Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/nyacc-1.03.0/test-suite/nyacc/lang/ffi-help/inc/fh01.h Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex07.c Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex14.c Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex04.c Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex20.c Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex19.c Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex09.c Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/inc.h Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex05.c Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex02.c Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex14.h Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex13.c Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex18.c Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex10.c Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex16.h Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex12.c Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex15.c Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex06.c Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex08.c Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex11.c Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex03.c Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex17.c Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex01.c Examining data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex21.c Examining data/nyacc-1.03.0/examples/nyacc/lang/mlang/exam.d/ex03b.h Examining data/nyacc-1.03.0/examples/nyacc/lang/mlang/mlang.c Examining data/nyacc-1.03.0/examples/nyacc/lang/mlang/simp3_x.c Examining data/nyacc-1.03.0/examples/nyacc/lang/mlang/mlang.h Examining data/nyacc-1.03.0/examples/nyacc/lang/c99/hello.c FINAL RESULTS: data/nyacc-1.03.0/examples/nyacc/lang/c99/hello.c:2:5: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. int printf(const char* fmt, ...); data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex20.c:21:25: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. __attribute__((format(printf, 1, 2))) case10 (const char *, ...), data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex20.c:43:5: [4] (buffer) sscanf: The scanf() family's %s operation, without a limit specification, permits buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a different input function. If the scanf format is influenceable by an attacker, it's exploitable. int sscanf (const char *__restrict __s, const char *__restrict __format, ...) data/nyacc-1.03.0/test-suite/nyacc/lang/c99/exam.d/ex21.c:1:5: [4] (buffer) sscanf: The scanf() family's %s operation, without a limit specification, permits buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a different input function. If the scanf format is influenceable by an attacker, it's exploitable. int sscanf (const char *__restrict __s, const char *__restrict __format, ...) ANALYSIS SUMMARY: Hits = 4 Lines analyzed = 418 in approximately 0.04 seconds (9799 lines/second) Physical Source Lines of Code (SLOC) = 273 Hits@level = [0] 1 [1] 0 [2] 0 [3] 0 [4] 4 [5] 0 Hits@level+ = [0+] 5 [1+] 4 [2+] 4 [3+] 4 [4+] 4 [5+] 0 Hits/KSLOC@level+ = [0+] 18.315 [1+] 14.652 [2+] 14.652 [3+] 14.652 [4+] 14.652 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.