Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/psautohint-2.1.0/libpsautohint/autohintexe.c Examining data/psautohint-2.1.0/libpsautohint/include/psautohint.h Examining data/psautohint-2.1.0/libpsautohint/src/ac.c Examining data/psautohint-2.1.0/libpsautohint/src/ac.h Examining data/psautohint-2.1.0/libpsautohint/src/acfixed.c Examining data/psautohint-2.1.0/libpsautohint/src/auto.c Examining data/psautohint-2.1.0/libpsautohint/src/basic.h Examining data/psautohint-2.1.0/libpsautohint/src/bbox.c Examining data/psautohint-2.1.0/libpsautohint/src/bbox.h Examining data/psautohint-2.1.0/libpsautohint/src/buffer.c Examining data/psautohint-2.1.0/libpsautohint/src/charpath.c Examining data/psautohint-2.1.0/libpsautohint/src/charpath.h Examining data/psautohint-2.1.0/libpsautohint/src/charpathpriv.c Examining data/psautohint-2.1.0/libpsautohint/src/charprop.c Examining data/psautohint-2.1.0/libpsautohint/src/check.c Examining data/psautohint-2.1.0/libpsautohint/src/control.c Examining data/psautohint-2.1.0/libpsautohint/src/eval.c Examining data/psautohint-2.1.0/libpsautohint/src/fix.c Examining data/psautohint-2.1.0/libpsautohint/src/flat.c Examining data/psautohint-2.1.0/libpsautohint/src/fontinfo.c Examining data/psautohint-2.1.0/libpsautohint/src/fontinfo.h Examining data/psautohint-2.1.0/libpsautohint/src/gen.c Examining data/psautohint-2.1.0/libpsautohint/src/head.c Examining data/psautohint-2.1.0/libpsautohint/src/logging.c Examining data/psautohint-2.1.0/libpsautohint/src/logging.h Examining data/psautohint-2.1.0/libpsautohint/src/memory.c Examining data/psautohint-2.1.0/libpsautohint/src/memory.h Examining data/psautohint-2.1.0/libpsautohint/src/merge.c Examining data/psautohint-2.1.0/libpsautohint/src/misc.c Examining data/psautohint-2.1.0/libpsautohint/src/opcodes.h Examining data/psautohint-2.1.0/libpsautohint/src/optable.c Examining data/psautohint-2.1.0/libpsautohint/src/optable.h Examining data/psautohint-2.1.0/libpsautohint/src/pick.c Examining data/psautohint-2.1.0/libpsautohint/src/psautohint.c Examining data/psautohint-2.1.0/libpsautohint/src/read.c Examining data/psautohint-2.1.0/libpsautohint/src/report.c Examining data/psautohint-2.1.0/libpsautohint/src/shuffle.c Examining data/psautohint-2.1.0/libpsautohint/src/stemreport.c Examining data/psautohint-2.1.0/libpsautohint/src/write.c Examining data/psautohint-2.1.0/python/psautohint/_psautohint.c FINAL RESULTS: data/psautohint-2.1.0/libpsautohint/autohintexe.c:187:9: [4] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). strcat(savedName, name); data/psautohint-2.1.0/libpsautohint/autohintexe.c:188:9: [4] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). strcat(savedName, fSuffix); data/psautohint-2.1.0/libpsautohint/autohintexe.c:208:9: [4] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). strcat(savedName, name); data/psautohint-2.1.0/libpsautohint/autohintexe.c:209:9: [4] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). strcat(savedName, fSuffix); data/psautohint-2.1.0/libpsautohint/autohintexe.c:463:13: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(masters[i], bezName); data/psautohint-2.1.0/libpsautohint/src/buffer.c:85:11: [4] (format) vsnprintf: If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134). Use a constant for the format specification. len = vsnprintf(outstr, STRLEN, format, va); data/psautohint-2.1.0/libpsautohint/src/buffer.c:94:15: [4] (format) vsnprintf: If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134). Use a constant for the format specification. len = vsnprintf(outstr, len + 1, format, va); data/psautohint-2.1.0/libpsautohint/src/charprop.c:75:9: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(HintList[ListEntries++], token); data/psautohint-2.1.0/libpsautohint/src/logging.c:39:5: [4] (format) vsnprintf: If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate (CWE-134). Use a constant for the format specification. vsnprintf(str + strlen(str), MAXMSGLEN, format, va); data/psautohint-2.1.0/libpsautohint/src/write.c:90:9: [4] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). strcat(s1, s2); data/psautohint-2.1.0/libpsautohint/src/write.c:229:9: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(prevhintmaskstr, hintmaskstr); data/psautohint-2.1.0/libpsautohint/src/write.c:404:9: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(prevhintmaskstr, hintmaskstr); data/psautohint-2.1.0/libpsautohint/autohintexe.c:161:20: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). FILE* fp = fopen(name, "r"); data/psautohint-2.1.0/libpsautohint/autohintexe.c:189:14: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fp = fopen(savedName, "w"); data/psautohint-2.1.0/libpsautohint/autohintexe.c:192:14: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fp = fopen(name, "w"); data/psautohint-2.1.0/libpsautohint/autohintexe.c:210:16: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). file = fopen(savedName, "w"); data/psautohint-2.1.0/libpsautohint/autohintexe.c:213:16: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). file = fopen(name, "w"); data/psautohint-2.1.0/libpsautohint/src/ac.c:50:17: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static unsigned char *vmfree, *vmlast, vm[VMSIZE]; data/psautohint-2.1.0/libpsautohint/src/ac.h:230:8: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. extern char gGlyphName[MAX_GLYPHNAME_LEN]; data/psautohint-2.1.0/libpsautohint/src/buffer.c:69:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(buffer->data + buffer->len, data, length); data/psautohint-2.1.0/libpsautohint/src/buffer.c:77:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char outstr[STRLEN]; data/psautohint-2.1.0/libpsautohint/src/fontinfo.c:38:27: [2] (integer) atol: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). *value = (int32_t)atol(fontinfostr); data/psautohint-2.1.0/libpsautohint/src/logging.c:32:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char str[MAX_GLYPHNAME_LEN + 2 + MAXMSGLEN + 1] = { 0 }; data/psautohint-2.1.0/libpsautohint/src/read.c:16:1: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char gGlyphName[MAX_GLYPHNAME_LEN]; data/psautohint-2.1.0/libpsautohint/src/read.c:379:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char op[80]; data/psautohint-2.1.0/libpsautohint/src/report.c:378:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char s[2]; data/psautohint-2.1.0/libpsautohint/src/shuffle.c:162:14: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char sumlinks[MAXCNT], output[MAXCNT], outlinks[MAXCNT]; data/psautohint-2.1.0/libpsautohint/src/write.c:19:8: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static char S0[MAXBUFFLEN + 1]; data/psautohint-2.1.0/libpsautohint/src/write.c:81:8: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static char hintmaskstr[HINTMAXSTR]; data/psautohint-2.1.0/libpsautohint/src/write.c:82:8: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static char prevhintmaskstr[HINTMAXSTR]; data/psautohint-2.1.0/libpsautohint/autohintexe.c:184:20: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). nameSize = strlen(name) + strlen(fSuffix) + 1; data/psautohint-2.1.0/libpsautohint/autohintexe.c:184:35: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). nameSize = strlen(name) + strlen(fSuffix) + 1; data/psautohint-2.1.0/libpsautohint/autohintexe.c:205:20: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). nameSize = strlen(name) + strlen(fSuffix) + 1; data/psautohint-2.1.0/libpsautohint/autohintexe.c:205:35: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). nameSize = strlen(name) + strlen(fSuffix) + 1; data/psautohint-2.1.0/libpsautohint/autohintexe.c:407:38: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). output = ACBufferNew(4 * strlen(bezdata)); data/psautohint-2.1.0/libpsautohint/autohintexe.c:462:33: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). masters[i] = malloc(strlen(bezName) + 1); data/psautohint-2.1.0/libpsautohint/autohintexe.c:465:44: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). outGlyphs[i] = ACBufferNew(4 * strlen(inGlyphs[i])); data/psautohint-2.1.0/libpsautohint/autohintexe.c:468:39: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). hintedGlyph = ACBufferNew(4 * strlen(inGlyphs[0])); data/psautohint-2.1.0/libpsautohint/autohintexe.c:480:13: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(inGlyphs[0], data, len); data/psautohint-2.1.0/libpsautohint/src/charprop.c:74:26: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). AllocateMem(1, strlen(token) + 1, "counter hints list"); data/psautohint-2.1.0/libpsautohint/src/fontinfo.c:37:9: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(fontinfostr) != 0) { data/psautohint-2.1.0/libpsautohint/src/fontinfo.c:48:9: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(fontinfostr) != 0) data/psautohint-2.1.0/libpsautohint/src/fontinfo.c:238:9: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(initline) == 0) data/psautohint-2.1.0/libpsautohint/src/fontinfo.c:425:45: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). size_t matchLen = NUMMAX(kwLen, strlen(info->keys[i])); data/psautohint-2.1.0/libpsautohint/src/fontinfo.c:429:17: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(info->values[i], tkstart, current - tkstart); data/psautohint-2.1.0/libpsautohint/src/logging.c:35:9: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(gGlyphName) > 0) data/psautohint-2.1.0/libpsautohint/src/logging.c:36:23: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). snprintf(str, strlen(gGlyphName) + 3, "%s: ", gGlyphName); data/psautohint-2.1.0/libpsautohint/src/logging.c:39:21: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). vsnprintf(str + strlen(str), MAXMSGLEN, format, va); data/psautohint-2.1.0/libpsautohint/src/read.c:382:5: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(op, nm, len); data/psautohint-2.1.0/libpsautohint/src/read.c:430:21: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(gGlyphName, s, end); data/psautohint-2.1.0/libpsautohint/src/write.c:87:9: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(s1) + strlen(s2) + 1 > HINTMAXSTR) { data/psautohint-2.1.0/libpsautohint/src/write.c:87:22: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(s1) + strlen(s2) + 1 > HINTMAXSTR) { data/psautohint-2.1.0/python/psautohint/_psautohint.c:178:44: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). ACBuffer* output = ACBufferNew(4 * strlen(inData)); data/psautohint-2.1.0/python/psautohint/_psautohint.c:304:44: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). outGlyphs[i] = ACBufferNew(4 * strlen(inGlyphs[i])); ANALYSIS SUMMARY: Hits = 54 Lines analyzed = 13409 in approximately 0.33 seconds (40087 lines/second) Physical Source Lines of Code (SLOC) = 11177 Hits@level = [0] 42 [1] 24 [2] 18 [3] 0 [4] 12 [5] 0 Hits@level+ = [0+] 96 [1+] 54 [2+] 30 [3+] 12 [4+] 12 [5+] 0 Hits/KSLOC@level+ = [0+] 8.58907 [1+] 4.83135 [2+] 2.68408 [3+] 1.07363 [4+] 1.07363 [5+] 0 Dot directories skipped = 2 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.