Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/network-manager-iodine-1.2.0/auth-dialog/main.c Examining data/network-manager-iodine-1.2.0/properties/nm-iodine.c Examining data/network-manager-iodine-1.2.0/properties/nm-iodine.h Examining data/network-manager-iodine-1.2.0/src/nm-iodine-service-defines.h Examining data/network-manager-iodine-1.2.0/src/nm-iodine-service.c Examining data/network-manager-iodine-1.2.0/src/nm-iodine-service.h FINAL RESULTS: data/network-manager-iodine-1.2.0/properties/nm-iodine.c:203:6: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). f = fopen (path, "w"); data/network-manager-iodine-1.2.0/auth-dialog/main.c:243:7: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). n = read (0, &c, 1); data/network-manager-iodine-1.2.0/properties/nm-iodine.c:215:15: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (value && strlen (value)) data/network-manager-iodine-1.2.0/properties/nm-iodine.c:226:15: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (value && strlen (value)) data/network-manager-iodine-1.2.0/properties/nm-iodine.c:230:15: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (value && strlen (value)) data/network-manager-iodine-1.2.0/properties/nm-iodine.c:261:15: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (!str || !strlen (str)) { data/network-manager-iodine-1.2.0/properties/nm-iodine.c:379:15: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (value && strlen (value)) data/network-manager-iodine-1.2.0/properties/nm-iodine.c:514:19: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (password && strlen (password)) data/network-manager-iodine-1.2.0/properties/nm-iodine.c:552:13: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (str && strlen (str)) data/network-manager-iodine-1.2.0/properties/nm-iodine.c:558:13: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (str && strlen (str)) data/network-manager-iodine-1.2.0/properties/nm-iodine.c:564:13: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (str && strlen (str)) data/network-manager-iodine-1.2.0/src/nm-iodine-service.c:211:14: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (!str || strlen (str) < 1) data/network-manager-iodine-1.2.0/src/nm-iodine-service.c:237:14: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (!str || strlen (str) < 1) data/network-manager-iodine-1.2.0/src/nm-iodine-service.c:349:6: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). l = strlen(line); data/network-manager-iodine-1.2.0/src/nm-iodine-service.c:412:18: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (!passwd || !strlen(passwd)) data/network-manager-iodine-1.2.0/src/nm-iodine-service.c:415:27: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). ret = write (fd, passwd, strlen(passwd)); data/network-manager-iodine-1.2.0/src/nm-iodine-service.c:462:24: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (props_fragsize && strlen(props_fragsize)) { data/network-manager-iodine-1.2.0/src/nm-iodine-service.c:479:26: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (props_nameserver && strlen(props_nameserver)) data/network-manager-iodine-1.2.0/src/nm-iodine-service.c:482:25: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (props_topdomain && strlen(props_topdomain)) ANALYSIS SUMMARY: Hits = 19 Lines analyzed = 1903 in approximately 0.07 seconds (26764 lines/second) Physical Source Lines of Code (SLOC) = 1417 Hits@level = [0] 4 [1] 18 [2] 1 [3] 0 [4] 0 [5] 0 Hits@level+ = [0+] 23 [1+] 19 [2+] 1 [3+] 0 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 16.2315 [1+] 13.4086 [2+] 0.705716 [3+] 0 [4+] 0 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.