Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/ssss-0.5/ssss.c

FINAL RESULTS:

data/ssss-0.5/ssss.c:570:14:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
  while((i = getopt(argc, argv, "vDhqQxs:t:n:w:")) != -1)
data/ssss-0.5/ssss.c:170:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char buf[MAXDEGREE / 8 + 1];
data/ssss-0.5/ssss.c:243:16:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  if ((cprng = open(RANDOM_SOURCE, O_RDONLY)) < 0)
data/ssss-0.5/ssss.c:255:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[MAXDEGREE / 8];
data/ssss-0.5/ssss.c:395:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[MAXLINELEN];
data/ssss-0.5/ssss.c:470:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[MAXLINELEN];
data/ssss-0.5/ssss.c:503:16:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    if (! (j = atoi(a)))
data/ssss-0.5/ssss.c:577:30:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    case 's': opt_security = atoi(optarg); break;
data/ssss-0.5/ssss.c:578:31:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    case 't': opt_threshold = atoi(optarg); break;
data/ssss-0.5/ssss.c:579:28:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    case 'n': opt_number = atoi(optarg); break;
data/ssss-0.5/ssss.c:140:9:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if (strlen(s) > degree / 4)
data/ssss-0.5/ssss.c:142:9:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if (strlen(s) < degree / 4)
data/ssss-0.5/ssss.c:150:9:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if (strlen(s) > degree / 8)
data/ssss-0.5/ssss.c:152:13:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    for(i = strlen(s) - 1; i >= 0; i--)
data/ssss-0.5/ssss.c:156:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    mpz_import(x, strlen(s), 1, 1, 0, 0, s);
data/ssss-0.5/ssss.c:259:14:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    if ((i = read(cprng, buf + count, degree / 8 - count)) < 0) {
data/ssss-0.5/ssss.c:421:36:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    opt_security = opt_hex ? 4 * ((strlen(buf) + 1) & ~1): 8 * strlen(buf);
data/ssss-0.5/ssss.c:421:64:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    opt_security = opt_hex ? 4 * ((strlen(buf) + 1) & ~1): 8 * strlen(buf);
data/ssss-0.5/ssss.c:494:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      s = 4 * strlen(b);
data/ssss-0.5/ssss.c:500:20:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      if (s != 4 * strlen(b))
data/ssss-0.5/ssss.c:612:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if (opt_token && (strlen(opt_token) > MAXTOKENLEN))

ANALYSIS SUMMARY:

Hits = 21
Lines analyzed = 633 in approximately 0.04 seconds (16657 lines/second)
Physical Source Lines of Code (SLOC) = 512
Hits@level = [0]  19 [1]  11 [2]   9 [3]   1 [4]   0 [5]   0
Hits@level+ = [0+]  40 [1+]  21 [2+]  10 [3+]   1 [4+]   0 [5+]   0
Hits/KSLOC@level+ = [0+] 78.125 [1+] 41.0156 [2+] 19.5312 [3+] 1.95312 [4+]   0 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.