Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/libcrcutil-1.0/code/base_types.h Examining data/libcrcutil-1.0/code/crc32c_sse4.h Examining data/libcrcutil-1.0/code/crc32c_sse4_intrin.h Examining data/libcrcutil-1.0/code/crc_casts.h Examining data/libcrcutil-1.0/code/generic_crc.h Examining data/libcrcutil-1.0/code/gf_util.h Examining data/libcrcutil-1.0/code/multiword_128_64_gcc_amd64_sse2.cc Examining data/libcrcutil-1.0/code/multiword_64_64_cl_i386_mmx.cc Examining data/libcrcutil-1.0/code/multiword_64_64_gcc_amd64_asm.cc Examining data/libcrcutil-1.0/code/multiword_64_64_gcc_i386_mmx.cc Examining data/libcrcutil-1.0/code/multiword_64_64_intrinsic_i386_mmx.cc Examining data/libcrcutil-1.0/code/platform.h Examining data/libcrcutil-1.0/code/protected_crc.h Examining data/libcrcutil-1.0/code/rolling_crc.h Examining data/libcrcutil-1.0/code/std_headers.h Examining data/libcrcutil-1.0/code/uint128_sse2.h Examining data/libcrcutil-1.0/code/crc32c_sse4.cc Examining data/libcrcutil-1.0/examples/interface.cc Examining data/libcrcutil-1.0/examples/interface.h Examining data/libcrcutil-1.0/examples/usage.cc Examining data/libcrcutil-1.0/tests/aligned_alloc.h Examining data/libcrcutil-1.0/tests/bob_jenkins_rng.h Examining data/libcrcutil-1.0/tests/rdtsc.h Examining data/libcrcutil-1.0/tests/set_hi_pri.c Examining data/libcrcutil-1.0/tests/unittest.cc Examining data/libcrcutil-1.0/tests/unittest_helper.h Examining data/libcrcutil-1.0/tests/unittest.h FINAL RESULTS: data/libcrcutil-1.0/examples/usage.cc:34:3: [4] (format) vprintf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. vprintf(format, va); data/libcrcutil-1.0/tests/unittest.h:1006:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(class_title_, class_title); data/libcrcutil-1.0/tests/unittest.h:1062:5: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(name, "CRC-%d-%s-4-%s", static_cast<int>(degree), data/libcrcutil-1.0/tests/unittest.h:1073:7: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(name, "CRC-%d-%s-6-%s", static_cast<int>(degree), data/libcrcutil-1.0/tests/unittest.h:1084:5: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(name, "CRC-%d-%s-3-%s", static_cast<int>(degree), data/libcrcutil-1.0/examples/usage.cc:44:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buffer[sizeof(kTestData) + 32]; data/libcrcutil-1.0/examples/usage.cc:160:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(buffer, kTestData, sizeof(kTestData) - 1); data/libcrcutil-1.0/examples/usage.cc:179:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(buffer, kTestData, sizeof(kTestData) - 1); data/libcrcutil-1.0/tests/unittest.h:1017:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&generating_polynomial_, &generating_polynomial, sizeof(Crc)); data/libcrcutil-1.0/tests/unittest.h:1025:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&generating_polynomial, &generating_polynomial_, sizeof(Crc)); data/libcrcutil-1.0/tests/unittest.h:1043:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char class_title_[128]; data/libcrcutil-1.0/tests/unittest.h:1059:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char name[128]; data/libcrcutil-1.0/tests/unittest.h:289:28: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). second_dash = name + strlen(name); data/libcrcutil-1.0/tests/unittest.h:299:26: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). last_dash = name + strlen(name); ANALYSIS SUMMARY: Hits = 14 Lines analyzed = 6381 in approximately 0.45 seconds (14061 lines/second) Physical Source Lines of Code (SLOC) = 4433 Hits@level = [0] 30 [1] 2 [2] 7 [3] 0 [4] 5 [5] 0 Hits@level+ = [0+] 44 [1+] 14 [2+] 12 [3+] 5 [4+] 5 [5+] 0 Hits/KSLOC@level+ = [0+] 9.92556 [1+] 3.15813 [2+] 2.70697 [3+] 1.1279 [4+] 1.1279 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.