return buf; } // null-move notation in WB protocol
data/hachu-0.21-29-gdf26f4a/hachu.c:2615:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(buf+strlen(buf), "%c%d%c%d,", f%BW+'a', f/BW+ONE, e2%BW+'a', e2/BW+ONE); f = e2;
data/hachu-0.21-29-gdf26f4a/hachu.c:2619:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(buf, "%c%d%c%d,", f%BW+'a', f/BW+ONE, e%BW+'a', e/BW+ONE); f = e;
data/hachu-0.21-29-gdf26f4a/hachu.c:2634:7:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
  r = atoi(p + 1) - ONE;
data/hachu-0.21-29-gdf26f4a/hachu.c:2640:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char boardCopy[BSIZE];
data/hachu-0.21-29-gdf26f4a/hachu.c:2750:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char b[BSIZE], buf[2000], *q;
data/hachu-0.21-29-gdf26f4a/hachu.c:2808:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char inBuf[8000], command[80], ponderMoveText[20];
data/hachu-0.21-29-gdf26f4a/hachu.c:2855:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      char tail[100];
data/hachu-0.21-29-gdf26f4a/hachu.c:3033:57:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
        if(!strcmp(command, "memory"))  { SetMemorySize(atoi(inBuf+7)); continue; }
data/hachu-0.21-29-gdf26f4a/hachu.c:2615:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      sprintf(buf+strlen(buf), "%c%d%c%d,", f%BW+'a', f/BW+ONE, e2%BW+'a', e2/BW+ONE); f = e2;
data/hachu-0.21-29-gdf26f4a/hachu.c:2625:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  sprintf(buf+strlen(buf), "%c%d%c%d%s", f%BW+'a', f/BW+ONE, t%BW+'a', t/BW+ONE,  promoChar);
data/hachu-0.21-29-gdf26f4a/hachu.c:2869:38:  [1] (buffer) getchar:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
          for(i = 0; (inBuf[i] = c = getchar()) != '\n'; i++) if(c == EOF || i>7997) exit(0);

ANALYSIS SUMMARY:

Hits = 33
Lines analyzed = 3126 in approximately 0.15 seconds (20935 lines/second)
Physical Source Lines of Code (SLOC) = 2773
Hits@level = [0] 108 [1]   3 [2]  24 [3]   0 [4]   6 [5]   0
Hits@level+ = [0+] 141 [1+]  33 [2+]  30 [3+]   6 [4+]   6 [5+]   0
Hits/KSLOC@level+ = [0+] 50.8475 [1+] 11.9005 [2+] 10.8186 [3+] 2.16372 [4+] 2.16372 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.