Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/jskeus-1.2.4+dfsg/irteus/CBULLET.cpp Examining data/jskeus-1.2.4+dfsg/irteus/CPQP.C Examining data/jskeus-1.2.4+dfsg/irteus/eusbullet.c Examining data/jskeus-1.2.4+dfsg/irteus/euspng.c Examining data/jskeus-1.2.4+dfsg/irteus/euspqp.c Examining data/jskeus-1.2.4+dfsg/irteus/irtc.c Examining data/jskeus-1.2.4+dfsg/irteus/irtgeoc.c Examining data/jskeus-1.2.4+dfsg/irteus/irtglc.c Examining data/jskeus-1.2.4+dfsg/irteus/nr.c Examining data/jskeus-1.2.4+dfsg/irteus/nr.h FINAL RESULTS: data/jskeus-1.2.4+dfsg/irteus/euspng.c:58:39: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. if (isstring(argv[0])) file_name = (char *)(argv[0]->c.str.chars); data/jskeus-1.2.4+dfsg/irteus/euspng.c:61:14: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). FILE *fp = fopen(file_name, "rb"); data/jskeus-1.2.4+dfsg/irteus/euspng.c:144:39: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. if (isstring(argv[0])) file_name = (char *)(argv[0]->c.str.chars); data/jskeus-1.2.4+dfsg/irteus/euspng.c:150:14: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). FILE *fp = fopen(file_name, "wb"); data/jskeus-1.2.4+dfsg/irteus/irtglc.c:71:31: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. if (isstring(argv[2])) src=(char *)argv[2]->c.str.chars; data/jskeus-1.2.4+dfsg/irteus/irtglc.c:77:7: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(buf, src + (h-y-1)*step, step); data/jskeus-1.2.4+dfsg/irteus/irtglc.c:78:7: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(src + (h-y-1)*step, src + y*step, step); data/jskeus-1.2.4+dfsg/irteus/irtglc.c:79:7: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(src + y*step, buf, step); data/jskeus-1.2.4+dfsg/irteus/irtglc.c:84:33: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. if (isstring(argv[3])) dst=(char *)argv[3]->c.str.chars; data/jskeus-1.2.4+dfsg/irteus/irtglc.c:87:7: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(dst + y*step, src + (h-y-1)*step, step); data/jskeus-1.2.4+dfsg/irteus/irtc.c:1057:36: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). p=cons(ctx,makestring(SVNVERSION,strlen(SVNVERSION)),NIL); ANALYSIS SUMMARY: Hits = 11 Lines analyzed = 3266 in approximately 0.17 seconds (19553 lines/second) Physical Source Lines of Code (SLOC) = 2371 Hits@level = [0] 10 [1] 1 [2] 10 [3] 0 [4] 0 [5] 0 Hits@level+ = [0+] 21 [1+] 11 [2+] 10 [3+] 0 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 8.85702 [1+] 4.63939 [2+] 4.21763 [3+] 0 [4+] 0 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.