Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/thin-provisioning-tools-0.9.0/base/application.cc
Examining data/thin-provisioning-tools-0.9.0/base/application.h
Examining data/thin-provisioning-tools-0.9.0/base/base64.cc
Examining data/thin-provisioning-tools-0.9.0/base/base64.h
Examining data/thin-provisioning-tools-0.9.0/base/bits.h
Examining data/thin-provisioning-tools-0.9.0/base/container_of.h
Examining data/thin-provisioning-tools-0.9.0/base/disk_units.cc
Examining data/thin-provisioning-tools-0.9.0/base/disk_units.h
Examining data/thin-provisioning-tools-0.9.0/base/endian_utils.cc
Examining data/thin-provisioning-tools-0.9.0/base/endian_utils.h
Examining data/thin-provisioning-tools-0.9.0/base/error_state.cc
Examining data/thin-provisioning-tools-0.9.0/base/error_state.h
Examining data/thin-provisioning-tools-0.9.0/base/error_string.cc
Examining data/thin-provisioning-tools-0.9.0/base/error_string.h
Examining data/thin-provisioning-tools-0.9.0/base/file_utils.cc
Examining data/thin-provisioning-tools-0.9.0/base/file_utils.h
Examining data/thin-provisioning-tools-0.9.0/base/grid_layout.cc
Examining data/thin-provisioning-tools-0.9.0/base/grid_layout.h
Examining data/thin-provisioning-tools-0.9.0/base/indented_stream.h
Examining data/thin-provisioning-tools-0.9.0/base/io.h
Examining data/thin-provisioning-tools-0.9.0/base/io_generator.cc
Examining data/thin-provisioning-tools-0.9.0/base/io_generator.h
Examining data/thin-provisioning-tools-0.9.0/base/math_utils.h
Examining data/thin-provisioning-tools-0.9.0/base/nested_output.h
Examining data/thin-provisioning-tools-0.9.0/base/output_file_requirements.cc
Examining data/thin-provisioning-tools-0.9.0/base/output_file_requirements.h
Examining data/thin-provisioning-tools-0.9.0/base/progress_monitor.cc
Examining data/thin-provisioning-tools-0.9.0/base/progress_monitor.h
Examining data/thin-provisioning-tools-0.9.0/base/rolling_hash.cc
Examining data/thin-provisioning-tools-0.9.0/base/rolling_hash.h
Examining data/thin-provisioning-tools-0.9.0/base/run.h
Examining data/thin-provisioning-tools-0.9.0/base/run_set.h
Examining data/thin-provisioning-tools-0.9.0/base/sequence_generator.cc
Examining data/thin-provisioning-tools-0.9.0/base/sequence_generator.h
Examining data/thin-provisioning-tools-0.9.0/base/types.h
Examining data/thin-provisioning-tools-0.9.0/base/unique_handle.h
Examining data/thin-provisioning-tools-0.9.0/base/xml_utils.cc
Examining data/thin-provisioning-tools-0.9.0/base/xml_utils.h
Examining data/thin-provisioning-tools-0.9.0/block-cache/block_cache.cc
Examining data/thin-provisioning-tools-0.9.0/block-cache/block_cache.h
Examining data/thin-provisioning-tools-0.9.0/block-cache/copier.cc
Examining data/thin-provisioning-tools-0.9.0/block-cache/copier.h
Examining data/thin-provisioning-tools-0.9.0/block-cache/io_engine.cc
Examining data/thin-provisioning-tools-0.9.0/block-cache/io_engine.h
Examining data/thin-provisioning-tools-0.9.0/block-cache/list.h
Examining data/thin-provisioning-tools-0.9.0/block-cache/mem_pool.cc
Examining data/thin-provisioning-tools-0.9.0/block-cache/mem_pool.h
Examining data/thin-provisioning-tools-0.9.0/caching/cache_check.cc
Examining data/thin-provisioning-tools-0.9.0/caching/cache_dump.cc
Examining data/thin-provisioning-tools-0.9.0/caching/cache_metadata.h
Examining data/thin-provisioning-tools-0.9.0/caching/cache_metadata_size.cc
Examining data/thin-provisioning-tools-0.9.0/caching/cache_repair.cc
Examining data/thin-provisioning-tools-0.9.0/caching/cache_restore.cc
Examining data/thin-provisioning-tools-0.9.0/caching/cache_writeback.cc
Examining data/thin-provisioning-tools-0.9.0/caching/commands.cc
Examining data/thin-provisioning-tools-0.9.0/caching/commands.h
Examining data/thin-provisioning-tools-0.9.0/caching/dump.cc
Examining data/thin-provisioning-tools-0.9.0/caching/emitter.h
Examining data/thin-provisioning-tools-0.9.0/caching/hint_array.cc
Examining data/thin-provisioning-tools-0.9.0/caching/hint_array.h
Examining data/thin-provisioning-tools-0.9.0/caching/mapping_array.cc
Examining data/thin-provisioning-tools-0.9.0/caching/mapping_array.h
Examining data/thin-provisioning-tools-0.9.0/caching/metadata.cc
Examining data/thin-provisioning-tools-0.9.0/caching/metadata.h
Examining data/thin-provisioning-tools-0.9.0/caching/metadata_disk_structures.cc
Examining data/thin-provisioning-tools-0.9.0/caching/metadata_disk_structures.h
Examining data/thin-provisioning-tools-0.9.0/caching/metadata_dump.cc
Examining data/thin-provisioning-tools-0.9.0/caching/metadata_dump.h
Examining data/thin-provisioning-tools-0.9.0/caching/restore_emitter.cc
Examining data/thin-provisioning-tools-0.9.0/caching/restore_emitter.h
Examining data/thin-provisioning-tools-0.9.0/caching/superblock.cc
Examining data/thin-provisioning-tools-0.9.0/caching/superblock.h
Examining data/thin-provisioning-tools-0.9.0/caching/xml_format.cc
Examining data/thin-provisioning-tools-0.9.0/caching/xml_format.h
Examining data/thin-provisioning-tools-0.9.0/contrib/ewheeler_emitter.cc
Examining data/thin-provisioning-tools-0.9.0/contrib/thin_sexp_emitter.cc
