Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/libmspub-0.1.4/src/fuzz/pubfuzzer.cpp Examining data/libmspub-0.1.4/src/lib/MSPUBCollector.cpp Examining data/libmspub-0.1.4/src/lib/MSPUBParser97.cpp Examining data/libmspub-0.1.4/src/lib/MSPUBDocument.cpp Examining data/libmspub-0.1.4/src/lib/NumberingType.h Examining data/libmspub-0.1.4/src/lib/ShapeFlags.h Examining data/libmspub-0.1.4/src/lib/libmspub_utils.h Examining data/libmspub-0.1.4/src/lib/ShapeGroupElement.h Examining data/libmspub-0.1.4/src/lib/Line.h Examining data/libmspub-0.1.4/src/lib/Shapes.h Examining data/libmspub-0.1.4/src/lib/ShapeGroupElement.cpp Examining data/libmspub-0.1.4/src/lib/MSPUBConstants.h Examining data/libmspub-0.1.4/src/lib/ShapeInfo.h Examining data/libmspub-0.1.4/src/lib/EmbeddedFontInfo.h Examining data/libmspub-0.1.4/src/lib/VerticalAlign.h Examining data/libmspub-0.1.4/src/lib/VectorTransformation2D.h Examining data/libmspub-0.1.4/src/lib/Shadow.cpp Examining data/libmspub-0.1.4/src/lib/EscherContainerType.h Examining data/libmspub-0.1.4/src/lib/MSPUBBlockID.h Examining data/libmspub-0.1.4/src/lib/Dash.cpp Examining data/libmspub-0.1.4/src/lib/ListInfo.h Examining data/libmspub-0.1.4/src/lib/TableInfo.h Examining data/libmspub-0.1.4/src/lib/ColorReference.cpp Examining data/libmspub-0.1.4/src/lib/PolygonUtils.cpp Examining data/libmspub-0.1.4/src/lib/MSPUBParser97.h Examining data/libmspub-0.1.4/src/lib/libmspub_utils.cpp Examining data/libmspub-0.1.4/src/lib/Margins.h Examining data/libmspub-0.1.4/src/lib/MSPUBContentChunkType.h Examining data/libmspub-0.1.4/src/lib/ShapeType.h Examining data/libmspub-0.1.4/src/lib/PolygonUtils.h Examining data/libmspub-0.1.4/src/lib/Fill.h Examining data/libmspub-0.1.4/src/lib/Fill.cpp Examining data/libmspub-0.1.4/src/lib/NumberingDelimiter.h Examining data/libmspub-0.1.4/src/lib/VectorTransformation2D.cpp Examining data/libmspub-0.1.4/src/lib/MSPUBParser.h Examining data/libmspub-0.1.4/src/lib/MSPUBMetaData.cpp Examining data/libmspub-0.1.4/src/lib/MSPUBParser2k.h Examining data/libmspub-0.1.4/src/lib/Shadow.h Examining data/libmspub-0.1.4/src/lib/Coordinate.h Examining data/libmspub-0.1.4/src/lib/EscherFieldIds.h Examining data/libmspub-0.1.4/src/lib/MSPUBParser2k.cpp Examining data/libmspub-0.1.4/src/lib/MSPUBTypes.h Examining data/libmspub-0.1.4/src/lib/MSPUBBlockType.h Examining data/libmspub-0.1.4/src/lib/MSPUBParser.cpp Examining data/libmspub-0.1.4/src/lib/Dash.h Examining data/libmspub-0.1.4/src/lib/ColorReference.h Examining data/libmspub-0.1.4/src/lib/Arrow.h Examining data/libmspub-0.1.4/src/lib/MSPUBCollector.h Examining data/libmspub-0.1.4/src/lib/BorderArtInfo.h Examining data/libmspub-0.1.4/src/lib/FillType.h Examining data/libmspub-0.1.4/src/lib/MSPUBMetaData.h Examining data/libmspub-0.1.4/src/conv/raw/pub2raw.cpp Examining data/libmspub-0.1.4/src/conv/svg/pub2xhtml.cpp Examining data/libmspub-0.1.4/inc/libmspub/MSPUBDocument.h Examining data/libmspub-0.1.4/inc/libmspub/libmspub.h FINAL RESULTS: data/libmspub-0.1.4/src/lib/Fill.cpp:45:14: [4] (format) sprintf: Potential format string problem (CWE-134). Make format string constant. sValue.sprintf("%d", m_rotation); data/libmspub-0.1.4/src/lib/Fill.cpp:97:7: [4] (format) sprintf: Potential format string problem (CWE-134). Make format string constant. val.sprintf("%d%%", (int)(m_opacity * 100)); data/libmspub-0.1.4/src/lib/Fill.cpp:167:12: [4] (format) sprintf: Potential format string problem (CWE-134). Make format string constant. sValue.sprintf("%d%%", stop.m_offsetPercent); data/libmspub-0.1.4/src/lib/Fill.cpp:170:12: [4] (format) sprintf: Potential format string problem (CWE-134). Make format string constant. sValue.sprintf("%d%%", (int)(stop.m_opacity * 100)); data/libmspub-0.1.4/src/lib/MSPUBCollector.cpp:1069:16: [4] (format) sprintf: Potential format string problem (CWE-134). Make format string constant. dots.sprintf("draw:dots%d", i + 