Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/libqxp-0.0.2/inc/libqxp/QXPPathResolver.h Examining data/libqxp-0.0.2/inc/libqxp/QXPDocument.h Examining data/libqxp-0.0.2/inc/libqxp/libqxp_api.h Examining data/libqxp-0.0.2/inc/libqxp/libqxp.h Examining data/libqxp-0.0.2/src/lib/QXPDocument.cpp Examining data/libqxp-0.0.2/src/lib/QXP1Header.cpp Examining data/libqxp-0.0.2/src/lib/QXPCollector.h Examining data/libqxp-0.0.2/src/lib/QXP3HeaderBase.cpp Examining data/libqxp-0.0.2/src/lib/QXPMemoryStream.cpp Examining data/libqxp-0.0.2/src/lib/QXP4Parser.h Examining data/libqxp-0.0.2/src/lib/QXP33Header.cpp Examining data/libqxp-0.0.2/src/lib/libqxp_utils.cpp Examining data/libqxp-0.0.2/src/lib/QXPContentCollector.h Examining data/libqxp-0.0.2/src/lib/QXPDeobfuscator.h Examining data/libqxp-0.0.2/src/lib/QXP33Parser.h Examining data/libqxp-0.0.2/src/lib/QXPHeader.cpp Examining data/libqxp-0.0.2/src/lib/QXP3HeaderBase.h Examining data/libqxp-0.0.2/src/lib/QXP1Header.h Examining data/libqxp-0.0.2/src/lib/QXPTypes.h Examining data/libqxp-0.0.2/src/lib/QXPTextParser.cpp Examining data/libqxp-0.0.2/src/lib/QXPBlockParser.cpp Examining data/libqxp-0.0.2/src/lib/QXP33Deobfuscator.cpp Examining data/libqxp-0.0.2/src/lib/QXP1Parser.cpp Examining data/libqxp-0.0.2/src/lib/QXPParser.h Examining data/libqxp-0.0.2/src/lib/QXP4Deobfuscator.cpp Examining data/libqxp-0.0.2/src/lib/QXPTextParser.h Examining data/libqxp-0.0.2/src/lib/QXP4Header.cpp Examining data/libqxp-0.0.2/src/lib/QXP33Deobfuscator.h Examining data/libqxp-0.0.2/src/lib/QXP4Deobfuscator.h Examining data/libqxp-0.0.2/src/lib/QXP1Parser.h Examining data/libqxp-0.0.2/src/lib/QXPDeobfuscator.cpp Examining data/libqxp-0.0.2/src/lib/QXPBlockParser.h Examining data/libqxp-0.0.2/src/lib/QXPMacFileParser.h Examining data/libqxp-0.0.2/src/lib/libqxp_utils.h Examining data/libqxp-0.0.2/src/lib/QXPMacFileParser.cpp Examining data/libqxp-0.0.2/src/lib/QXP4Parser.cpp Examining data/libqxp-0.0.2/src/lib/QXPContentCollector.cpp Examining data/libqxp-0.0.2/src/lib/QXP33Parser.cpp Examining data/libqxp-0.0.2/src/lib/QXPMemoryStream.h Examining data/libqxp-0.0.2/src/lib/QXPParser.cpp Examining data/libqxp-0.0.2/src/lib/QXPHeader.h Examining data/libqxp-0.0.2/src/lib/QXP33Header.h Examining data/libqxp-0.0.2/src/lib/QXP4Header.h Examining data/libqxp-0.0.2/src/lib/QXPTypes.cpp Examining data/libqxp-0.0.2/src/lib/QXPDetector.h Examining data/libqxp-0.0.2/src/lib/QXPDetector.cpp Examining data/libqxp-0.0.2/src/test/test.cpp Examining data/libqxp-0.0.2/src/test/UtilsTest.cpp Examining data/libqxp-0.0.2/src/test/QXPDocumentTest.cpp Examining data/libqxp-0.0.2/src/test/QXPBlockParserTest.cpp Examining data/libqxp-0.0.2/src/test/QXPTypesTest.cpp Examining data/libqxp-0.0.2/src/test/QXPDeobfuscatorTest.cpp Examining data/libqxp-0.0.2/src/test/QXPTextParserTest.cpp Examining data/libqxp-0.0.2/src/fuzz/qxpfuzzer.cpp Examining data/libqxp-0.0.2/src/conv/text/qxp2text.cpp Examining data/libqxp-0.0.2/src/conv/svg/qxp2svg.cpp Examining data/libqxp-0.0.2/src/conv/raw/qxp2raw.cpp FINAL RESULTS: data/libqxp-0.0.2/src/lib/QXPContentCollector.cpp:37:10: [4] (format) sprintf: Potential format string problem (CWE-134). Make format string constant. border.sprintf("%fpt", width); data/libqxp-0.0.2/src/lib/QXPContentCollector.cpp:224:12: [4] (format) sprintf: Potential format string problem (CWE-134). Make format string constant. propName.sprintf("draw:marker-%s-viewbox", name); data/libqxp-0.0.2/src/lib/QXPContentCollector.cpp:226:12: [4] (format) sprintf: Potential format string problem (CWE-134). Make format string constant. propName.sprintf("draw:marker-%s-path", name); data/libqxp-0.0.2/src/lib/QXPContentCollector.cpp:228:12: [4] (format) sprintf: Potential format string problem (CWE-134). Make format string constant. propName.sprintf("draw:marker-%s-width", name); data/libqxp-0.0.2/src/lib/QXPContentCollector.cpp:284:7: [4] (format) sprintf: Potential format string problem (CWE-134). Make format string constant. pos.sprintf("%f%% %f%%", 100 * offset, 100 * scale); data/libqxp-0.0.2/src/lib/QXPTypes.cpp:101:12: [4] (format) sprintf: Potential format string problem (CWE-134). Make format string constant. colorStr.sprintf("#%.2x%.2x%.2x", red, green, blue); data/libqxp-0.0.2/src/lib/libqxp_utils.cpp:94:8: [4] (format) vfprintf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. std::vfprintf(stderr, format, args); data/libqxp-0.0.2/src/lib/libqxp_utils.h:30:62: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. #define QXP_ATTRIBUTE_PRINTF(fmt, arg) __attribute__((format(printf, fmt, arg))) data/libqxp-0.0.2/src/lib/QXPMacFileParser.cpp:620:10: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static char const binChar[65] = "!