Examining data/thin-provisioning-tools-0.9.0/contrib/tmakatos_emitter.cc
Examining data/thin-provisioning-tools-0.9.0/contrib/tmakatos_emitter.h
Examining data/thin-provisioning-tools-0.9.0/era/commands.cc
Examining data/thin-provisioning-tools-0.9.0/era/commands.h
Examining data/thin-provisioning-tools-0.9.0/era/emitter.h
Examining data/thin-provisioning-tools-0.9.0/era/era_array.cc
Examining data/thin-provisioning-tools-0.9.0/era/era_array.h
Examining data/thin-provisioning-tools-0.9.0/era/era_check.cc
Examining data/thin-provisioning-tools-0.9.0/era/era_detail.cc
Examining data/thin-provisioning-tools-0.9.0/era/era_detail.h
Examining data/thin-provisioning-tools-0.9.0/era/era_dump.cc
Examining data/thin-provisioning-tools-0.9.0/era/era_invalidate.cc
Examining data/thin-provisioning-tools-0.9.0/era/era_restore.cc
Examining data/thin-provisioning-tools-0.9.0/era/metadata.cc
Examining data/thin-provisioning-tools-0.9.0/era/metadata.h
Examining data/thin-provisioning-tools-0.9.0/era/metadata_dump.cc
Examining data/thin-provisioning-tools-0.9.0/era/metadata_dump.h
Examining data/thin-provisioning-tools-0.9.0/era/restore_emitter.cc
Examining data/thin-provisioning-tools-0.9.0/era/restore_emitter.h
Examining data/thin-provisioning-tools-0.9.0/era/superblock.cc
Examining data/thin-provisioning-tools-0.9.0/era/superblock.h
Examining data/thin-provisioning-tools-0.9.0/era/writeset_tree.cc
Examining data/thin-provisioning-tools-0.9.0/era/writeset_tree.h
Examining data/thin-provisioning-tools-0.9.0/era/xml_format.cc
Examining data/thin-provisioning-tools-0.9.0/era/xml_format.h
Examining data/thin-provisioning-tools-0.9.0/ft-lib/bcache.c
Examining data/thin-provisioning-tools-0.9.0/ft-lib/bcache.h
Examining data/thin-provisioning-tools-0.9.0/ft-lib/crc32c.c
Examining data/thin-provisioning-tools-0.9.0/ft-lib/dm-ioctl.c
Examining data/thin-provisioning-tools-0.9.0/ft-lib/list.h
Examining data/thin-provisioning-tools-0.9.0/main.cc
Examining data/thin-provisioning-tools-0.9.0/persistent-data/block.cc
Examining data/thin-provisioning-tools-0.9.0/persistent-data/block.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/block_counter.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/checksum.cc
Examining data/thin-provisioning-tools-0.9.0/persistent-data/checksum.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/data-structures/array.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/data-structures/array_block.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/data-structures/bitset.cc
Examining data/thin-provisioning-tools-0.9.0/persistent-data/data-structures/bitset.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/data-structures/bloom_filter.cc
Examining data/thin-provisioning-tools-0.9.0/persistent-data/data-structures/bloom_filter.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/data-structures/btree.cc
Examining data/thin-provisioning-tools-0.9.0/persistent-data/data-structures/btree.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/data-structures/btree_base_visitor.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/data-structures/btree_counter.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/data-structures/btree_damage_visitor.cc
Examining data/thin-provisioning-tools-0.9.0/persistent-data/data-structures/btree_damage_visitor.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/data-structures/btree_disk_structures.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/data-structures/btree_node_checker.cc
Examining data/thin-provisioning-tools-0.9.0/persistent-data/data-structures/btree_node_checker.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/data-structures/ref_counter.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/data-structures/simple_traits.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/deleter.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/error_set.cc
Examining data/thin-provisioning-tools-0.9.0/persistent-data/error_set.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/errors.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/file_utils.cc
Examining data/thin-provisioning-tools-0.9.0/persistent-data/file_utils.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/hex_dump.cc
Examining data/thin-provisioning-tools-0.9.0/persistent-data/hex_dump.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/space-maps/careful_alloc.cc
Examining data/thin-provisioning-tools-0.9.0/persistent-data/space-maps/careful_alloc.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/space-maps/core.cc
Examining data/thin-provisioning-tools-0.9.0/persistent-data/space-maps/core.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/space-maps/disk.cc
Examining data/thin-provisioning-tools-0.9.0/persistent-data/space-maps/disk.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/space-maps/disk_structures.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/space-maps/noop.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/space-maps/recursive.cc
