Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/tclreadline-2.3.8/tclshrl.c
Examining data/tclreadline-2.3.8/wishrl.c
Examining data/tclreadline-2.3.8/tclreadline.c

FINAL RESULTS:

data/tclreadline-2.3.8/tclreadline.c:680:13:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
            strcpy(rl_line_buffer, expansion);
data/tclreadline-2.3.8/tclshrl.c:40:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(file, "%s/tclreadlineInit.tcl", TCLRL_LIBRARY);
data/tclreadline-2.3.8/wishrl.c:45:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(file, "%s/tclreadlineInit.tcl", TCLRL_LIBRARY);
data/tclreadline-2.3.8/tclreadline.c:696:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char start_s[BUFSIZ], end_s[BUFSIZ];
data/tclreadline-2.3.8/tclreadline.c:703:9:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
        sprintf(start_s, "%d", start);
data/tclreadline-2.3.8/tclreadline.c:704:9:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
        sprintf(end_s, "%d", end);
data/tclreadline-2.3.8/tclshrl.c:25:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char file[0xff];
data/tclreadline-2.3.8/wishrl.c:26:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char file[0xff];
data/tclreadline-2.3.8/tclreadline.c:143:26:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        memmove(in, ptr, strlen(ptr) + 1);
data/tclreadline-2.3.8/tclreadline.c:182:18:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    int i, len = strlen(quotechars);
data/tclreadline-2.3.8/tclreadline.c:676:22:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        int oldlen = strlen(rl_line_buffer);
data/tclreadline-2.3.8/tclreadline.c:679:35:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            rl_extend_line_buffer(strlen(expansion) + 1);
data/tclreadline-2.3.8/tclreadline.c:681:22:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            rl_end = strlen(expansion);
data/tclreadline-2.3.8/tclreadline.c:682:25:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            rl_point += strlen(expansion) - oldlen;
data/tclreadline-2.3.8/tclreadline.c:730:35:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                if (1 == objc && !strlen(matches[i])) {
data/tclreadline-2.3.8/tclreadline.c:745:31:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            if (2 == objc && !strlen(matches[1])) {
data/tclreadline-2.3.8/tclreadline.c:821:27:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                    len = strlen(text);
data/tclreadline-2.3.8/tclreadline.c:834:27:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
                    len = strlen(text);

ANALYSIS SUMMARY:

Hits = 18
Lines analyzed = 1007 in approximately 0.04 seconds (24951 lines/second)
Physical Source Lines of Code (SLOC) = 720
Hits@level = [0]   3 [1]  10 [2]   5 [3]   0 [4]   3 [5]   0
Hits@level+ = [0+]  21 [1+]  18 [2+]   8 [3+]   3 [4+]   3 [5+]   0
Hits/KSLOC@level+ = [0+] 29.1667 [1+]  25 [2+] 11.1111 [3+] 4.16667 [4+] 4.16667 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.