Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/libcompiler-lexer-perl-0.23/include/common.hpp
Examining data/libcompiler-lexer-perl-0.23/include/gen_token.hpp
Examining data/libcompiler-lexer-perl-0.23/include/keyword.hpp
Examining data/libcompiler-lexer-perl-0.23/include/lexer.hpp
Examining data/libcompiler-lexer-perl-0.23/include/token.hpp
Examining data/libcompiler-lexer-perl-0.23/src/compiler/lexer/Compiler_annotator.cpp
Examining data/libcompiler-lexer-perl-0.23/src/compiler/lexer/Compiler_lexer.cpp
Examining data/libcompiler-lexer-perl-0.23/src/compiler/lexer/Compiler_manager.cpp
Examining data/libcompiler-lexer-perl-0.23/src/compiler/lexer/Compiler_scanner.cpp
Examining data/libcompiler-lexer-perl-0.23/src/compiler/util/Compiler_double_charactor_operator.cpp
Examining data/libcompiler-lexer-perl-0.23/src/compiler/util/Compiler_gen_token_decl.cpp
Examining data/libcompiler-lexer-perl-0.23/src/compiler/util/Compiler_reserved_keyword.cpp
Examining data/libcompiler-lexer-perl-0.23/src/compiler/util/Compiler_token.cpp
Examining data/libcompiler-lexer-perl-0.23/src/compiler/util/Compiler_triple_charactor_operator.cpp
Examining data/libcompiler-lexer-perl-0.23/src/compiler/util/Compiler_util.cpp
FINAL RESULTS:
data/libcompiler-lexer-perl-0.23/include/common.hpp:22:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(stderr, fmt, ## __VA_ARGS__); \
data/libcompiler-lexer-perl-0.23/include/common.hpp:25:2: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(stderr, fmt, ## __VA_ARGS__); \
data/libcompiler-lexer-perl-0.23/src/compiler/lexer/Compiler_manager.cpp:174:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[len + 1];
data/libcompiler-lexer-perl-0.23/src/compiler/lexer/Compiler_manager.cpp:176:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buffer, raw_script + s, len);
data/libcompiler-lexer-perl-0.23/src/compiler/lexer/Compiler_scanner.cpp:194:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char num_buffer[2] = {0};
data/libcompiler-lexer-perl-0.23/src/compiler/lexer/Compiler_scanner.cpp:197:7: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
if (atoi(num_buffer) > 0 || number == '0') {
data/libcompiler-lexer-perl-0.23/src/compiler/lexer/Compiler_scanner.cpp:532:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char op[4] = { symbol, next_ch, after_next_ch, EOL };
data/libcompiler-lexer-perl-0.23/src/compiler/lexer/Compiler_scanner.cpp:555:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char op[3] = { symbol, next_ch, EOL };
data/libcompiler-lexer-perl-0.23/include/lexer.hpp:55:56: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ReservedKeyword *ret = keyword_map.in_word_set(data, strlen(data));
data/libcompiler-lexer-perl-0.23/src/compiler/lexer/Compiler_annotator.cpp:56:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t len = strlen(opt);
data/libcompiler-lexer-perl-0.23/src/compiler/lexer/Compiler_lexer.cpp:17:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
script_size = strlen(script) + 1;
data/libcompiler-lexer-perl-0.23/src/compiler/lexer/Compiler_manager.cpp:165:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
script_size = strlen(script) + 1;
data/libcompiler-lexer-perl-0.23/src/compiler/lexer/Compiler_scanner.cpp:408:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t len = strlen(opt);
ANALYSIS SUMMARY:
Hits = 13
Lines analyzed = 5506 in approximately 0.32 seconds (17314 lines/second)
Physical Source Lines of Code (SLOC) = 5127
Hits@level = [0] 13 [1] 5 [2] 6 [3] 0 [4] 2 [5] 0
Hits@level+ = [0+] 26 [1+] 13 [2+] 8 [3+] 2 [4+] 2 [5+] 0
Hits/KSLOC@level+ = [0+] 5.07119 [1+] 2.5356 [2+] 1.56037 [3+] 0.390092 [4+] 0.390092 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.