Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/libcrcutil-1.0/code/base_types.h
Examining data/libcrcutil-1.0/code/crc32c_sse4.h
Examining data/libcrcutil-1.0/code/crc32c_sse4_intrin.h
Examining data/libcrcutil-1.0/code/crc_casts.h
Examining data/libcrcutil-1.0/code/generic_crc.h
Examining data/libcrcutil-1.0/code/gf_util.h
Examining data/libcrcutil-1.0/code/multiword_128_64_gcc_amd64_sse2.cc
Examining data/libcrcutil-1.0/code/multiword_64_64_cl_i386_mmx.cc
Examining data/libcrcutil-1.0/code/multiword_64_64_gcc_amd64_asm.cc
Examining data/libcrcutil-1.0/code/multiword_64_64_gcc_i386_mmx.cc
Examining data/libcrcutil-1.0/code/multiword_64_64_intrinsic_i386_mmx.cc
Examining data/libcrcutil-1.0/code/platform.h
Examining data/libcrcutil-1.0/code/protected_crc.h
Examining data/libcrcutil-1.0/code/rolling_crc.h
Examining data/libcrcutil-1.0/code/std_headers.h
Examining data/libcrcutil-1.0/code/uint128_sse2.h
Examining data/libcrcutil-1.0/code/crc32c_sse4.cc
Examining data/libcrcutil-1.0/examples/interface.cc
Examining data/libcrcutil-1.0/examples/interface.h
Examining data/libcrcutil-1.0/examples/usage.cc
Examining data/libcrcutil-1.0/tests/aligned_alloc.h
Examining data/libcrcutil-1.0/tests/bob_jenkins_rng.h
Examining data/libcrcutil-1.0/tests/rdtsc.h
Examining data/libcrcutil-1.0/tests/set_hi_pri.c
Examining data/libcrcutil-1.0/tests/unittest.cc
Examining data/libcrcutil-1.0/tests/unittest_helper.h
Examining data/libcrcutil-1.0/tests/unittest.h

FINAL RESULTS:

data/libcrcutil-1.0/examples/usage.cc:34:3:  [4] (format) vprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
  vprintf(format, va);
data/libcrcutil-1.0/tests/unittest.h:1006:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(class_title_, class_title);
data/libcrcutil-1.0/tests/unittest.h:1062:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(name, "CRC-%d-%s-4-%s", static_cast<int>(degree),
data/libcrcutil-1.0/tests/unittest.h:1073:7:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
      sprintf(name, "CRC-%d-%s-6-%s", static_cast<int>(degree),
data/libcrcutil-1.0/tests/unittest.h:1084:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(name, "CRC-%d-%s-3-%s", static_cast<int>(degree),
data/libcrcutil-1.0/examples/usage.cc:44:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buffer[sizeof(kTestData) + 32];
data/libcrcutil-1.0/examples/usage.cc:160:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(buffer, kTestData, sizeof(kTestData) - 1);
data/libcrcutil-1.0/examples/usage.cc:179:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(buffer, kTestData, sizeof(kTestData) - 1);
data/libcrcutil-1.0/tests/unittest.h:1017:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&generating_polynomial_, &generating_polynomial, sizeof(Crc));
data/libcrcutil-1.0/tests/unittest.h:1025:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&generating_polynomial, &generating_polynomial_, sizeof(Crc));
data/libcrcutil-1.0/tests/unittest.h:1043:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char class_title_[128];
data/libcrcutil-1.0/tests/unittest.h:1059:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char name[128];
data/libcrcutil-1.0/tests/unittest.h:289:28:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      second_dash = name + strlen(name);
data/libcrcutil-1.0/tests/unittest.h:299:26:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      last_dash = name + strlen(name);

ANALYSIS SUMMARY:

Hits = 14
Lines analyzed = 6381 in approximately 0.45 seconds (14061 lines/second)
Physical Source Lines of Code (SLOC) = 4433
Hits@level = [0]  30 [1]   2 [2]   7 [3]   0 [4]   5 [5]   0
Hits@level+ = [0+]  44 [1+]  14 [2+]  12 [3+]   5 [4+]   5 [5+]   0
Hits/KSLOC@level+ = [0+] 9.92556 [1+] 3.15813 [2+] 2.70697 [3+] 1.1279 [4+] 1.1279 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.