Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/libsmf-1.3/src/smf_decode.c Examining data/libsmf-1.3/src/smf.h Examining data/libsmf-1.3/src/smf_private.h Examining data/libsmf-1.3/src/smf_load.c Examining data/libsmf-1.3/src/smf_tempo.c Examining data/libsmf-1.3/src/smf_save.c Examining data/libsmf-1.3/src/smf.c Examining data/libsmf-1.3/src/smfsh.c FINAL RESULTS: data/libsmf-1.3/src/smf_decode.c:502:2: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(buf, "%s%d", names[note], octave); data/libsmf-1.3/src/smfsh.c:1001:15: [3] (buffer) getopt: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. while ((ch = getopt(argc, argv, "V")) != -1) { data/libsmf-1.3/src/smf.c:260:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(event->midi_buffer, midi_data, len); data/libsmf-1.3/src/smf_decode.c:517:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char *buf, note[5]; data/libsmf-1.3/src/smf_load.c:421:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(event->midi_buffer + 1, c, message_length - 1); data/libsmf-1.3/src/smf_load.c:459:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(event->midi_buffer, c, message_length); data/libsmf-1.3/src/smf_load.c:529:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(event->midi_buffer + 1, c, message_length - 1); data/libsmf-1.3/src/smf_load.c:615:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(str, buf, len); data/libsmf-1.3/src/smf_load.c:806:17: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). FILE *stream = fopen(file_name, "rb"); data/libsmf-1.3/src/smf_private.h:54:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char id[4]; data/libsmf-1.3/src/smf_save.c:98:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(dest, buffer, buffer_length); data/libsmf-1.3/src/smf_save.c:111:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(mthd_chunk.mthd_header.id, "MThd", 4); data/libsmf-1.3/src/smf_save.c:158:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(dest, buffer, buffer_length); data/libsmf-1.3/src/smf_save.c:235:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char buf[MAX_VLQ_LENGTH]; data/libsmf-1.3/src/smf_save.c:346:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(mtrk_header.id, "MTrk", 4); data/libsmf-1.3/src/smf_save.c:402:11: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). stream = fopen(file_name, "wb+"); data/libsmf-1.3/src/smfsh.c:474:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[3]; data/libsmf-1.3/src/smfsh.c:798:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char padding[COMMAND_LENGTH + 1]; data/libsmf-1.3/src/smf_save.c:200:16: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). text_length = strlen(text); data/libsmf-1.3/src/smfsh.c:168:25: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (end - new_ppqn != strlen(new_ppqn)) { data/libsmf-1.3/src/smfsh.c:199:27: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (end - new_format != strlen(new_format)) { data/libsmf-1.3/src/smfsh.c:247:19: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (end - arg != strlen(arg)) { data/libsmf-1.3/src/smfsh.c:423:19: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (end - arg != strlen(arg)) { data/libsmf-1.3/src/smfsh.c:478:7: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if ((strlen(str) % 2) != 0) { data/libsmf-1.3/src/smfsh.c:483:23: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). midi_buffer_length = strlen(str) / 2; data/libsmf-1.3/src/smfsh.c:550:24: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (endtime - time != strlen(time)) { data/libsmf-1.3/src/smfsh.c:614:20: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (end - time != strlen(time)) { data/libsmf-1.3/src/smfsh.c:634:23: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (end - typestr != strlen(typestr)) { data/libsmf-1.3/src/smfsh.c:683:20: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (end - time != strlen(time)) { data/libsmf-1.3/src/smfsh.c:808:37: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). padding_length = COMMAND_LENGTH - strlen(tmp->name); data/libsmf-1.3/src/smfsh.c:851:8: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). len = strlen(dest); data/libsmf-1.3/src/smfsh.c:884:8: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). len = strlen(buf); data/libsmf-1.3/src/smfsh.c:935:7: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(command) > 0) { data/libsmf-1.3/src/smfsh.c:963:26: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strncmp(tmp, text, strlen(text)) == 0) ANALYSIS SUMMARY: Hits = 34 Lines analyzed = 5331 in approximately 0.15 seconds (36513 lines/second) Physical Source Lines of Code (SLOC) = 3262 Hits@level = [0] 72 [1] 16 [2] 16 [3] 1 [4] 1 [5] 0 Hits@level+ = [0+] 106 [1+] 34 [2+] 18 [3+] 2 [4+] 1 [5+] 0 Hits/KSLOC@level+ = [0+] 32.4954 [1+] 10.4231 [2+] 5.51809 [3+] 0.613121 [4+] 0.30656 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.