Examining data/thin-provisioning-tools-0.9.0/persistent-data/space-maps/recursive.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/space-maps/subtracting_span_iterator.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/space_map.cc
Examining data/thin-provisioning-tools-0.9.0/persistent-data/space_map.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/span.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/transaction_manager.cc
Examining data/thin-provisioning-tools-0.9.0/persistent-data/transaction_manager.h
Examining data/thin-provisioning-tools-0.9.0/persistent-data/validators.cc
Examining data/thin-provisioning-tools-0.9.0/persistent-data/validators.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/cache_stream.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/cache_stream.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/chunk_stream.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/chunk_stream.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/commands.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/commands.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/damage_generator.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/damage_generator.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/device_tree.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/device_tree.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/emitter.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/fixed_chunk_stream.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/fixed_chunk_stream.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/human_readable_format.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/human_readable_format.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/main.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/mapping_tree.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/mapping_tree.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/metadata.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/metadata.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/metadata_checker.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/metadata_checker.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/metadata_counter.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/metadata_counter.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/metadata_dumper.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/metadata_dumper.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/override_emitter.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/override_emitter.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/pool_stream.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/pool_stream.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/restore_emitter.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/restore_emitter.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/rmap_visitor.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/rmap_visitor.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/shared_library_emitter.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/shared_library_emitter.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/static_library_emitter.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/superblock.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/superblock.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_check.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_debug.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_delta.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_dump.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_generate_damage.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_generate_mappings.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_generate_metadata.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_journal.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_journal.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_journal_check.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_ll_dump.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_ll_restore.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_ls.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_metadata_size.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_pool.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_pool.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_repair.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_restore.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_rmap.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_scan.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_show_duplicates.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_show_metadata.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_trim.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/variable_chunk_stream.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/variable_chunk_stream.h
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/xml_format.cc
Examining data/thin-provisioning-tools-0.9.0/thin-provisioning/xml_format.h
Examining data/thin-provisioning-tools-0.9.0/ui/ui.cc
