Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/pyodbc-4.0.30/src/connection.h
Examining data/pyodbc-4.0.30/src/pyodbcmodule.h
Examining data/pyodbc-4.0.30/src/getdata.cpp
Examining data/pyodbc-4.0.30/src/pyodbccompat.cpp
Examining data/pyodbc-4.0.30/src/cnxninfo.cpp
Examining data/pyodbc-4.0.30/src/wrapper.h
Examining data/pyodbc-4.0.30/src/pyodbc.h
Examining data/pyodbc-4.0.30/src/params.h
Examining data/pyodbc-4.0.30/src/pyodbcmodule.cpp
Examining data/pyodbc-4.0.30/src/textenc.h
Examining data/pyodbc-4.0.30/src/dbspecific.h
Examining data/pyodbc-4.0.30/src/errors.h
Examining data/pyodbc-4.0.30/src/pyodbccompat.h
Examining data/pyodbc-4.0.30/src/textenc.cpp
Examining data/pyodbc-4.0.30/src/buffer.cpp
Examining data/pyodbc-4.0.30/src/cursor.h
Examining data/pyodbc-4.0.30/src/buffer.h
Examining data/pyodbc-4.0.30/src/resource.h
Examining data/pyodbc-4.0.30/src/errors.cpp
Examining data/pyodbc-4.0.30/src/pyodbcdbg.cpp
Examining data/pyodbc-4.0.30/src/connection.cpp
Examining data/pyodbc-4.0.30/src/cnxninfo.h
Examining data/pyodbc-4.0.30/src/getdata.h
Examining data/pyodbc-4.0.30/src/row.h
Examining data/pyodbc-4.0.30/src/params.cpp
Examining data/pyodbc-4.0.30/src/cursor.cpp
Examining data/pyodbc-4.0.30/src/row.cpp

FINAL RESULTS:

data/pyodbc-4.0.30/src/pyodbcdbg.cpp:98:5:  [4] (format) vprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
    vprintf(szFmt, marker);
data/pyodbc-4.0.30/src/cnxninfo.cpp:123:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char szVer[20];
data/pyodbc-4.0.30/src/cnxninfo.cpp:132:33:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
            p->odbc_major=(char)atoi(szVer);
data/pyodbc-4.0.30/src/cnxninfo.cpp:133:33:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
            p->odbc_minor=(char)atoi(dot + 1);
data/pyodbc-4.0.30/src/cnxninfo.cpp:137:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char szYN[2];
data/pyodbc-4.0.30/src/connection.cpp:807:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char szBuffer[0x1000];
data/pyodbc-4.0.30/src/connection.cpp:979:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char sz[8] = { 0 };
data/pyodbc-4.0.30/src/connection.cpp:1116:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(&types[i], &types[i+1], move * sizeof(SQLSMALLINT));
data/pyodbc-4.0.30/src/connection.cpp:1117:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(&funcs[i], &funcs[i+1], move * sizeof(PyObject*));
data/pyodbc-4.0.30/src/connection.cpp:1182:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(&newtypes[1], oldtypes, sizeof(SQLSMALLINT) * oldcount);
data/pyodbc-4.0.30/src/connection.cpp:1183:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(&newfuncs[1], oldfuncs, sizeof(PyObject*) * oldcount);
data/pyodbc-4.0.30/src/connection.cpp:1351:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char lower[30];
data/pyodbc-4.0.30/src/errors.cpp:245:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char sqlstate[6] = "";
data/pyodbc-4.0.30/src/errors.cpp:365:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char szActual[6];
data/pyodbc-4.0.30/src/getdata.cpp:431:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char ascii[100];
data/pyodbc-4.0.30/src/params.cpp:316:13:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
            memcpy(*outbuf, PyBytes_AS_STRING(cell), len);
data/pyodbc-4.0.30/src/params.cpp:362:17:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                memcpy(*outbuf, PyBytes_AS_STRING((PyObject*)encoded), len);
data/pyodbc-4.0.30/src/params.cpp:387:17:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                memcpy(*outbuf, PyUnicode_AS_DATA(cell), len);
data/pyodbc-4.0.30/src/params.cpp:473:13:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
            memcpy(*outbuf, PyByteArray_AS_STRING(cell), len);
data/pyodbc-4.0.30/src/params.cpp:504:13:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
            memcpy(*outbuf, pb, len);
data/pyodbc-4.0.30/src/params.cpp:519:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(*outbuf, PyBytes_AS_STRING(b.Get()), sizeof(SQLGUID));
data/pyodbc-4.0.30/src/params.cpp:1040:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(info.ParameterValuePtr, PyBytes_AS_STRING(b.Get()), sizeof(SQLGUID));
data/pyodbc-4.0.30/src/pyodbccompat.h:147:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(buffer, PyUnicode_AS_UNICODE(o), cch * sizeof(Py_UNICODE));
data/pyodbc-4.0.30/src/row.cpp:298:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(&buffer[offset], Text_Buffer(item), Text_Size(item) * sizeof(TEXT_T));
data/pyodbc-4.0.30/src/params.cpp:1014:25:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    I(pch == 0 || (int)(strlen(pch) + 1) == len);
data/pyodbc-4.0.30/src/params.cpp:1099:38:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    info.StrLen_or_Ind = (SQLINTEGER)strlen((char*)info.ParameterValuePtr);
data/pyodbc-4.0.30/src/pyodbccompat.cpp:15:37:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    Py_ssize_t cchRHS = (Py_ssize_t)strlen(rhs);

ANALYSIS SUMMARY:

Hits = 27
Lines analyzed = 11319 in approximately 0.25 seconds (44451 lines/second)
Physical Source Lines of Code (SLOC) = 8387
Hits@level = [0]  11 [1]   3 [2]  23 [3]   0 [4]   1 [5]   0
Hits@level+ = [0+]  38 [1+]  27 [2+]  24 [3+]   1 [4+]   1 [5+]   0
Hits/KSLOC@level+ = [0+] 4.53082 [1+] 3.21927 [2+] 2.86157 [3+] 0.119232 [4+] 0.119232 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.