Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/tk-table-2.10.5/generic/tkAppInit.c Examining data/tk-table-2.10.5/generic/tkTable.c Examining data/tk-table-2.10.5/generic/tkTable.h Examining data/tk-table-2.10.5/generic/tkTableCell.c Examining data/tk-table-2.10.5/generic/tkTableCellSort.c Examining data/tk-table-2.10.5/generic/tkTableCmds.c Examining data/tk-table-2.10.5/generic/tkTableEdit.c Examining data/tk-table-2.10.5/generic/tkTableInitScript.h Examining data/tk-table-2.10.5/generic/tkTablePs.c Examining data/tk-table-2.10.5/generic/tkTableWin.c Examining data/tk-table-2.10.5/generic/version.h Examining data/tk-table-2.10.5/generic/tkTableTag.c Examining data/tk-table-2.10.5/generic/tkTableUtil.c FINAL RESULTS: data/tk-table-2.10.5/generic/tkTable.c:1055:2: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(oldVar, tablePtr->arrayVar); data/tk-table-2.10.5/generic/tkTable.c:1193:2: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(tablePtr->defaultTag.borderStr, data/tk-table-2.10.5/generic/tkTable.c:2787:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(tablePtr->activeBuf, data); data/tk-table-2.10.5/generic/tkTable.c:2875:6: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(tablePtr->activeBuf, data); data/tk-table-2.10.5/generic/tkTable.c:2901:3: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(val, data); data/tk-table-2.10.5/generic/tkTableCell.c:417:7: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(buf1, val); data/tk-table-2.10.5/generic/tkTableCell.c:420:7: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(buf2, val); data/tk-table-2.10.5/generic/tkTableCell.c:437:7: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(buf1, val); data/tk-table-2.10.5/generic/tkTableCell.c:440:7: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(buf2, val); data/tk-table-2.10.5/generic/tkTableCell.c:535:6: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(val, result); data/tk-table-2.10.5/generic/tkTableCell.c:662:6: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(val, value); data/tk-table-2.10.5/generic/tkTableCell.c:1195:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(dbuf, span); data/tk-table-2.10.5/generic/tkTableCmds.c:740:2: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(tablePtr->activeBuf, value); data/tk-table-2.10.5/generic/tkTableEdit.c:391:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(new + byteIndex, string + byteIndex + byteCount); data/tk-table-2.10.5/generic/tkTableEdit.c:407:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(new+index, tablePtr->activeBuf+index+count); data/tk-table-2.10.5/generic/tkTableEdit.c:487:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(new + byteIndex, value); data/tk-table-2.10.5/generic/tkTableEdit.c:488:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(new + byteIndex + byteCount, string + byteIndex); data/tk-table-2.10.5/generic/tkTableEdit.c:538:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(new+index, value); data/tk-table-2.10.5/generic/tkTableEdit.c:539:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(new+index+newlen, (tablePtr->activeBuf)+index); data/tk-table-2.10.5/generic/tkTablePs.c:744:2: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(string, "%s%s\n", p, Tcl_GetHashKey(&psInfo.fontTable, hPtr)); data/tk-table-2.10.5/generic/tkTablePs.c:772:2: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(string, "%s%s\n", "%%IncludeResource: font ", data/tk-table-2.10.5/generic/tkTablePs.c:876:3: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(msg, "\n (generating Postscript for cell %s)", data/tk-table-2.10.5/generic/tkTablePs.c:1293:5: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(buffer, "] %d %g %g %s %d %d DrawCellText\n", data/tk-table-2.10.5/generic/tkTableUtil.c:145:7: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(*borderStr, value); data/tk-table-2.10.5/generic/tkTable.c:675:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. (char *) tablePtr, Tcl_GetString(objv[2]), 0); data/tk-table-2.10.5/generic/tkTable.c:757:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[INDEX_BUFSIZE]; data/tk-table-2.10.5/generic/tkTable.c:1727:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[INDEX_BUFSIZE]; data/tk-table-2.10.5/generic/tkTable.c:2474:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy((VOID *) tablePtr->activeTagPtr, data/tk-table-2.10.5/generic/tkTable.c:2703:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[INDEX_BUFSIZE]; data/tk-table-2.10.5/generic/tkTable.c:2881:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[INDEX_BUFSIZE]; data/tk-table-2.10.5/generic/tkTable.c:3358:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[INDEX_BUFSIZE]; data/tk-table-2.10.5/generic/tkTable.c:3383:6: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(buf, " %g %g", first, last); data/tk-table-2.10.5/generic/tkTable.c:3407:6: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(buf, " %g %g", first, last); data/tk-table-2.10.5/generic/tkTable.c:3693:2: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy((VOID *) buffer, data/tk-table-2.10.5/generic/tkTable.c:3903:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char *string, buf[INDEX_BUFSIZE]; data/tk-table-2.10.5/generic/tkTable.c:3951:6: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(buf, "%d", c); data/tk-table-2.10.5/generic/tkTable.c:3959:6: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(buf, "%d", r); data/tk-table-2.10.5/generic/tkTable.c:3963:6: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(buf, "%d", index); data/tk-table-2.10.5/generic/tkTable.h:633:38: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. #define TableMakeArrayIndex(r, c, i) sprintf((i), "%d,%d", (r), (c)) data/tk-table-2.10.5/generic/tkTableCell.c:44:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[INDEX_BUFSIZE]; data/tk-table-2.10.5/generic/tkTableCell.c:106:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[INDEX_BUFSIZE]; data/tk-table-2.10.5/generic/tkTableCell.c:317:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[INDEX_BUFSIZE]; data/tk-table-2.10.5/generic/tkTableCell.c:405:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf1[INDEX_BUFSIZE], buf2[INDEX_BUFSIZE]; data/tk-table-2.10.5/generic/tkTableCell.c:474:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[INDEX_BUFSIZE]; data/tk-table-2.10.5/generic/tkTableCell.c:600:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[INDEX_BUFSIZE]; data/tk-table-2.10.5/generic/tkTableCell.c:1081:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char *dbuf, buf[INDEX_BUFSIZE], cell[INDEX_BUFSIZE], span[INDEX_BUFSIZE]; data/tk-table-2.10.5/generic/tkTableCmds.c:57:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf1[INDEX_BUFSIZE], buf2[INDEX_BUFSIZE]; data/tk-table-2.10.5/generic/tkTableCmds.c:164:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf1[INDEX_BUFSIZE]; data/tk-table-2.10.5/generic/tkTableCmds.c:188:6: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(buf1, "%d %d", posn, value); data/tk-table-2.10.5/generic/tkTableCmds.c:533:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[INDEX_BUFSIZE], *value; data/tk-table-2.10.5/generic/tkTableCmds.c:935:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf1[INDEX_BUFSIZE]; data/tk-table-2.10.5/generic/tkTableCmds.c:1033:2: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[INDEX_BUFSIZE]; data/tk-table-2.10.5/generic/tkTableCmds.c:1063:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf1[INDEX_BUFSIZE]; data/tk-table-2.10.5/generic/tkTableEdit.c:390:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(new, string, (size_t) byteIndex); data/tk-table-2.10.5/generic/tkTableEdit.c:486:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(new, string, (size_t) byteIndex); data/tk-table-2.10.5/generic/tkTableEdit.c:597:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[INDEX_BUFSIZE], buf1[INDEX_BUFSIZE]; data/tk-table-2.10.5/generic/tkTablePs.c:450:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char string[STRING_LENGTH+1], *p, **argv; data/tk-table-2.10.5/generic/tkTablePs.c:712:5: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(string, " %d,%d => %d,%d\n", firstRow, firstCol, lastRow, lastCol); data/tk-table-2.10.5/generic/tkTablePs.c:721:2: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(string, "%d %d %d %d\n", data/tk-table-2.10.5/generic/tkTablePs.c:729:2: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(string, "%d %d %d %d\n", data/tk-table-2.10.5/generic/tkTablePs.c:768:5: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(string, "/CL %d def\n", psInfo.colorLevel); data/tk-table-2.10.5/generic/tkTablePs.c:784:5: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(string, "%.1f %.1f translate\n", data/tk-table-2.10.5/generic/tkTablePs.c:789:5: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(string, "%.4g %.4g scale\n%d %d translate\n", data/tk-table-2.10.5/generic/tkTablePs.c:792:5: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(string, "%d %.15g moveto %d %.15g lineto %d %.15g lineto %d %.15g", data/tk-table-2.10.5/generic/tkTablePs.c:874:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char msg[64 + TCL_INTEGER_SPACE]; data/tk-table-2.10.5/generic/tkTablePs.c:883:2: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(string, "/row%d %d def\n", data/tk-table-2.10.5/generic/tkTablePs.c:889:5: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(string, "/row%d %d def\n", row, tablePtr->psInfoPtr->y2 - total); data/tk-table-2.10.5/generic/tkTablePs.c:894:2: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(string, "/col%d %d def\n", col, total); data/tk-table-2.10.5/generic/tkTablePs.c:898:5: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(string, "/col%d %d def\n", col, total); data/tk-table-2.10.5/generic/tkTablePs.c:1012:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char string[200]; data/tk-table-2.10.5/generic/tkTablePs.c:1050:5: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(string, "%.3f %.3f %.3f AdjustColor\n", data/tk-table-2.10.5/generic/tkTablePs.c:1089:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char