Examining data/thin-provisioning-tools-0.9.0/ui/ui.h
Examining data/thin-provisioning-tools-0.9.0/unit-tests/array_block_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/array_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/base64_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/bcache_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/bitset_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/block_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/bloom_filter_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/btree_counter_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/btree_damage_visitor_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/btree_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/buffer_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/cache_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/damage_tracker_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/endian_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/era_superblock_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/error_state_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/gmock_main.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/mem_pool_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/metadata_checker_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/metadata_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/rolling_hash_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/run_list_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/run_set_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/sequence_generator_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/space_map_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/test_utils.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/thin_metadata_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/transaction_manager_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/cache_superblock_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/copier_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/io_engine_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/rmap_visitor_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/span_iterator_t.cc
Examining data/thin-provisioning-tools-0.9.0/unit-tests/test_utils.h
Examining data/thin-provisioning-tools-0.9.0/debian/unit-tests/preload.c

FINAL RESULTS:

data/thin-provisioning-tools-0.9.0/ft-lib/bcache.c:27:2:  [4] (format) vfprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
	vfprintf(stderr, fmt, ap);
data/thin-provisioning-tools-0.9.0/ft-lib/bcache.c:39:2:  [4] (format) vfprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
	vfprintf(stderr, fmt, ap);
data/thin-provisioning-tools-0.9.0/ft-lib/dm-ioctl.c:176:2:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
	strcpy(dest, src);
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_metadata_size.cc:195:2:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
	strcpy(buf, b);
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_metadata_size.cc:197:3:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
		strcat(buf, mandatory ? "{" :"["), strcat(buf, g->unit.chars), strcat(buf, mandatory ? "}" : "]");
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_metadata_size.cc:197:38:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
		strcat(buf, mandatory ? "{" :"["), strcat(buf, g->unit.chars), strcat(buf, mandatory ? "}" : "]");
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_metadata_size.cc:197:66:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
		strcat(buf, mandatory ? "{" :"["), strcat(buf, g->unit.chars), strcat(buf, mandatory ? "}" : "]");
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_metadata_size.cc:266:2:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
	strcpy(g->options.s[o], arg);
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_metadata_size.cc:268:3:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
		strcat(g->options.s[o], g->unit.strings[idx]);
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_metadata_size.cc:337:3:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
		printf(r - rtrunc < 1E-2 ? "%0.2e" : "%0.2f", r);
data/thin-provisioning-tools-0.9.0/unit-tests/test_utils.h:35:11:  [4] (shell) system:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
		int r = system("rm -f ./test.data");
data/thin-provisioning-tools-0.9.0/unit-tests/test_utils.h:99:4:  [4] (shell) system:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
			system(cmd);
data/thin-provisioning-tools-0.9.0/unit-tests/test_utils.h:105:4:  [4] (shell) system:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
			system(cmd);
data/thin-provisioning-tools-0.9.0/unit-tests/test_utils.h:108:8:  [4] (shell) system:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
		void system(std::string const &cmd) {
data/thin-provisioning-tools-0.9.0/unit-tests/test_utils.h:109:14:  [4] (shell) system:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
			int r = ::system(cmd.c_str());
