Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/pd-pdogg-0.25.1/oggamp~.c
Examining data/pd-pdogg-0.25.1/oggcast~.c
Examining data/pd-pdogg-0.25.1/oggread~.c
Examining data/pd-pdogg-0.25.1/pdogg.c
Examining data/pd-pdogg-0.25.1/oggwrite~.c

FINAL RESULTS:

data/pd-pdogg-0.25.1/oggamp~.c:553:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(request, "GET /%s HTTP/1.0 \r\nHost: %s\r\nUser-Agent: oggamp~ 0.2\r\nAccept: audio/x-ogg\r\n\r\n", 
data/pd-pdogg-0.25.1/oggcast~.c:627:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
		sprintf(resp, "source:%s", passwd);
data/pd-pdogg-0.25.1/oggcast~.c:629:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
		sprintf(resp, "Authorization: Basic %s\r\n", buf);
data/pd-pdogg-0.25.1/oggcast~.c:374:2:  [3] (random) srand:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
	srand(time(NULL));
data/pd-pdogg-0.25.1/oggwrite~.c:347:2:  [3] (random) srand:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
	srand(time(NULL));
data/pd-pdogg-0.25.1/oggamp~.c:498:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char            request[STRBUF_SIZE];           /* string to be send to server */
data/pd-pdogg-0.25.1/oggamp~.c:524:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy((char *)&server.sin_addr, (char *)hp->h_addr, hp->h_length);
data/pd-pdogg-0.25.1/oggamp~.c:649:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		char color[32];
data/pd-pdogg-0.25.1/oggamp~.c:654:4:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
			strcpy(color, "red");
data/pd-pdogg-0.25.1/oggamp~.c:658:4:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
			strcpy(color, "lightgreen");
data/pd-pdogg-0.25.1/oggamp~.c:743:8:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    			char boo[80];
data/pd-pdogg-0.25.1/oggamp~.c:826:7:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    		sprintf(boo, "fifosize %d\n", 
data/pd-pdogg-0.25.1/oggamp~.c:843:9:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
		    		sprintf(boo, "head %d, tail %d\n", x->x_fifohead, x->x_fifotail);
data/pd-pdogg-0.25.1/oggamp~.c:883:12:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    	    		sprintf(boo, "after: head %d, tail %d\n", 
data/pd-pdogg-0.25.1/oggcast~.c:204:8:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static char base64table[65] = {
data/pd-pdogg-0.25.1/oggcast~.c:502:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char            resp[STRBUF_SIZE];
data/pd-pdogg-0.25.1/oggcast~.c:525:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy((char *)&server.sin_addr, (char *)hp->h_addr, hp->h_length);
data/pd-pdogg-0.25.1/oggcast~.c:602:6:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
		if(sprintf(resp, "%d", br_nom) == -1)    /* convert int to a string */
data/pd-pdogg-0.25.1/oggcast~.c:670:6:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
		if(sprintf(resp, "%d", br_nom) == -1)    /* convert int to a string */
data/pd-pdogg-0.25.1/oggcast~.c:767:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    		char boo[100];
data/pd-pdogg-0.25.1/oggcast~.c:845:8:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    			sprintf(boo, "fifosize %d\n", x->x_fifosize);
data/pd-pdogg-0.25.1/oggcast~.c:891:12:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    	    		sprintf(boo, "after: head %d, tail %d, pages %d\n", x->x_fifohead, x->x_fifotail, sysrtn);
data/pd-pdogg-0.25.1/oggread~.c:294:18:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	if((x->x_file = fopen(filename->s_name, "rb")) < 0)
data/pd-pdogg-0.25.1/oggread~.c:296:20:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
   if((x->x_file = fopen(filename->s_name, "r")) < 0)
data/pd-pdogg-0.25.1/oggwrite~.c:472:19:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    if((x->x_fd = open( sfile->s_name, x->x_file_open_mode, S_IRWXU|S_IRWXG|S_IRWXO )) < 0)
data/pd-pdogg-0.25.1/oggamp~.c:556:32:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if ( send(sockfd, request, strlen(request), 0) < 0 )    /* say hello to server */
data/pd-pdogg-0.25.1/oggamp~.c:685:17:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    write(2, s, strlen(s));
data/pd-pdogg-0.25.1/oggamp~.c:1260:2:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
	strncpy(h, hostptr, stringlength);
data/pd-pdogg-0.25.1/oggamp~.c:1270:18:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		stringlength = strlen(defaultportstr);
data/pd-pdogg-0.25.1/oggamp~.c:1279:2:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
	strncpy(p0, portptr, stringlength);
data/pd-pdogg-0.25.1/oggcast~.c:214:12:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	int len = strlen(data);
data/pd-pdogg-0.25.1/oggcast~.c:559:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:561:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:563:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:565:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:569:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:571:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:574:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:576:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:579:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:581:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:584:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:586:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:589:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:598:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:601:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:606:22:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, resp, strlen(resp), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:609:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:611:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:614:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:621:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:623:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:625:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:630:22:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, resp, strlen(resp), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:633:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:637:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:639:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:642:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:644:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:647:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:649:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:652:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:654:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:657:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:666:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:669:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:674:22:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, resp, strlen(resp), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:677:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:679:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:682:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		send(sockfd, buf, strlen(buf), SEND_OPT);
data/pd-pdogg-0.25.1/oggcast~.c:710:17:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    write(2, s, strlen(s));
data/pd-pdogg-0.25.1/oggcast~.c:1320:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	freebytes(comment, strlen(comment));
data/pd-pdogg-0.25.1/oggwrite~.c:553:12:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	int len = strlen(atom_gensym(argv)->s_name);

ANALYSIS SUMMARY:

Hits = 73
Lines analyzed = 4106 in approximately 0.20 seconds (20103 lines/second)
Physical Source Lines of Code (SLOC) = 3262
Hits@level = [0]   3 [1]  48 [2]  20 [3]   2 [4]   3 [5]   0
Hits@level+ = [0+]  76 [1+]  73 [2+]  25 [3+]   5 [4+]   3 [5+]   0
Hits/KSLOC@level+ = [0+] 23.2986 [1+] 22.3789 [2+] 7.66401 [3+] 1.5328 [4+] 0.919681 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.