Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/sent-1/arg.h Examining data/sent-1/config.def.h Examining data/sent-1/drw.c Examining data/sent-1/drw.h Examining data/sent-1/sent.c Examining data/sent-1/util.c Examining data/sent-1/util.h FINAL RESULTS: data/sent-1/sent.c:153:3: [4] (shell) execlp: This causes a new program to execute and is difficult to use safely (CWE-78). try using a library call that implements the same functionality if available. execlp("sh", "sh", "-c", cmd, (char *)0); data/sent-1/util.c:24:2: [4] (format) vfprintf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. vfprintf(stderr, fmt, ap); data/sent-1/drw.c:14:23: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static const unsigned char utfbyte[UTF_SIZ + 1] = {0x80, 0, 0xC0, 0xE0, 0xF0}; data/sent-1/drw.c:15:23: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static const unsigned char utfmask[UTF_SIZ + 1] = {0xC0, 0x80, 0xE0, 0xF0, 0xF8}; data/sent-1/drw.c:240:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[1024]; data/sent-1/drw.c:303:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(buf, utf8str, len); data/sent-1/sent.c:178:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char hdr[16]; data/sent-1/sent.c:203:14: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if ((fdin = open(filename, O_RDONLY)) < 0) data/sent-1/sent.c:395:13: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if (!(fp = fopen(fname, "r"))) data/sent-1/sent.c:411:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[BUFSIZ], *p; data/sent-1/sent.c:607:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char *fstrs[LEN(fontfallbacks)]; data/sent-1/sent.c:693:18: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). else if (!(fp = fopen(fname = argv[0], "r"))) data/sent-1/sent.c:210:6: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). if (read(fdout, hdr, 16) != 16) data/sent-1/sent.c:222:62: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). s->img->buf = ecalloc(s->img->bufwidth * s->img->bufheight, strlen("888")); data/sent-1/sent.c:225:34: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). rowlen = s->img->bufwidth * 2 * strlen("RGBA"); data/sent-1/sent.c:236:12: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). count = read(fdout, (char *)row + nbytes, rowlen - nbytes); data/sent-1/sent.c:441:11: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). blen = strlen(buf); data/sent-1/util.c:27:20: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (fmt[0] && fmt[strlen(fmt)-1] == ':') { ANALYSIS SUMMARY: Hits = 18 Lines analyzed = 1332 in approximately 0.05 seconds (24818 lines/second) Physical Source Lines of Code (SLOC) = 1073 Hits@level = [0] 8 [1] 6 [2] 10 [3] 0 [4] 2 [5] 0 Hits@level+ = [0+] 26 [1+] 18 [2+] 12 [3+] 2 [4+] 2 [5+] 0 Hits/KSLOC@level+ = [0+] 24.2311 [1+] 16.7754 [2+] 11.1836 [3+] 1.86393 [4+] 1.86393 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.