Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/qsynth-0.6.3/src/qsynthSetupForm.h
Examining data/qsynth-0.6.3/src/qsynthChannelsForm.h
Examining data/qsynth-0.6.3/src/qsynthTabBar.cpp
Examining data/qsynth-0.6.3/src/qsynthChannels.cpp
Examining data/qsynth-0.6.3/src/qsynthSetup.cpp
Examining data/qsynth-0.6.3/src/qsynthEngine.cpp
Examining data/qsynth-0.6.3/src/qsynth.h
Examining data/qsynth-0.6.3/src/qsynthPaletteForm.h
Examining data/qsynth-0.6.3/src/qsynthMainForm.h
Examining data/qsynth-0.6.3/src/qsynthOptions.h
Examining data/qsynth-0.6.3/src/qsynthOptions.cpp
Examining data/qsynth-0.6.3/src/qsynthAbout.h
Examining data/qsynth-0.6.3/src/qsynthDialPeppinoStyle.h
Examining data/qsynth-0.6.3/src/qsynthAboutForm.h
Examining data/qsynth-0.6.3/src/qsynthKnob.cpp
Examining data/qsynth-0.6.3/src/qsynthMessagesForm.cpp
Examining data/qsynth-0.6.3/src/qsynthSystemTray.cpp
Examining data/qsynth-0.6.3/src/qsynthPresetForm.h
Examining data/qsynth-0.6.3/src/qsynthSetup.h
Examining data/qsynth-0.6.3/src/qsynthEngine.h
Examining data/qsynth-0.6.3/src/qsynthDialSkulptureStyle.cpp
Examining data/qsynth-0.6.3/src/qsynthChannels.h
Examining data/qsynth-0.6.3/src/qsynthSystemTray.h
Examining data/qsynth-0.6.3/src/qsynthDialClassicStyle.cpp
Examining data/qsynth-0.6.3/src/qsynthDialVokiStyle.h
Examining data/qsynth-0.6.3/src/qsynthMessagesForm.h
Examining data/qsynth-0.6.3/src/qsynthDialVokiStyle.cpp
Examining data/qsynth-0.6.3/src/qsynthDialPeppinoStyle.cpp
Examining data/qsynth-0.6.3/src/qsynthDialClassicStyle.h
Examining data/qsynth-0.6.3/src/qsynth.cpp
Examining data/qsynth-0.6.3/src/qsynthPresetForm.cpp
Examining data/qsynth-0.6.3/src/qsynthChannelsForm.cpp
Examining data/qsynth-0.6.3/src/qsynthKnob.h
Examining data/qsynth-0.6.3/src/qsynthOptionsForm.cpp
Examining data/qsynth-0.6.3/src/qsynthMeter.cpp
Examining data/qsynth-0.6.3/src/qsynthOptionsForm.h
Examining data/qsynth-0.6.3/src/qsynthMainForm.cpp
Examining data/qsynth-0.6.3/src/qsynthPaletteForm.cpp
Examining data/qsynth-0.6.3/src/qsynthAboutForm.cpp
Examining data/qsynth-0.6.3/src/qsynthDialSkulptureStyle.h
Examining data/qsynth-0.6.3/src/qsynthMeter.h
Examining data/qsynth-0.6.3/src/qsynthTabBar.h
Examining data/qsynth-0.6.3/src/qsynthSetupForm.cpp
FINAL RESULTS:
data/qsynth-0.6.3/src/qsynth.cpp:432:2: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
snprintf(cmd, sizeof(cmd), format, (int) getpid());
data/qsynth-0.6.3/src/qsynth.cpp:442:3: [4] (shell) execl:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
execl(shell, shell, "-c", cmd, nullptr);
data/qsynth-0.6.3/src/qsynthDialSkulptureStyle.cpp:216:20: [4] (format) sprintf:
Potential format string problem (CWE-134). Make format string constant.
pixmapName.sprintf("scp-qdb-%x-%x-%llx-%x", state, option->direction, option->palette.cacheKey(), d);
data/qsynth-0.6.3/src/qsynthDialSkulptureStyle.cpp:368:20: [4] (format) sprintf:
Potential format string problem (CWE-134). Make format string constant.
pixmapName.sprintf("scp-isg-%x-%x-%s-%x-%x", state, option->direction, colorName.constData(), option->rect.width(), option->rect.height());
data/qsynth-0.6.3/src/qsynth.cpp:210:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char szHostName[255];
data/qsynth-0.6.3/src/qsynth.cpp:423:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cmd[80];
data/qsynth-0.6.3/src/qsynthMainForm.cpp:368:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
::memcpy(pNewSoundFont, pSoundFont, sizeof(fluid_sfont_t));
data/qsynth-0.6.3/src/qsynthMainForm.cpp:1019:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char achBuffer[1024];
data/qsynth-0.6.3/src/qsynthMessagesForm.cpp:142:23: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (m_pMessagesLog->open(QIODevice::Text | QIODevice::Append)) {
data/qsynth-0.6.3/src/qsynth.cpp:386:37: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
const QByteArray data = pSocket->read(nread);
data/qsynth-0.6.3/src/qsynthMainForm.cpp:988:8: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (::read(g_fdSigterm[1], &c, sizeof(c)) > 0)
data/qsynth-0.6.3/src/qsynthMainForm.cpp:1021:18: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
int cchRead = ::read(fd, achBuffer, cchBuffer);
data/qsynth-0.6.3/src/qsynthMainForm.cpp:1025:29: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
cchRead = (bBlock ? 0 : ::read(fd, achBuffer, cchBuffer));
ANALYSIS SUMMARY:
Hits = 13
Lines analyzed = 13204 in approximately 0.30 seconds (44639 lines/second)
Physical Source Lines of Code (SLOC) = 8934
Hits@level = [0] 4 [1] 4 [2] 5 [3] 0 [4] 4 [5] 0
Hits@level+ = [0+] 17 [1+] 13 [2+] 9 [3+] 4 [4+] 4 [5+] 0
Hits/KSLOC@level+ = [0+] 1.90284 [1+] 1.45512 [2+] 1.00739 [3+] 0.447728 [4+] 0.447728 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.