Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/libgtextutils-0.7/src/gtextutils/container_join.h
Examining data/libgtextutils-0.7/src/gtextutils/exit_manip.h
Examining data/libgtextutils-0.7/src/gtextutils/inbuf1.hpp
Examining data/libgtextutils-0.7/src/gtextutils/natsort.h
Examining data/libgtextutils-0.7/src/gtextutils/outbuf3.hpp
Examining data/libgtextutils-0.7/src/gtextutils/pipe_fitter.c
Examining data/libgtextutils-0.7/src/gtextutils/pipe_fitter.h
Examining data/libgtextutils-0.7/src/gtextutils/stream_wrapper.cpp
Examining data/libgtextutils-0.7/src/gtextutils/stream_wrapper.h
Examining data/libgtextutils-0.7/src/gtextutils/string_tokenize.h
Examining data/libgtextutils-0.7/src/gtextutils/strnatcmp.c
Examining data/libgtextutils-0.7/src/gtextutils/strnatcmp.h
Examining data/libgtextutils-0.7/src/gtextutils/tuple_parser.h
Examining data/libgtextutils-0.7/src/gtextutils/text_line_reader.cpp
Examining data/libgtextutils-0.7/src/gtextutils/text_line_reader.h
Examining data/libgtextutils-0.7/tests/test_container_join.cpp
Examining data/libgtextutils-0.7/tests/test_fd_inbuf.cpp
Examining data/libgtextutils-0.7/tests/test_fd_outbuf.cpp
Examining data/libgtextutils-0.7/tests/test_in_out_buf.cpp
Examining data/libgtextutils-0.7/tests/test_input_stream_wrapper.cpp
Examining data/libgtextutils-0.7/tests/test_natural_sort.cpp
Examining data/libgtextutils-0.7/tests/test_pipe_fitter.c
Examining data/libgtextutils-0.7/tests/test_string_tokenize.cpp
Examining data/libgtextutils-0.7/tests/test_text_reader.cpp
Examining data/libgtextutils-0.7/tests/test_text_reader_unget.cpp
Examining data/libgtextutils-0.7/tests/test_tuple_parser.cpp
Examining data/libgtextutils-0.7/tests/test_tuple_parser_file.cpp
Examining data/libgtextutils-0.7/tests/tests_assertion.h
FINAL RESULTS:
data/libgtextutils-0.7/src/gtextutils/pipe_fitter.c:108:2: [4] (shell) execlp:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
execlp(executable,executable,(char*)NULL);
data/libgtextutils-0.7/tests/test_in_out_buf.cpp:71:2: [4] (shell) execlp:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
execlp(program,program,"-f",NULL);
data/libgtextutils-0.7/tests/test_tuple_parser_file.cpp:52:14: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while ((opt=getopt(argc, argv,"hi:c:s:ev")) != -1) {
data/libgtextutils-0.7/src/gtextutils/pipe_fitter.c:67:13: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
file_fd = open(filename,
data/libgtextutils-0.7/src/gtextutils/stream_wrapper.cpp:32:14: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
input_file.open(filename.c_str()) ;
data/libgtextutils-0.7/src/gtextutils/stream_wrapper.cpp:51:16: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
output_file.open(filename.c_str()) ;
data/libgtextutils-0.7/tests/test_fd_inbuf.cpp:45:11: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
int fd = open(filename, O_RDONLY);
data/libgtextutils-0.7/tests/test_fd_outbuf.cpp:46:11: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
int fd = open("fdout.tmp", O_CREAT | O_WRONLY | O_TRUNC, S_IRUSR|S_IWUSR ) ;
data/libgtextutils-0.7/tests/test_in_out_buf.cpp:65:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd = open(output_filename, O_WRONLY | O_CREAT, 0666 );
data/libgtextutils-0.7/tests/test_pipe_fitter.c:37:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char temp[1000];
data/libgtextutils-0.7/tests/test_pipe_fitter.c:38:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char str[1000];
data/libgtextutils-0.7/src/gtextutils/inbuf1.hpp:109:15: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
num = read (input_fd, buffer+putBackSize, bufferSize-putBackSize);
data/libgtextutils-0.7/tests/test_pipe_fitter.c:44:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
i = write ( fd, text, strlen(text)) ;
data/libgtextutils-0.7/tests/test_pipe_fitter.c:57:2: [1] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant character.
strcat(str,"");
data/libgtextutils-0.7/tests/test_pipe_fitter.c:59:7: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
n = read ( fd, temp, sizeof(temp)-1) ;
data/libgtextutils-0.7/tests/test_pipe_fitter.c:69:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy ( str, temp, sizeof(str)-1);
ANALYSIS SUMMARY:
Hits = 16
Lines analyzed = 2830 in approximately 0.18 seconds (15940 lines/second)
Physical Source Lines of Code (SLOC) = 1364
Hits@level = [0] 3 [1] 5 [2] 8 [3] 1 [4] 2 [5] 0
Hits@level+ = [0+] 19 [1+] 16 [2+] 11 [3+] 3 [4+] 2 [5+] 0
Hits/KSLOC@level+ = [0+] 13.9296 [1+] 11.7302 [2+] 8.06452 [3+] 2.19941 [4+] 1.46628 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.