Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/imgvtopgm-2.0/mine/ipdb.h Examining data/imgvtopgm-2.0/mine/ipdbP.h Examining data/imgvtopgm-2.0/mine/sex.h Examining data/imgvtopgm-2.0/mine/slop.h Examining data/imgvtopgm-2.0/imgvinfo.c Examining data/imgvtopgm-2.0/imgvtopnm.c Examining data/imgvtopgm-2.0/ipdb_c.c Examining data/imgvtopgm-2.0/ipdb_r.c Examining data/imgvtopgm-2.0/ipdb_w.c Examining data/imgvtopgm-2.0/pbmtoimgv.c Examining data/imgvtopgm-2.0/pgmtoimgv.c Examining data/imgvtopgm-2.0/sex.c FINAL RESULTS: data/imgvtopgm-2.0/imgvinfo.c:84:2: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. printf(usefmt, me); data/imgvtopgm-2.0/imgvtopnm.c:66:2: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. printf(usefmt, me); data/imgvtopgm-2.0/ipdb_c.c:214:2: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(t->data, s); data/imgvtopgm-2.0/pbmtoimgv.c:65:2: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. printf(usefmt, me); data/imgvtopgm-2.0/pgmtoimgv.c:66:2: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. printf(usefmt, me); data/imgvtopgm-2.0/imgvinfo.c:37:12: [3] (buffer) getopt: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. extern int getopt(int, char *const *, const char *); data/imgvtopgm-2.0/imgvinfo.c:188:13: [3] (buffer) getopt: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. while((o = getopt(argc, argv, OPTS)) != EOF) { data/imgvtopgm-2.0/imgvtopnm.c:36:12: [3] (buffer) getopt: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. extern int getopt(int, char *const *, const char *); data/imgvtopgm-2.0/imgvtopnm.c:156:13: [3] (buffer) getopt: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. while((o = getopt(argc, argv, OPTS)) != EOF) { data/imgvtopgm-2.0/pbmtoimgv.c:37:12: [3] (buffer) getopt: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. extern int getopt(int, char *const *, const char *); data/imgvtopgm-2.0/pbmtoimgv.c:133:13: [3] (buffer) getopt: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. while((i = getopt(argc, argv, OPTS)) != EOF) { data/imgvtopgm-2.0/pgmtoimgv.c:37:12: [3] (buffer) getopt: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. extern int getopt(int, char *const *, const char *); data/imgvtopgm-2.0/pgmtoimgv.c:137:13: [3] (buffer) getopt: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. while((i = getopt(argc, argv, OPTS)) != EOF) { data/imgvtopgm-2.0/imgvinfo.c:100:16: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). else if((fp = fopen(name, "r")) == NULL) { data/imgvtopgm-2.0/imgvinfo.c:124:8: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static char buf[1024]; data/imgvtopgm-2.0/imgvtopnm.c:133:16: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). else if((fp = fopen(name, "w")) == NULL) data/imgvtopgm-2.0/ipdb_r.c:60:4: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(out, in, put); data/imgvtopgm-2.0/ipdb_r.c:152:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[BUFSZ]; data/imgvtopgm-2.0/ipdb_r.c:182:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(s + used, buf, len); data/imgvtopgm-2.0/ipdb_r.c:189:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(t->data, s, used); data/imgvtopgm-2.0/ipdb_w.c:130:19: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. r->p = (u1 *)memcpy(r->p, r->buf, n) + n; data/imgvtopgm-2.0/mine/ipdb.h:51:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char name[32]; /* nul terminated */ data/imgvtopgm-2.0/mine/ipdb.h:112:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char name[32]; /* nul terminated */ data/imgvtopgm-2.0/ipdb_c.c:140:2: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(p->name, name == NULL ? "unnamed" : name, 31); data/imgvtopgm-2.0/ipdb_c.c:188:2: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(i->name, name == NULL ? "unnamed" : name, 31); data/imgvtopgm-2.0/ipdb_c.c:212:26: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if((t->data = calloc(1, strlen(s) + 1)) == NULL) data/imgvtopgm-2.0/ipdb_w.c:93:8: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). len = strlen(t->data) + 1; data/imgvtopgm-2.0/pbmtoimgv.c:110:10: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). for(n = strlen(s) - 1; n >= 0 && s[n] == '\n'; --n) data/imgvtopgm-2.0/pgmtoimgv.c:114:10: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). for(n = strlen(s) - 1; n >= 0 && s[n] == '\n'; --n) ANALYSIS SUMMARY: Hits = 29 Lines analyzed = 2437 in approximately 0.13 seconds (18344 lines/second) Physical Source Lines of Code (SLOC) = 1668 Hits@level = [0] 44 [1] 6 [2] 10 [3] 8 [4] 5 [5] 0 Hits@level+ = [0+] 73 [1+] 29 [2+] 23 [3+] 13 [4+] 5 [5+] 0 Hits/KSLOC@level+ = [0+] 43.765 [1+] 17.3861 [2+] 13.789 [3+] 7.79376 [4+] 2.9976 [5+] 0 Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.