Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/qtpass-1.3.2/main/main.cpp
Examining data/qtpass-1.3.2/src/configdialog.cpp
Examining data/qtpass-1.3.2/src/configdialog.h
Examining data/qtpass-1.3.2/src/debughelper.h
Examining data/qtpass-1.3.2/src/deselectabletreeview.h
Examining data/qtpass-1.3.2/src/enums.h
Examining data/qtpass-1.3.2/src/executor.cpp
Examining data/qtpass-1.3.2/src/executor.h
Examining data/qtpass-1.3.2/src/filecontent.cpp
Examining data/qtpass-1.3.2/src/filecontent.h
Examining data/qtpass-1.3.2/src/imitatepass.cpp
Examining data/qtpass-1.3.2/src/imitatepass.h
Examining data/qtpass-1.3.2/src/keygendialog.cpp
Examining data/qtpass-1.3.2/src/keygendialog.h
Examining data/qtpass-1.3.2/src/mainwindow.cpp
Examining data/qtpass-1.3.2/src/mainwindow.h
Examining data/qtpass-1.3.2/src/pass.cpp
Examining data/qtpass-1.3.2/src/pass.h
Examining data/qtpass-1.3.2/src/passwordconfiguration.h
Examining data/qtpass-1.3.2/src/passworddialog.cpp
Examining data/qtpass-1.3.2/src/passworddialog.h
Examining data/qtpass-1.3.2/src/qprogressindicator.cpp
Examining data/qtpass-1.3.2/src/qprogressindicator.h
Examining data/qtpass-1.3.2/src/qpushbuttonasqrcode.cpp
Examining data/qtpass-1.3.2/src/qpushbuttonasqrcode.h
Examining data/qtpass-1.3.2/src/qpushbuttonwithclipboard.cpp
Examining data/qtpass-1.3.2/src/qpushbuttonwithclipboard.h
Examining data/qtpass-1.3.2/src/qtpass.cpp
Examining data/qtpass-1.3.2/src/qtpass.h
Examining data/qtpass-1.3.2/src/qtpasssettings.h
Examining data/qtpass-1.3.2/src/realpass.cpp
Examining data/qtpass-1.3.2/src/realpass.h
Examining data/qtpass-1.3.2/src/settingsconstants.cpp
Examining data/qtpass-1.3.2/src/settingsconstants.h
Examining data/qtpass-1.3.2/src/simpletransaction.cpp
Examining data/qtpass-1.3.2/src/simpletransaction.h
Examining data/qtpass-1.3.2/src/singleapplication.cpp
Examining data/qtpass-1.3.2/src/singleapplication.h
Examining data/qtpass-1.3.2/src/storemodel.cpp
Examining data/qtpass-1.3.2/src/storemodel.h
Examining data/qtpass-1.3.2/src/trayicon.cpp
Examining data/qtpass-1.3.2/src/trayicon.h
Examining data/qtpass-1.3.2/src/userinfo.h
Examining data/qtpass-1.3.2/src/usersdialog.cpp
Examining data/qtpass-1.3.2/src/usersdialog.h
Examining data/qtpass-1.3.2/src/util.cpp
Examining data/qtpass-1.3.2/src/util.h
Examining data/qtpass-1.3.2/src/qtpasssettings.cpp
Examining data/qtpass-1.3.2/tests/auto/ui/tst_ui.cpp
Examining data/qtpass-1.3.2/tests/auto/util/tst_util.cpp

FINAL RESULTS:

data/qtpass-1.3.2/main/main.cpp:80:29:  [4] (shell) system:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
  QString locale = QLocale::system().name();
data/qtpass-1.3.2/src/pass.cpp:324:33:  [4] (shell) system:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
    randval = QRandomGenerator::system()->generate();
data/qtpass-1.3.2/src/imitatepass.cpp:174:14:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  if (!gpgId.open(QIODevice::WriteOnly | QIODevice::Text)) {
data/qtpass-1.3.2/src/pass.cpp:276:14:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  if (!gpgId.open(QIODevice::ReadOnly | QIODevice::Text))
data/qtpass-1.3.2/src/pass.cpp:316:18:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    assert((fd = open("/dev/urandom", O_RDONLY)) >= 0);
data/qtpass-1.3.2/src/qtpass.cpp:172:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char dst[20] = {0};
data/qtpass-1.3.2/src/qtpass.cpp:188:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char message[256] = {0};
data/qtpass-1.3.2/src/pass.cpp:322:12:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    assert(read(fd, &randval, sizeof(randval)) == sizeof(randval));

ANALYSIS SUMMARY:

Hits = 8
Lines analyzed = 8024 in approximately 0.19 seconds (41661 lines/second)
Physical Source Lines of Code (SLOC) = 5432
Hits@level = [0]   0 [1]   1 [2]   5 [3]   0 [4]   2 [5]   0
Hits@level+ = [0+]   8 [1+]   8 [2+]   7 [3+]   2 [4+]   2 [5+]   0
Hits/KSLOC@level+ = [0+] 1.47275 [1+] 1.47275 [2+] 1.28866 [3+] 0.368189 [4+] 0.368189 [5+]   0
Symlinks skipped = 1 (--allowlink overrides but see doc for security issue)
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.