Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/libgee-0.8-0.20.3/tests/testarraylist.c Examining data/libgee-0.8-0.20.3/tests/testcase.c Examining data/libgee-0.8-0.20.3/tests/testset.c Examining data/libgee-0.8-0.20.3/tests/testmultiset.c Examining data/libgee-0.8-0.20.3/tests/testreadonlycollection.c Examining data/libgee-0.8-0.20.3/tests/testpriorityqueue.c Examining data/libgee-0.8-0.20.3/tests/testconcurrentlist.c Examining data/libgee-0.8-0.20.3/tests/testconcurrentset.c Examining data/libgee-0.8-0.20.3/tests/testhashset.c Examining data/libgee-0.8-0.20.3/tests/testmain.c Examining data/libgee-0.8-0.20.3/tests/testlist.c Examining data/libgee-0.8-0.20.3/tests/testhashmultiset.c Examining data/libgee-0.8-0.20.3/tests/testarrayqueue.c Examining data/libgee-0.8-0.20.3/tests/testfunctions.c Examining data/libgee-0.8-0.20.3/tests/testmultimap.c Examining data/libgee-0.8-0.20.3/tests/testlinkedlist.c Examining data/libgee-0.8-0.20.3/tests/testqueue.c Examining data/libgee-0.8-0.20.3/tests/testdeque.c Examining data/libgee-0.8-0.20.3/tests/testtreemultimap.c Examining data/libgee-0.8-0.20.3/tests/testlinkedlistasdeque.c Examining data/libgee-0.8-0.20.3/tests/testreadonlymap.c Examining data/libgee-0.8-0.20.3/tests/testmap.c Examining data/libgee-0.8-0.20.3/tests/testcollection.c Examining data/libgee-0.8-0.20.3/tests/testtreemap.c Examining data/libgee-0.8-0.20.3/tests/testhashmultimap.c Examining data/libgee-0.8-0.20.3/tests/testtreeset.c Examining data/libgee-0.8-0.20.3/tests/testunrolledlinkedlist.c Examining data/libgee-0.8-0.20.3/tests/testreadonlylist.c Examining data/libgee-0.8-0.20.3/tests/testdata.c Examining data/libgee-0.8-0.20.3/tests/testreadonlybidirlist.c Examining data/libgee-0.8-0.20.3/tests/testhashmap.c Examining data/libgee-0.8-0.20.3/tests/testunrolledlinkedlistasdeque.c Examining data/libgee-0.8-0.20.3/tests/testbidirlist.c Examining data/libgee-0.8-0.20.3/tests/testbidirsortedmap.c Examining data/libgee-0.8-0.20.3/tests/testsortedmap.c Examining data/libgee-0.8-0.20.3/tests/testreadonlyset.c Examining data/libgee-0.8-0.20.3/tests/testsortedset.c Examining data/libgee-0.8-0.20.3/tests/testbidirsortedset.c Examining data/libgee-0.8-0.20.3/tests/testtreemultiset.c Examining data/libgee-0.8-0.20.3/benchmark/benchmarksorts.c Examining data/libgee-0.8-0.20.3/benchmark/benchmark.c Examining data/libgee-0.8-0.20.3/utils/free.h Examining data/libgee-0.8-0.20.3/utils/assume.h Examining data/libgee-0.8-0.20.3/utils/misc.h Examining data/libgee-0.8-0.20.3/utils/async.h Examining data/libgee-0.8-0.20.3/gee/abstractset.c Examining data/libgee-0.8-0.20.3/gee/lightmapfuture.c Examining data/libgee-0.8-0.20.3/gee/readonlybidirlist.c Examining data/libgee-0.8-0.20.3/gee/map.c Examining data/libgee-0.8-0.20.3/gee/lazy.c Examining data/libgee-0.8-0.20.3/gee/multimap.c Examining data/libgee-0.8-0.20.3/gee/abstractqueue.c Examining data/libgee-0.8-0.20.3/gee/assemblyinfo.c Examining data/libgee-0.8-0.20.3/gee/multiset.c Examining data/libgee-0.8-0.20.3/gee/abstractmap.c Examining data/libgee-0.8-0.20.3/gee/set.c Examining data/libgee-0.8-0.20.3/gee/timsort.c Examining data/libgee-0.8-0.20.3/gee/bidirlist.c Examining data/libgee-0.8-0.20.3/gee/promise.c Examining data/libgee-0.8-0.20.3/gee/streamiterator.c