Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/sumatra-1.0.36+ds/sumatra.h Examining data/sumatra-1.0.36+ds/mtcompare_sumatra.h Examining data/sumatra-1.0.36+ds/sumatra.c Parsing failed to find end of parameter list; semicolon terminated it in (stderr, static void ExitUsage(stat) int stat; { PP "usage: sumatra [-l|L|a|n|r|d|g|x] [-t threshold_value] [-p number of threads] [dataset1] [dataset2]\n"); PP "typ Examining data/sumatra-1.0.36+ds/mtcompare_sumatra.c FINAL RESULTS: data/sumatra-1.0.36+ds/sumatra.c:29:12: [4] (format) fprintf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. #define PP fprintf(stdout, data/sumatra-1.0.36+ds/sumatra.c:84:12: [4] (format) fprintf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. #define PP fprintf(stderr, data/sumatra-1.0.36+ds/sumatra.c:368:17: [3] (buffer) getopt: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. while ((carg = getopt(argc, argv, "hlLanrdt:p:gx")) != -1) { ANALYSIS SUMMARY: Hits = 3 Lines analyzed = 861 in approximately 0.04 seconds (21995 lines/second) Physical Source Lines of Code (SLOC) = 651 Hits@level = [0] 44 [1] 0 [2] 0 [3] 1 [4] 2 [5] 0 Hits@level+ = [0+] 47 [1+] 3 [2+] 3 [3+] 3 [4+] 2 [5+] 0 Hits/KSLOC@level+ = [0+] 72.1966 [1+] 4.60829 [2+] 4.60829 [3+] 4.60829 [4+] 3.0722 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.