Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/msgpuck-1.0.3/msgpuck.c
Examining data/msgpuck-1.0.3/test/test.h
Examining data/msgpuck-1.0.3/test/test.c
Examining data/msgpuck-1.0.3/test/msgpuck.c
Examining data/msgpuck-1.0.3/msgpuck.h

FINAL RESULTS:

data/msgpuck-1.0.3/test/test.c:100:2:  [4] (format) vprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
	vprintf(fmt, ap);
data/msgpuck-1.0.3/test/test.h:63:2:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
	fprintf(stream, __VA_ARGS__); fprintf(stream, "\n"); })
data/msgpuck-1.0.3/test/test.h:87:3:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
		fprintf(stderr, fmt, ##args);		\
data/msgpuck-1.0.3/test/test.h:99:3:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
		fprintf(stderr, fmt, ##args);		\
data/msgpuck-1.0.3/test/test.h:111:3:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
		fprintf(stderr, fmt, ##args);		\
data/msgpuck-1.0.3/msgpuck.h:1563:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(data, str, len);
data/msgpuck-1.0.3/msgpuck.h:1586:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(data, str, len);
data/msgpuck-1.0.3/msgpuck.h:2896:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
const char *mp_char2escape[128] = {
data/msgpuck-1.0.3/test/msgpuck.c:44:8:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static char buf[BUF_MAXLEN + 1];
data/msgpuck-1.0.3/test/msgpuck.c:45:8:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static char str[STRBIN_MAXLEN];
data/msgpuck-1.0.3/test/msgpuck.c:479:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char bufa[9];
data/msgpuck-1.0.3/test/msgpuck.c:480:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char bufb[9];
data/msgpuck-1.0.3/test/msgpuck.c:538:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char buf[buf_size];
data/msgpuck-1.0.3/test/msgpuck.c:729:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char data[512];
data/msgpuck-1.0.3/test/msgpuck.c:760:15:  [2] (tmpfile) tmpfile:
  Function tmpfile() has a security flaw on some systems (e.g., older System
  V systems) (CWE-377).
	FILE *tmpf = tmpfile();
data/msgpuck-1.0.3/msgpuck.h:2069:30:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
				uint32_t len = (uint32_t)strlen(str);

ANALYSIS SUMMARY:

Hits = 16
Lines analyzed = 4140 in approximately 0.12 seconds (33411 lines/second)
Physical Source Lines of Code (SLOC) = 2722
Hits@level = [0]  22 [1]   1 [2]  10 [3]   0 [4]   5 [5]   0
Hits@level+ = [0+]  38 [1+]  16 [2+]  15 [3+]   5 [4+]   5 [5+]   0
Hits/KSLOC@level+ = [0+] 13.9603 [1+] 5.87803 [2+] 5.51065 [3+] 1.83688 [4+] 1.83688 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.