Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/parole-1.0.5/data/interfaces/plugins_ui.h Examining data/parole-1.0.5/data/interfaces/playlist_ui.h Examining data/parole-1.0.5/data/interfaces/mediachooser_ui.h Examining data/parole-1.0.5/data/interfaces/parole_ui.h Examining data/parole-1.0.5/data/interfaces/open-location_ui.h Examining data/parole-1.0.5/data/interfaces/save-playlist_ui.h Examining data/parole-1.0.5/data/interfaces/parole-settings_ui.h Examining data/parole-1.0.5/data/interfaces/shortcuts_ui.h Examining data/parole-1.0.5/src/parole-mediachooser.h Examining data/parole-1.0.5/src/dbus/parole-dbus.c Examining data/parole-1.0.5/src/dbus/parole-dbus.h Examining data/parole-1.0.5/src/parole-clutter.c Examining data/parole-1.0.5/src/parole-conf.h Examining data/parole-1.0.5/src/parole-conf.c Examining data/parole-1.0.5/src/main.c Examining data/parole-1.0.5/src/parole-plugin-player.c Examining data/parole-1.0.5/src/parole-subtitle-encoding.h Examining data/parole-1.0.5/src/enum-gtypes.c Examining data/parole-1.0.5/src/parole-vis.h Examining data/parole-1.0.5/src/enum-gtypes.h Examining data/parole-1.0.5/src/parole-utils.c Examining data/parole-1.0.5/src/parole-button.c Examining data/parole-1.0.5/src/parole-plugins-manager.c Examining data/parole-1.0.5/src/parole-mediachooser.c Examining data/parole-1.0.5/src/parole-about.h Examining data/parole-1.0.5/src/parole-medialist.c Examining data/parole-1.0.5/src/parole-conf-dialog.h Examining data/parole-1.0.5/src/parole-clutter.h Examining data/parole-1.0.5/src/parole-builder.c Examining data/parole-1.0.5/src/parole-medialist.h Examining data/parole-1.0.5/src/parole-disc.c Examining data/parole-1.0.5/src/parole-subtitle-encoding.c Examining data/parole-1.0.5/src/common/parole-rc-utils.h Examining data/parole-1.0.5/src/common/parole-powermanager.c Examining data/parole-1.0.5/src/common/parole-common.c Examining data/parole-1.0.5/src/common/parole-screensaver.c Examining data/parole-1.0.5/src/common/parole-screensaver.h Examining data/parole-1.0.5/src/common/parole-rc-utils.c Examining data/parole-1.0.5/src/common/parole-powermanager.h Examining data/parole-1.0.5/src/common/parole-common.h Examining data/parole-1.0.5/src/parole-about.c Examining data/parole-1.0.5/src/org.parole.media.list.h Examining data/parole-1.0.5/src/parole-shortcuts.h Examining data/parole-1.0.5/src/parole-vis.c Examining data/parole-1.0.5/src/gst/gstmarshal.h Examining data/parole-1.0.5/src/gst/gst-enum-types.c Examining data/parole-1.0.5/src/gst/gst-enum-types.h Examining data/parole-1.0.5/src/gst/gstmarshal.c Examining data/parole-1.0.5/src/gst/parole-gst.c Examining data/parole-1.0.5/src/gst/parole-gst.h Examining data/parole-1.0.5/src/parole-player.c Examining data/parole-1.0.5/src/parole-module.c Examining data/parole-1.0.5/src/parole-plugin-player.h Examining data/parole-1.0.5/src/parole-disc.h Examining data/parole-1.0.5/src/plugins/tray/tray-provider.h Examining data/parole-1.0.5/src/plugins/tray/tray-plugin.c Examining data/parole-1.0.5/src/plugins/tray/tray-provider.c Examining data/parole-1.0.5/src/plugins/notify/notify-provider.h Examining data/parole-1.0.5/src/plugins/notify/notify-plugin.c Examining data/parole-1.0.5/src/plugins/notify/notify-provider.c Examining data/parole-1.0.5/src/plugins/sample/sample-plugin.c Examining data/parole-1.0.5/src/plugins/sample/sample-provider.h Examining data/parole-1.0.5/src/plugins/sample/sample-provider.c Examining data/parole-1.0.5/src/plugins/mpris2/mpris2-plugin.c Examining data/parole-1.0.5/src/plugins/mpris2/mpris2-provider.c Examining data/parole-1.0.5/src/plugins/mpris2/mpris2-provider.h Examining data/parole-1.0.5/src/gmarshal.h Examining data/parole-1.0.5/src/parole-shortcuts.c Examining data/parole-1.0.5/src/parole-module.h Examining data/parole-1.0.5/src/parole-conf-dialog.c Examining