Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/r-cran-ff-4.0.4+ds/src/config.h
Examining data/r-cran-ff-4.0.4+ds/src/FSInfo_win32.cpp
Examining data/r-cran-ff-4.0.4+ds/src/r_ff_addgetset.h
Examining data/r-cran-ff-4.0.4+ds/src/utk_file_resize_win32.hpp
Examining data/r-cran-ff-4.0.4+ds/src/r_ff_makevmodes.h
Examining data/r-cran-ff-4.0.4+ds/src/FSInfo_statfs.cpp
Examining data/r-cran-ff-4.0.4+ds/src/Win32FileMapping.hpp
Examining data/r-cran-ff-4.0.4+ds/src/utk_config.hpp
Examining data/r-cran-ff-4.0.4+ds/src/ff.cpp
Examining data/r-cran-ff-4.0.4+ds/src/Error.hpp
Examining data/r-cran-ff-4.0.4+ds/src/r_ff_methodswitch.h
Examining data/r-cran-ff-4.0.4+ds/src/utk_file_resize_ftruncate.hpp
Examining data/r-cran-ff-4.0.4+ds/src/utk_file_allocate_fseek.cpp
Examining data/r-cran-ff-4.0.4+ds/src/Error.cpp
Examining data/r-cran-ff-4.0.4+ds/src/MMapFileMapping.hpp
Examining data/r-cran-ff-4.0.4+ds/src/MMapFileMapping.cpp
Examining data/r-cran-ff-4.0.4+ds/src/utk_file_resize.cpp
Examining data/r-cran-ff-4.0.4+ds/src/ordermerge.c
Examining data/r-cran-ff-4.0.4+ds/src/utk_file_resize.hpp
Examining data/r-cran-ff-4.0.4+ds/src/utk_file_allocate_fseek.hpp
Examining data/r-cran-ff-4.0.4+ds/src/r_ff_methoddeclaration.h
Examining data/r-cran-ff-4.0.4+ds/src/r_file_resize.h
Examining data/r-cran-ff-4.0.4+ds/src/r_ff.h
Examining data/r-cran-ff-4.0.4+ds/src/FileMapping.hpp
Examining data/r-cran-ff-4.0.4+ds/src/utk_platform_macros.hpp
Examining data/r-cran-ff-4.0.4+ds/src/r_ff.c
Examining data/r-cran-ff-4.0.4+ds/src/r_file_resize.cpp
Examining data/r-cran-ff-4.0.4+ds/src/Array.hpp
Examining data/r-cran-ff-4.0.4+ds/src/Win32FileMapping.cpp
Examining data/r-cran-ff-4.0.4+ds/src/ff.h
Examining data/r-cran-ff-4.0.4+ds/src/FSInfo.hpp
Examining data/r-cran-ff-4.0.4+ds/src/types.hpp

FINAL RESULTS:

data/r-cran-ff-4.0.4+ds/src/FSInfo_win32.cpp:52:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char dir[MAX_PATH], *p;
data/r-cran-ff-4.0.4+ds/src/MMapFileMapping.cpp:112:9:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  _fd = open(path, flags, 0777);
data/r-cran-ff-4.0.4+ds/src/utk_file_allocate_fseek.cpp:37:15:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    FILE* f = fopen(path,"w");
data/r-cran-ff-4.0.4+ds/src/utk_file_resize_ftruncate.hpp:31:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  int fd = open(path, O_RDWR|O_CREAT, 0644);
data/r-cran-ff-4.0.4+ds/src/FSInfo_win32.cpp:53:3:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
  strncpy(dir, path, 10); p = strchr(dir, '/');
data/r-cran-ff-4.0.4+ds/src/ordermerge.c:20:9:  [1] (buffer) equal:
  Function does not check the second iterator for over-read conditions
  (CWE-126). This function is often discouraged by most C++ coding standards
  in favor of its safer alternatives provided since C++14. Consider using a
  form of this function that checks the second iterator before potentially
  overflowing it.
#define equal(a,b) a==b
data/r-cran-ff-4.0.4+ds/src/ordermerge.c:25:24:  [1] (buffer) equal:
  Function does not check the second iterator for over-read conditions
  (CWE-126). This function is often discouraged by most C++ coding standards
  in favor of its safer alternatives provided since C++14. Consider using a
  form of this function that checks the second iterator before potentially
  overflowing it.
#define keyequal(A,B) (equal(key(A),key(B)))
data/r-cran-ff-4.0.4+ds/src/ordermerge.c:1414:15:  [1] (buffer) equal:
  Function does not check the second iterator for over-read conditions
  (CWE-126). This function is often discouraged by most C++ coding standards
  in favor of its safer alternatives provided since C++14. Consider using a
  form of this function that checks the second iterator before potentially
  overflowing it.
          if (equal(data[index[i]], v)){
data/r-cran-ff-4.0.4+ds/src/ordermerge.c:1417:27:  [1] (buffer) equal:
  Function does not check the second iterator for over-read conditions
  (CWE-126). This function is often discouraged by most C++ coding standards
  in favor of its safer alternatives provided since C++14. Consider using a
  form of this function that checks the second iterator before potentially
  overflowing it.
            while(i<=r && equal(data[index[i]], v)){
data/r-cran-ff-4.0.4+ds/src/ordermerge.c:1692:15:  [1] (buffer) equal:
  Function does not check the second iterator for over-read conditions
  (CWE-126). This function is often discouraged by most C++ coding standards
  in favor of its safer alternatives provided since C++14. Consider using a
  form of this function that checks the second iterator before potentially
  overflowing it.
          if (equal(data[index[i]], v)){
data/r-cran-ff-4.0.4+ds/src/ordermerge.c:1695:27:  [1] (buffer) equal:
  Function does not check the second iterator for over-read conditions
  (CWE-126). This function is often discouraged by most C++ coding standards
  in favor of its safer alternatives provided since C++14. Consider using a
  form of this function that checks the second iterator before potentially
  overflowing it.
            while(i<=r && equal(data[index[i]], v)){

ANALYSIS SUMMARY:

Hits = 11
Lines analyzed = 13085 in approximately 0.34 seconds (38477 lines/second)
Physical Source Lines of Code (SLOC) = 9823
Hits@level = [0]   0 [1]   7 [2]   4 [3]   0 [4]   0 [5]   0
Hits@level+ = [0+]  11 [1+]  11 [2+]   4 [3+]   0 [4+]   0 [5+]   0
Hits/KSLOC@level+ = [0+] 1.11982 [1+] 1.11982 [2+] 0.407208 [3+]   0 [4+]   0 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.