Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt.browser.chromium/common/library/chromiumbridge.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt.browser.chromium/common/library/chromiumlib.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt.browser.chromium/common/library/chromiumlib.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt.browser.chromium/common/library/chromiumlib_custom.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt.browser.chromium/common/library/chromiumlib_stats.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt.browser.chromium/common/library/chromiumlib_stats.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt.browser.chromium/common/library/chromiumlib_structs.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt.browser.chromium/common/library/chromiumlib_structs.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt.browser.chromium/common/rust-library/chromium_subp/cef.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt.browser.chromium/common/rust-library/chromium_subp/cef_linux.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt.browser.chromium/common/rust-library/chromium_subp/cef_mac.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt.browser.chromium/common/rust-library/chromium_subp/cef_win.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT AWT/cocoa/library/swt_awt.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT AWT/gtk/library/swt_awt.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT AWT/win32/library/swt_awt.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT OpenGL/glx/library/glx.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT OpenGL/glx/library/glx.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT OpenGL/glx/library/glx_stats.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT OpenGL/glx/library/glx_stats.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT OpenGL/glx/library/glx_structs.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT OpenGL/glx/library/glx_structs.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT OpenGL/win32/library/wgl.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT OpenGL/win32/library/wgl.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT OpenGL/win32/library/wgl_stats.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT OpenGL/win32/library/wgl_stats.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT OpenGL/win32/library/wgl_structs.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT OpenGL/win32/library/wgl_structs.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/cairo/library/cairo.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/cairo/library/cairo.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/cairo/library/cairo_custom.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/cairo/library/cairo_stats.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/cairo/library/cairo_stats.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/cairo/library/cairo_structs.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/cairo/library/cairo_structs.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/cocoa/library/os.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/cocoa/library/os.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/cocoa/library/os_custom.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/cocoa/library/os_custom.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/cocoa/library/os_stats.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/cocoa/library/os_stats.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/cocoa/library/os_structs.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/cocoa/library/os_structs.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/common/library/c.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/common/library/c.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/common/library/c_stats.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/common/library/c_stats.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/common/library/c_structs.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/common/library/c_structs.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/gtk/library/atk.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/gtk/library/atk.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/gtk/library/atk_custom.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/gtk/library/atk_custom.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/gtk/library/atk_stats.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/gtk/library/atk_stats.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/gtk/library/atk_structs.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/gtk/library/atk_structs.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/gtk/library/os.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/gtk/library/os.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/gtk/library/os_custom.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/gtk/library/os_custom.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/gtk/library/os_stats.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/gtk/library/os_stats.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/gtk/library/os_structs.