\"#$%&'()*+,-012345689@ABCDEFGHIJKLMNPQRSTUVXYZ[`abcdefhijklmpqr"; data/libqxp-0.0.2/src/lib/libqxp_utils.cpp:73:12: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char outbuf[6] = { 0, 0, 0, 0, 0, 0 }; data/libqxp-0.0.2/src/lib/QXPBlockParser.cpp:62:27: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). auto block = m_input->read(m_blockLength, bytes); data/libqxp-0.0.2/src/lib/QXPBlockParser.cpp:102:29: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). auto block = m_input->read(len, bytes); data/libqxp-0.0.2/src/lib/QXPDocument.cpp:25:12: [1] (buffer) equal: Function does not check the second iterator for over-read conditions (CWE-126). This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it. using std::equal; data/libqxp-0.0.2/src/lib/QXPMacFileParser.cpp:134:18: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). const uint8_t *read(size_t numBytes, unsigned long &numBytesRead); data/libqxp-0.0.2/src/lib/QXPMacFileParser.cpp:319:33: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). const uint8_t *MWAWInputStream::read(size_t numBytes, unsigned long &numBytesRead) data/libqxp-0.0.2/src/lib/QXPMacFileParser.cpp:323:20: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). return m_stream->read(numBytes, numBytesRead); data/libqxp-0.0.2/src/lib/QXPMacFileParser.cpp:392:32: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). uint8_t const *p = stream->read(static_cast<unsigned long>(num), numBytesRead); data/libqxp-0.0.2/src/lib/QXPMacFileParser.cpp:439:30: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). uint8_t const *p = stream->read(sizeof(uint8_t), numBytesRead); data/libqxp-0.0.2/src/lib/QXPMacFileParser.cpp:600:50: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). char const *str=reinterpret_cast<char const *>(read(45, nRead)); data/libqxp-0.0.2/src/lib/QXPMacFileParser.cpp:767:21: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). contentInput->read(static_cast<unsigned long>(rsrcLength), numBytesRead); data/libqxp-0.0.2/src/lib/QXPMacFileParser.cpp:785:21: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). contentInput->read(static_cast<unsigned long>(dataLength), numBytesRead); data/libqxp-0.0.2/src/lib/QXPMacFileParser.cpp:833:56: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). const unsigned char *data = newInfo ? newInfo->read(8, numBytesRead) : 0; data/libqxp-0.0.2/src/lib/QXPMacFileParser.cpp:1051:40: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). const unsigned char *data = inp->read(entrySize, numBytesRead); data/libqxp-0.0.2/src/lib/QXPMacFileParser.cpp:1213:27: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). if ((readData=m_stream->read(static_cast<unsigned long>(sz), sizeRead)) == 0 || long(sizeRead)!=sz) data/libqxp-0.0.2/src/lib/QXPMemoryStream.cpp:63:39: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). const unsigned char *QXPMemoryStream::read(unsigned long numBytes, unsigned long &numBytesRead) try data/libqxp-0.0.2/src/lib/QXPMemoryStream.h:37:24: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). const unsigned char *read(unsigned long numBytes, unsigned long &numBytesRead) override; data/libqxp-0.0.2/src/lib/libqxp_utils.cpp:104:29: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). uint8_t const *p = input->read(sizeof(uint8_t), numBytesRead); data/libqxp-0.0.2/src/lib/libqxp_utils.cpp:116:29: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). uint8_t const *p = input->read(sizeof(uint16_t), numBytesRead); data/libqxp-0.0.2/src/lib/libqxp_utils.cpp:132:29: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). uint8_t const *p = input->read(sizeof(uint32_t), numBytesRead); data/libqxp-0.0.2/src/lib/libqxp_utils.cpp:148:29: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). uint8_t const *p = input->read(sizeof(uint64_t), numBytesRead); data/libqxp-0.0.2/src/lib/libqxp_utils.cpp:185:41: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). const unsigned char *const s = input->read(numBytes, readBytes); ANALYSIS SUMMARY: Hits = 31 Lines analyzed = 10127 in approximately 0.29 seconds (34585 lines/second) Physical Source Lines of Code (SLOC) = 7712 Hits@level = [0] 31 [1] 21 [2] 2 [3] 0 [4] 8 [5] 0 Hits@level+ = [0+] 62 [1+] 31 [2+] 10 [3+] 8 [4+] 8 [5+] 0 Hits/KSLOC@level+ = [0+] 8.03942 [1+] 4.01971 [2+] 1.29668 [3+] 1.03734 [4+] 1.03734 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.