Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/httpry-0.1.8/config.h
Examining data/httpry-0.1.8/error.h
Examining data/httpry-0.1.8/format.c
Examining data/httpry-0.1.8/format.h
Examining data/httpry-0.1.8/httpry.c
Examining data/httpry-0.1.8/methods.c
Examining data/httpry-0.1.8/methods.h
Examining data/httpry-0.1.8/rate.c
Examining data/httpry-0.1.8/rate.h
Examining data/httpry-0.1.8/tcp.h
Examining data/httpry-0.1.8/utility.c
Examining data/httpry-0.1.8/utility.h

FINAL RESULTS:

data/httpry-0.1.8/httpry.c:272:21:  [5] (race) chown:
  This accepts filename arguments; if an attacker can move those files, a
  race condition results. (CWE-362). Use fchown( ) instead.
                if (chown(use_outfile, user->pw_uid, user->pw_gid) < 0)
data/httpry-0.1.8/httpry.c:277:21:  [5] (race) chown:
  This accepts filename arguments; if an attacker can move those files, a
  race condition results. (CWE-362). Use fchown( ) instead.
                if (chown(use_dumpfile, user->pw_uid, user->pw_gid) < 0)
data/httpry-0.1.8/error.h:22:42:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
#define PRINT(x...) { if (!quiet_mode) { fprintf(stderr, x); fprintf(stderr, "\n"); } }
data/httpry-0.1.8/error.h:23:22:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
#define WARN(x...) { fprintf(stderr, "Warning: " x); fprintf(stderr, "\n"); }
data/httpry-0.1.8/error.h:24:80:  [4] (format) syslog:
  If syslog's format strings can be influenced by an attacker, they can be
  exploited (CWE-134). Use a constant format string for syslog.
#define LOG(x...) { if (use_syslog) { openlog(PROG_NAME, LOG_PID, LOG_DAEMON); syslog(LOG_ERR, x); closelog(); } }
data/httpry-0.1.8/error.h:25:21:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
#define DIE(x...) { fprintf(stderr, "Error: " x); fprintf(stderr, "\n"); raise(SIGINT); }
data/httpry-0.1.8/httpry.c:33:5:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
int getopt(int, char * const *, const char *);
data/httpry-0.1.8/httpry.c:681:23:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
        while ((opt = getopt(argc, argv, "b:df:Fhpqi:l:m:n:o:P:r:st:u:S:")) != -1) {
data/httpry-0.1.8/httpry.c:84:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char errbuf[PCAP_ERRBUF_SIZE];
data/httpry-0.1.8/httpry.c:238:25:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
        if ((pid_file = fopen(pid_filename, "w"))) {
data/httpry-0.1.8/httpry.c:298:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char saddr[INET6_ADDRSTRLEN], daddr[INET6_ADDRSTRLEN];
data/httpry-0.1.8/httpry.c:299:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char sport[PORTSTRLEN], dport[PORTSTRLEN];
data/httpry-0.1.8/httpry.c:300:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char ts[MAX_TIME_LEN];
data/httpry-0.1.8/httpry.c:362:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(buf, data, size_data);
data/httpry-0.1.8/httpry.c:689:52:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
                        case 'l': rate_threshold = atoi(optarg); break;
data/httpry-0.1.8/httpry.c:691:49:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
                        case 'n': parse_count = atoi(optarg); break;
data/httpry-0.1.8/httpry.c:698:51:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
                        case 't': rate_interval = atoi(optarg); break;
data/httpry-0.1.8/httpry.c:700:51:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
                        case 'S': eth_skip_bits = atoi(optarg); break;
data/httpry-0.1.8/rate.c:29:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char host[MAX_HOST_LEN + 1];
data/httpry-0.1.8/rate.c:180:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char st_time[MAX_TIME_LEN];
data/httpry-0.1.8/format.c:58:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        len = strlen(str);
data/httpry-0.1.8/format.c:70:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                len = strlen(name);
data/httpry-0.1.8/format.c:157:14:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        if ((strlen(name) == 0) || (strlen(value) == 0))
data/httpry-0.1.8/format.c:157:37:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        if ((strlen(name) == 0) || (strlen(value) == 0))
data/httpry-0.1.8/format.c:174:13:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        if (strlen(name) == 0)
data/httpry-0.1.8/format.c:272:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        ASSERT(strlen(str) > 0);
data/httpry-0.1.8/httpry.c:231:9:  [1] (access) umask:
  Ensure that umask is given most restrictive possible setting (e.g., 066 or
  077) (CWE-732).
        umask(022); /* Reset file creation mask */
data/httpry-0.1.8/httpry.c:354:47:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        } else if (strncmp(data, HTTP_STRING, strlen(HTTP_STRING)) == 0) {
data/httpry-0.1.8/httpry.c:494:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        ASSERT(strlen(header_line) > 0);
data/httpry-0.1.8/httpry.c:506:56:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                if (strncmp(http_version, HTTP_STRING, strlen(HTTP_STRING)) != 0) return 1;
data/httpry-0.1.8/httpry.c:523:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        ASSERT(strlen(header_line) > 0);
data/httpry-0.1.8/methods.c:52:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        len = strlen(str);
data/httpry-0.1.8/methods.c:63:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                len = strlen(method);
data/httpry-0.1.8/methods.c:84:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        ASSERT(strlen(method) > 0);
data/httpry-0.1.8/methods.c:124:13:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        if (strlen(str) == 0) return 0;
data/httpry-0.1.8/rate.c:337:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        ASSERT(strlen(str) > 0);
data/httpry-0.1.8/utility.c:21:22:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        size_t len = strlen(str);
data/httpry-0.1.8/utility.c:25:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        ASSERT(strlen(str) > 0);
data/httpry-0.1.8/utility.c:41:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        ASSERT(strlen(str) > 0);
data/httpry-0.1.8/utility.c:59:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        ASSERT(strlen(str2) > 0);
data/httpry-0.1.8/utility.c:93:22:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        size_t len = strlen(str);
data/httpry-0.1.8/utility.c:114:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        ASSERT(strlen(str) > 0);

ANALYSIS SUMMARY:

Hits = 42
Lines analyzed = 2107 in approximately 0.09 seconds (23080 lines/second)
Physical Source Lines of Code (SLOC) = 1358
Hits@level = [0]  21 [1]  22 [2]  12 [3]   2 [4]   4 [5]   2
Hits@level+ = [0+]  63 [1+]  42 [2+]  20 [3+]   8 [4+]   6 [5+]   2
Hits/KSLOC@level+ = [0+] 46.3918 [1+] 30.9278 [2+] 14.7275 [3+] 5.89102 [4+] 4.41826 [5+] 1.47275
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.