Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/libapache-mod-log-sql-1.100/functions13.h
Examining data/libapache-mod-log-sql-1.100/functions20.h
Examining data/libapache-mod-log-sql-1.100/apache13.h
Examining data/libapache-mod-log-sql-1.100/apache20.h
Examining data/libapache-mod-log-sql-1.100/winconfig.h
Examining data/libapache-mod-log-sql-1.100/mod_log_sql_ssl.c
Examining data/libapache-mod-log-sql-1.100/mod_log_sql.c
Examining data/libapache-mod-log-sql-1.100/mod_log_sql.h
Examining data/libapache-mod-log-sql-1.100/mod_log_sql_dbi.c
Examining data/libapache-mod-log-sql-1.100/mod_log_sql_mysql.c
Examining data/libapache-mod-log-sql-1.100/mod_log_sql_pgsql.c
Examining data/libapache-mod-log-sql-1.100/functions.h

FINAL RESULTS:

data/libapache-mod-log-sql-1.100/apache13.h:81:69:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
	const server_rec *s, const char *fmt, ...) __attribute__ ((format (printf, 6,7)));
data/libapache-mod-log-sql-1.100/apache13.h:89:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	static char buff[MAX_STRING_LEN];
data/libapache-mod-log-sql-1.100/functions13.h:19:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char tstr[MAX_STRING_LEN];
data/libapache-mod-log-sql-1.100/functions20.h:16:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char tstr[MAX_STRING_LEN];
data/libapache-mod-log-sql-1.100/functions20.h:24:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char timestr[DEFAULT_REQUEST_TIME_SIZE];
data/libapache-mod-log-sql-1.100/functions20.h:60:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(cached_time, &(request_time_cache[i]), sizeof(*cached_time));
data/libapache-mod-log-sql-1.100/functions20.h:86:13:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
            memcpy(&(request_time_cache[i]), cached_time,
data/libapache-mod-log-sql-1.100/mod_log_sql.c:1136:4:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
			char sql_month[60];
data/libapache-mod-log-sql-1.100/mod_log_sql.c:1137:4:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
			char sql_year[60];
data/libapache-mod-log-sql-1.100/mod_log_sql.c:1138:4:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
			char a[60];
data/libapache-mod-log-sql-1.100/mod_log_sql_dbi.c:42:37:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
	unsigned int tcpport = (s_tcpport)?atoi(s_tcpport):0;
data/libapache-mod-log-sql-1.100/mod_log_sql_mysql.c:40:37:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
	unsigned int tcpport = (s_tcpport)?atoi(s_tcpport):3306;
data/libapache-mod-log-sql-1.100/mod_log_sql_pgsql.c:42:37:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
	unsigned int tcpport = (s_tcpport)?atoi(s_tcpport):3306;
data/libapache-mod-log-sql-1.100/functions.h:41:13:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	} else if (strlen(rvalue) == 0) {
data/libapache-mod-log-sql-1.100/functions.h:196:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
				isvalid += strlen(a) + 1;
data/libapache-mod-log-sql-1.100/functions.h:214:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
				isvalid += strlen(a) + 1;
data/libapache-mod-log-sql-1.100/functions.h:229:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			    isvalid += strlen(a) + 1;
data/libapache-mod-log-sql-1.100/functions13.h:32:22:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		ap_snprintf(tstr + strlen(tstr), sizeof(tstr) - strlen(tstr), "%c%.2d%.2d]", sign, timz / 60, timz % 60);
data/libapache-mod-log-sql-1.100/functions13.h:32:51:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		ap_snprintf(tstr + strlen(tstr), sizeof(tstr) - strlen(tstr), "%c%.2d%.2d]", sign, timz / 60, timz % 60);
data/libapache-mod-log-sql-1.100/mod_log_sql.c:314:3:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		strlen(arg) * sizeof(logsql_item *));
data/libapache-mod-log-sql-1.100/mod_log_sql.c:647:4:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			strlen(cls->transfer_log_format) * sizeof(logsql_item *));
data/libapache-mod-log-sql-1.100/mod_log_sql.c:745:4:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			strlen(child->transfer_log_format) * sizeof(logsql_item *));
data/libapache-mod-log-sql-1.100/mod_log_sql.c:911:12:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		length = strlen(cls->transfer_log_format);
data/libapache-mod-log-sql-1.100/mod_log_sql_mysql.c:81:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	if (!from_str || strlen(from_str) == 0)
data/libapache-mod-log-sql-1.100/mod_log_sql_mysql.c:85:26:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		unsigned long length = strlen(from_str);
data/libapache-mod-log-sql-1.100/mod_log_sql_mysql.c:95:9:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
        strcpy(to_str, "'");
data/libapache-mod-log-sql-1.100/mod_log_sql_mysql.c:108:9:  [1] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant character.
        strcat(to_str,"'");
data/libapache-mod-log-sql-1.100/mod_log_sql_pgsql.c:84:26:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		unsigned long length = strlen(from_str);

ANALYSIS SUMMARY:

Hits = 28
Lines analyzed = 3007 in approximately 0.19 seconds (16054 lines/second)
Physical Source Lines of Code (SLOC) = 2192
Hits@level = [0]   1 [1]  15 [2]  12 [3]   0 [4]   1 [5]   0
Hits@level+ = [0+]  29 [1+]  28 [2+]  13 [3+]   1 [4+]   1 [5+]   0
Hits/KSLOC@level+ = [0+] 13.2299 [1+] 12.7737 [2+] 5.93066 [3+] 0.456204 [4+] 0.456204 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.