Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/rarpd-0.981107/rarpd.c

FINAL RESULTS:

data/rarpd-0.981107/rarpd.c:214:6:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
					sprintf(tmpa, "%s", inet_ntoa(*(struct in_addr*)&addr));
data/rarpd-0.981107/rarpd.c:613:16:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((opt = getopt(argc, argv, "aAb:dvoe")) != EOF) {
data/rarpd-0.981107/rarpd.c:63:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char		name[IFNAMSIZ];
data/rarpd-0.981107/rarpd.c:165:4:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			memcpy(ifl->lladdr, ifrp->ifr_hwaddr.sa_data, sizeof(u_int8_t) * ETH_ALEN);
data/rarpd-0.981107/rarpd.c:213:6:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
					char tmpa[64];
data/rarpd-0.981107/rarpd.c:234:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char name[9];
data/rarpd-0.981107/rarpd.c:236:2:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
	sprintf(name, "%08X", (__u32)ntohl(addr));
data/rarpd-0.981107/rarpd.c:311:4:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
			char ename[256];
data/rarpd-0.981107/rarpd.c:331:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
				memcpy(emap.lladdr, lladdr, sizeof(u_int8_t) * ETH_ALEN);
data/rarpd-0.981107/rarpd.c:369:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(*ptr_p, ifl->lladdr, alen);
data/rarpd-0.981107/rarpd.c:393:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(*ptr_p, &laddr, 4);
data/rarpd-0.981107/rarpd.c:419:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(req.arp_ha.sa_data, lladdr, lllen);
data/rarpd-0.981107/rarpd.c:420:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(req.arp_dev, ifl->name, IFNAMSIZ);
data/rarpd-0.981107/rarpd.c:432:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char buf[1024];
data/rarpd-0.981107/rarpd.c:439:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char tmpbuf[16 * 3], tmpname[IFNAMSIZ];
data/rarpd-0.981107/rarpd.c:482:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
				sprintf(ptr, ":%02x", sll.sll_addr[i]);
data/rarpd-0.981107/rarpd.c:485:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
				sprintf(ptr, "%02x", sll.sll_addr[i]);
data/rarpd-0.981107/rarpd.c:495:4:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
			sprintf(tmpname, "if%d", sll.sll_ifindex);
data/rarpd-0.981107/rarpd.c:566:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(ptr, &rmap->ipaddr, 4);
data/rarpd-0.981107/rarpd.c:721:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		fd = open("/dev/null", O_RDWR);
data/rarpd-0.981107/rarpd.c:166:4:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
			strncpy(ifl->name, ifrp->ifr_name, IFNAMSIZ);
data/rarpd-0.981107/rarpd.c:492:4:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
			strncpy(tmpname, ifl->name, IFNAMSIZ);
data/rarpd-0.981107/rarpd.c:660:3:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
		strncpy(ifr.ifr_name, ifname, IFNAMSIZ - 1);

ANALYSIS SUMMARY:

Hits = 23
Lines analyzed = 772 in approximately 0.03 seconds (28581 lines/second)
Physical Source Lines of Code (SLOC) = 643
Hits@level = [0]  31 [1]   3 [2]  18 [3]   1 [4]   1 [5]   0
Hits@level+ = [0+]  54 [1+]  23 [2+]  20 [3+]   2 [4+]   1 [5+]   0
Hits/KSLOC@level+ = [0+] 83.9813 [1+] 35.7698 [2+] 31.1042 [3+] 3.11042 [4+] 1.55521 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.