Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/libpillowfight-0.3.0/include/pillowfight/pillowfight.h Examining data/libpillowfight-0.3.0/include/pillowfight/util.h Examining data/libpillowfight-0.3.0/src/pillowfight/_ace.c Examining data/libpillowfight-0.3.0/src/pillowfight/_blackfilter.c Examining data/libpillowfight-0.3.0/src/pillowfight/_blurfilter.c Examining data/libpillowfight-0.3.0/src/pillowfight/_border.c Examining data/libpillowfight-0.3.0/src/pillowfight/_canny.c Examining data/libpillowfight-0.3.0/src/pillowfight/_compare.c Examining data/libpillowfight-0.3.0/src/pillowfight/_gaussian.c Examining data/libpillowfight-0.3.0/src/pillowfight/_grayfilter.c Examining data/libpillowfight-0.3.0/src/pillowfight/_masks.c Examining data/libpillowfight-0.3.0/src/pillowfight/_noisefilter.c Examining data/libpillowfight-0.3.0/src/pillowfight/_pymod.c Examining data/libpillowfight-0.3.0/src/pillowfight/_pymod.h Examining data/libpillowfight-0.3.0/src/pillowfight/_scanborders.c Examining data/libpillowfight-0.3.0/src/pillowfight/_sobel.c Examining data/libpillowfight-0.3.0/src/pillowfight/_swt.c Examining data/libpillowfight-0.3.0/src/pillowfight/_version.c Examining data/libpillowfight-0.3.0/src/pillowfight/util.c FINAL RESULTS: data/libpillowfight-0.3.0/src/pillowfight/_ace.c:414:2: [3] (random) srand: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. srand(seed); data/libpillowfight-0.3.0/src/pillowfight/_ace.c:336:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(&adj_params[i]->rscore, &rscore, sizeof(rscore)); data/libpillowfight-0.3.0/src/pillowfight/_blackfilter.c:239:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(out->pixels, in->pixels, sizeof(union pf_pixel) * in->size.x * in->size.y); data/libpillowfight-0.3.0/src/pillowfight/_blurfilter.c:65:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(out->pixels, in->pixels, sizeof(union pf_pixel) * in->size.x * in->size.y); data/libpillowfight-0.3.0/src/pillowfight/_border.c:108:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(out->pixels, in->pixels, sizeof(union pf_pixel) * in->size.x * in->size.y); data/libpillowfight-0.3.0/src/pillowfight/_grayfilter.c:72:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(out->pixels, in->pixels, sizeof(union pf_pixel) * in->size.x * in->size.y); data/libpillowfight-0.3.0/src/pillowfight/_masks.c:149:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(out->pixels, in->pixels, sizeof(union pf_pixel) * in->size.x * in->size.y); data/libpillowfight-0.3.0/src/pillowfight/_noisefilter.c:145:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(out->pixels, in->pixels, sizeof(union pf_pixel) * in->size.x * in->size.y); data/libpillowfight-0.3.0/src/pillowfight/util.c:125:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(out.values, in->values, in->size.x * in->size.y * sizeof(out.values[0])); data/libpillowfight-0.3.0/src/pillowfight/util.c:296:7: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fp = fopen(filepath, "w"); data/libpillowfight-0.3.0/src/pillowfight/util.c:323:7: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fp = fopen(filepath, "w"); ANALYSIS SUMMARY: Hits = 11 Lines analyzed = 4943 in approximately 0.15 seconds (32914 lines/second) Physical Source Lines of Code (SLOC) = 3540 Hits@level = [0] 16 [1] 0 [2] 10 [3] 1 [4] 0 [5] 0 Hits@level+ = [0+] 27 [1+] 11 [2+] 11 [3+] 1 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 7.62712 [1+] 3.10734 [2+] 3.10734 [3+] 0.282486 [4+] 0 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.