Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/icmpinfo-1.11/defs.h
Examining data/icmpinfo-1.11/err.c
Examining data/icmpinfo-1.11/icmpinfo.c
Examining data/icmpinfo-1.11/linux_ip_icmp.h
Examining data/icmpinfo-1.11/pid.c
Examining data/icmpinfo-1.11/print.c
Examining data/icmpinfo-1.11/recvping.c

FINAL RESULTS:

data/icmpinfo-1.11/print.c:52:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(prbuf,"packet too short (%d bytes) from %s", cc,
data/icmpinfo-1.11/print.c:88:7:  [4] (format) sprintf:
  Potential format string problem (CWE-134). Make format string constant.
      sprintf(prbuf,hostent?"ICMP_%s%s < %s [%s]":"ICMP_%s%s < %s",
data/icmpinfo-1.11/print.c:106:8:  [4] (format) sprintf:
  Potential format string problem (CWE-134). Make format string constant.
	      sprintf(prbuf+strlen(prbuf),hostent?" - %s [%s]":" - %s",
data/icmpinfo-1.11/print.c:117:8:  [4] (format) sprintf:
  Potential format string problem (CWE-134). Make format string constant.
	      sprintf(prbuf+strlen(prbuf),hostent?" > %s [%s]":" > %s",
data/icmpinfo-1.11/print.c:130:9:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
		      sprintf(prbuf+strlen(prbuf)," sp=%d [%s]",
data/icmpinfo-1.11/print.c:135:9:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
		      sprintf(prbuf+strlen(prbuf)," dp=%d [%s] seq=0x%8.8x",
data/icmpinfo-1.11/print.c:152:9:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
		      sprintf(prbuf+strlen(prbuf)," sp=%d [%s]",
data/icmpinfo-1.11/print.c:157:9:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
		      sprintf(prbuf+strlen(prbuf)," dp=%d [%s] seq=0x%8.8x",
data/icmpinfo-1.11/print.c:294:4:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
	  sprintf(buf,"[%s]",ttab[t]);
data/icmpinfo-1.11/linux_ip_icmp.h:56:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		char	id_data[1];
data/icmpinfo-1.11/pid.c:16:15:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    if ((fp = fopen(PIDFILE, "w")) != (FILE *)NULL) {
data/icmpinfo-1.11/pid.c:42:15:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    if ((fp = fopen(PIDFILE, "r")) != (FILE *)NULL)
data/icmpinfo-1.11/print.c:42:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  static char prbuf[1024]={'\0'};	/* provide enough room for even the longest hosts*/
data/icmpinfo-1.11/print.c:125:9:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
		      sprintf(prbuf+strlen(prbuf)," sp=%d dp=%d seq=0x%8.8x",
data/icmpinfo-1.11/print.c:133:9:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
		      sprintf(prbuf+strlen(prbuf)," sp=%d",tp->source);
data/icmpinfo-1.11/print.c:139:9:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
		      sprintf(prbuf+strlen(prbuf)," dp=%d seq=0x%8.8x",
data/icmpinfo-1.11/print.c:147:9:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
		      sprintf(prbuf+strlen(prbuf)," sp=%d dp=%d seq=0x%8.8x",
data/icmpinfo-1.11/print.c:155:9:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
		      sprintf(prbuf+strlen(prbuf)," sp=%d",tp->th_sport);
data/icmpinfo-1.11/print.c:161:9:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
		      sprintf(prbuf+strlen(prbuf)," dp=%d seq=0x%8.8x",
data/icmpinfo-1.11/print.c:168:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
      sprintf(prbuf+strlen(prbuf)," sz=%d(+%d)",cc,iphdrlen);
data/icmpinfo-1.11/print.c:256:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	  static char buf[80];
data/icmpinfo-1.11/print.c:257:4:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
	  sprintf(buf,"OUT_OF_RANGE(%d)",t);
data/icmpinfo-1.11/print.c:289:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	static char buf[80];
data/icmpinfo-1.11/print.c:292:4:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
	  sprintf(buf,"[OUT_OF_RANGE(%d)]",t);
data/icmpinfo-1.11/print.c:106:22:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	      sprintf(prbuf+strlen(prbuf),hostent?" - %s [%s]":" - %s",
data/icmpinfo-1.11/print.c:117:22:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	      sprintf(prbuf+strlen(prbuf),hostent?" > %s [%s]":" > %s",
data/icmpinfo-1.11/print.c:125:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		      sprintf(prbuf+strlen(prbuf)," sp=%d dp=%d seq=0x%8.8x",
data/icmpinfo-1.11/print.c:130:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		      sprintf(prbuf+strlen(prbuf)," sp=%d [%s]",
data/icmpinfo-1.11/print.c:133:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		      sprintf(prbuf+strlen(prbuf)," sp=%d",tp->source);
data/icmpinfo-1.11/print.c:135:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		      sprintf(prbuf+strlen(prbuf)," dp=%d [%s] seq=0x%8.8x",
data/icmpinfo-1.11/print.c:139:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		      sprintf(prbuf+strlen(prbuf)," dp=%d seq=0x%8.8x",
data/icmpinfo-1.11/print.c:147:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		      sprintf(prbuf+strlen(prbuf)," sp=%d dp=%d seq=0x%8.8x",
data/icmpinfo-1.11/print.c:152:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		      sprintf(prbuf+strlen(prbuf)," sp=%d [%s]",
data/icmpinfo-1.11/print.c:155:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		      sprintf(prbuf+strlen(prbuf)," sp=%d",tp->th_sport);
data/icmpinfo-1.11/print.c:157:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		      sprintf(prbuf+strlen(prbuf)," dp=%d [%s] seq=0x%8.8x",
data/icmpinfo-1.11/print.c:161:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		      sprintf(prbuf+strlen(prbuf)," dp=%d seq=0x%8.8x",
data/icmpinfo-1.11/print.c:168:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      sprintf(prbuf+strlen(prbuf)," sz=%d(+%d)",cc,iphdrlen);

ANALYSIS SUMMARY:

Hits = 37
Lines analyzed = 727 in approximately 0.04 seconds (17909 lines/second)
Physical Source Lines of Code (SLOC) = 565
Hits@level = [0]  13 [1]  13 [2]  15 [3]   0 [4]   9 [5]   0
Hits@level+ = [0+]  50 [1+]  37 [2+]  24 [3+]   9 [4+]   9 [5+]   0
Hits/KSLOC@level+ = [0+] 88.4956 [1+] 65.4867 [2+] 42.4779 [3+] 15.9292 [4+] 15.9292 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.