Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/haskell-gtk-0.15.5/Graphics/UI/Gtk/General/hsgthread.c Examining data/haskell-gtk-0.15.5/Graphics/UI/Gtk/General/hsgthread.h Examining data/haskell-gtk-0.15.5/Graphics/UI/Gtk/ModelView/Gtk2HsStore.c Examining data/haskell-gtk-0.15.5/Graphics/UI/Gtk/ModelView/Gtk2HsStore.h Examining data/haskell-gtk-0.15.5/hsgtk.h Examining data/haskell-gtk-0.15.5/template-hsc-gtk2hs.h FINAL RESULTS: data/haskell-gtk-0.15.5/template-hsc-gtk2hs.h:8:5: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. printf ("%s%" G_GSIZE_FORMAT, \ data/haskell-gtk-0.15.5/Graphics/UI/Gtk/General/hsgthread.c:75:21: [3] (misc) LoadLibrary: Ensure that the full path to the library is specified, or current directory may be used (CWE-829, CWE-20). Use registry entry or GetWindowsDirectory to find library path, if you aren't already. HANDLE handle = LoadLibrary("MSVCRT.dll"); data/haskell-gtk-0.15.5/Graphics/UI/Gtk/General/hsgthread.c:103:5: [3] (misc) InitializeCriticalSection: Exceptions can be thrown in low-memory situations. Use InitializeCriticalSectionAndSpinCount instead. InitializeCriticalSection(>k2hs_finalizer_mutex); data/haskell-gtk-0.15.5/Graphics/UI/Gtk/General/hsgthread.c:133:5: [3] (misc) EnterCriticalSection: On some versions of Windows, exceptions can be thrown in low-memory situations. Use InitializeCriticalSectionAndSpinCount instead. EnterCriticalSection(>k2hs_finalizer_mutex); data/haskell-gtk-0.15.5/Graphics/UI/Gtk/General/hsgthread.c:198:5: [3] (misc) EnterCriticalSection: On some versions of Windows, exceptions can be thrown in low-memory situations. Use InitializeCriticalSectionAndSpinCount instead. EnterCriticalSection(>k2hs_finalizer_mutex); data/haskell-gtk-0.15.5/Graphics/UI/Gtk/ModelView/Gtk2HsStore.c:287:18: [3] (random) g_random_int: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. store->stamp = g_random_int(); /* Random int to check whether an iter belongs to our model */ ANALYSIS SUMMARY: Hits = 6 Lines analyzed = 1195 in approximately 0.07 seconds (17695 lines/second) Physical Source Lines of Code (SLOC) = 826 Hits@level = [0] 16 [1] 0 [2] 0 [3] 5 [4] 1 [5] 0 Hits@level+ = [0+] 22 [1+] 6 [2+] 6 [3+] 6 [4+] 1 [5+] 0 Hits/KSLOC@level+ = [0+] 26.6344 [1+] 7.26392 [2+] 7.26392 [3+] 7.26392 [4+] 1.21065 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.