Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/isomd5sum-1.2.3/checkisomd5.c
Examining data/isomd5sum-1.2.3/implantisomd5.c
Examining data/isomd5sum-1.2.3/libcheckisomd5.h
Examining data/isomd5sum-1.2.3/libimplantisomd5.c
Examining data/isomd5sum-1.2.3/libimplantisomd5.h
Examining data/isomd5sum-1.2.3/md5.c
Examining data/isomd5sum-1.2.3/md5.h
Examining data/isomd5sum-1.2.3/pyisomd5sum.c
Examining data/isomd5sum-1.2.3/libcheckisomd5.c
Examining data/isomd5sum-1.2.3/utilities.c
Examining data/isomd5sum-1.2.3/utilities.h

FINAL RESULTS:

data/isomd5sum-1.2.3/implantisomd5.c:72:9:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
        fprintf(stderr, errstr, args[0]);
data/isomd5sum-1.2.3/libimplantisomd5.c:162:5:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
    snprintf(tmp, sizeof(status) / sizeof(*status), status, supported);
data/isomd5sum-1.2.3/libcheckisomd5.c:116:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char hashsum[HASH_SIZE + 1];
data/isomd5sum-1.2.3/libcheckisomd5.c:125:17:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    int isofd = open(file, O_RDONLY | O_BINARY);
data/isomd5sum-1.2.3/libcheckisomd5.c:139:17:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    int isofd = open(file, O_RDONLY | O_BINARY);
data/isomd5sum-1.2.3/libimplantisomd5.c:44:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(appdata + *loc, valstr, vallen);
data/isomd5sum-1.2.3/libimplantisomd5.c:51:17:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    int isofd = open(iso, O_RDWR | O_BINARY);
data/isomd5sum-1.2.3/libimplantisomd5.c:71:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char appdata[APPDATA_SIZE];
data/isomd5sum-1.2.3/libimplantisomd5.c:100:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char fragmentsums[FRAGMENT_SUM_SIZE + 1];
data/isomd5sum-1.2.3/libimplantisomd5.c:131:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char hashsum[HASH_SIZE + 1];
data/isomd5sum-1.2.3/libimplantisomd5.c:150:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char appdata_buffer[APPDATA_SIZE];
data/isomd5sum-1.2.3/libimplantisomd5.c:161:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char tmp[sizeof(status) / sizeof(*status)];
data/isomd5sum-1.2.3/md5.c:94:25:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                        memcpy(p, buf, len);
data/isomd5sum-1.2.3/md5.c:97:17:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                memcpy(p, buf, t);
data/isomd5sum-1.2.3/md5.c:106:17:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                memcpy(ctx->in, buf, 64);
data/isomd5sum-1.2.3/md5.c:115:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(ctx->in, buf, len);
data/isomd5sum-1.2.3/md5.c:122:25:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
void MD5_Final(unsigned char digest[16], struct MD5Context *ctx)
data/isomd5sum-1.2.3/md5.c:154:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(ctx->in+56, ctx->bits, sizeof(ctx->bits));
data/isomd5sum-1.2.3/md5.c:158:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(digest, ctx->buf, 16);
data/isomd5sum-1.2.3/md5.h:12:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char in[64];
data/isomd5sum-1.2.3/md5.h:18:25:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
void MD5_Final(unsigned char digest[16], struct MD5Context *);
data/isomd5sum-1.2.3/utilities.c:88:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char tmp[APPDATA_SIZE];
data/isomd5sum-1.2.3/utilities.c:113:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char buffer[APPDATA_SIZE];
data/isomd5sum-1.2.3/utilities.c:130:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(buffer, aligned_buffer + APPDATA_OFFSET, APPDATA_SIZE);
data/isomd5sum-1.2.3/utilities.c:149:13:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
            memcpy(result->hashsum, buffer + index, HASH_SIZE);
data/isomd5sum-1.2.3/utilities.c:171:13:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
            memcpy(result->fragmentsums, buffer + index, FRAGMENT_SUM_SIZE);
data/isomd5sum-1.2.3/utilities.c:209:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char digest[HASH_SIZE / 2];
data/isomd5sum-1.2.3/utilities.c:215:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char tmp[3];
data/isomd5sum-1.2.3/utilities.c:232:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char digest[HASH_SIZE / 2];
data/isomd5sum-1.2.3/utilities.c:236:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char tmp[3];
data/isomd5sum-1.2.3/utilities.h:62:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char hashsum[HASH_SIZE + 1];
data/isomd5sum-1.2.3/utilities.h:63:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char fragmentsums[FRAGMENT_SUM_SIZE + 1];
data/isomd5sum-1.2.3/checkisomd5.c:46:49:  [1] (buffer) getchar:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    if (select(1, &rfds, NULL, NULL, &timev) && getchar() == 27)
data/isomd5sum-1.2.3/libcheckisomd5.c:71:25:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
        ssize_t nread = read(isofd, buffer, nbyte);
data/isomd5sum-1.2.3/libcheckisomd5.c:150:9:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if (strlen(info->fragmentsums) > 0 && info->fragmentcount > 0) {
data/isomd5sum-1.2.3/libimplantisomd5.c:38:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    size_t vallen = strlen(valstr);
data/isomd5sum-1.2.3/libimplantisomd5.c:72:9:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    if (read(isofd, appdata, APPDATA_SIZE) <= 0) {
data/isomd5sum-1.2.3/libimplantisomd5.c:114:25:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
        ssize_t nread = read(isofd, buffer, nbyte);
data/isomd5sum-1.2.3/utilities.c:47:13:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
        if (read(fd, sector_buffer, SECTOR_SIZE) == -1) {
data/isomd5sum-1.2.3/utilities.c:76:24:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    const size_t len = strlen(string);
data/isomd5sum-1.2.3/utilities.c:221:13:  [1] (buffer) strncat:
  Easily used incorrectly (e.g., incorrectly computing the correct maximum
  size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf,
  or automatically resizing strings.
            strncat(hashsums, tmp, 1);
data/isomd5sum-1.2.3/utilities.c:238:9:  [1] (buffer) strncat:
  Easily used incorrectly (e.g., incorrectly computing the correct maximum
  size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf,
  or automatically resizing strings.
        strncat(hashsum, tmp, 2);

ANALYSIS SUMMARY:

Hits = 42
Lines analyzed = 1377 in approximately 0.07 seconds (20057 lines/second)
Physical Source Lines of Code (SLOC) = 928
Hits@level = [0]  25 [1]  10 [2]  30 [3]   0 [4]   2 [5]   0
Hits@level+ = [0+]  67 [1+]  42 [2+]  32 [3+]   2 [4+]   2 [5+]   0
Hits/KSLOC@level+ = [0+] 72.1983 [1+] 45.2586 [2+] 34.4828 [3+] 2.15517 [4+] 2.15517 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.