1); data/libmspub-0.1.4/src/lib/MSPUBCollector.cpp:1074:20: [4] (format) sprintf: Potential format string problem (CWE-134). Make format string constant. length.sprintf("draw:dots%d-length", i + 1); data/libmspub-0.1.4/src/lib/MSPUBCollector.cpp:1723:7: [4] (format) sprintf: Potential format string problem (CWE-134). Make format string constant. ret.sprintf("#%.2x%.2x%.2x",(unsigned char)color.r, (unsigned char)color.g, (unsigned char)color.b); data/libmspub-0.1.4/src/lib/PolygonUtils.cpp:5893:10: [4] (format) sprintf: Potential format string problem (CWE-134). Make format string constant. sValue.sprintf("M %f %f", (double)vector.m_x, (double)vector.m_y); data/libmspub-0.1.4/src/lib/PolygonUtils.cpp:5900:13: [4] (format) sprintf: Potential format string problem (CWE-134). Make format string constant. sValue2.sprintf(" L %f %f", (double)vector2.m_x, (double)vector2.m_y); data/libmspub-0.1.4/src/lib/libmspub_utils.cpp:32:8: [4] (format) vfprintf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. std::vfprintf(stderr, format, args); data/libmspub-0.1.4/src/conv/svg/pub2xhtml.cpp:82:7: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). o.open(out_file); data/libmspub-0.1.4/src/lib/MSPUBCollector.cpp:332:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char locale[ULOC_FULLNAME_CAPACITY]; data/libmspub-0.1.4/src/lib/MSPUBCollector.cpp:337:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char component[ULOC_FULLNAME_CAPACITY]; data/libmspub-0.1.4/src/lib/MSPUBMetaData.cpp:116:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char FMTID0[37]; data/libmspub-0.1.4/src/lib/MSPUBMetaData.cpp:117:3: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(FMTID0, "%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x", data1, data2, data3, data/libmspub-0.1.4/src/lib/MSPUBMetaData.cpp:316:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buffer[MAX_BUFFER]; data/libmspub-0.1.4/src/lib/MSPUBParser.cpp:937:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char name[5]; data/libmspub-0.1.4/src/lib/MSPUBParser.cpp:946:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char name2[5]; data/libmspub-0.1.4/src/lib/libmspub_utils.cpp:170:12: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char out[ZLIB_CHUNK]; data/libmspub-0.1.4/src/lib/libmspub_utils.cpp:249:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char outbuf[7] = { 0 }; data/libmspub-0.1.4/src/lib/libmspub_utils.cpp:345:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(out.data(), tmpBuffer, numBytesRead); data/libmspub-0.1.4/src/lib/MSPUBParser.cpp:307:43: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). const unsigned char *buf = input->read(toRead, howManyRead); data/libmspub-0.1.4/src/lib/MSPUBParser.cpp:571:49: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). const unsigned char *buf = input->read(toRead, howManyRead); data/libmspub-0.1.4/src/lib/MSPUBParser.cpp:619:55: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). const unsigned char *buf = input->read(toRead, howManyRead); data/libmspub-0.1.4/src/lib/MSPUBParser2k.cpp:460:41: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). const unsigned char *buf = input->read(toRead, howManyRead); data/libmspub-0.1.4/src/lib/libmspub_utils.cpp:278:29: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). uint8_t const *p = input->read(sizeof(uint8_t), numBytesRead); data/libmspub-0.1.4/src/lib/libmspub_utils.cpp:338:43: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). const unsigned char *tmpBuffer = input->read(length, numBytesRead); ANALYSIS SUMMARY: Hits = 27 Lines analyzed = 16634 in approximately 0.46 seconds (36391 lines/second) Physical Source Lines of Code (SLOC) = 14156 Hits@level = [0] 22 [1] 6 [2] 11 [3] 0 [4] 10 [5] 0 Hits@level+ = [0+] 49 [1+] 27 [2+] 21 [3+] 10 [4+] 10 [5+] 0 Hits/KSLOC@level+ = [0+] 3.46143 [1+] 1.90732 [2+] 1.48347 [3+] 0.706414 [4+] 0.706414 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.