data/thin-provisioning-tools-0.9.0/caching/cache_check.cc:381:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/caching/cache_dump.cc:93:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/caching/cache_metadata_size.cc:45:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, short_opts, long_opts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/caching/cache_repair.cc:85:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/caching/cache_restore.cc:132:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, short_opts, long_opts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/caching/cache_writeback.cc:390:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, short_opts, long_opts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/caching/dump.cc:88:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/era/era_check.cc:301:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/era/era_dump.cc:98:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/era/era_invalidate.cc:222:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/era/era_restore.cc:95:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, short_opts, long_opts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_check.cc:124:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_debug.cc:327:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_delta.cc:659:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_dump.cc:166:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_generate_damage.cc:122:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_generate_mappings.cc:169:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_generate_metadata.cc:203:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_journal_check.cc:423:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_ll_dump.cc:323:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_ll_restore.cc:232:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_ls.cc:503:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_metadata_size.cc:286:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, "b:s:m:u:n::hV", long_options, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_repair.cc:85:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_restore.cc:115:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_rmap.cc:134:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_scan.cc:685:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_show_duplicates.cc:306:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_show_metadata.cc:321:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_trim.cc:187:14:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != -1) {
data/thin-provisioning-tools-0.9.0/unit-tests/bloom_filter_t.cc:49:27:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
			using namespace boost::random;
data/thin-provisioning-tools-0.9.0/unit-tests/bloom_filter_t.cc:52:11:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
			boost::random::uniform_int_distribution<uint64_t> uniform_dist(0, max);
data/thin-provisioning-tools-0.9.0/unit-tests/bloom_filter_t.cc:59:23:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
				block_address b = random() % max;
data/thin-provisioning-tools-0.9.0/unit-tests/bloom_filter_t.cc:93:10:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
		boost::random::mt19937 rng_;
data/thin-provisioning-tools-0.9.0/unit-tests/btree_damage_visitor_t.cc:135:22:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
			unsigned target = random() % nr;
data/thin-provisioning-tools-0.9.0/unit-tests/btree_damage_visitor_t.cc:142:30:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
			unsigned target = count + random() % (nr - count);
data/thin-provisioning-tools-0.9.0/unit-tests/metadata_checker_t.cc:106:21:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
			return *nodes_[::random() % nodes_.size()];
data/thin-provisioning-tools-0.9.0/unit-tests/rolling_hash_t.cc:31:11:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
			return random() % 256;
data/thin-provisioning-tools-0.9.0/unit-tests/rolling_hash_t.cc:61:11:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
			return random() % 256;
data/thin-provisioning-tools-0.9.0/unit-tests/space_map_t.cc:177:4:  [3] (random) srand:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
			srand(1234);
data/thin-provisioning-tools-0.9.0/unit-tests/space_map_t.cc:190:4:  [3] (random) srand:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
			srand(1234);
data/thin-provisioning-tools-0.9.0/unit-tests/space_map_t.cc:197:4:  [3] (random) srand:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
			srand(1234);
data/thin-provisioning-tools-0.9.0/base/application.cc:94:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char buffer[PATH_MAX + 1];
data/thin-provisioning-tools-0.9.0/base/error_string.cc:17:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char buffer[128];
data/thin-provisioning-tools-0.9.0/base/error_string.cc:28:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char buffer[128];
data/thin-provisioning-tools-0.9.0/base/file_utils.cc:43:10:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fd_ = ::open(path.c_str(), OPEN_FLAGS | flags, DEFAULT_MODE);
