Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/libinline-python-perl-0.56/py2pl.c
Examining data/libinline-python-perl-0.56/perlmodule.c
Examining data/libinline-python-perl-0.56/py2pl.h
Examining data/libinline-python-perl-0.56/util.h
Examining data/libinline-python-perl-0.56/perlmodule.h
Examining data/libinline-python-perl-0.56/util.c

FINAL RESULTS:

data/libinline-python-perl-0.56/perlmodule.c:81:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(str, "%s%s::", bs, pkg);
data/libinline-python-perl-0.56/perlmodule.c:112:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(str, "<perl package: '%s'>", PyBytes_AsString(self->full));
data/libinline-python-perl-0.56/perlmodule.c:115:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(str, "<perl package: '%s'>", PyString_AsString(self->full));
data/libinline-python-perl-0.56/perlmodule.c:258:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(str, "<perl object: '%s'>", PyBytes_AsString(self->pkg));
data/libinline-python-perl-0.56/perlmodule.c:261:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(str, "<perl object: '%s'>", PyString_AsString(self->pkg));
data/libinline-python-perl-0.56/perlmodule.c:343:17:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
                sprintf(attribute_error, "attribute %s not found", name);
data/libinline-python-perl-0.56/perlmodule.c:397:13:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
            sprintf(attribute_error, "attribute %s not found", name);
data/libinline-python-perl-0.56/perlmodule.c:685:9:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
        sprintf(str, "%s%s", PyBytes_AsString(package),
data/libinline-python-perl-0.56/perlmodule.c:688:9:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
        sprintf(str, "%s%s", PyString_AsString(package),
data/libinline-python-perl-0.56/perlmodule.c:874:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(str, "<perl sub: '%s'>", (self->full
data/libinline-python-perl-0.56/perlmodule.c:879:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(str, "<perl sub: '%s'>", (self->full
data/libinline-python-perl-0.56/perlmodule.c:1113:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(str, "use %s", s_c_bytes);
data/libinline-python-perl-0.56/util.c:61:9:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
        sprintf(test,"%s%s",pkg,key);
data/libinline-python-perl-0.56/util.c:80:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(fpkg,"%s::",pkg);
data/libinline-python-perl-0.56/util.c:105:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(qsub,"%s%s",pkg,sub);
data/libinline-python-perl-0.56/util.h:37:19:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
#define Printf(x) printf x
data/libinline-python-perl-0.56/perlmodule.c:342:17:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
                char attribute_error[strlen(name) + 21];
data/libinline-python-perl-0.56/perlmodule.c:396:13:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
            char attribute_error[strlen(name) + 21];
data/libinline-python-perl-0.56/perlmodule.c:73:39:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    char * const str = (char*)malloc((strlen(bs) + strlen(pkg) + strlen("::") + 1)
data/libinline-python-perl-0.56/perlmodule.c:73:52:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    char * const str = (char*)malloc((strlen(bs) + strlen(pkg) + strlen("::") + 1)
data/libinline-python-perl-0.56/perlmodule.c:73:66:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    char * const str = (char*)malloc((strlen(bs) + strlen(pkg) + strlen("::") + 1)
data/libinline-python-perl-0.56/perlmodule.c:108:39:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    char * const str = (char*)malloc((strlen("<perl package: ''>")
data/libinline-python-perl-0.56/perlmodule.c:254:39:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    char * const str = (char*)malloc((strlen("<perl object: ''>")
data/libinline-python-perl-0.56/perlmodule.c:342:38:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                char attribute_error[strlen(name) + 21];
data/libinline-python-perl-0.56/perlmodule.c:396:34:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            char attribute_error[strlen(name) + 21];
data/libinline-python-perl-0.56/perlmodule.c:868:39:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    char * const str = (char*)malloc((strlen("<perl sub: ''>")
data/libinline-python-perl-0.56/perlmodule.c:871:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                    : strlen("anonymous"))
data/libinline-python-perl-0.56/perlmodule.c:1111:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    str = malloc((strlen("use ")
data/libinline-python-perl-0.56/py2pl.c:246:43:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                hv_store(retval, key_val, strlen(key_val), sv_val, 0);
data/libinline-python-perl-0.56/util.c:60:44:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        char * const test = (char*)malloc((strlen(pkg) + strlen(key) + 1)*sizeof(char));
data/libinline-python-perl-0.56/util.c:60:58:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        char * const test = (char*)malloc((strlen(pkg) + strlen(key) + 1)*sizeof(char));
data/libinline-python-perl-0.56/util.c:79:40:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    char * const fpkg = (char*)malloc((strlen(pkg) + strlen("::") + 1)*sizeof(char));
data/libinline-python-perl-0.56/util.c:79:54:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    char * const fpkg = (char*)malloc((strlen(pkg) + strlen("::") + 1)*sizeof(char));
data/libinline-python-perl-0.56/util.c:85:39:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if (hash && hv_exists(hash, fpkg, strlen(fpkg))) {
data/libinline-python-perl-0.56/util.c:104:40:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    char * const qsub = (char*)malloc((strlen(pkg) + strlen(sub) + 1)*sizeof(char));
data/libinline-python-perl-0.56/util.c:104:54:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    char * const qsub = (char*)malloc((strlen(pkg) + strlen(sub) + 1)*sizeof(char));

ANALYSIS SUMMARY:

Hits = 36
Lines analyzed = 2141 in approximately 0.17 seconds (12759 lines/second)
Physical Source Lines of Code (SLOC) = 1692
Hits@level = [0]   5 [1]  18 [2]   2 [3]   0 [4]  16 [5]   0
Hits@level+ = [0+]  41 [1+]  36 [2+]  18 [3+]  16 [4+]  16 [5+]   0
Hits/KSLOC@level+ = [0+] 24.2317 [1+] 21.2766 [2+] 10.6383 [3+] 9.45626 [4+] 9.45626 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.