Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/libvirt-dbus-1.4.0/src/connect.h Examining data/libvirt-dbus-1.4.0/src/domain.h Examining data/libvirt-dbus-1.4.0/src/domainsnapshot.h Examining data/libvirt-dbus-1.4.0/src/events.c Examining data/libvirt-dbus-1.4.0/src/events.h Examining data/libvirt-dbus-1.4.0/src/gdbus.c Examining data/libvirt-dbus-1.4.0/src/gdbus.h Examining data/libvirt-dbus-1.4.0/src/interface.c Examining data/libvirt-dbus-1.4.0/src/interface.h Examining data/libvirt-dbus-1.4.0/src/main.c Examining data/libvirt-dbus-1.4.0/src/network.c Examining data/libvirt-dbus-1.4.0/src/network.h Examining data/libvirt-dbus-1.4.0/src/nodedev.c Examining data/libvirt-dbus-1.4.0/src/nodedev.h Examining data/libvirt-dbus-1.4.0/src/nwfilter.c Examining data/libvirt-dbus-1.4.0/src/nwfilter.h Examining data/libvirt-dbus-1.4.0/src/secret.c Examining data/libvirt-dbus-1.4.0/src/secret.h Examining data/libvirt-dbus-1.4.0/src/storagepool.c Examining data/libvirt-dbus-1.4.0/src/storagepool.h Examining data/libvirt-dbus-1.4.0/src/storagevol.c Examining data/libvirt-dbus-1.4.0/src/storagevol.h Examining data/libvirt-dbus-1.4.0/src/util.c Examining data/libvirt-dbus-1.4.0/src/util.h Examining data/libvirt-dbus-1.4.0/src/domainsnapshot.c Examining data/libvirt-dbus-1.4.0/src/connect.c Examining data/libvirt-dbus-1.4.0/src/domain.c Examining data/libvirt-dbus-1.4.0/tests/test_util.c FINAL RESULTS: data/libvirt-dbus-1.4.0/src/util.c:207:16: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). gint len = strlen(str); data/libvirt-dbus-1.4.0/src/util.c:232:16: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). gint len = strlen(str); data/libvirt-dbus-1.4.0/src/util.c:269:23: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). gsize prefixLen = strlen(domainPath) + 1; data/libvirt-dbus-1.4.0/src/util.c:293:23: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). gsize prefixLen = strlen(domainSnapshotPath) + 1; data/libvirt-dbus-1.4.0/src/util.c:341:23: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). gsize prefixLen = strlen(interfacePath) + 1; data/libvirt-dbus-1.4.0/src/util.c:376:23: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). gsize prefixLen = strlen(networkPath) + 1; data/libvirt-dbus-1.4.0/src/util.c:409:23: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). gsize prefixLen = strlen(nodeDevPath) + 1; data/libvirt-dbus-1.4.0/src/util.c:444:23: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). gsize prefixLen = strlen(nwfilterPath) + 1; data/libvirt-dbus-1.4.0/src/util.c:485:23: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). gsize prefixLen = strlen(secretPath) + 1; data/libvirt-dbus-1.4.0/src/util.c:518:23: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). gsize prefixLen = strlen(storagePoolPath) + 1; data/libvirt-dbus-1.4.0/src/util.c:551:23: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). gsize prefixLen = strlen(storageVolPath) + 1; ANALYSIS SUMMARY: Hits = 11 Lines analyzed = 10564 in approximately 0.22 seconds (48556 lines/second) Physical Source Lines of Code (SLOC) = 8558 Hits@level = [0] 0 [1] 11 [2] 0 [3] 0 [4] 0 [5] 0 Hits@level+ = [0+] 11 [1+] 11 [2+] 0 [3+] 0 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 1.28535 [1+] 1.28535 [2+] 0 [3+] 0 [4+] 0 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.