Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/libkf5libkleo-20.08.2/src/ui/cryptoconfigmodule.h Examining data/libkf5libkleo-20.08.2/src/ui/dnattributeorderconfigwidget.cpp Examining data/libkf5libkleo-20.08.2/src/ui/keyrequester.cpp Examining data/libkf5libkleo-20.08.2/src/ui/newkeyapprovaldialog.cpp Examining data/libkf5libkleo-20.08.2/src/ui/progressdialog.cpp Examining data/libkf5libkleo-20.08.2/src/ui/directoryserviceswidget.h Examining data/libkf5libkleo-20.08.2/src/ui/filenamerequester.h Examining data/libkf5libkleo-20.08.2/src/ui/kdhorizontalline.h Examining data/libkf5libkleo-20.08.2/src/ui/keyselectioncombo.h Examining data/libkf5libkleo-20.08.2/src/ui/filenamerequester.cpp Examining data/libkf5libkleo-20.08.2/src/ui/cryptoconfigmodule.cpp Examining data/libkf5libkleo-20.08.2/src/ui/messagebox.cpp Examining data/libkf5libkleo-20.08.2/src/ui/newkeyapprovaldialog.h Examining data/libkf5libkleo-20.08.2/src/ui/directoryserviceswidget.cpp Examining data/libkf5libkleo-20.08.2/src/ui/keyselectioncombo.cpp Examining data/libkf5libkleo-20.08.2/src/ui/keylistview.h Examining data/libkf5libkleo-20.08.2/src/ui/auditlogviewer.h Examining data/libkf5libkleo-20.08.2/src/ui/cryptoconfigdialog.cpp Examining data/libkf5libkleo-20.08.2/src/ui/keyselectiondialog.h Examining data/libkf5libkleo-20.08.2/src/ui/cryptoconfigmodule_p.h Examining data/libkf5libkleo-20.08.2/src/ui/progressdialog.h Examining data/libkf5libkleo-20.08.2/src/ui/keyapprovaldialog.h Examining data/libkf5libkleo-20.08.2/src/ui/messagebox.h Examining data/libkf5libkleo-20.08.2/src/ui/keyapprovaldialog.cpp Examining data/libkf5libkleo-20.08.2/src/ui/keyselectiondialog.cpp Examining data/libkf5libkleo-20.08.2/src/ui/auditlogviewer.cpp Examining data/libkf5libkleo-20.08.2/src/ui/cryptoconfigdialog.h Examining data/libkf5libkleo-20.08.2/src/ui/progressbar.cpp Examining data/libkf5libkleo-20.08.2/src/ui/kdhorizontalline.cpp Examining data/libkf5libkleo-20.08.2/src/ui/keylistview.cpp Examining data/libkf5libkleo-20.08.2/src/ui/progressbar.h Examining data/libkf5libkleo-20.08.2/src/ui/dnattributeorderconfigwidget.h Examining data/libkf5libkleo-20.08.2/src/ui/keyrequester.h Examining data/libkf5libkleo-20.08.2/src/models/subkeylistmodel.h Examining data/libkf5libkleo-20.08.2/src/models/keycache_p.h Examining data/libkf5libkleo-20.08.2/src/models/useridlistmodel.h Examining data/libkf5libkleo-20.08.2/src/models/subkeylistmodel.cpp Examining data/libkf5libkleo-20.08.2/src/models/keycache.h Examining data/libkf5libkleo-20.08.2/src/models/keyrearrangecolumnsproxymodel.h Examining data/libkf5libkleo-20.08.2/src/models/keyrearrangecolumnsproxymodel.cpp Examining data/libkf5libkleo-20.08.2/src/models/keylistmodelinterface.h Examining data/libkf5libkleo-20.08.2/src/models/keycache.cpp Examining data/libkf5libkleo-20.08.2/src/models/useridlistmodel.cpp Examining data/libkf5libkleo-20.08.2/src/models/keylistmodel.h Examining data/libkf5libkleo-20.08.2/src/models/keylistsortfilterproxymodel.cpp Examining data/libkf5libkleo-20.08.2/src/models/keylistmodel.cpp Examining data/libkf5libkleo-20.08.2/src/models/keylistsortfilterproxymodel.h