Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/sfarklib-2.24/sfArkLib.h
Examining data/sfarklib-2.24/sfklDiff.cpp
Examining data/sfarklib-2.24/sfklFile.cpp
Examining data/sfarklib-2.24/sfklLPC.cpp
Examining data/sfarklib-2.24/sfklString.cpp
Examining data/sfarklib-2.24/sfklZip.cpp
Examining data/sfarklib-2.24/sfklCoding.cpp
Examining data/sfarklib-2.24/sfklCrunch.cpp
Examining data/sfarklib-2.24/wcc.h

FINAL RESULTS:

data/sfarklib-2.24/sfklCoding.cpp:266:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(MsgTxt, "File Header fails checksum!%s", CorruptedMsg);
data/sfarklib-2.24/sfklCoding.cpp:286:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(MsgTxt, "You need %s version %2.1f (or higher) to decompress this file (your version is %s) %s", 
data/sfarklib-2.24/sfklCoding.cpp:297:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(MsgTxt, "This file was created with %s %s.  Your version of %s (%s) can uncompress this file, "
data/sfarklib-2.24/sfklCoding.cpp:313:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
		sprintf(MsgTxt, "ERROR - Invalid EncodeCount (apparently %d) %s", EncodeCount, CorruptedMsg);
data/sfarklib-2.24/sfklCoding.cpp:331:9:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
        sprintf(MsgTxt, "ERROR - UnCrunchWin returned: %d %s", UnCrunchResult, CorruptedMsg);
data/sfarklib-2.24/sfklCoding.cpp:384:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
				sprintf(MsgTxt, "ERROR - Invalid Shift ChangePos (apparently %d) %s", ChangePos, CorruptedMsg);
data/sfarklib-2.24/sfklCoding.cpp:445:9:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
        sprintf(MsgTxt, "ERROR - UnCrunchWin returned: %d %s", UnCrunchResult, CorruptedMsg);
data/sfarklib-2.24/sfklCoding.cpp:553:4:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
	  sprintf(MsgTxt, "ERROR - Invalid length for Non-audio Block (apparently %d bytes) %s", n, CorruptedMsg);
data/sfarklib-2.24/sfklCoding.cpp:636:4:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
			sprintf(MsgTxt, "ERROR - Invalid length for %s file (apparently %ld bytes) %s", FileExt, n, CorruptedMsg);
data/sfarklib-2.24/sfklCoding.cpp:658:21:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
                    sprintf(MsgTxt, "Created license file: %s", OutFileName);
data/sfarklib-2.24/sfklCoding.cpp:668:21:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
                    sprintf(MsgTxt, "Created notes file: %s", OutFileName);
data/sfarklib-2.24/sfklCoding.cpp:789:4:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
			sprintf(MsgTxt, "Unknown Compression Method: %d%s", FileHeader->CompMethod, CorruptedMsg);
data/sfarklib-2.24/sfklCoding.cpp:828:9:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
        sprintf(MsgTxt, "CheckSum Fail!%s",CorruptedMsg);
data/sfarklib-2.24/sfklCoding.cpp:836:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(MsgTxt, "Created %s (%ld kb) successfully.", ReqOutFileName, Blk.TotBytesWritten/1024);
data/sfarklib-2.24/sfklFile.cpp:202:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(ErrDesc, "OS ERROR %d - Failed to %s: %s", ErrCode, ErrorMsg, FileName);
data/sfarklib-2.24/wcc.h:38:15:  [4] (shell) system:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
#error ENDIAN system undefined
data/sfarklib-2.24/sfklCoding.cpp:90:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char		ProgVersion[HDR_NAME_LEN];	// 21-25	Version string (nn.nn) that created this file (NOT terminated)
data/sfarklib-2.24/sfklCoding.cpp:91:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char		ProgName[HDR_VERS_LEN];		// 26-30	Signature "sfArk" (not terminated)
data/sfarklib-2.24/sfklCoding.cpp:96:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char		FileName[MAX_FILENAME];		// 42-297	Original filename, no path (stored variable length, null terminated)
data/sfarklib-2.24/sfklCoding.cpp:174:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char	CreatedByProg[HDR_NAME_LEN +1],  CreatedByVersion[HDR_VERS_LEN +1];
data/sfarklib-2.24/sfklCoding.cpp:212:22:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      #define CPF(f) memcpy(&(FileHeader->f), bptr, sizeof(FileHeader->f)); bptr += sizeof(FileHeader->f)
data/sfarklib-2.24/sfklCoding.cpp:220:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(bpFileHeader, HdrBuf, V2_FILEHEADER_SIZE);	// Copy entire data block to structure
data/sfarklib-2.24/sfklCoding.cpp:260:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(MsgTxt, "This file was created with sfArk V1, and this program only handles sfArk V2+ files.  Unfortunately sfArk V1 uses a proprietary compression algorithm for the non-audio metadata, so we cannot really support that. You might try running the Windows sfArk program from http://melodymachine.com/sfark.htm under Wine."); 