data/thin-provisioning-tools-0.9.0/base/file_utils.cc:129:14:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		int fd = ::open(file.c_str(), O_RDONLY);
data/thin-provisioning-tools-0.9.0/base/xml_utils.cc:25:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		char buffer[4096];
data/thin-provisioning-tools-0.9.0/block-cache/io_engine.cc:76:13:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	int fd = ::open(path.c_str(), O_DIRECT | flags);
data/thin-provisioning-tools-0.9.0/caching/xml_format.cc:250:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		char buffer[4096];
data/thin-provisioning-tools-0.9.0/contrib/thin_sexp_emitter.cc:24:4:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
			open("superblock");
data/thin-provisioning-tools-0.9.0/contrib/thin_sexp_emitter.cc:47:4:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
			open("device");
data/thin-provisioning-tools-0.9.0/contrib/thin_sexp_emitter.cc:90:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		void open(char const *tag) {
data/thin-provisioning-tools-0.9.0/debian/unit-tests/preload.c:16:5:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
int open(const char *file, int oflag, ...) {
data/thin-provisioning-tools-0.9.0/ft-lib/bcache.c:712:11:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	int fd = open(path, O_DIRECT | O_EXCL | O_RDONLY);
data/thin-provisioning-tools-0.9.0/ft-lib/dm-ioctl.c:73:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(payload(ctl), payload(old), sizeof(*ctl));
data/thin-provisioning-tools-0.9.0/ft-lib/dm-ioctl.c:89:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char path[1024];
data/thin-provisioning-tools-0.9.0/ft-lib/dm-ioctl.c:93:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fd = open(path, O_RDWR | O_EXCL);
data/thin-provisioning-tools-0.9.0/ft-lib/dm-ioctl.c:590:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(msg->message, msg_str, msg_len);
data/thin-provisioning-tools-0.9.0/ft-lib/dm-ioctl.c:602:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fd = open(path, O_RDONLY);
data/thin-provisioning-tools-0.9.0/ft-lib/dm-ioctl.c:617:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fd = open(path, O_RDWR);
data/thin-provisioning-tools-0.9.0/persistent-data/space-maps/disk.cc:532:6:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			::memcpy(dest, &d, sizeof(d));
data/thin-provisioning-tools-0.9.0/persistent-data/transaction_manager.cc:75:4:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	::memcpy(dest.data(), src.data(), MD_BLOCK_SIZE);
data/thin-provisioning-tools-0.9.0/thin-provisioning/superblock.h:58:13:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
			unsigned char uuid_[16];
data/thin-provisioning-tools-0.9.0/thin-provisioning/superblock.h:67:13:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
			unsigned char data_space_map_root_[SPACE_MAP_ROOT_SIZE];
data/thin-provisioning-tools-0.9.0/thin-provisioning/superblock.h:68:13:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
			unsigned char metadata_space_map_root_[SPACE_MAP_ROOT_SIZE];
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_delta.cc:392:5:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
				open(t);
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_delta.cc:397:5:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
				open(t);
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_delta.cc:401:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		void open(block_type t) {
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_journal.cc:64:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(b, data_begin, len);
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_journal_check.cc:298:6:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
					memcpy(data + d.offset_, d.bytes_.data(), d.bytes_.size());
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_metadata_size.cc:48:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char *s[OPT_END];
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_metadata_size.cc:193:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char buf[80];
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_rmap.cc:82:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		char dots[2] = {'\0', '\0'};
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_trim.cc:56:11:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
			fd = ::open(data_dev.c_str(), O_WRONLY);
data/thin-provisioning-tools-0.9.0/unit-tests/btree_damage_visitor_t.cc:47:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		char padding[200];
data/thin-provisioning-tools-0.9.0/unit-tests/space_map_t.cc:78:4:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
			open(transaction_manager &tm, void *root) {
data/thin-provisioning-tools-0.9.0/unit-tests/space_map_t.cc:90:4:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
			open(transaction_manager &tm, void *root) {
data/thin-provisioning-tools-0.9.0/unit-tests/space_map_t.cc:204:13:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
