Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/doc/src/snippets/qtfeedbackdocsample/qtfeedbackdocsample.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/examples/hapticsplayer/hapticsplayer.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/examples/hapticsplayer/hapticsplayer.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/examples/hapticsplayer/main.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/examples/hapticsquare/hapticbutton.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/examples/hapticsquare/hapticbutton.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/examples/hapticsquare/hapticsquare.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/examples/hapticsquare/hapticsquare.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/examples/hapticsquare/main.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/include/QtFeedback/0.0.0/QtFeedback/private/qfeedbackeffect_p.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/include/QtFeedback/0.0.0/QtFeedback/private/qfeedbackplugin_p.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/include/QtFeedback/qfeedbackactuator.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/include/QtFeedback/qfeedbackeffect.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/include/QtFeedback/qfeedbackglobal.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/include/QtFeedback/qfeedbackplugininterfaces.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/include/QtFeedback/qfeedbackpluginsearch.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/include/QtFeedback/qtfeedbackversion.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/feedback/qfeedbackactuator.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/feedback/qfeedbackactuator.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/feedback/qfeedbackeffect.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/feedback/qfeedbackeffect.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/feedback/qfeedbackeffect_p.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/feedback/qfeedbackglobal.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/feedback/qfeedbackplugin.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/feedback/qfeedbackplugininterfaces.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/feedback/qfeedbackplugin_p.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/feedback/qfeedbackpluginsearch.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/imports/feedback/plugin.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/imports/feedback/qdeclarativefeedbackactuator.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/imports/feedback/qdeclarativefeedbackactuator_p.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/imports/feedback/qdeclarativefeedbackeffect.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/imports/feedback/qdeclarativefeedbackeffect_p.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/imports/feedback/qdeclarativefileeffect.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/imports/feedback/qdeclarativefileeffect_p.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/imports/feedback/qdeclarativehapticseffect.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/imports/feedback/qdeclarativehapticseffect_p.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/imports/feedback/qdeclarativethemeeffect.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/imports/feedback/qdeclarativethemeeffect_p.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/plugins/feedback/immersion/qfeedback.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/plugins/feedback/immersion/qfeedback.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/plugins/feedback/meegotouch/qfeedback.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/plugins/feedback/meegotouch/qfeedback.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/plugins/feedback/mmk/qfeedback.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/plugins/feedback/mmk/qfeedback.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/tests/auto/cmake/test_modules/main.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/tests/auto/qdeclarativefeedback/tst_qdeclarativefeedback.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/tests/auto/qfeedbackactuator/tst_qfeedbackactuator.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/tests/auto/qfeedbackhapticseffect/tst_qfeedbackhapticseffect.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/tests/auto/qfeedbackmmk/tst_qfeedbackmmk.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/tests/auto/qfeedbackplugin/testplugin2/qfeedbacktestplugin.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/tests/auto/qfeedbackplugin/testplugin2/qfeedbacktestplugin.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/tests/auto/qfeedbackplugin/testplugin3/qfeedbacktestplugin.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/tests/auto/qfeedbackplugin/testplugin3/qfeedbacktestplugin.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/tests/auto/qfeedbackplugin/testplugin/qfeedbacktestplugin.cpp
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/tests/auto/qfeedbackplugin/testplugin/qfeedbacktestplugin.h
Examining data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/tests/auto/qfeedbackplugin/unittest/tst_qfeedbackplugin.cpp
FINAL RESULTS:
data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/plugins/feedback/immersion/qfeedback.cpp:104:13: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char szDeviceName[VIBE_MAX_DEVICE_NAME_LENGTH] = { 0 };
data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/src/plugins/feedback/immersion/qfeedback.cpp:350:53: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (file.size() < MAX_FILE_SIZE && file.open(QIODevice::ReadOnly)) {
data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/tests/auto/qdeclarativefeedback/tst_qdeclarativefeedback.cpp:174:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
QCOMPARE(p.read(dte).value<int>(), (int)QFeedbackEffect::Press);
data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/tests/auto/qdeclarativefeedback/tst_qdeclarativefeedback.cpp:177:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
QCOMPARE(p.read(dte).value<bool>(), QFeedbackEffect::supportsThemeEffect());
data/qtfeedback-opensource-src-5.0~git20180329.a14bd0bb/tests/auto/qdeclarativefeedback/tst_qdeclarativefeedback.cpp:189:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
QCOMPARE(p.read(dte).value<int>(), (int)QFeedbackEffect::Press);
ANALYSIS SUMMARY:
Hits = 5
Lines analyzed = 7528 in approximately 0.27 seconds (28122 lines/second)
Physical Source Lines of Code (SLOC) = 3413
Hits@level = [0] 0 [1] 3 [2] 2 [3] 0 [4] 0 [5] 0
Hits@level+ = [0+] 5 [1+] 5 [2+] 2 [3+] 0 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 1.46499 [1+] 1.46499 [2+] 0.585995 [3+] 0 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.