Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/phototonic-2.1/Bookmarks.cpp Examining data/phototonic-2.1/Bookmarks.h Examining data/phototonic-2.1/ColorsDialog.cpp Examining data/phototonic-2.1/ColorsDialog.h Examining data/phototonic-2.1/CopyMoveDialog.cpp Examining data/phototonic-2.1/CopyMoveDialog.h Examining data/phototonic-2.1/CopyMoveToDialog.cpp Examining data/phototonic-2.1/CopyMoveToDialog.h Examining data/phototonic-2.1/CropDialog.cpp Examining data/phototonic-2.1/CropDialog.h Examining data/phototonic-2.1/CropRubberband.cpp Examining data/phototonic-2.1/CropRubberband.h Examining data/phototonic-2.1/DirCompleter.cpp Examining data/phototonic-2.1/DirCompleter.h Examining data/phototonic-2.1/ExternalAppsDialog.cpp Examining data/phototonic-2.1/ExternalAppsDialog.h Examining data/phototonic-2.1/FileListWidget.cpp Examining data/phototonic-2.1/FileListWidget.h Examining data/phototonic-2.1/FileSystemModel.cpp Examining data/phototonic-2.1/FileSystemModel.h Examining data/phototonic-2.1/FileSystemTree.cpp Examining data/phototonic-2.1/FileSystemTree.h Examining data/phototonic-2.1/ImagePreview.cpp Examining data/phototonic-2.1/ImagePreview.h Examining data/phototonic-2.1/ImageViewer.cpp Examining data/phototonic-2.1/ImageViewer.h Examining data/phototonic-2.1/InfoViewer.cpp Examining data/phototonic-2.1/InfoViewer.h Examining data/phototonic-2.1/MessageBox.cpp Examining data/phototonic-2.1/MessageBox.h Examining data/phototonic-2.1/MetadataCache.cpp Examining data/phototonic-2.1/MetadataCache.h Examining data/phototonic-2.1/Phototonic.cpp Examining data/phototonic-2.1/Phototonic.h Examining data/phototonic-2.1/ProgressDialog.cpp Examining data/phototonic-2.1/ProgressDialog.h Examining data/phototonic-2.1/RenameDialog.cpp Examining data/phototonic-2.1/RenameDialog.h Examining data/phototonic-2.1/ResizeDialog.cpp Examining data/phototonic-2.1/ResizeDialog.h Examining data/phototonic-2.1/Settings.cpp Examining data/phototonic-2.1/Settings.h Examining data/phototonic-2.1/SettingsDialog.cpp Examining data/phototonic-2.1/SettingsDialog.h Examining data/phototonic-2.1/ShortcutsTable.cpp Examining data/phototonic-2.1/ShortcutsTable.h Examining data/phototonic-2.1/Tags.cpp Examining data/phototonic-2.1/Tags.h Examining data/phototonic-2.1/ThumbsViewer.cpp Examining data/phototonic-2.1/ThumbsViewer.h Examining data/phototonic-2.1/Trashcan.cpp Examining data/phototonic-2.1/Trashcan.h Examining data/phototonic-2.1/main.cpp FINAL RESULTS: data/phototonic-2.1/main.cpp:32:31: [4] (shell) system: This causes a new program to execute and is difficult to use safely (CWE-78). try using a library call that implements the same functionality if available. QLocale locale = QLocale::system(); data/phototonic-2.1/ImageViewer.cpp:486:21: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static unsigned char contrastTransform[256]; data/phototonic-2.1/ImageViewer.cpp:487:21: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static unsigned char brightTransform[256]; data/phototonic-2.1/ImageViewer.cpp:959:38: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). image = Exiv2::ImageFactory::open(viewerImageFullPath.toStdString()); data/phototonic-2.1/ImageViewer.cpp:1002:46: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). exifImage = Exiv2::ImageFactory::open(viewerImageFullPath.toStdString()); data/phototonic-2.1/ImageViewer.cpp:1016:57: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). newExifImage = Exiv2::ImageFactory::open(fileName.toStdString()); data/phototonic-2.1/MetadataCache.cpp:72:42: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). exifImage = Exiv2::ImageFactory::open(imageFullPath.toStdString()); data/phototonic-2.1/Phototonic.cpp:3156:46: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). image = Exiv2::ImageFactory::open(fileList[file].toStdString()); data/phototonic-2.1/Tags.cpp:142:42: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). exifImage = Exiv2::ImageFactory::open(imageFileName.toStdString()); data/phototonic-2.1/ThumbsViewer.cpp:215:42: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). exifImage = Exiv2::ImageFactory::open(imageFullPath.toStdString()); data/phototonic-2.1/Trashcan.cpp:53:21: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). ((fd = open(trashInfoDir.filePath(infoFileName).toUtf8().data(), flag, mode)) == -1 && errno == EEXIST); ++n) { data/phototonic-2.1/Trashcan.cpp:66:22: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if (infoFile.open(fd, QIODevice::WriteOnly, QFileDevice::AutoCloseHandle)) { data/phototonic-2.1/ImagePreview.cpp:54:21: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). imageReader.read(&previewImage); data/phototonic-2.1/ImageViewer.cpp:646:53: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). if (imageReader.size().isValid() && imageReader.read(&origImage)) { data/phototonic-2.1/Tags.cpp:164:20: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). value->read(tag.toStdString()); data/phototonic-2.1/ThumbsViewer.cpp:207:25: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). imageInfoReader.read(); data/phototonic-2.1/ThumbsViewer.cpp:648:39: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). imageReadOk = thumbReader.read(&thumb); data/phototonic-2.1/ThumbsViewer.cpp:706:29: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). thumb = thumbReader.read(); ANALYSIS SUMMARY: Hits = 18 Lines analyzed = 10808 in approximately 0.29 seconds (37480 lines/second) Physical Source Lines of Code (SLOC) = 8035 Hits@level = [0] 0 [1] 6 [2] 11 [3] 0 [4] 1 [5] 0 Hits@level+ = [0+] 18 [1+] 18 [2+] 12 [3+] 1 [4+] 1 [5+] 0 Hits/KSLOC@level+ = [0+] 2.2402 [1+] 2.2402 [2+] 1.49347 [3+] 0.124456 [4+] 0.124456 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.