Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/kubrick-20.04.3/src/scenelabel.cpp Examining data/kubrick-20.04.3/src/game.cpp Examining data/kubrick-20.04.3/src/kubrick.cpp Examining data/kubrick-20.04.3/src/kubrick.h Examining data/kubrick-20.04.3/src/movetracker.cpp Examining data/kubrick-20.04.3/src/kbkglobal.h Examining data/kubrick-20.04.3/src/quaternion.cpp Examining data/kubrick-20.04.3/src/quaternion.h Examining data/kubrick-20.04.3/src/scenelabel.h Examining data/kubrick-20.04.3/src/cube.cpp Examining data/kubrick-20.04.3/src/gameglview.cpp Examining data/kubrick-20.04.3/src/main.cpp Examining data/kubrick-20.04.3/src/gamedialog.h Examining data/kubrick-20.04.3/src/cube.h Examining data/kubrick-20.04.3/src/game.h Examining data/kubrick-20.04.3/src/movetracker.h Examining data/kubrick-20.04.3/src/gamedialog.cpp Examining data/kubrick-20.04.3/src/gameglview.h FINAL RESULTS: data/kubrick-20.04.3/src/game.cpp:56:5: [3] (random) random: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. random.setSeed (0); // Zero gets us an arbitrary seed. data/kubrick-20.04.3/src/game.cpp:1204:24: [3] (random) random: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. double pickShape = random.getDouble (); data/kubrick-20.04.3/src/game.cpp:1634:24: [3] (random) random: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. return (lo + (int) random.getLong (hi - lo + 1)); data/kubrick-20.04.3/src/game.h:195:21: [3] (random) random: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. KRandomSequence random; // Random number generator object. data/kubrick-20.04.3/src/kubrick.cpp:467:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char ident [10]; data/kubrick-20.04.3/src/kubrick.cpp:468:5: [2] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). Risk is low because the source is a constant string. strcpy (ident, "slice n"); data/kubrick-20.04.3/src/kubrick.cpp:470:9: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf (ident, "slice %d", i); ANALYSIS SUMMARY: Hits = 7 Lines analyzed = 6273 in approximately 0.49 seconds (12829 lines/second) Physical Source Lines of Code (SLOC) = 3986 Hits@level = [0] 9 [1] 0 [2] 3 [3] 4 [4] 0 [5] 0 Hits@level+ = [0+] 16 [1+] 7 [2+] 7 [3+] 4 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 4.01405 [1+] 1.75615 [2+] 1.75615 [3+] 1.00351 [4+] 0 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.