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/gtk/library/os_structs.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/com.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/com.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/com_custom.cpp Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/com_custom.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/com_stats.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/com_stats.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/com_structs.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/com_structs.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/defines.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/gdip.cpp Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/gdip.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/gdip_custom.cpp Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/gdip_stats.cpp Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/gdip_stats.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/gdip_structs.cpp Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/gdip_structs.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/os.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/os.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/os_custom.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/os_custom.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/os_stats.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/os_stats.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/os_structs.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/os_structs.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT WebKit/gtk/library/webkitgtk.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT WebKit/gtk/library/webkitgtk.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT WebKit/gtk/library/webkitgtk_custom.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT WebKit/gtk/library/webkitgtk_custom.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT WebKit/gtk/library/webkitgtk_extension.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT WebKit/gtk/library/webkitgtk_extension.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT WebKit/gtk/library/webkitgtk_stats.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT WebKit/gtk/library/webkitgtk_stats.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT WebKit/gtk/library/webkitgtk_structs.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT WebKit/gtk/library/webkitgtk_structs.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT/common/library/callback.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT/common/library/callback.h Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT/common/library/swt.c Examining data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT/common/library/swt.h Examining data/swt4-gtk-4.17.0/tests/org.eclipse.swt.tests.gtk/ManualNativeCTests/BugSnippets/Bug_395296_Toolbar_Width.c Examining data/swt4-gtk-4.17.0/tests/org.eclipse.swt.tests.gtk/ManualNativeCTests/BugSnippets/Bug_464228_ComboBox.c Examining data/swt4-gtk-4.17.0/tests/org.eclipse.swt.tests.gtk/ManualNativeCTests/BugSnippets/Bug_534179_Tree_Column_Warning.c Examining data/swt4-gtk-4.17.0/tests/org.eclipse.swt.tests.gtk/ManualNativeCTests/BugSnippets/Bug_535083_Set_Region_Black_Out.c Examining data/swt4-gtk-4.17.0/tests/org.eclipse.swt.tests.gtk/ManualNativeCTests/BugSnippets/Bug_535538_Shell_Auto_Max.c Examining data/swt4-gtk-4.17.0/tests/org.eclipse.swt.tests.gtk/ManualNativeCTests/BugSnippets/Bug_541427_TreeHeaderNotVisible.cpp Examining data/swt4-gtk-4.17.0/tests/org.eclipse.swt.tests.gtk/ManualNativeCTests/BugSnippets/Bug_545587_TooltipColor.cpp Examining data/swt4-gtk-4.17.0/tests/org.eclipse.swt.tests.gtk/ManualNativeCTests/SwtFixed_native/GTK3/os_custom.c Examining data/swt4-gtk-4.17.0/tests/org.eclipse.swt.tests.gtk/ManualNativeCTests/SwtFixed_native/GTK3/os_custom.h Examining data/swt4-gtk-4.17.0/tests/org.eclipse.swt.tests.gtk/ManualNativeCTests/SwtFixed_native/GTK3/simple_button_app.c Examining data/swt4-gtk-4.17.0/tests/org.eclipse.swt.tests.gtk/ManualNativeCTests/SwtFixed_native/GTK4/os_custom.c Examining data/swt4-gtk-4.17.0/tests/org.eclipse.swt.tests.gtk/ManualNativeCTests/SwtFixed_native/GTK4/os_custom.h Examining data/swt4-gtk-4.17.0/tests/org.eclipse.swt.tests.gtk/ManualNativeCTests/SwtFixed_native/GTK4/simple_button_app.c FINAL RESULTS: data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/common/library/c.c:49:34: [3] (buffer) getenv: Environment variables are untrustable input if they can be set by an attacker. They can have any content and length, and the same variable can be set more than once (CWE-807, CWE-20). Check environment variables carefully before using them. JNIEXPORT jlong JNICALL C_NATIVE(getenv) data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/common/library/c.c:56:14: [3] (buffer) getenv: Environment variables are untrustable input if they can be set by an attacker. They can have any content and length, and the same variable can be set more than once (CWE-807, CWE-20). Check environment variables carefully before using them. rc = (jlong)getenv((const char *)lparg0); data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/gtk/library/os.c:18445:35: [3] (buffer) realpath: This function does not protect against buffer overflows, and some implementations can overflow internally (CWE-120/CWE-785!). Ensure that the destination buffer is at least of size MAXPATHLEN, andto protect against implementation problems, the input argument should also be checked to ensure it is no larger than MAXPATHLEN. JNIEXPORT jlong JNICALL OS_NATIVE(realpath) data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/gtk/library/os.c:18454:14: [3] (buffer) realpath: This function does not protect against buffer overflows, and some implementations can overflow internally (CWE-120/CWE-785!). Ensure that the destination buffer is at least of size MAXPATHLEN, andto protect against implementation problems, the input argument should also be checked to ensure it is no larger than MAXPATHLEN. rc = (jlong)realpath((const char *)lparg0, (char *)lparg1); data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/gtk/library/os.h:64:9: [3] (buffer) realpath: This function does not protect against buffer overflows, and some implementations can overflow internally (CWE-120/CWE-785!). Ensure that the destination buffer is at least of size MAXPATHLEN, andto protect against implementation problems, the input argument should also be checked to ensure it is no larger than MAXPATHLEN. #define realpath(N,R) _fullpath((R),(N),_MAX_PATH) data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/gtk/library/os.h:80:17: [3] (misc) LoadLibrary: Ensure that the full path to the library is specified, or current directory may be used (CWE-829, CWE-20). Use registry entry or GetWindowsDirectory to find library path, if you aren't already. HMODULE hm = LoadLibrary(libname); \ data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/os.c:1008:38: [3] (shell) CreateProcess: This causes a new process to execute and is difficult to use safely (CWE-78). Specify the application path in the first argument, NOT as part of the second, or embedded spaces could allow an attacker to force a different program to run. JNIEXPORT jboolean JNICALL OS_NATIVE(CreateProcess) data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/os.c:6409:13: [2] (buffer) MultiByteToWideChar: Requires maximum length in CHARACTERS, not bytes (CWE-120). rc = (jint)MultiByteToWideChar(arg0, arg1, (LPCSTR)arg2, arg3, (LPWSTR)lparg4, arg5); data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/os.c:6427:13: [2] (buffer) MultiByteToWideChar: Requires maximum length in CHARACTERS, not bytes (CWE-120). rc = (jint)MultiByteToWideChar(arg0, arg1, (LPCSTR)lparg2, arg3, (LPWSTR)lparg4, arg5); data/swt4-gtk-4.17.0/tests/org.eclipse.swt.tests.gtk/ManualNativeCTests/BugSnippets/Bug_541427_TreeHeaderNotVisible.cpp:31:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buffer[256]; data/swt4-gtk-4.17.0/tests/org.eclipse.swt.tests.gtk/ManualNativeCTests/BugSnippets/Bug_541427_TreeHeaderNotVisible.cpp:32:3: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(buffer, "Header %+d px", iHeightDiff); data/swt4-gtk-4.17.0/tests/org.eclipse.swt.tests.gtk/ManualNativeCTests/BugSnippets/Bug_545587_TooltipColor.cpp:24:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buffer[64]; data/swt4-gtk-4.17.0/tests/org.eclipse.swt.tests.gtk/ManualNativeCTests/BugSnippets/Bug_545587_TooltipColor.cpp:26:2: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf data/swt4-gtk-4.17.0/tests/org.eclipse.swt.tests.gtk/ManualNativeCTests/BugSnippets/Bug_545587_TooltipColor.cpp:156:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char imageBytes[4]; data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/common/library/c.c:348:33: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). JNIEXPORT jint JNICALL C_NATIVE(strlen) data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/common/library/c.c:353:13: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). rc = (jint)strlen((char *)arg0); data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/os.c:10043:34: [1] (buffer) wcslen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). JNIEXPORT jint JNICALL OS_NATIVE(wcslen) data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT PI/win32/library/os.c:10048:13: [1] (buffer) wcslen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). rc = (jint)wcslen((const wchar_t *)arg0); data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT WebKit/gtk/library/webkitgtk_extension.c:482:41: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). dbus_introspection_xml = g_new (gchar, strlen(dbus_introspection_xml_template) + data/swt4-gtk-4.17.0/bundles/org.eclipse.swt/Eclipse SWT WebKit/gtk/library/webkitgtk_extension.c:483:4: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). strlen(WEBKITGTK_EXTENSION_INTERFACE_NAME) + 1); ANALYSIS SUMMARY: Hits = 20 Lines analyzed = 78250 in approximately 4.37 seconds (17895 lines/second) Physical Source Lines of Code (SLOC) = 68856 Hits@level = [0] 21 [1] 6 [2] 7 [3] 7 [4] 0 [5] 0 Hits@level+ = [0+] 41 [1+] 20 [2+] 14 [3+] 7 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 0.595446 [1+] 0.290461 [2+] 0.203323 [3+] 0.101661 [4+] 0 [5+] 0 Dot directories skipped = 20 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.