Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/step-20.04.0/autotests/test_metaobject.h
Examining data/step-20.04.0/autotests/test_worldcopy.h
Examining data/step-20.04.0/autotests/test_contacts.cc
Examining data/step-20.04.0/autotests/test_worldcopy.cc
Examining data/step-20.04.0/autotests/test_forces.cc
Examining data/step-20.04.0/autotests/test_contacts.h
Examining data/step-20.04.0/autotests/test_forces.h
Examining data/step-20.04.0/autotests/test_metaobject.cc
Examining data/step-20.04.0/stepcore/particle.cc
Examining data/step-20.04.0/stepcore/body.cc
Examining data/step-20.04.0/stepcore/coulombforce.h
Examining data/step-20.04.0/stepcore/joints.cc
Examining data/step-20.04.0/stepcore/coulombforce.cc
Examining data/step-20.04.0/stepcore/itemgroup.h
Examining data/step-20.04.0/stepcore/motor.cc
Examining data/step-20.04.0/stepcore/xmlfile.cc
Examining data/step-20.04.0/stepcore/eulersolver.cc
Examining data/step-20.04.0/stepcore/constraintsolver.cc
Examining data/step-20.04.0/stepcore/gas.cc
Examining data/step-20.04.0/stepcore/solver.h
Examining data/step-20.04.0/stepcore/vector.h
Examining data/step-20.04.0/stepcore/world.cc
Examining data/step-20.04.0/stepcore/tool.cc
Examining data/step-20.04.0/stepcore/util.h
Examining data/step-20.04.0/stepcore/object.cc
Examining data/step-20.04.0/stepcore/force.cc
Examining data/step-20.04.0/stepcore/objecterrors.h
Examining data/step-20.04.0/stepcore/gslsolver.cc
Examining data/step-20.04.0/stepcore/collisionsolver.h
Examining data/step-20.04.0/stepcore/object.h
Examining data/step-20.04.0/stepcore/factory.h
Examining data/step-20.04.0/stepcore/types.h
Examining data/step-20.04.0/stepcore/softbody.h
Examining data/step-20.04.0/stepcore/gas.h
Examining data/step-20.04.0/stepcore/tool.h
Examining data/step-20.04.0/stepcore/item.cc
Examining data/step-20.04.0/stepcore/constants.cc
Examining data/step-20.04.0/stepcore/constraintsolver.h
Examining data/step-20.04.0/stepcore/spring.h
Examining data/step-20.04.0/stepcore/material.h
Examining data/step-20.04.0/stepcore/solver.cc
Examining data/step-20.04.0/stepcore/particle.h
Examining data/step-20.04.0/stepcore/body.h
Examining data/step-20.04.0/stepcore/rigidbody.h
Examining data/step-20.04.0/stepcore/joint.cc
Examining data/step-20.04.0/stepcore/collisionsolver.cc
Examining data/step-20.04.0/stepcore/gslsolver.h
Examining data/step-20.04.0/stepcore/motor.h
Examining data/step-20.04.0/stepcore/eulersolver.h
Examining data/step-20.04.0/stepcore/spring.cc
Examining data/step-20.04.0/stepcore/itemgroup.cc
Examining data/step-20.04.0/stepcore/joints.h
Examining data/step-20.04.0/stepcore/force.h
Examining data/step-20.04.0/stepcore/factory.cc
Examining data/step-20.04.0/stepcore/material.cc
Examining data/step-20.04.0/stepcore/xmlfile.h
Examining data/step-20.04.0/stepcore/softbody.cc
Examining data/step-20.04.0/stepcore/rigidbody.cc
Examining data/step-20.04.0/stepcore/constants.h
Examining data/step-20.04.0/stepcore/gravitation.h
Examining data/step-20.04.0/stepcore/world.h
Examining data/step-20.04.0/stepcore/item.h
Examining data/step-20.04.0/stepcore/joint.h
Examining data/step-20.04.0/stepcore/objecterrors.cc
Examining data/step-20.04.0/stepcore/gravitation.cc
Examining data/step-20.04.0/step/polygongraphics.cc
Examining data/step-20.04.0/step/clipboard.h
Examining data/step-20.04.0/step/main.cc
Examining data/step-20.04.0/step/arrow.cc
Examining data/step-20.04.0/step/motorgraphics.cc
Examining data/step-20.04.0/step/jointgraphics.cc
Examining data/step-20.04.0/step/itempalette.h
Examining data/step-20.04.0/step/mainwindow.h
Examining data/step-20.04.0/step/messageframe.h
Examining data/step-20.04.0/step/worldbrowser.cc
Examining data/step-20.04.0/step/springgraphics.h
Examining data/step-20.04.0/step/choicesmodel.cc
Examining data/step-20.04.0/step/toolgraphics.h
Examining data/step-20.04.0/step/arrow.h
Examining data/step-20.04.0/step/latexformula.h
Examining data/step-20.04.0/step/stepgraphicsitem.cc
Examining data/step-20.04.0/step/particlegraphics.h
Examining data/step-20.04.0/step/undobrowser.cc
Examining data/step-20.04.0/step/worldmodel.cc
Examining data/step-20.04.0/step/propertiesbrowser.h
Examining data/step-20.04.0/step/gasgraphics.h
Examining data/step-20.04.0/step/worldgraphics.cc
Examining data/step-20.04.0/step/unitscalc.cc