data/parole-1.0.5/src/parole-open-location.c Examining data/parole-1.0.5/src/parole-open-location.h Examining data/parole-1.0.5/src/gmarshal.c Examining data/parole-1.0.5/src/org.parole.media.player.h Examining data/parole-1.0.5/src/misc/parole-provider-player.h Examining data/parole-1.0.5/src/misc/parole-pl-parser.c Examining data/parole-1.0.5/src/misc/parole-marshal.h Examining data/parole-1.0.5/src/misc/parole-marshal.c Examining data/parole-1.0.5/src/misc/parole-provider-plugin.h Examining data/parole-1.0.5/src/misc/parole.h Examining data/parole-1.0.5/src/misc/parole-debug.h Examining data/parole-1.0.5/src/misc/parole-provider-player.c Examining data/parole-1.0.5/src/misc/parole-filters.c Examining data/parole-1.0.5/src/misc/parole-enum-types.c Examining data/parole-1.0.5/src/misc/parole-stream.h Examining data/parole-1.0.5/src/misc/parole-filters.h Examining data/parole-1.0.5/src/misc/parole-stream.c Examining data/parole-1.0.5/src/misc/parole-enum-types.h Examining data/parole-1.0.5/src/misc/parole-pl-parser.h Examining data/parole-1.0.5/src/misc/parole-file.h Examining data/parole-1.0.5/src/misc/parole-debug.c Examining data/parole-1.0.5/src/misc/parole-file.c Examining data/parole-1.0.5/src/misc/parole-provider-plugin.c Examining data/parole-1.0.5/src/parole-player.h Examining data/parole-1.0.5/src/parole-builder.h Examining data/parole-1.0.5/src/parole-plugins-manager.h Examining data/parole-1.0.5/src/parole-utils.h Examining data/parole-1.0.5/src/parole-button.h FINAL RESULTS: data/parole-1.0.5/src/common/parole-screensaver.c:78:18: [4] (shell) system: This causes a new program to execute and is difficult to use safely (CWE-78). try using a library call that implements the same functionality if available. returncode = system(cmd); data/parole-1.0.5/src/common/parole-screensaver.c:92:18: [4] (shell) system: This causes a new program to execute and is difficult to use safely (CWE-78). try using a library call that implements the same functionality if available. returncode = system(cmd); data/parole-1.0.5/src/parole-medialist.c:1722:42: [3] (random) g_random_int_range: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. path_str = g_strdup_printf("%i", g_random_int_range(0, nch)); data/parole-1.0.5/src/common/parole-rc-utils.c:85:13: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). f = fopen(history, "a"); data/parole-1.0.5/src/misc/parole-pl-parser.c:673:9: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). f = fopen(filename, "w"); data/parole-1.0.5/src/parole-disc.c:314:15: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if ((fd = open(device, O_RDONLY)) < 0) { data/parole-1.0.5/src/parole-medialist.c:178:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char *history[3]; data/parole-1.0.5/src/parole-player.c:700:23: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). gint chapter_id = atoi((char*)g_object_get_data(G_OBJECT(widget), "chapter-id")); data/parole-1.0.5/src/parole-utils.c:406:15: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if ((fd = open(device, O_RDONLY)) < 0) { data/parole-1.0.5/src/misc/parole-file.c:222:26: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if ( strlen(title_s) ) { data/parole-1.0.5/src/parole-open-location.c:82:27: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if ( !location || strlen (location) == 0) data/parole-1.0.5/src/parole-utils.c:221:11: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). len = strlen(name); ANALYSIS SUMMARY: Hits = 12 Lines analyzed = 26397 in approximately 0.70 seconds (37950 lines/second) Physical Source Lines of Code (SLOC) = 17749 Hits@level = [0] 13 [1] 3 [2] 6 [3] 1 [4] 2 [5] 0 Hits@level+ = [0+] 25 [1+] 12 [2+] 9 [3+] 3 [4+] 2 [5+] 0 Hits/KSLOC@level+ = [0+] 1.40853 [1+] 0.676094 [2+] 0.507071 [3+] 0.169024 [4+] 0.112682 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.