Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/ocaml-bjack-0.1.5/src/jack_wrapper.c
Examining data/ocaml-bjack-0.1.5/src/jack_wrapper.h
Examining data/ocaml-bjack-0.1.5/src/jack_stubs.c

FINAL RESULTS:

data/ocaml-bjack-0.1.5/src/jack_wrapper.c:74:3:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
  fprintf(OUTFILE, "%ld.%06ld: %s::%s(%d) "format, timer_now.tv_sec, timer_now.tv_usec, __FILE__, __FUNCTION__, __LINE__, ##args)
data/ocaml-bjack-0.1.5/src/jack_wrapper.c:80:31:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
#define TRACE(format,args...) fprintf(OUTFILE, "%s::%s(%d) "format, __FILE__, __FUNCTION__, __LINE__,##args);	\
data/ocaml-bjack-0.1.5/src/jack_wrapper.c:87:31:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
#define DEBUG(format,args...) fprintf(OUTFILE, "%s::%s(%d) "format, __FILE__, __FUNCTION__, __LINE__,##args);	\
data/ocaml-bjack-0.1.5/src/jack_wrapper.c:94:40:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
#define CALLBACK_TRACE(format,args...) fprintf(OUTFILE, "%s::%s(%d) "format, __FILE__, __FUNCTION__, __LINE__,##args);	\
data/ocaml-bjack-0.1.5/src/jack_wrapper.c:101:30:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
#define WARN(format,args...) fprintf(OUTFILE, "WARN: %s::%s(%d) "format, __FILE__,__FUNCTION__,__LINE__,##args);	\
data/ocaml-bjack-0.1.5/src/jack_wrapper.c:107:29:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
#define ERR(format,args...) fprintf(OUTFILE, "ERR: %s::%s(%d) "format, __FILE__,__FUNCTION__,__LINE__,##args);	\
data/ocaml-bjack-0.1.5/src/jack_wrapper.c:745:3:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
  strcpy(client_name,drv->client_name);
data/ocaml-bjack-0.1.5/src/jack_wrapper.c:753:3:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
  strcpy(server_name,drv->server_name);
data/ocaml-bjack-0.1.5/src/jack_wrapper.c:1091:3:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
  strcpy(drv->client_name,client_name);
data/ocaml-bjack-0.1.5/src/jack_wrapper.c:1099:3:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
  strcpy(drv->server_name,server_name);
data/ocaml-bjack-0.1.5/src/jack_stubs.c:193:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(buf,String_val(data),n);
data/ocaml-bjack-0.1.5/src/jack_stubs.c:236:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(String_val(ans),buf,ret);
data/ocaml-bjack-0.1.5/src/jack_wrapper.c:877:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char portname[32];
data/ocaml-bjack-0.1.5/src/jack_wrapper.c:878:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(portname, "out_%d", i);
data/ocaml-bjack-0.1.5/src/jack_wrapper.c:891:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char portname[32];
data/ocaml-bjack-0.1.5/src/jack_wrapper.c:892:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(portname, "in_%d", i);
data/ocaml-bjack-0.1.5/src/jack_wrapper.c:515:36:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
      drv->written_client_bytes += read;
data/ocaml-bjack-0.1.5/src/jack_wrapper.c:517:32:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
      drv->clientBytesInJack = read;    /* record the input bytes we wrote to jack */
data/ocaml-bjack-0.1.5/src/jack_wrapper.c:738:11:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  int n = strlen(drv->client_name)+1;
data/ocaml-bjack-0.1.5/src/jack_wrapper.c:746:7:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  n = strlen(drv->server_name)+1;
data/ocaml-bjack-0.1.5/src/jack_wrapper.c:1078:7:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  n = strlen(client_name)+1;
data/ocaml-bjack-0.1.5/src/jack_wrapper.c:1092:7:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  n = strlen(server_name)+1;

ANALYSIS SUMMARY:

Hits = 22
Lines analyzed = 2617 in approximately 0.08 seconds (34577 lines/second)
Physical Source Lines of Code (SLOC) = 1800
Hits@level = [0]   1 [1]   6 [2]   6 [3]   0 [4]  10 [5]   0
Hits@level+ = [0+]  23 [1+]  22 [2+]  16 [3+]  10 [4+]  10 [5+]   0
Hits/KSLOC@level+ = [0+] 12.7778 [1+] 12.2222 [2+] 8.88889 [3+] 5.55556 [4+] 5.55556 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.