Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/subnetcalc-2.4.16/src/t1.cc
Examining data/subnetcalc-2.4.16/src/subnetcalc.cc
Examining data/subnetcalc-2.4.16/src/tools.cc
Examining data/subnetcalc-2.4.16/src/tools.h

FINAL RESULTS:

data/subnetcalc-2.4.16/src/subnetcalc.cc:167:61:  [4] (shell) system:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
#warning Using default random number generator on non-Linux system!
data/subnetcalc-2.4.16/src/subnetcalc.cc:443:4:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
   snprintf((char*)&interfaceIDString, sizeof(interfaceIDString),
data/subnetcalc-2.4.16/src/subnetcalc.cc:454:7:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
      snprintf((char*)&interfaceIDString, sizeof(interfaceIDString),
data/subnetcalc-2.4.16/src/subnetcalc.cc:468:4:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
   snprintf((char*)&snmcAddressString, sizeof(snmcAddressString),
data/subnetcalc-2.4.16/src/tools.cc:230:4:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
   strcpy((char*)&host,string);
data/subnetcalc-2.4.16/src/tools.cc:238:13:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
            strcpy((char*)&port, &p1[2]);
data/subnetcalc-2.4.16/src/tools.cc:261:16:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
               strcpy((char*)&port, &p1[1]);
data/subnetcalc-2.4.16/src/subnetcalc.cc:167:24:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
#warning Using default random number generator on non-Linux system!
data/subnetcalc-2.4.16/src/subnetcalc.cc:168:4:  [3] (random) srandom:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
   srandom((unsigned int)getMicroTime());
data/subnetcalc-2.4.16/src/subnetcalc.cc:170:29:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
      buffer[i] = (uint8_t)(random() % 0xff);
data/subnetcalc-2.4.16/src/subnetcalc.cc:100:17:  [2] (integer) atol:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
   int prefix = atol(parameter);
data/subnetcalc-2.4.16/src/subnetcalc.cc:151:15:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
   FILE* fh = fopen(randomFile, "r");
data/subnetcalc-2.4.16/src/subnetcalc.cc:176:4:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
   memcpy((char*)&address.in6.sin6_addr.s6_addr[1], (const char*)&buffer, sizeof(buffer));
data/subnetcalc-2.4.16/src/subnetcalc.cc:221:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
         char str[16];
data/subnetcalc-2.4.16/src/subnetcalc.cc:421:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      char globalIDString[16];
data/subnetcalc-2.4.16/src/subnetcalc.cc:431:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      char           subnetIDString[16];
data/subnetcalc-2.4.16/src/subnetcalc.cc:438:4:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
   char           interfaceIDString[128];
data/subnetcalc-2.4.16/src/subnetcalc.cc:467:4:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
   char snmcAddressString[32];
data/subnetcalc-2.4.16/src/subnetcalc.cc:556:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
         char macAddressString[32];
data/subnetcalc-2.4.16/src/subnetcalc.cc:627:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
         char macAddressString[32];
data/subnetcalc-2.4.16/src/subnetcalc.cc:647:13:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
            char nodeAddressString[64];
data/subnetcalc-2.4.16/src/subnetcalc.cc:872:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      char maxHostsString[128];
data/subnetcalc-2.4.16/src/subnetcalc.cc:991:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      char hostname[NI_MAXHOST];
data/subnetcalc-2.4.16/src/tools.cc:155:4:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
   char                       str[128];
data/subnetcalc-2.4.16/src/tools.cc:156:4:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
   char                       scope[IFNAMSIZ + 16];
data/subnetcalc-2.4.16/src/tools.cc:157:4:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
   char                       ifnamebuffer[IFNAMSIZ];
data/subnetcalc-2.4.16/src/tools.cc:213:4:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
   char                 host[128];
data/subnetcalc-2.4.16/src/tools.cc:214:4:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
   char                 port[128];
data/subnetcalc-2.4.16/src/tools.cc:323:4:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
   memcpy((char*)address,res->ai_addr,res->ai_addrlen);
data/subnetcalc-2.4.16/src/tools.cc:354:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
   static char str[128];
data/subnetcalc-2.4.16/src/subnetcalc.cc:95:25:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
   for(size_t i = 0;i < strlen(parameter);i++) {
data/subnetcalc-2.4.16/src/tools.cc:62:4:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
   strncpy(dest, src, size);
data/subnetcalc-2.4.16/src/tools.cc:64:11:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
   return(strlen(dest) < size);
data/subnetcalc-2.4.16/src/tools.cc:71:22:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
   const size_t l1 = strlen(dest);
data/subnetcalc-2.4.16/src/tools.cc:72:22:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
   const size_t l2 = strlen(src);
data/subnetcalc-2.4.16/src/tools.cc:75:4:  [1] (buffer) strncat:
  Easily used incorrectly (e.g., incorrectly computing the correct maximum
  size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf,
  or automatically resizing strings.
   strncat(dest, src, size - l1 - 1);
data/subnetcalc-2.4.16/src/tools.cc:104:31:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      string = (char*)&string[strlen(string)];
data/subnetcalc-2.4.16/src/tools.cc:227:7:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
   if(strlen(string) > sizeof(host)) {
data/subnetcalc-2.4.16/src/tools.cc:231:4:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
   strcpy((char*)&port, "0");
data/subnetcalc-2.4.16/src/tools.cc:249:31:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
         for(size_t i = 0;i < strlen(host);i++) {
data/subnetcalc-2.4.16/src/tools.cc:283:17:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
   hostLength = strlen(host);

ANALYSIS SUMMARY:

Hits = 41
Lines analyzed = 1464 in approximately 0.06 seconds (26429 lines/second)
Physical Source Lines of Code (SLOC) = 1175
Hits@level = [0]  23 [1]  11 [2]  20 [3]   3 [4]   7 [5]   0
Hits@level+ = [0+]  64 [1+]  41 [2+]  30 [3+]  10 [4+]   7 [5+]   0
Hits/KSLOC@level+ = [0+] 54.4681 [1+] 34.8936 [2+] 25.5319 [3+] 8.51064 [4+] 5.95745 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.