Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/libkolabxml-1.1.6/compiled/XMLParserWrapper.cpp
Examining data/libkolabxml-1.1.6/compiled/XMLParserWrapper.h
Examining data/libkolabxml-1.1.6/compiled/grammar-input-stream.cxx
Examining data/libkolabxml-1.1.6/compiled/xsdbin.cxx
Examining data/libkolabxml-1.1.6/src/base64.cpp
Examining data/libkolabxml-1.1.6/src/base64.h
Examining data/libkolabxml-1.1.6/src/containers/incidence_p.h
Examining data/libkolabxml-1.1.6/src/containers/kolabconfiguration.cpp
Examining data/libkolabxml-1.1.6/src/containers/kolabconfiguration.h
Examining data/libkolabxml-1.1.6/src/containers/kolabcontact.cpp
Examining data/libkolabxml-1.1.6/src/containers/kolabcontact.h
Examining data/libkolabxml-1.1.6/src/containers/kolabcontainers.cpp
Examining data/libkolabxml-1.1.6/src/containers/kolabcontainers.h
Examining data/libkolabxml-1.1.6/src/containers/kolabevent.cpp
Examining data/libkolabxml-1.1.6/src/containers/kolabevent.h
Examining data/libkolabxml-1.1.6/src/containers/kolabevent_p.h
Examining data/libkolabxml-1.1.6/src/containers/kolabfile.cpp
Examining data/libkolabxml-1.1.6/src/containers/kolabfile.h
Examining data/libkolabxml-1.1.6/src/containers/kolabfreebusy.cpp
Examining data/libkolabxml-1.1.6/src/containers/kolabfreebusy.h
Examining data/libkolabxml-1.1.6/src/containers/kolabfreebusy_p.h
Examining data/libkolabxml-1.1.6/src/containers/kolabjournal.cpp
Examining data/libkolabxml-1.1.6/src/containers/kolabjournal.h
Examining data/libkolabxml-1.1.6/src/containers/kolabnote.cpp
Examining data/libkolabxml-1.1.6/src/containers/kolabnote.h
Examining data/libkolabxml-1.1.6/src/containers/kolabtodo.cpp
Examining data/libkolabxml-1.1.6/src/containers/kolabtodo.h
Examining data/libkolabxml-1.1.6/src/global_definitions.h
Examining data/libkolabxml-1.1.6/src/kolabconversions.h
Examining data/libkolabxml-1.1.6/src/kolabformat.cpp
Examining data/libkolabxml-1.1.6/src/kolabformat.h
Examining data/libkolabxml-1.1.6/src/objectvalidation.cpp
Examining data/libkolabxml-1.1.6/src/objectvalidation.h
Examining data/libkolabxml-1.1.6/src/shared_conversions.h
Examining data/libkolabxml-1.1.6/src/uriencode.cpp
Examining data/libkolabxml-1.1.6/src/uriencode.h
Examining data/libkolabxml-1.1.6/src/utils.cpp
Examining data/libkolabxml-1.1.6/src/utils.h
Examining data/libkolabxml-1.1.6/src/xcalconversions.h
Examining data/libkolabxml-1.1.6/src/xcardconversions.h
Examining data/libkolabxml-1.1.6/tests/bindingstest.cpp
Examining data/libkolabxml-1.1.6/tests/bindingstest.h
Examining data/libkolabxml-1.1.6/tests/conversiontest.cpp
Examining data/libkolabxml-1.1.6/tests/conversiontest.h
Examining data/libkolabxml-1.1.6/tests/kolabconversationtest.cpp
Examining data/libkolabxml-1.1.6/tests/kolabconversationtest.h
Examining data/libkolabxml-1.1.6/tests/parsingtest.cpp
Examining data/libkolabxml-1.1.6/tests/parsingtest.h
Examining data/libkolabxml-1.1.6/tests/serializers.h
Examining data/libkolabxml-1.1.6/tests/validationtest.cpp
Examining data/libkolabxml-1.1.6/tests/validationtest.h
Examining data/libkolabxml-1.1.6/tztable.h
Examining data/libkolabxml-1.1.6/utils/kolabformatchecker.cpp
FINAL RESULTS:
data/libkolabxml-1.1.6/compiled/XMLParserWrapper.cpp:234:13: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
ifs.open (url.c_str());
data/libkolabxml-1.1.6/compiled/xsdbin.cxx:252:16: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char v (buf[i++]);
data/libkolabxml-1.1.6/src/base64.cpp:45:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char char_array_3[3];
data/libkolabxml-1.1.6/src/base64.cpp:46:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char char_array_4[4];
data/libkolabxml-1.1.6/src/base64.cpp:89:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char char_array_4[4], char_array_3[3];
data/libkolabxml-1.1.6/src/xcalconversions.h:464:31: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
tzid.erase(0, strlen(TZ_PREFIX));
data/libkolabxml-1.1.6/tests/bindingstest.cpp:309:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
file.read (memblock, size);
data/libkolabxml-1.1.6/tests/bindingstest.cpp:538:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
file.read (memblock, size);
ANALYSIS SUMMARY:
Hits = 8
Lines analyzed = 13550 in approximately 0.42 seconds (32523 lines/second)
Physical Source Lines of Code (SLOC) = 10336
Hits@level = [0] 0 [1] 3 [2] 5 [3] 0 [4] 0 [5] 0
Hits@level+ = [0+] 8 [1+] 8 [2+] 5 [3+] 0 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 0.773994 [1+] 0.773994 [2+] 0.483746 [3+] 0 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.