Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/isight-firmware-tools-1.6/src/load.h
Examining data/isight-firmware-tools-1.6/src/load.c
Examining data/isight-firmware-tools-1.6/src/extract.c
Examining data/isight-firmware-tools-1.6/src/export.c
Examining data/isight-firmware-tools-1.6/src/udev.c

FINAL RESULTS:

data/isight-firmware-tools-1.6/src/load.h:45:28:  [4] (format) syslog:
  If syslog's format strings can be influenced by an attacker, they can be
  exploited (CWE-134). Use a constant format string for syslog.
#define	ift_debug(args...)	syslog(LOG_DEBUG, args)
data/isight-firmware-tools-1.6/src/load.h:46:30:  [4] (format) syslog:
  If syslog's format strings can be influenced by an attacker, they can be
  exploited (CWE-134). Use a constant format string for syslog.
#define	ift_message(args...)	syslog(LOG_INFO, args)
data/isight-firmware-tools-1.6/src/load.h:47:30:  [4] (format) syslog:
  If syslog's format strings can be influenced by an attacker, they can be
  exploited (CWE-134). Use a constant format string for syslog.
#define	ift_warning(args...)	syslog(LOG_WARNING, args)
data/isight-firmware-tools-1.6/src/load.h:48:30:  [4] (format) syslog:
  If syslog's format strings can be influenced by an attacker, they can be
  exploited (CWE-134). Use a constant format string for syslog.
#define	ift_error(args...)	({syslog(LOG_ERR, args); exit(-1);})
data/isight-firmware-tools-1.6/src/export.c:86:3:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
		sprintf(sdata+2*i, "%02X", data[i]);
data/isight-firmware-tools-1.6/src/export.c:126:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char data[4], rdata[1024];
data/isight-firmware-tools-1.6/src/export.c:128:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	if ((fd = open (filename, O_RDONLY)) == -1) {
data/isight-firmware-tools-1.6/src/export.c:133:13:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	if ((fdo = open(output, O_WRONLY | O_CREAT | O_TRUNC,
data/isight-firmware-tools-1.6/src/extract.c:59:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char value[3];
data/isight-firmware-tools-1.6/src/extract.c:210:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char data[4], rdata[1024];
data/isight-firmware-tools-1.6/src/load.c:53:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char data[4], rdata[1024], *ptr;
data/isight-firmware-tools-1.6/src/export.c:91:22:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	w = write(fd, line, strlen(line));
data/isight-firmware-tools-1.6/src/export.c:93:11:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	if (w != strlen(line)) {
data/isight-firmware-tools-1.6/src/export.c:96:13:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			line, w, strlen(line));
data/isight-firmware-tools-1.6/src/export.c:141:14:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
		if ((len = read (fd, data, 4)) != 4) {
data/isight-firmware-tools-1.6/src/export.c:158:14:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
		} else if (read (fd, rdata, len) != len) {
data/isight-firmware-tools-1.6/src/export.c:168:18:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	write(fdo, end, strlen(end));
data/isight-firmware-tools-1.6/src/extract.c:178:19:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
		if ((read_len = read(fd, chunk, chunk_len)) != chunk_len) {
data/isight-firmware-tools-1.6/src/extract.c:230:14:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
		if ((len = read (fd, data, 4)) != 4) {
data/isight-firmware-tools-1.6/src/extract.c:250:14:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
		} else if (read (fd, rdata, len) != len) {
data/isight-firmware-tools-1.6/src/extract.c:277:18:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	if ((read_len = read(fd, version, 3)) != 3)
data/isight-firmware-tools-1.6/src/load.c:75:14:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
		if ((len = read(fd, data, 4)) != 4) {
data/isight-firmware-tools-1.6/src/load.c:95:14:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
		} else if (read(fd, rdata, len) != len) {

ANALYSIS SUMMARY:

Hits = 23
Lines analyzed = 990 in approximately 0.06 seconds (16408 lines/second)
Physical Source Lines of Code (SLOC) = 645
Hits@level = [0]   7 [1]  12 [2]   7 [3]   0 [4]   4 [5]   0
Hits@level+ = [0+]  30 [1+]  23 [2+]  11 [3+]   4 [4+]   4 [5+]   0
Hits/KSLOC@level+ = [0+] 46.5116 [1+] 35.6589 [2+] 17.0543 [3+] 6.20155 [4+] 6.20155 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.