Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/jffi-1.2.7/jni/jffi/Array.c
Examining data/jffi-1.2.7/jni/jffi/Array.h
Examining data/jffi-1.2.7/jni/jffi/CallContext.c
Examining data/jffi-1.2.7/jni/jffi/CallContext.h
Examining data/jffi-1.2.7/jni/jffi/ClosureMagazine.c
Examining data/jffi-1.2.7/jni/jffi/Exception.c
Examining data/jffi-1.2.7/jni/jffi/Exception.h
Examining data/jffi-1.2.7/jni/jffi/FastIntInvoke.c
Examining data/jffi-1.2.7/jni/jffi/FastLongInvoke.c
Examining data/jffi-1.2.7/jni/jffi/FastNumeric.h
Examining data/jffi-1.2.7/jni/jffi/FastNumericInvoker.c
Examining data/jffi-1.2.7/jni/jffi/FaultProtect.c
Examining data/jffi-1.2.7/jni/jffi/FaultProtect.h
Examining data/jffi-1.2.7/jni/jffi/Foreign.c
Examining data/jffi-1.2.7/jni/jffi/Internals.c
Examining data/jffi-1.2.7/jni/jffi/Invoke.c
Examining data/jffi-1.2.7/jni/jffi/LastError.c
Examining data/jffi-1.2.7/jni/jffi/LastError.h
Examining data/jffi-1.2.7/jni/jffi/Library.c
Examining data/jffi-1.2.7/jni/jffi/LongDouble.c
Examining data/jffi-1.2.7/jni/jffi/Memory.c
Examining data/jffi-1.2.7/jni/jffi/MemoryIO.c
Examining data/jffi-1.2.7/jni/jffi/MemoryUtil.c
Examining data/jffi-1.2.7/jni/jffi/MemoryUtil.h
Examining data/jffi-1.2.7/jni/jffi/Struct.c
Examining data/jffi-1.2.7/jni/jffi/Type.c
Examining data/jffi-1.2.7/jni/jffi/Type.h
Examining data/jffi-1.2.7/jni/jffi/deprecated.c
Examining data/jffi-1.2.7/jni/jffi/jffi.h
Examining data/jffi-1.2.7/jni/jffi/longjmp.c
Examining data/jffi-1.2.7/jni/jffi/queue.h
Examining data/jffi-1.2.7/jni/jffi/setjmp.c
Examining data/jffi-1.2.7/jni/jffi/endian.h
Examining data/jffi-1.2.7/libtest/Benchmark.c
Examining data/jffi-1.2.7/libtest/BufferTest.c
Examining data/jffi-1.2.7/libtest/ClosureTest.c
Examining data/jffi-1.2.7/libtest/EnumTest.c
Examining data/jffi-1.2.7/libtest/GlobalVariable.c
Examining data/jffi-1.2.7/libtest/LastErrorTest.c
Examining data/jffi-1.2.7/libtest/NumberTest.c
Examining data/jffi-1.2.7/libtest/PointerTest.c
Examining data/jffi-1.2.7/libtest/ReferenceTest.c
Examining data/jffi-1.2.7/libtest/StringTest.c
Examining data/jffi-1.2.7/libtest/StructTest.c
Examining data/jffi-1.2.7/libtest/VariadicTest.c

FINAL RESULTS:

