Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/node-opencv-7.0.0+git20200310.6c13234/inc/Matrix.h
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/OpenCV.cc
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/Constants.cc
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/FaceRecognizer.cc
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/HighGUI.h
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/Features2d.cc
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/VideoWriterWrap.h
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/VideoWriterWrap.cc
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/Stereo.h
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/FaceRecognizer.h
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/Contours.cc
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/Matrix.cc
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/OpenCV.h
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/VideoCaptureWrap.h
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/init.cc
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/ImgProc.cc
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/Stereo.cc
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/Features2d.h
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/ImgProc.h
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/CascadeClassifierWrap.cc
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/CamShift.h
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/VideoCaptureWrap.cc
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/LDAWrap.cc
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/Point.cc
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/Histogram.cc
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/CascadeClassifierWrap.h
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/Calib3D.h
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/Calib3D.cc
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/Point.h
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/Contours.h
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/BackgroundSubtractor.cc
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/Matrix.h
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/BackgroundSubtractor.h
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/CamShift.cc
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/HighGUI.cc
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/Histogram.h
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/Constants.h
Examining data/node-opencv-7.0.0+git20200310.6c13234/src/LDAWrap.h
Examining data/node-opencv-7.0.0+git20200310.6c13234/test/nativemat.cc
FINAL RESULTS:
data/node-opencv-7.0.0+git20200310.6c13234/src/Matrix.cc:2304:7: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(errorMessage, typeString);
data/node-opencv-7.0.0+git20200310.6c13234/src/Matrix.cc:2305:7: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(errorMessage, text);
data/node-opencv-7.0.0+git20200310.6c13234/src/Matrix.cc:2328:7: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(errorMessage, algo);
data/node-opencv-7.0.0+git20200310.6c13234/src/Matrix.cc:2329:7: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat(errorMessage, text);
data/node-opencv-7.0.0+git20200310.6c13234/src/Matrix.cc:420:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(self->mat.data, buffer_data, buffer_length);
data/node-opencv-7.0.0+git20200310.6c13234/src/Matrix.cc:436:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, copy.data, size);
data/node-opencv-7.0.0+git20200310.6c13234/src/Matrix.cc:438:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, self->mat.data, size);
data/node-opencv-7.0.0+git20200310.6c13234/src/Matrix.cc:816:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, &vec[0], vec.size());
data/node-opencv-7.0.0+git20200310.6c13234/src/Matrix.cc:857:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, &res[0], res.size());
data/node-opencv-7.0.0+git20200310.6c13234/src/OpenCV.cc:9:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char out [21];
data/node-opencv-7.0.0+git20200310.6c13234/src/OpenCV.cc:10:11: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
int n = sprintf(out, "%i.%i", CV_MAJOR_VERSION, CV_MINOR_VERSION);
data/node-opencv-7.0.0+git20200310.6c13234/src/VideoCaptureWrap.cc:76:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
cap.open(device);
data/node-opencv-7.0.0+git20200310.6c13234/src/VideoCaptureWrap.cc:85:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
cap.open(filename);
data/node-opencv-7.0.0+git20200310.6c13234/src/VideoWriterWrap.cc:79:10: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
writer.open(filename, fourcc, fps, frameSize, isColor);
data/node-opencv-7.0.0+git20200310.6c13234/src/FaceRecognizer.cc:441:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
self->rec->read(filename);
data/node-opencv-7.0.0+git20200310.6c13234/src/Matrix.cc:2302:31: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
errorMessage = new char[strlen(typeString) + strlen(text) + 2];
data/node-opencv-7.0.0+git20200310.6c13234/src/Matrix.cc:2302:52: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
errorMessage = new char[strlen(typeString) + strlen(text) + 2];
data/node-opencv-7.0.0+git20200310.6c13234/src/Matrix.cc:2303:7: [1] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant character.
strcpy(errorMessage, "\"");
data/node-opencv-7.0.0+git20200310.6c13234/src/Matrix.cc:2326:31: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
errorMessage = new char[strlen(algo) + strlen(text) + 2];
data/node-opencv-7.0.0+git20200310.6c13234/src/Matrix.cc:2326:46: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
errorMessage = new char[strlen(algo) + strlen(text) + 2];
data/node-opencv-7.0.0+git20200310.6c13234/src/Matrix.cc:2327:7: [1] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant character.
strcpy(errorMessage, "\"");
data/node-opencv-7.0.0+git20200310.6c13234/src/VideoCaptureWrap.cc:235:19: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
this->vc->cap.read(mat);
data/node-opencv-7.0.0+git20200310.6c13234/src/VideoCaptureWrap.cc:283:10: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
v->cap.read(outputmat);
ANALYSIS SUMMARY:
Hits = 23
Lines analyzed = 8515 in approximately 0.29 seconds (29848 lines/second)
Physical Source Lines of Code (SLOC) = 6033
Hits@level = [0] 1 [1] 9 [2] 10 [3] 0 [4] 4 [5] 0
Hits@level+ = [0+] 24 [1+] 23 [2+] 14 [3+] 4 [4+] 4 [5+] 0
Hits/KSLOC@level+ = [0+] 3.97812 [1+] 3.81237 [2+] 2.32057 [3+] 0.66302 [4+] 0.66302 [5+] 0
Dot directories skipped = 2 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.