Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/mdf2iso-0.3.1/src/mdf2iso.c

FINAL RESULTS:

data/mdf2iso-0.3.1/src/mdf2iso.c:29:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
const char SYNC_HEADER[12] = { (char) 0x00,
data/mdf2iso-0.3.1/src/mdf2iso.c:43:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
const char SYNC_HEADER_MDF_AUDIO[12] = { (char) 0x80,
data/mdf2iso-0.3.1/src/mdf2iso.c:57:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
const char SYNC_HEADER_MDF[12] = { (char) 0x80,
data/mdf2iso-0.3.1/src/mdf2iso.c:71:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
const char ISO_9660[8] = { (char) 0x01,
data/mdf2iso-0.3.1/src/mdf2iso.c:96:3:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
  strcpy (destfiletoc + strlen (destfilename) - 4, ".toc");
data/mdf2iso-0.3.1/src/mdf2iso.c:97:3:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
  strcpy (destfiledat + strlen (destfilename) - 4, ".dat");
data/mdf2iso-0.3.1/src/mdf2iso.c:99:15:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  if ((ftoc = fopen (destfiletoc, "w")) != NULL)
data/mdf2iso-0.3.1/src/mdf2iso.c:164:3:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
  strcpy (destfilecue + strlen (destfilename) - 4, ".cue");
data/mdf2iso-0.3.1/src/mdf2iso.c:165:3:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
  strcpy (destfilebin + strlen (destfilename) - 4, ".bin");
data/mdf2iso-0.3.1/src/mdf2iso.c:166:15:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  if ((fcue = fopen (destfilecue, "w"))!=NULL)
data/mdf2iso-0.3.1/src/mdf2iso.c:232:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[12];
data/mdf2iso-0.3.1/src/mdf2iso.c:268:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[2448];
data/mdf2iso-0.3.1/src/mdf2iso.c:332:7:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
      strcat(destfilename, ".iso");
data/mdf2iso-0.3.1/src/mdf2iso.c:335:7:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
      strcpy(destfilename + i - 3, "iso");
data/mdf2iso-0.3.1/src/mdf2iso.c:341:18:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  if ((fsource = fopen(basefilename, "rb")) == NULL)
data/mdf2iso-0.3.1/src/mdf2iso.c:428:16:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  if ((fdest = fopen (destfilename, "wb")) == NULL)
data/mdf2iso-0.3.1/src/mdf2iso.c:96:25:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  strcpy (destfiletoc + strlen (destfilename) - 4, ".toc");
data/mdf2iso-0.3.1/src/mdf2iso.c:97:25:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  strcpy (destfiledat + strlen (destfilename) - 4, ".dat");
data/mdf2iso-0.3.1/src/mdf2iso.c:164:25:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  strcpy (destfilecue + strlen (destfilename) - 4, ".cue");
data/mdf2iso-0.3.1/src/mdf2iso.c:165:25:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  strcpy (destfilebin + strlen (destfilename) - 4, ".bin");
data/mdf2iso-0.3.1/src/mdf2iso.c:328:7:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    i=strlen(destfilename);  // Reusing 'i' here as temporary variable

ANALYSIS SUMMARY:

Hits = 21
Lines analyzed = 497 in approximately 0.02 seconds (19955 lines/second)
Physical Source Lines of Code (SLOC) = 345
Hits@level = [0]  42 [1]   5 [2]  16 [3]   0 [4]   0 [5]   0
Hits@level+ = [0+]  63 [1+]  21 [2+]  16 [3+]   0 [4+]   0 [5+]   0
Hits/KSLOC@level+ = [0+] 182.609 [1+] 60.8696 [2+] 46.3768 [3+]   0 [4+]   0 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.