Examining data/step-20.04.0/step/unitscalc.h
Examining data/step-20.04.0/step/worldbrowser.h
Examining data/step-20.04.0/step/polygongraphics.h
Examining data/step-20.04.0/step/motorgraphics.h
Examining data/step-20.04.0/step/toolgraphics.cc
Examining data/step-20.04.0/step/worldfactory.cc
Examining data/step-20.04.0/step/choicesmodel.h
Examining data/step-20.04.0/step/gascreationdialog.h
Examining data/step-20.04.0/step/worldfactory.h
Examining data/step-20.04.0/step/itempalette.cc
Examining data/step-20.04.0/step/stepgraphicsitem.h
Examining data/step-20.04.0/step/gasgraphics.cc
Examining data/step-20.04.0/step/undobrowser.h
Examining data/step-20.04.0/step/simulationthread.h
Examining data/step-20.04.0/step/messageframe.cc
Examining data/step-20.04.0/step/worldscene.h
Examining data/step-20.04.0/step/clipboard.cc
Examining data/step-20.04.0/step/simulationthread.cc
Examining data/step-20.04.0/step/springgraphics.cc
Examining data/step-20.04.0/step/worldgraphics.h
Examining data/step-20.04.0/step/infobrowser.cc
Examining data/step-20.04.0/step/worldscene.cc
Examining data/step-20.04.0/step/jointgraphics.h
Examining data/step-20.04.0/step/softbodygraphics.h
Examining data/step-20.04.0/step/gascreationdialog.cc
Examining data/step-20.04.0/step/worldmodel.h
Examining data/step-20.04.0/step/propertiesbrowser.cc
Examining data/step-20.04.0/step/latexformula.cc
Examining data/step-20.04.0/step/particlegraphics.cc
Examining data/step-20.04.0/step/softbodygraphics.cc
Examining data/step-20.04.0/step/infobrowser.h
Examining data/step-20.04.0/step/mainwindow.cc
FINAL RESULTS:
data/step-20.04.0/step/mainwindow.cc:69:10: [3] (random) srand:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
std::srand(time(NULL));
data/step-20.04.0/step/clipboard.cc:131:12: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
buffer.open(QBuffer::WriteOnly);
data/step-20.04.0/step/clipboard.cc:159:12: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
buffer.open(QBuffer::ReadOnly);
data/step-20.04.0/step/infobrowser.cc:159:21: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if(file.open(QIODevice::ReadOnly | QIODevice::Text)) {
data/step-20.04.0/step/latexformula.cc:92:19: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if(!latexFile.open(QIODevice::WriteOnly)) {
data/step-20.04.0/step/latexformula.cc:126:17: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if(!pngFile.open(QIODevice::ReadOnly)) {
data/step-20.04.0/step/mainwindow.cc:141:22: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
KStandardAction::open(this, SLOT(openFile()), actionCollection());
data/step-20.04.0/step/mainwindow.cc:365:15: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if(!file->open(QIODevice::WriteOnly | QIODevice::Text)) {
data/step-20.04.0/step/toolgraphics.cc:647:14: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
tempFile.open();
data/step-20.04.0/stepcore/world.cc:611:10: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
std::memcpy(f, y+_variablesCount, _variablesCount*sizeof(*f));
data/step-20.04.0/stepcore/world.cc:612:19: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
if(fvar) std::memcpy(fvar, y+_variablesCount, _variablesCount*sizeof(*fvar));
data/step-20.04.0/stepcore/object.h:293:53: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
template<T (C::*_read)() const> static QVariant read(const Object* obj) {
data/step-20.04.0/stepcore/object.h:296:60: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
template<const T& (C::*_read)() const> static QVariant read(const Object* obj) {
data/step-20.04.0/stepcore/object.h:386:55: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
StepCore::MetaPropertyHelper<_thisType, _type>::read<&_thisType::_read>, \
data/step-20.04.0/stepcore/object.h:395:55: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
StepCore::MetaPropertyHelper<_thisType, _type>::read<&_thisType::_read>, \
ANALYSIS SUMMARY:
Hits = 15
Lines analyzed = 26178 in approximately 0.92 seconds (28430 lines/second)
Physical Source Lines of Code (SLOC) = 16725
Hits@level = [0] 1 [1] 4 [2] 10 [3] 1 [4] 0 [5] 0
Hits@level+ = [0+] 16 [1+] 15 [2+] 11 [3+] 1 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 0.956652 [1+] 0.896861 [2+] 0.657698 [3+] 0.0597907 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.