Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/kanjipad-2.0.0/jstroke/jstroke.h
Examining data/kanjipad-2.0.0/jstroke/jstrokerc.h
Examining data/kanjipad-2.0.0/jstroke/memowrite.c
Examining data/kanjipad-2.0.0/jstroke/memowrite.h
Examining data/kanjipad-2.0.0/jstroke/pilotcompat.h
Examining data/kanjipad-2.0.0/jstroke/scoring.c
Examining data/kanjipad-2.0.0/jstroke/strokedata.h
Examining data/kanjipad-2.0.0/jstroke/util.c
Examining data/kanjipad-2.0.0/kanjipad.c
Examining data/kanjipad-2.0.0/kanjipad.h
Examining data/kanjipad-2.0.0/kpengine.c
Examining data/kanjipad-2.0.0/padarea.c

FINAL RESULTS:

data/kanjipad-2.0.0/jstroke/memowrite.c:142:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char buf[10];
data/kanjipad-2.0.0/jstroke/memowrite.c:156:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char buf[10];
data/kanjipad-2.0.0/jstroke/pilotcompat.h:49:25:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
#define StrIToA(str, n) sprintf((str),"%ld",(long)(n))
data/kanjipad-2.0.0/jstroke/pilotcompat.h:50:25:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
#define StrIToH(str, n) sprintf((str),"%lx",(long)(n))
data/kanjipad-2.0.0/jstroke/scoring.c:212:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char         buf[10];
data/kanjipad-2.0.0/jstroke/scoring.c:499:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char    cArg[2];
data/kanjipad-2.0.0/kanjipad.c:368:23:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
      if (!(samples = fopen("samples.dat", "a")))
data/kanjipad-2.0.0/kpengine.c:30:8:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static char *stroke_dicts[MAX_STROKES];
data/kanjipad-2.0.0/kpengine.c:42:14:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
      file = fopen (data_file, "rb");
data/kanjipad-2.0.0/kpengine.c:52:14:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
      file = fopen (fname, "rb");
data/kanjipad-2.0.0/kpengine.c:55:9:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	file = fopen ("jdata.dat", "rb");
data/kanjipad-2.0.0/kpengine.c:197:17:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	      unsigned char c[2];
data/kanjipad-2.0.0/padarea.c:41:4:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	  char buffer[16];
data/kanjipad-2.0.0/padarea.c:52:4:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
	  sprintf (buffer, "%d", index);
data/kanjipad-2.0.0/jstroke/pilotcompat.h:48:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
#define StrLen strlen
data/kanjipad-2.0.0/kpengine.c:142:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      while ((strlen(buffer) == buflen - 1) && (buffer[buflen-2] != '\n'))

ANALYSIS SUMMARY:

Hits = 16
Lines analyzed = 4632 in approximately 0.94 seconds (4905 lines/second)
Physical Source Lines of Code (SLOC) = 3753
Hits@level = [0]  20 [1]   2 [2]  14 [3]   0 [4]   0 [5]   0
Hits@level+ = [0+]  36 [1+]  16 [2+]  14 [3+]   0 [4+]   0 [5+]   0
Hits/KSLOC@level+ = [0+] 9.59233 [1+] 4.26326 [2+] 3.73035 [3+]   0 [4+]   0 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.