Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/libatomic-ops-7.6.10/src/atomic_ops.c
Examining data/libatomic-ops-7.6.10/src/atomic_ops.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/ao_version.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/generalize-arithm.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/generalize-small.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/generalize.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/all_acquire_release_volatile.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/all_aligned_atomic_load_store.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/all_atomic_load_store.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/all_atomic_only_load.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/ao_t_is_int.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/armcc/arm_v6.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/emul_cas.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/gcc/aarch64.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/gcc/alpha.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/gcc/arm.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/gcc/avr32.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/gcc/cris.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/gcc/generic-arithm.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/gcc/generic-small.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/gcc/generic.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/gcc/hexagon.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/gcc/hppa.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/gcc/ia64.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/gcc/m68k.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/gcc/mips.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/gcc/powerpc.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/gcc/riscv.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/gcc/s390.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/gcc/sh.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/gcc/sparc.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/gcc/tile.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/gcc/x86.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/generic_pthread.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/hpc/hppa.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/hpc/ia64.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/ibmc/powerpc.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/icc/ia64.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/loadstore/acquire_release_volatile.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/loadstore/atomic_load.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/loadstore/atomic_store.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/loadstore/char_acquire_release_volatile.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/loadstore/char_atomic_load.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/loadstore/char_atomic_store.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/loadstore/double_atomic_load_store.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/loadstore/int_acquire_release_volatile.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/loadstore/int_atomic_load.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/loadstore/int_atomic_store.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/loadstore/ordered_loads_only.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/loadstore/ordered_stores_only.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/loadstore/short_acquire_release_volatile.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/loadstore/short_atomic_load.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/loadstore/short_atomic_store.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/msftc/arm.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/msftc/common32_defs.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/msftc/x86.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/msftc/x86_64.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/ordered.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/ordered_except_wr.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/read_ordered.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/standard_ao_double_t.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/sunc/sparc.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/sunc/x86.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/test_and_set_t_is_ao_t.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/test_and_set_t_is_char.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops_malloc.c
Examining data/libatomic-ops-7.6.10/src/atomic_ops_malloc.h
Examining data/libatomic-ops-7.6.10/src/atomic_ops_stack.c
Examining data/libatomic-ops-7.6.10/src/atomic_ops_stack.h
Examining data/libatomic-ops-7.6.10/tests/run_parallel.h
Examining data/libatomic-ops-7.6.10/tests/test_atomic.c
Examining data/libatomic-ops-7.6.10/tests/test_malloc.c
Examining data/libatomic-ops-7.6.10/tests/test_stack.c
FINAL RESULTS:
data/libatomic-ops-7.6.10/src/atomic_ops/sysdeps/standard_ao_double_t.h:79:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char dummy[sizeof(AO_double_t) == 2 * sizeof(AO_t) ? 1 : -1];
data/libatomic-ops-7.6.10/src/atomic_ops_malloc.c:81:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char AO_initial_heap[AO_INITIAL_HEAP_SIZE];
data/libatomic-ops-7.6.10/src/atomic_ops_malloc.c:144:15: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
zero_fd = open("/dev/zero", O_RDONLY);
data/libatomic-ops-7.6.10/src/atomic_ops_malloc.c:269:23: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const unsigned char msbs[16] = {
data/libatomic-ops-7.6.10/tests/test_malloc.c:233:18: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
nthreads = atoi(argv[1]);
data/libatomic-ops-7.6.10/tests/test_stack.c:116:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char marks[MAX_NTHREADS * (MAX_NTHREADS + 1) / 2 + 1];
data/libatomic-ops-7.6.10/tests/test_stack.c:232:22: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
max_nthreads = atoi(argv[1]);
ANALYSIS SUMMARY:
Hits = 7
Lines analyzed = 18795 in approximately 0.74 seconds (25405 lines/second)
Physical Source Lines of Code (SLOC) = 13553
Hits@level = [0] 61 [1] 0 [2] 7 [3] 0 [4] 0 [5] 0
Hits@level+ = [0+] 68 [1+] 7 [2+] 7 [3+] 0 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 5.01734 [1+] 0.516491 [2+] 0.516491 [3+] 0 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.