Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/liblxqt-0.14.1/configdialog/lxqtconfigdialog.cpp
Examining data/liblxqt-0.14.1/configdialog/lxqtconfigdialog.h
Examining data/liblxqt-0.14.1/configdialog/lxqtconfigdialog_p.h
Examining data/liblxqt-0.14.1/configdialog/lxqtconfigdialogcmdlineoptions.cpp
Examining data/liblxqt-0.14.1/configdialog/lxqtconfigdialogcmdlineoptions.h
Examining data/liblxqt-0.14.1/configdialog/lxqtpageselectwidget.cpp
Examining data/liblxqt-0.14.1/configdialog/lxqtpageselectwidget.h
Examining data/liblxqt-0.14.1/lxqtapplication.cpp
Examining data/liblxqt-0.14.1/lxqtapplication.h
Examining data/liblxqt-0.14.1/lxqtautostartentry.cpp
Examining data/liblxqt-0.14.1/lxqtautostartentry.h
Examining data/liblxqt-0.14.1/lxqtbacklight.h
Examining data/liblxqt-0.14.1/lxqtbacklight/linux_backend/driver/libbacklight_backend.c
Examining data/liblxqt-0.14.1/lxqtbacklight/linux_backend/driver/libbacklight_backend.h
Examining data/liblxqt-0.14.1/lxqtbacklight/linux_backend/driver/lxqtbacklight_backend.c
Examining data/liblxqt-0.14.1/lxqtbacklight/linux_backend/linuxbackend.cpp
Examining data/liblxqt-0.14.1/lxqtbacklight/linux_backend/linuxbackend.h
Examining data/liblxqt-0.14.1/lxqtbacklight/virtual_backend.cpp
Examining data/liblxqt-0.14.1/lxqtbacklight/virtual_backend.h
Examining data/liblxqt-0.14.1/lxqtglobals.h
Examining data/liblxqt-0.14.1/lxqtgridlayout.cpp
Examining data/liblxqt-0.14.1/lxqtgridlayout.h
Examining data/liblxqt-0.14.1/lxqthtmldelegate.cpp
Examining data/liblxqt-0.14.1/lxqthtmldelegate.h
Examining data/liblxqt-0.14.1/lxqtnotification.cpp
Examining data/liblxqt-0.14.1/lxqtnotification.h
Examining data/liblxqt-0.14.1/lxqtnotification_p.h
Examining data/liblxqt-0.14.1/lxqtplugininfo.cpp
Examining data/liblxqt-0.14.1/lxqtplugininfo.h
Examining data/liblxqt-0.14.1/lxqtpower/lxqtpower.cpp
Examining data/liblxqt-0.14.1/lxqtpower/lxqtpower.h
Examining data/liblxqt-0.14.1/lxqtpower/lxqtpowerproviders.cpp
Examining data/liblxqt-0.14.1/lxqtpower/lxqtpowerproviders.h
Examining data/liblxqt-0.14.1/lxqtpowermanager.cpp
Examining data/liblxqt-0.14.1/lxqtpowermanager.h
Examining data/liblxqt-0.14.1/lxqtprogramfinder.cpp
Examining data/liblxqt-0.14.1/lxqtprogramfinder.h
Examining data/liblxqt-0.14.1/lxqtrotatedwidget.cpp
Examining data/liblxqt-0.14.1/lxqtrotatedwidget.h
Examining data/liblxqt-0.14.1/lxqtscreensaver.cpp
Examining data/liblxqt-0.14.1/lxqtscreensaver.h
Examining data/liblxqt-0.14.1/lxqtsettings.cpp
Examining data/liblxqt-0.14.1/lxqtsettings.h
Examining data/liblxqt-0.14.1/lxqtsingleapplication.h
Examining data/liblxqt-0.14.1/lxqttranslator.cpp
Examining data/liblxqt-0.14.1/lxqttranslator.h
Examining data/liblxqt-0.14.1/lxqtsingleapplication.cpp
Examining data/liblxqt-0.14.1/lxqtbacklight.cpp
FINAL RESULTS:
data/liblxqt-0.14.1/lxqtbacklight/linux_backend/driver/libbacklight_backend.c:102:20: [4] (shell) popen:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
FILE *stream = popen("pkexec lxqt-backlight_backend --stdin", "w");
data/liblxqt-0.14.1/lxqtplugininfo.cpp:89:37: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
const QString locale = QLocale::system().name();
data/liblxqt-0.14.1/lxqttranslator.cpp:88:37: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
const QString locale = QLocale::system().name();
data/liblxqt-0.14.1/lxqttranslator.cpp:135:37: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
const QString locale = QLocale::system().name();
data/liblxqt-0.14.1/lxqtapplication.cpp:92:15: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *f = fopen(dir.absoluteFilePath(QL1S("debug.log")).toUtf8().constData(), "a+");
data/liblxqt-0.14.1/lxqtbacklight/linux_backend/driver/libbacklight_backend.c:134:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char path[PATH_MAX];
data/liblxqt-0.14.1/lxqtbacklight/linux_backend/driver/libbacklight_backend.c:144:17: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *ret = fopen(path, mode);
data/liblxqt-0.14.1/lxqtbacklight/linux_backend/driver/libbacklight_backend.c:175:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *drivers[N_BACKLIGHT];
data/liblxqt-0.14.1/lxqtbacklight/linux_backend/driver/libbacklight_backend.c:178:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char type[1024];
data/liblxqt-0.14.1/lxqtbacklight/linux_backend/driver/lxqtbacklight_backend.c:198:21: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
value = atoi(argv[n]);
data/liblxqt-0.14.1/lxqtsettings.cpp:539:13: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (! f.open(QIODevice::ReadOnly | QIODevice::Text))
data/liblxqt-0.14.1/lxqtapplication.cpp:163:27: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
int ret = read(mSignalSock[1], &signo, sizeof (int));
data/liblxqt-0.14.1/lxqtbacklight/linux_backend/driver/libbacklight_backend.c:198:22: [1] (buffer) fscanf:
It's unclear if the %s limit in the format string is small enough
(CWE-120). Check that the limit is sufficiently small, or use a different
input function.
int ok = fscanf(in, "%1023s", type);
ANALYSIS SUMMARY:
Hits = 13
Lines analyzed = 7891 in approximately 0.22 seconds (36414 lines/second)
Physical Source Lines of Code (SLOC) = 4426
Hits@level = [0] 14 [1] 2 [2] 7 [3] 0 [4] 4 [5] 0
Hits@level+ = [0+] 27 [1+] 13 [2+] 11 [3+] 4 [4+] 4 [5+] 0
Hits/KSLOC@level+ = [0+] 6.10032 [1+] 2.93719 [2+] 2.48531 [3+] 0.903751 [4+] 0.903751 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.