data/sfarklib-2.24/sfklCoding.cpp:272:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(MsgTxt, "This does not appear to be a sfArk file!");
data/sfarklib-2.24/sfklCoding.cpp:650:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		char OutFileName[MAX_FILENAME];
data/sfarklib-2.24/sfklCoding.cpp:680:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char	OutFileName[MAX_FILEPATH];	// File name for current output file
data/sfarklib-2.24/sfklDiff.cpp:59:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(OutBuf, InBuf, bufsize*sizeof(AWORD));  
data/sfarklib-2.24/sfklFile.cpp:55:31:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
#define	CREATEFILE(filename) 	fopen(filename, "wb")
data/sfarklib-2.24/sfklFile.cpp:56:28:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
#define OPENFILE(filename)	fopen(filename, "rb")
data/sfarklib-2.24/sfklFile.cpp:68:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char	InFileName[SFARKLIB_MAX_FILEPATH];							// current input file name
data/sfarklib-2.24/sfklFile.cpp:69:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char	OutFileName[SFARKLIB_MAX_FILEPATH];							// ... and output file name
data/sfarklib-2.24/sfklFile.cpp:197:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char	ErrDesc[MAX_MSGTEXT];
data/sfarklib-2.24/sfklZip.cpp:33:9:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
        sprintf(MsgTxt, "ZLIB uncompress failed: %d", Result);
data/sfarklib-2.24/wcc.h:73:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char	MsgTxt[MAX_MSGTEXT];				// Used with sprintf to build message									// Text buffer for msg()
data/sfarklib-2.24/sfklCoding.cpp:152:10:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	int n = strlen(OutFileName);
data/sfarklib-2.24/sfklCoding.cpp:165:2:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
	strncpy(p, NewExt, OutFileNameSize-1 - n);
data/sfarklib-2.24/sfklCoding.cpp:230:69:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    HeaderLen = V2_FILEHEADER_SIZE - sizeof(FileHeader->FileName) + strlen(FileHeader->FileName) + 1;
data/sfarklib-2.24/sfklCoding.cpp:278:3:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
  strncpy(CreatedByProg, FileHeader->ProgName, HDR_NAME_LEN);			// Copy program name
data/sfarklib-2.24/sfklCoding.cpp:280:3:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
  strncpy(CreatedByVersion, FileHeader->ProgVersion, HDR_VERS_LEN);		// Copy version string
data/sfarklib-2.24/sfklCoding.cpp:651:3:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
		strncpy(OutFileName, Blk->FileHeader.FileName, sizeof(OutFileName));	// copy output filename
data/sfarklib-2.24/sfklCoding.cpp:739:9:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
        strncpy(OutFileName, ReqOutFileName, sizeof(OutFileName));			// Copy output filename
data/sfarklib-2.24/sfklFile.cpp:81:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  int lenInFileName = strlen(InFileName); 
data/sfarklib-2.24/sfklFile.cpp:89:5:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
    strncpy(OutFileName, FileName, sizeof(OutFileName));
data/sfarklib-2.24/sfklFile.cpp:92:7:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
      strncpy(OutFileName, InFileName, i+1);
data/sfarklib-2.24/sfklFile.cpp:93:7:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
      strncpy(OutFileName+i+1, FileName, sizeof(OutFileName) - (i+1));
data/sfarklib-2.24/sfklFile.cpp:96:3:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
  strncpy(OutFileName, FileName, sizeof(OutFileName));
data/sfarklib-2.24/sfklFile.cpp:110:3:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
  strncpy(InFileName, FileName, sizeof(InFileName));
data/sfarklib-2.24/sfklString.cpp:27:22:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  for(p = FileName + strlen(FileName); p > FileName &&  *p != '.'; p--) {}
data/sfarklib-2.24/sfklString.cpp:28:34:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if (*p == '.')  p = FileName + strlen(FileName);

ANALYSIS SUMMARY:

Hits = 49
Lines analyzed = 2349 in approximately 0.07 seconds (35152 lines/second)
Physical Source Lines of Code (SLOC) = 1494
Hits@level = [0]   7 [1]  15 [2]  18 [3]   0 [4]  16 [5]   0
Hits@level+ = [0+]  56 [1+]  49 [2+]  34 [3+]  16 [4+]  16 [5+]   0
Hits/KSLOC@level+ = [0+] 37.4833 [1+] 32.7979 [2+] 22.7577 [3+] 10.7095 [4+] 10.7095 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.