data/jffi-1.2.7/jni/jffi/Exception.c:44:5:  [4] (format) vsnprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
    vsnprintf(buf, sizeof(buf) - 1, fmt, ap);
data/jffi-1.2.7/jni/jffi/FaultProtect.c:67:9:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
        strcpy((char *) (uintptr_t) fdp->frame[fdp->frame_count].libname, dli.dli_fname);
data/jffi-1.2.7/jni/jffi/LongDouble.c:94:5:  [4] (format) sprintf:
  Potential format string problem (CWE-134). Make format string constant.
    sprintf(tmp, fmt, jffi_decodeLongDouble(env, array, arrayOffset, arrayLength));
data/jffi-1.2.7/jni/jffi/jffi.h:215:34:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
       write(STDERR_FILENO, tmp, snprintf(tmp, sizeof(tmp), fmt "\n", ##a)); \
data/jffi-1.2.7/libtest/StringTest.c:39:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(s1, s2);
data/jffi-1.2.7/libtest/StringTest.c:44:5:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
    strcat(dst, src);
data/jffi-1.2.7/libtest/StructTest.c:113:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(t->string, s);
data/jffi-1.2.7/jni/jffi/Library.c:176:16:  [3] (misc) LoadLibraryEx:
  Ensure that the full path to the library is specified, or current directory
  may be used (CWE-829, CWE-20). Use registry entry or GetWindowsDirectory to
  find library path, if you aren't already.
        return LoadLibraryEx(name, NULL, LOAD_WITH_ALTERED_SEARCH_PATH);
data/jffi-1.2.7/jni/jffi/ClosureMagazine.c:86:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char errmsg[256];
data/jffi-1.2.7/jni/jffi/Exception.c:42:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char buf[1024] = { 0 };
data/jffi-1.2.7/jni/jffi/FaultProtect.c:54:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char fn[256];
data/jffi-1.2.7/jni/jffi/FaultProtect.h:71:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char backtrace_buf[1024];
data/jffi-1.2.7/jni/jffi/Library.c:88:9:  [2] (buffer) wchar_t:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        wchar_t path[PATH_MAX];
data/jffi-1.2.7/jni/jffi/Library.c:93:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char path_[PATH_MAX];
data/jffi-1.2.7/jni/jffi/Library.c:115:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char errbuf[1024] = { 0 };
data/jffi-1.2.7/jni/jffi/Library.c:138:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char sym[1024];
data/jffi-1.2.7/jni/jffi/Library.c:147:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char errbuf[1024] = { 0 };
data/jffi-1.2.7/jni/jffi/Library.c:163:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char errbuf[1024] = { 0 };
data/jffi-1.2.7/jni/jffi/LongDouble.c:92:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char tmp[256];
data/jffi-1.2.7/jni/jffi/MemoryIO.c:83:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
{ memcpy(j2p(address), &value, sizeof(value)); } \
data/jffi-1.2.7/jni/jffi/MemoryIO.c:86:8:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
{ PROT(memcpy(j2p(address), &value, sizeof(value)),); }
data/jffi-1.2.7/jni/jffi/MemoryIO.c:189:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(j2p(address), &tmp, sizeof(tmp));
data/jffi-1.2.7/jni/jffi/MemoryIO.c:196:10:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    PROT(memcpy(j2p(address), &tmp, sizeof(tmp)),);
data/jffi-1.2.7/jni/jffi/MemoryIO.c:224:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(j2p(dst), j2p(src), size);
data/jffi-1.2.7/jni/jffi/MemoryIO.c:230:10:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    PROT(memcpy(j2p(dst), j2p(src), size),);
data/jffi-1.2.7/jni/jffi/MemoryIO.c:275:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(j2p(dst), j2p(src), size);
data/jffi-1.2.7/jni/jffi/MemoryIO.c:281:12:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      PROT(memcpy(j2p(dst), j2p(src), size), );
data/jffi-1.2.7/jni/jffi/jffi.h:214:8:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
       char tmp[1024]; \
data/jffi-1.2.7/jni/jffi/longjmp.c:74:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char name[256];
data/jffi-1.2.7/libtest/PointerTest.c:44:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy((caddr_t) arg1 + offset, &value, sizeof(value)); \
data/jffi-1.2.7/libtest/StructTest.c:64:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char string[32];
data/jffi-1.2.7/libtest/VariadicTest.c:43:17:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                memcpy(buf++, &d, sizeof(d));
data/jffi-1.2.7/jni/jffi/FaultProtect.c:64:17:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        boff += strlen((char *) fdp->frame[fdp->frame_count].procname) + 1;
data/jffi-1.2.7/jni/jffi/FaultProtect.c:68:17:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        boff += strlen((char *) fdp->frame[fdp->frame_count].libname) + 1;
data/jffi-1.2.7/jni/jffi/MemoryIO.c:292:20:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    return (jlong) strlen(j2p(address));
data/jffi-1.2.7/jni/jffi/MemoryIO.c:298:25:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    PROT(return (jlong) strlen(j2p(address)), 0);
data/jffi-1.2.7/jni/jffi/MemoryIO.c:310:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    int len = strlen(str);
data/jffi-1.2.7/jni/jffi/MemoryIO.c:325:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    PROT(len = strlen(str), NULL);

ANALYSIS SUMMARY:

Hits = 38
Lines analyzed = 7373 in approximately 0.28 seconds (26043 lines/second)
Physical Source Lines of Code (SLOC) = 4683
Hits@level = [0]   6 [1]   6 [2]  24 [3]   1 [4]   7 [5]   0
Hits@level+ = [0+]  44 [1+]  38 [2+]  32 [3+]   8 [4+]   7 [5+]   0
Hits/KSLOC@level+ = [0+] 9.39569 [1+] 8.11446 [2+] 6.83323 [3+] 1.70831 [4+] 1.49477 [5+]   0
Dot directories skipped = 2 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.