Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c
Examining data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.h
Examining data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.c
Examining data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.h
Examining data/mmc-utils-0+git20180327.b4fe0c8c/mmc.c
Examining data/mmc-utils-0+git20180327.b4fe0c8c/mmc.h
Examining data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c
Examining data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.h
Examining data/mmc-utils-0+git20180327.b4fe0c8c/lsmmc.c

FINAL RESULTS:

data/mmc-utils-0+git20180327.b4fe0c8c/lsmmc.c:377:4:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
			strcat(binstr, bindigits[*hexstr - '0']);
data/mmc-utils-0+git20180327.b4fe0c8c/lsmmc.c:379:4:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
			strcat(binstr, bindigits[*hexstr - 'a']);
data/mmc-utils-0+git20180327.b4fe0c8c/lsmmc.c:381:4:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
			strcat(binstr, bindigits[*hexstr - 'A']);
data/mmc-utils-0+git20180327.b4fe0c8c/lsmmc.c:416:3:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
		strcat(a, s);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc.c:355:2:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
	strcpy(newname, prgname);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc.c:357:2:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
	strcat(newname, cmd->verb);
data/mmc-utils-0+git20180327.b4fe0c8c/lsmmc.c:238:14:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt(argc, argv, "hv")) != -1) {
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:51:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char key_temp[SHA224_DIGEST_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:85:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&ctx->ctx_inside_reinit, &ctx->ctx_inside,
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:87:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&ctx->ctx_outside_reinit, &ctx->ctx_outside,
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:93:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&ctx->ctx_inside, &ctx->ctx_inside_reinit,
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:95:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&ctx->ctx_outside, &ctx->ctx_outside_reinit,
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:108:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char digest_inside[SHA224_DIGEST_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:109:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char mac_temp[SHA224_DIGEST_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:114:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(mac, mac_temp, mac_size);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:137:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char key_temp[SHA256_DIGEST_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:171:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&ctx->ctx_inside_reinit, &ctx->ctx_inside,
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:173:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&ctx->ctx_outside_reinit, &ctx->ctx_outside,
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:179:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&ctx->ctx_inside, &ctx->ctx_inside_reinit,
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:181:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&ctx->ctx_outside, &ctx->ctx_outside_reinit,
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:194:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char digest_inside[SHA256_DIGEST_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:195:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char mac_temp[SHA256_DIGEST_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:200:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(mac, mac_temp, mac_size);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:223:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char key_temp[SHA384_DIGEST_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:257:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&ctx->ctx_inside_reinit, &ctx->ctx_inside,
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:259:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&ctx->ctx_outside_reinit, &ctx->ctx_outside,
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:265:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&ctx->ctx_inside, &ctx->ctx_inside_reinit,
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:267:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&ctx->ctx_outside, &ctx->ctx_outside_reinit,
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:280:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char digest_inside[SHA384_DIGEST_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:281:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char mac_temp[SHA384_DIGEST_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:286:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(mac, mac_temp, mac_size);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:309:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char key_temp[SHA512_DIGEST_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:343:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&ctx->ctx_inside_reinit, &ctx->ctx_inside,
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:345:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&ctx->ctx_outside_reinit, &ctx->ctx_outside,
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:351:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&ctx->ctx_inside, &ctx->ctx_inside_reinit,
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:353:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&ctx->ctx_outside, &ctx->ctx_outside_reinit,
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:366:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char digest_inside[SHA512_DIGEST_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:367:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char mac_temp[SHA512_DIGEST_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:372:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(mac, mac_temp, mac_size);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:396:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char output[2 * SHA512_DIGEST_SIZE + 1];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:402:8:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
       sprintf(output + 2*i, "%02x", digest[i]);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:475:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char mac[SHA512_DIGEST_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:476:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char *keys[7];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:491:5:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
    strcpy((char *) keys[1], "Jefe");
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:491:13:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    strcpy((char *) keys[1], "Jefe");
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:528:53:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        hmac_sha224(keys[i], keys_len[i], (unsigned char *) messages[i],
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:531:53:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        hmac_sha256(keys[i], keys_len[i], (unsigned char *) messages[i],
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:534:53:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        hmac_sha384(keys[i], keys_len[i], (unsigned char *) messages[i],
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:537:53:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        hmac_sha512(keys[i], keys_len[i], (unsigned char *) messages[i],
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.h:55:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char block_ipad[SHA224_BLOCK_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.h:56:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char block_opad[SHA224_BLOCK_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.h:67:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char block_ipad[SHA256_BLOCK_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.h:68:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char block_opad[SHA256_BLOCK_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.h:79:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char block_ipad[SHA384_BLOCK_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.h:80:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char block_opad[SHA384_BLOCK_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.h:91:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char block_ipad[SHA512_BLOCK_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.h:92:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char block_opad[SHA512_BLOCK_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.c:368:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&ctx->block[ctx->len], message, rem_len);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.c:385:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(ctx->block, &shifted_message[block_nb << 6],
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.c:565:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&ctx->block[ctx->len], message, rem_len);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.c:582:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(ctx->block, &shifted_message[block_nb << 7],
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.c:667:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&ctx->block[ctx->len], message, rem_len);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.c:684:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(ctx->block, &shifted_message[block_nb << 7],
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.c:767:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(&ctx->block[ctx->len], message, rem_len);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.c:784:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(ctx->block, &shifted_message[block_nb << 6],