Examining data/libgee-0.8-0.20.3/gee/unfolditerator.c Examining data/libgee-0.8-0.20.3/gee/sortedset.c Examining data/libgee-0.8-0.20.3/gee/abstractbidirsortedset.c Examining data/libgee-0.8-0.20.3/gee/abstractmultimap.c Examining data/libgee-0.8-0.20.3/gee/iterable.c Examining data/libgee-0.8-0.20.3/gee/readonlycollection.c Examining data/libgee-0.8-0.20.3/gee/abstractcollection.c Examining data/libgee-0.8-0.20.3/gee/treeset.c Examining data/libgee-0.8-0.20.3/gee/arraylist.c Examining data/libgee-0.8-0.20.3/gee/task.c Examining data/libgee-0.8-0.20.3/gee/hashable.c Examining data/libgee-0.8-0.20.3/gee/priorityqueue.c Examining data/libgee-0.8-0.20.3/gee/abstractbidirlist.c Examining data/libgee-0.8-0.20.3/gee/gee.h Examining data/libgee-0.8-0.20.3/gee/readonlybidirsortedmap.c Examining data/libgee-0.8-0.20.3/gee/readonlysortedset.c Examining data/libgee-0.8-0.20.3/gee/readonlymultimap.c Examining data/libgee-0.8-0.20.3/gee/queue.c Examining data/libgee-0.8-0.20.3/gee/hazardpointer.c Examining data/libgee-0.8-0.20.3/gee/iterator.c Examining data/libgee-0.8-0.20.3/gee/functions.c Examining data/libgee-0.8-0.20.3/gee/unrolledlinkedlist.c Examining data/libgee-0.8-0.20.3/gee/readonlymap.c Examining data/libgee-0.8-0.20.3/gee/bidirlistiterator.c Examining data/libgee-0.8-0.20.3/gee/future.c Examining data/libgee-0.8-0.20.3/gee/mapiterator.c Examining data/libgee-0.8-0.20.3/gee/hashset.c Examining data/libgee-0.8-0.20.3/gee/bidiriterator.c Examining data/libgee-0.8-0.20.3/gee/treemultiset.c Examining data/libgee-0.8-0.20.3/gee/bidirmapiterator.c Examining data/libgee-0.8-0.20.3/gee/treemap.c Examining data/libgee-0.8-0.20.3/gee/hashmap.c Examining data/libgee-0.8-0.20.3/gee/hashmultimap.c Examining data/libgee-0.8-0.20.3/gee/readonlylist.c Examining data/libgee-0.8-0.20.3/gee/hashmultiset.c Examining data/libgee-0.8-0.20.3/gee/abstractlist.c Examining data/libgee-0.8-0.20.3/gee/deque.c Examining data/libgee-0.8-0.20.3/gee/list.c Examining data/libgee-0.8-0.20.3/gee/sortedmap.c Examining data/libgee-0.8-0.20.3/gee/abstractbidirsortedmap.c Examining data/libgee-0.8-0.20.3/gee/concurrentlist.c Examining data/libgee-0.8-0.20.3/gee/concurrentset.c Examining data/libgee-0.8-0.20.3/gee/abstractsortedmap.c Examining data/libgee-0.8-0.20.3/gee/readonlymultiset.c Examining data/libgee-0.8-0.20.3/gee/traversable.c Examining data/libgee-0.8-0.20.3/gee/abstractsortedset.c Examining data/libgee-0.8-0.20.3/gee/comparable.c Examining data/libgee-0.8-0.20.3/gee/arrayqueue.c Examining data/libgee-0.8-0.20.3/gee/readonlybidirsortedset.c Examining data/libgee-0.8-0.20.3/gee/treemultimap.c Examining data/libgee-0.8-0.20.3/gee/readonlyset.c Examining data/libgee-0.8-0.20.3/gee/abstractmultiset.c Examining data/libgee-0.8-0.20.3/gee/linkedlist.c Examining data/libgee-0.8-0.20.3/gee/listiterator.c Examining data/libgee-0.8-0.20.3/gee/bidirsortedmap.c Examining data/libgee-0.8-0.20.3/gee/readonlysortedmap.c Examining data/libgee-0.8-0.20.3/gee/teeiterator.c Examining data/libgee-0.8-0.20.3/gee/bidirsortedset.c Examining data/libgee-0.8-0.20.3/gee/collection.c FINAL RESULTS: data/libgee-0.8-0.20.3/benchmark/benchmark.c:689:59: [3] (random) g_random_int_range: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. gee_collection_add (collection, (gpointer) ((gintptr) g_random_int_range ((gint32) 0, (gint32) (size - 1)))); data/libgee-0.8-0.20.3/benchmark/benchmark.c:802:75: [3] (random) g_random_int_range: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. gee_collection_add (collection, (gpointer) ((gintptr) ((gint32) ((i + g_random_int_range ((gint32) 0, (gint32) variance)) - (variance / 2))))); data/libgee-0.8-0.20.3/benchmark/benchmark.c:909:18: [3] (random) g_random_int_range: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. width = (gint) g_random_int_range ((gint32) 0, (gint32) variance); data/libgee-0.8-0.20.3/benchmark/benchmark.c:910:19: [3] (random) g_random_int_range: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. height = (gint) g_random_int_range ((gint32) ((-variance) / 2), (gint32) (variance / 2)); data/libgee-0.8-0.20.3/gee/concurrentset.c:1409:23: [3] (random) g_rand_int_range: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. rand_int = (guint32) g_rand_int_range (_tmp8_, (gint32) 0, G_MAXINT32); data/libgee-0.8-0.20.3/gee/concurrentset.c:3060:23: [3] (random) g_rand_int_range: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. rand_int = (guint32) g_rand_int_range (_tmp11_, (gint32) 0, G_MAXINT32); data/libgee-0.8-0.20.3/tests/testarraylist.c:424:72: [3] (random) g_random_int_range: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. gee_collection_add ((GeeCollection*) _tmp3_, (gpointer) ((gintptr) g_random_int_range ((gint32) 1, (gint32) (ARRAY_LIST_TESTS_BIG_SORT_SIZE - 1)))); data/libgee-0.8-0.20.3/gee/concurrentset.c:7933:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy (dup, self, sizeof (GeeConcurrentSetTowerNode)); data/libgee-0.8-0.20.3/gee/concurrentset.c:7975:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy ((*dest)._iter, _tmp0_, 31 * sizeof (GeeConcurrentSetTower*)); data/libgee-0.8-0.20.3/gee/hazardpointer.c:1875:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy (dup, self, sizeof (GeeHazardPointerPolicy)); data/libgee-0.8-0.20.3/gee/unrolledlinkedlist.c:2247:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy (dup, self, sizeof (gint)); data/libgee-0.8-0.20.3/gee/unrolledlinkedlist.c:2465:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy (_tmp12_->_data, &node->_data[GEE_UNROLLED_LINKED_LIST_SPLIT_POS], (gsize) (sizeof (gpointer) * (GEE_UNROLLED_LINKED_LIST_NODE_SIZE - GEE_UNROLLED_LINKED_LIST_SPLIT_POS))); data/libgee-0.8-0.20.3/gee/unrolledlinkedlist.c:2652:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy (&node->_data[node->_size], next->_data, (gsize) (sizeof (gpointer) * next->_size)); data/libgee-0.8-0.20.3/tests/testarraylist.c:466:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy (dup, self, sizeof (gdouble)); data/libgee-0.8-0.20.3/gee/task.c:364:11: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). _tmp3_ = strlen (str); ANALYSIS SUMMARY: Hits = 15 Lines analyzed = 163008 in approximately 3.65 seconds (44714 lines/second) Physical Source Lines of Code (SLOC) = 148073 Hits@level = [0] 14 [1] 1 [2] 7 [3] 7 [4] 0 [5] 0 Hits@level+ = [0+] 29 [1+] 15 [2+] 14 [3+] 7 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 0.195849 [1+] 0.101301 [2+] 0.094548 [3+] 0.047274 [4+] 0 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.