Examining data/libkf5libkleo-20.08.2/src/tests/test_keyselectiondialog.cpp Examining data/libkf5libkleo-20.08.2/src/tests/test_keylister.h Examining data/libkf5libkleo-20.08.2/src/tests/test_keylister.cpp Examining data/libkf5libkleo-20.08.2/src/tests/test_keygen.cpp Examining data/libkf5libkleo-20.08.2/src/tests/test_keygen.h Examining data/libkf5libkleo-20.08.2/src/tests/test_kdhorizontalline.cpp Examining data/libkf5libkleo-20.08.2/src/tests/test_keyresolver.cpp Examining data/libkf5libkleo-20.08.2/src/tests/gnupgviewer.h Examining data/libkf5libkleo-20.08.2/src/tests/test_auditlog.cpp Examining data/libkf5libkleo-20.08.2/src/tests/test_cryptoconfig.cpp Examining data/libkf5libkleo-20.08.2/src/tests/test_jobs.cpp Examining data/libkf5libkleo-20.08.2/src/tests/test_keyselectioncombo.cpp Examining data/libkf5libkleo-20.08.2/src/tests/test_keyformailbox.cpp Examining data/libkf5libkleo-20.08.2/src/kleo/stl_util.h Examining data/libkf5libkleo-20.08.2/src/kleo/keyfiltermanager.h Examining data/libkf5libkleo-20.08.2/src/kleo/exception.h Examining data/libkf5libkleo-20.08.2/src/kleo/keyresolver.cpp Examining data/libkf5libkleo-20.08.2/src/kleo/kconfigbasedkeyfilter.h Examining data/libkf5libkleo-20.08.2/src/kleo/kconfigbasedkeyfilter.cpp Examining data/libkf5libkleo-20.08.2/src/kleo/predicates.h Examining data/libkf5libkleo-20.08.2/src/kleo/keyfiltermanager.cpp Examining data/libkf5libkleo-20.08.2/src/kleo/defaultkeyfilter.h Examining data/libkf5libkleo-20.08.2/src/kleo/checksumdefinition.cpp Examining data/libkf5libkleo-20.08.2/src/kleo/oidmap.h Examining data/libkf5libkleo-20.08.2/src/kleo/dn.cpp Examining data/libkf5libkleo-20.08.2/src/kleo/keyresolver.h Examining data/libkf5libkleo-20.08.2/src/kleo/defaultkeygenerationjob.cpp Examining data/libkf5libkleo-20.08.2/src/kleo/dn.h Examining data/libkf5libkleo-20.08.2/src/kleo/enum.cpp Examining data/libkf5libkleo-20.08.2/src/kleo/defaultkeyfilter.cpp Examining data/libkf5libkleo-20.08.2/src/kleo/defaultkeygenerationjob.h Examining data/libkf5libkleo-20.08.2/src/kleo/exception.cpp Examining data/libkf5libkleo-20.08.2/src/kleo/checksumdefinition.h Examining data/libkf5libkleo-20.08.2/src/kleo/keyfilter.h Examining data/libkf5libkleo-20.08.2/src/kleo/enum.h Examining data/libkf5libkleo-20.08.2/src/utils/classify.h Examining data/libkf5libkleo-20.08.2/src/utils/hex.cpp Examining data/libkf5libkleo-20.08.2/src/utils/gnupg.cpp Examining data/libkf5libkleo-20.08.2/src/utils/classify.cpp Examining data/libkf5libkleo-20.08.2/src/utils/filesystemwatcher.h Examining data/libkf5libkleo-20.08.2/src/utils/formatting.h Examining data/libkf5libkleo-20.08.2/src/utils/formatting.cpp Examining data/libkf5libkleo-20.08.2/src/utils/gnupg.h Examining data/libkf5libkleo-20.08.2/src/utils/hex.h Examining data/libkf5libkleo-20.08.2/src/utils/filesystemwatcher.cpp FINAL RESULTS: data/libkf5libkleo-20.08.2/src/tests/test_cryptoconfig.cpp:277:13: [4] (shell) system: This causes a new program to execute and is difficult to use safely (CWE-78). try using a library call that implements the same functionality if available. system("gpgconf --list-options dirmngr | grep log-file"); data/libkf5libkleo-20.08.2/src/tests/test_cryptoconfig.cpp:296:17: [4] (format) sprintf: Potential format string problem (CWE-134). Make format string constant. sys.sprintf("echo 'log-file:%s' | gpgconf --change-options dirmngr", arg.local8Bit().data()); data/libkf5libkleo-20.08.2/src/tests/test_cryptoconfig.cpp:297:13: [4] (shell) system: This causes a new program to execute and is difficult to use safely (CWE-78). try using a library call that implements the same functionality if available. system(sys.data()); data/libkf5libkleo-20.08.2/src/tests/test_cryptoconfig.cpp:337:13: [4] (shell) system: This causes a new program to execute and is difficult to use safely (CWE-78). try using a library call that implements the same functionality if available. system("gpgconf --list-options dirmngr | grep 'LDAP Server'"); data/libkf5libkleo-20.08.2/src/kleo/dn.cpp:158:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(p, string, n); data/libkf5libkleo-20.08.2/src/kleo/dn.cpp:163:26: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. if (!strcasecmp((char *)p, oidmap[i].oid)) { data/libkf5libkleo-20.08.2/src/kleo/keyresolver.cpp:526:18: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). mDialog->open(); data/libkf5libkleo-20.08.2/src/ui/auditlogviewer.cpp:101:14: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if (file.open(QIODevice::WriteOnly)) { data/libkf5libkleo-20.08.2/src/ui/directoryserviceswidget.cpp:88:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. const char label[6]; data/libkf5libkleo-20.08.2/src/utils/classify.cpp:61:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char extension[4]; data/libkf5libkleo-20.08.2/src/utils/classify.cpp:127:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char content[28]; data/libkf5libkleo-20.08.2/src/utils/classify.cpp:218:15: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if (!file.open(QIODevice::ReadOnly)) { data/libkf5libkleo-20.08.2/src/utils/gnupg.cpp:139:22: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if (!versionFile.open(QIODevice::ReadOnly)) { data/libkf5libkleo-20.08.2/src/utils/gnupg.cpp:380:13: [2] (buffer) MultiByteToWideChar: Requires maximum length in CHARACTERS, not bytes (CWE-120). int n = MultiByteToWideChar(src_encoding, 0, data, -1, NULL, 0); data/libkf5libkleo-20.08.2/src/utils/gnupg.cpp:387:9: [2] (buffer) MultiByteToWideChar: Requires maximum length in CHARACTERS, not bytes (CWE-120). n = MultiByteToWideChar(src_encoding, 0, data, -1, result, n); data/libkf5libkleo-20.08.2/src/utils/classify.cpp:224:60: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). const unsigned int contentClass = classifyContent(file.read(4096)); ANALYSIS SUMMARY: Hits = 16 Lines analyzed = 23073 in approximately 0.64 seconds (36326 lines/second) Physical Source Lines of Code (SLOC) = 16167 Hits@level = [0] 0 [1] 1 [2] 11 [3] 0 [4] 4 [5] 0 Hits@level+ = [0+] 16 [1+] 16 [2+] 15 [3+] 4 [4+] 4 [5+] 0 Hits/KSLOC@level+ = [0+] 0.98967 [1+] 0.98967 [2+] 0.927816 [3+] 0.247418 [4+] 0.247418 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.