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.c:838:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char output[2 * SHA512_DIGEST_SIZE + 1];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.c:844:8:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
       sprintf(output + 2 * i, "%02x", digest[i]);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.c:856:18:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    static const char *vectors[4][3] =
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.c:897:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char digest[SHA512_DIGEST_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.h:65:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char block[2 * SHA256_BLOCK_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.h:72:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char block[2 * SHA512_BLOCK_SIZE];
data/mmc-utils-0+git20180327.b4fe0c8c/lsmmc.c:320:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char line[4096];
data/mmc-utils-0+git20180327.b4fe0c8c/lsmmc.c:323:6:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	f = fopen(name, "r");
data/mmc-utils-0+git20180327.b4fe0c8c/lsmmc.c:410:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		char c[2] = { '\0', '\0' };
data/mmc-utils-0+git20180327.b4fe0c8c/lsmmc.c:481:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char oid[3];
data/mmc-utils-0+git20180327.b4fe0c8c/lsmmc.c:482:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char pnm[6];
data/mmc-utils-0+git20180327.b4fe0c8c/lsmmc.c:538:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char pnm[7];
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:241:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fd = open(device, O_RDWR);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:271:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fd = open(device, O_RDWR);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:337:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fd = open(device, O_RDWR);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:399:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fd = open(device, O_RDWR);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:495:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fd = open(device, O_RDWR);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:552:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fd = open(device, O_RDWR);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:646:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fd = open(device, O_RDWR);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:684:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fd = open(device, O_RDWR);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:745:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fd = open(device, O_RDWR);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:785:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fd = open(device, O_RDWR);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:1009:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fd = open(device, O_RDWR);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:1125:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fd = open(device, O_RDWR);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:1271:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fd = open(device, O_RDWR);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:1329:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fd = open(device, O_RDWR);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:1795:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fd = open(device, O_RDWR);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:1967:11:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	dev_fd = open(argv[1], O_RDWR);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:1976:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		key_fd = open(argv[2], O_RDONLY);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:2049:11:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	dev_fd = open(argv[1], O_RDWR);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:2074:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char key[32];
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:2084:11:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	dev_fd = open(argv[1], O_RDWR);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:2122:13:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		data_fd = open(argv[4], O_WRONLY | O_CREAT | O_APPEND,
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:2135:13:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
			key_fd = open(argv[5], O_RDONLY);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:2170:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		unsigned char mac[32];
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:2222:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char key[32];
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:2235:11:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	dev_fd = open(argv[1], O_RDWR);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:2262:13:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		data_fd = open(argv[3], O_RDONLY);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:2284:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		key_fd = open(argv[4], O_RDONLY);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:2344:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fd = open(device, O_RDWR);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:2418:11:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	dev_fd = open(device, O_RDWR);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:2423:11:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	img_fd = open(argv[1], O_RDONLY);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:529:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                    strlen(messages[i]), mac, mac_224_size);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:532:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                    strlen(messages[i]), mac, mac_256_size);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:535:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                    strlen(messages[i]), mac, mac_384_size);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/hmac_sha2.c:538:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                    strlen(messages[i]), mac, mac_512_size);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.c:909:46:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    sha224((const unsigned char *) message1, strlen(message1), digest);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.c:911:47:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    sha224((const unsigned char *) message2a, strlen(message2a), digest);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.c:919:46:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    sha256((const unsigned char *) message1, strlen(message1), digest);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.c:921:47:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    sha256((const unsigned char *) message2a, strlen(message2a), digest);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.c:929:46:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    sha384((const unsigned char *) message1, strlen(message1), digest);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.c:931:46:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    sha384((const unsigned char *)message2b, strlen(message2b), digest);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.c:939:46:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    sha512((const unsigned char *) message1, strlen(message1), digest);
data/mmc-utils-0+git20180327.b4fe0c8c/3rdparty/hmac_sha/sha2.c:941:47:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    sha512((const unsigned char *) message2b, strlen(message2b), digest);
data/mmc-utils-0+git20180327.b4fe0c8c/lsmmc.c:352:22:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	while (isspace(line[strlen(line) - 1]))
data/mmc-utils-0+git20180327.b4fe0c8c/lsmmc.c:353:8:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		line[strlen(line) - 1] = '\0';
data/mmc-utils-0+git20180327.b4fe0c8c/lsmmc.c:370:18:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	binstr = calloc(strlen(hexstr) * 4 + 1, sizeof(char));
data/mmc-utils-0+git20180327.b4fe0c8c/mmc.c:344:26:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	newname = (char*)malloc(strlen(prgname)+strlen(cmd->verb)+2);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc.c:344:42:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	newname = (char*)malloc(strlen(prgname)+strlen(cmd->verb)+2);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc.c:356:2:  [1] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant character.
	strcat(newname, " ");
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:1984:14:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	ret = DO_IO(read, key_fd, frame_in.key_mac, sizeof(frame_in.key_mac));
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:2142:15:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
		ret = DO_IO(read, key_fd, key, sizeof(key));
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:2269:14:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	ret = DO_IO(read, data_fd, frame_in.data, sizeof(frame_in.data));
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:2291:14:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	ret = DO_IO(read, key_fd, key, sizeof(key));
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:2513:15:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	chunk_size = read(img_fd, buf, 512);
data/mmc-utils-0+git20180327.b4fe0c8c/mmc_cmds.c:2551:16:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
		chunk_size = read(img_fd, buf, 512);

ANALYSIS SUMMARY:

Hits = 131
Lines analyzed = 7521 in approximately 0.26 seconds (29154 lines/second)
Physical Source Lines of Code (SLOC) = 6169
Hits@level = [0] 797 [1]  24 [2] 100 [3]   1 [4]   6 [5]   0
Hits@level+ = [0+] 928 [1+] 131 [2+] 107 [3+]   7 [4+]   6 [5+]   0
Hits/KSLOC@level+ = [0+] 150.43 [1+] 21.2352 [2+] 17.3448 [3+] 1.13471 [4+] 0.972605 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.