			unsigned char buffer[128];
data/thin-provisioning-tools-0.9.0/unit-tests/space_map_t.cc:217:47:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
				persistent_space_map::ptr sm = SMCreator::open(tm_, buffer);
data/thin-provisioning-tools-0.9.0/unit-tests/space_map_t.cc:258:8:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		void open() {
data/thin-provisioning-tools-0.9.0/unit-tests/space_map_t.cc:329:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		unsigned char metadata_sm_root_[128];
data/thin-provisioning-tools-0.9.0/unit-tests/space_map_t.cc:374:2:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	open();
data/thin-provisioning-tools-0.9.0/unit-tests/space_map_t.cc:409:2:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	open();
data/thin-provisioning-tools-0.9.0/unit-tests/space_map_t.cc:430:2:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	open();
data/thin-provisioning-tools-0.9.0/unit-tests/space_map_t.cc:447:2:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	open();
data/thin-provisioning-tools-0.9.0/unit-tests/space_map_t.cc:465:2:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	open();
data/thin-provisioning-tools-0.9.0/unit-tests/space_map_t.cc:478:2:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	open();
data/thin-provisioning-tools-0.9.0/unit-tests/space_map_t.cc:498:2:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	open();
data/thin-provisioning-tools-0.9.0/unit-tests/test_utils.cc:34:13:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	int fd = ::open(path_.c_str(), O_CREAT | O_RDWR, 0666);
data/thin-provisioning-tools-0.9.0/unit-tests/test_utils.h:64:4:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
			char buffer[PATH_MAX];
data/thin-provisioning-tools-0.9.0/unit-tests/thin_metadata_t.cc:42:14:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		int fd = ::open(path.c_str(), O_CREAT | O_TRUNC | O_RDWR, 0666);
data/thin-provisioning-tools-0.9.0/base/application.cc:97:2:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
	strncpy(buffer, path.c_str(), PATH_MAX);
data/thin-provisioning-tools-0.9.0/base/xml_utils.cc:26:6:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
		in.read(buffer, sizeof(buffer));
data/thin-provisioning-tools-0.9.0/caching/restore_emitter.cc:28:4:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
			strncpy((char *) sb.policy_name, policy.c_str(), sizeof(sb.policy_name) - 1);
data/thin-provisioning-tools-0.9.0/caching/xml_format.cc:251:6:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
		in.read(buffer, sizeof(buffer));
data/thin-provisioning-tools-0.9.0/ft-lib/dm-ioctl.c:173:6:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	if (strlen(src) + 1 > max)
data/thin-provisioning-tools-0.9.0/ft-lib/dm-ioctl.c:420:12:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		space += strlen(t->args) + 16;
data/thin-provisioning-tools-0.9.0/ft-lib/dm-ioctl.c:450:41:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		spec->next = sizeof(*spec) + round_up(strlen(t->args) + 1, 8);
data/thin-provisioning-tools-0.9.0/ft-lib/dm-ioctl.c:580:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	size_t msg_len = strlen(msg_str) + 1;
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_metadata_size.cc:95:8:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	len = strlen(unit_string);
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_metadata_size.cc:239:42:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		bool unit_long = !strncmp("long", arg, strlen(arg));
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_metadata_size.cc:241:39:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		if (!*arg || (strncmp("short", arg, strlen(arg)) && !unit_long))
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_metadata_size.cc:262:47:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	g->options.s[o] = static_cast<char *>(malloc(strlen(arg) + strlen(g->unit.strings[idx]) + 1));
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_metadata_size.cc:262:61:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	g->options.s[o] = static_cast<char *>(malloc(strlen(arg) + strlen(g->unit.strings[idx]) + 1));
data/thin-provisioning-tools-0.9.0/thin-provisioning/thin_rmap.cc:86:6:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
		in.read(dots, sizeof(dots));
data/thin-provisioning-tools-0.9.0/unit-tests/base64_t.cc:74:18:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		unsigned len = strlen(in);
data/thin-provisioning-tools-0.9.0/unit-tests/base64_t.cc:96:18:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		unsigned len = strlen(in);

ANALYSIS SUMMARY:

Hits = 123
Lines analyzed = 39640 in approximately 0.73 seconds (54316 lines/second)
Physical Source Lines of Code (SLOC) = 28263
Hits@level = [0]  14 [1]  16 [2]  50 [3]  42 [4]  15 [5]   0
Hits@level+ = [0+] 137 [1+] 123 [2+] 107 [3+]  57 [4+]  15 [5+]   0
Hits/KSLOC@level+ = [0+] 4.84733 [1+] 4.35198 [2+] 3.78587 [3+] 2.01677 [4+] 0.530729 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.