Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/pvrg-jpeg-1.2.1+dfsg1/leedct.c Examining data/pvrg-jpeg-1.2.1+dfsg1/tables.h Examining data/pvrg-jpeg-1.2.1+dfsg1/chendct.c Examining data/pvrg-jpeg-1.2.1+dfsg1/param.h Examining data/pvrg-jpeg-1.2.1+dfsg1/lexer.c Examining data/pvrg-jpeg-1.2.1+dfsg1/codec.c Examining data/pvrg-jpeg-1.2.1+dfsg1/marker.h Examining data/pvrg-jpeg-1.2.1+dfsg1/csize.h Examining data/pvrg-jpeg-1.2.1+dfsg1/dct.h Examining data/pvrg-jpeg-1.2.1+dfsg1/stream.h Examining data/pvrg-jpeg-1.2.1+dfsg1/globals.h Examining data/pvrg-jpeg-1.2.1+dfsg1/prototypes.h Examining data/pvrg-jpeg-1.2.1+dfsg1/system.h Examining data/pvrg-jpeg-1.2.1+dfsg1/io.c Examining data/pvrg-jpeg-1.2.1+dfsg1/stream.c Examining data/pvrg-jpeg-1.2.1+dfsg1/transform.c Examining data/pvrg-jpeg-1.2.1+dfsg1/marker.c Examining data/pvrg-jpeg-1.2.1+dfsg1/huffman.c Examining data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c FINAL RESULTS: data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:379:4: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(CImage->StreamFileName,"%s.jpg", data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:2103:4: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(CFrame->ComponentFileName[CScan->ci[i]],"%s.%d.%d%s", data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:2110:4: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(CFrame->ComponentFileName[CScan->ci[i]],"%s.%d%s", data/pvrg-jpeg-1.2.1+dfsg1/lexer.c:456:3: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(temp->lid->name,str); /* Copy key */ data/pvrg-jpeg-1.2.1+dfsg1/globals.h:138:1: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char *ComponentFileName[MAXIMUM_COMPONENTS]; /* image component file names */ data/pvrg-jpeg-1.2.1+dfsg1/io.c:174:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char header[128]; data/pvrg-jpeg-1.2.1+dfsg1/io.c:231:5: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). open(CFrame->ComponentFileName[CScan->ci[index]], data/pvrg-jpeg-1.2.1+dfsg1/io.c:473:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(buffer->space,buffer->bptr,diff); /* Move buffer down. */ data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:158:17: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). ComponentIndex=atoi(argv[++i]); data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:178:32: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). LosslessPredictorType = atoi(argv[++i]); data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:190:7: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). atoi(argv[++i]); data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:199:7: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). atoi(argv[++i]); data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:218:27: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). CFrame->GlobalWidth = atoi(argv[++i]); data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:226:28: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). CFrame->GlobalHeight = atoi(argv[++i]); data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:243:3: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). atoi(argv[++i]); data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:252:15: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). Loud = atoi(argv[++i]); data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:278:32: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). CFrame->DataPrecision = atoi(argv[++i]); data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:287:33: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). CFrame->ResyncInterval = atoi(argv[++i]); data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:296:20: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). CFrame->Q = atoi(argv[++i]); data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:304:37: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). CFrame->vf[ComponentIndex] = atoi(argv[++i]); data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:320:23: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). PointTransform=atoi(argv[++i]); data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:2081:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char ext[8]; data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:2090:7: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(ext,".pgm"); data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:2239:16: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if ((test = fopen(CFrame->ComponentFileName[CScan->ci[i]], data/pvrg-jpeg-1.2.1+dfsg1/lexer.c:228:13: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). yyint = atoi(yytext); data/pvrg-jpeg-1.2.1+dfsg1/lexer.c:1812:1: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char yytext[YYLMAX]; data/pvrg-jpeg-1.2.1+dfsg1/lexer.c:1814:1: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char yysbuf[YYLMAX]; data/pvrg-jpeg-1.2.1+dfsg1/stream.c:364:15: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if ((srin = fopen(filename,"r"))==NULL) data/pvrg-jpeg-1.2.1+dfsg1/stream.c:423:16: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if ((swout = fopen(filename,"w+"))==NULL) data/pvrg-jpeg-1.2.1+dfsg1/system.h:72:1: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char header[128]; /* Header textfield */ data/pvrg-jpeg-1.2.1+dfsg1/io.c:484:17: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). if ((retval = read(buffer->iob->file, /* Do the read */ data/pvrg-jpeg-1.2.1+dfsg1/io.c:1200:11: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). rsize = read(Iob->file, timage, tsize); data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:377:22: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). (char *) calloc(strlen(CFrame->ComponentFileName[CFrame->cn[0]])+6, data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:2102:22: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). (char *) calloc(strlen(CImage->StreamFileName)+20,sizeof(char)); data/pvrg-jpeg-1.2.1+dfsg1/jpeg.c:2109:22: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). (char *) calloc(strlen(CImage->StreamFileName)+12,sizeof(char)); data/pvrg-jpeg-1.2.1+dfsg1/lexer.c:28:56: [1] (buffer) getc: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). # define input() (((yytchar=yysptr>yysbuf?U(*--yysptr):getc(yyin))==10?(yylineno++,yytchar):yytchar)==EOF?0:yytchar) data/pvrg-jpeg-1.2.1+dfsg1/lexer.c:383:21: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). enter(i,*sptr,strlen(*sptr)); /* Put reserved words in */ data/pvrg-jpeg-1.2.1+dfsg1/lexer.c:553:28: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (!(tmp=(char *)calloc(strlen(yytext)+1,sizeof(char)))) /* Make space */ data/pvrg-jpeg-1.2.1+dfsg1/stream.c:96:5: [1] (access) umask: Ensure that umask is given most restrictive possible setting (e.g., 066 or 077) (CWE-732). int umask[] = { /* This is -1 XOR 2^{i+1}-1 */ data/pvrg-jpeg-1.2.1+dfsg1/stream.c:274:26: [1] (buffer) getc: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). {BEGIN("bgetc");return(getc(srin));} data/pvrg-jpeg-1.2.1+dfsg1/stream.c:283:31: [1] (buffer) getc: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). {BEGIN("bgetw"); int fu; fu=getc(srin); return ((fu << 8)| getc(srin));} data/pvrg-jpeg-1.2.1+dfsg1/stream.c:283:62: [1] (buffer) getc: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). {BEGIN("bgetw"); int fu; fu=getc(srin); return ((fu << 8)| getc(srin));} data/pvrg-jpeg-1.2.1+dfsg1/stream.c:525:28: [1] (buffer) getc: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). current_write_byte = getc(swout); /* if within bounds, then read byte */ ANALYSIS SUMMARY: Hits = 43 Lines analyzed = 11565 in approximately 0.31 seconds (37439 lines/second) Physical Source Lines of Code (SLOC) = 8749 Hits@level = [0] 373 [1] 13 [2] 26 [3] 0 [4] 4 [5] 0 Hits@level+ = [0+] 416 [1+] 43 [2+] 30 [3+] 4 [4+] 4 [5+] 0 Hits/KSLOC@level+ = [0+] 47.5483 [1+] 4.91485 [2+] 3.42896 [3+] 0.457195 [4+] 0.457195 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.