pointString[TCL_INTEGER_SPACE]; data/tk-table-2.10.5/generic/tkTablePs.c:1136:5: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(pointString, "%d", points); data/tk-table-2.10.5/generic/tkTablePs.c:1252:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buffer[500]; data/tk-table-2.10.5/generic/tkTablePs.c:1266:5: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(buffer, "%% %.15g %.15g [\n", (tagX+width)/2.0, data/tk-table-2.10.5/generic/tkTablePs.c:1269:5: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(buffer, "col%d row%d [\n", col, row); data/tk-table-2.10.5/generic/tkTableTag.c:245:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy((VOID *) jtagPtr, (VOID *) &(tablePtr->defaultTag), data/tk-table-2.10.5/generic/tkTableTag.c:583:6: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[INDEX_BUFSIZE]; data/tk-table-2.10.5/generic/tkTableTag.c:588:6: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(buf, " %d", cell); data/tk-table-2.10.5/generic/tkTableTag.c:670:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[INDEX_BUFSIZE], *keybuf, *tagname; data/tk-table-2.10.5/generic/tkTableTag.c:973:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. (char *) tagPtr, Tcl_GetString(objv[4]), 0); data/tk-table-2.10.5/generic/tkTableUtil.c:278:6: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tagPtr->borderStr, oldValue, length); data/tk-table-2.10.5/generic/tkTableWin.c:373:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[INDEX_BUFSIZE]; data/tk-table-2.10.5/generic/tkTableWin.c:817:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[INDEX_BUFSIZE], *keybuf, *winname; data/tk-table-2.10.5/generic/tkTableWin.c:845:13: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. (char *) ewPtr, data/tk-table-2.10.5/generic/tkTable.c:1054:19: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). oldVar = ckalloc(strlen(tablePtr->arrayVar) + 1); data/tk-table-2.10.5/generic/tkTable.c:2129:47: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). numBytes = Tcl_NumUtfChars(string, (int) strlen(string)); data/tk-table-2.10.5/generic/tkTable.c:2131:17: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). numBytes = strlen(string); data/tk-table-2.10.5/generic/tkTable.c:2255:25: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). ellipsis, (int) strlen(ellipsis)); data/tk-table-2.10.5/generic/tkTable.c:2295:21: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). ellipsis, (int) strlen(ellipsis), data/tk-table-2.10.5/generic/tkTable.c:2329:21: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). ellipsis, (int) strlen(ellipsis), data/tk-table-2.10.5/generic/tkTable.c:2356:21: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). ellipsis, (int) strlen(ellipsis), data/tk-table-2.10.5/generic/tkTable.c:2786:6: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). strlen(data)+1); data/tk-table-2.10.5/generic/tkTable.c:2874:7: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). strlen(data)+1); data/tk-table-2.10.5/generic/tkTable.c:2900:25: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). val = (char *)ckalloc(strlen(data)+1); data/tk-table-2.10.5/generic/tkTable.c:3619:22: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). rslen = (rowsep?(strlen(rowsep)):0); data/tk-table-2.10.5/generic/tkTable.c:3620:22: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). cslen = (colsep?(strlen(colsep)):0); data/tk-table-2.10.5/generic/tkTableCell.c:534:28: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). val = (char *)ckalloc(strlen(result)+1); data/tk-table-2.10.5/generic/tkTableCell.c:661:28: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). val = (char *)ckalloc(strlen(value)+1); data/tk-table-2.10.5/generic/tkTableCell.c:781:11: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). len = strlen(tablePtr->activeBuf); data/tk-table-2.10.5/generic/tkTableCell.c:833:21: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). int r, c, len = strlen(str); data/tk-table-2.10.5/generic/tkTableCell.c:1194:28: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). dbuf = (char *)ckalloc(strlen(span)+1); data/tk-table-2.10.5/generic/tkTableEdit.c:375:16: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). numBytes = strlen(string); data/tk-table-2.10.5/generic/tkTableEdit.c:406:5: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(new, tablePtr->activeBuf, (size_t) index); data/tk-table-2.10.5/generic/tkTableEdit.c:465:17: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). byteCount = strlen(value); data/tk-table-2.10.5/generic/tkTableEdit.c:484:14: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). oldlen = strlen(string); data/tk-table-2.10.5/generic/tkTableEdit.c:522:14: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). newlen = strlen(value); data/tk-table-2.10.5/generic/tkTableEdit.c:534:14: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). oldlen = strlen(tablePtr->activeBuf); data/tk-table-2.10.5/generic/tkTableEdit.c:537:5: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(new, tablePtr->activeBuf, (size_t) index); data/tk-table-2.10.5/generic/tkTablePs.c:596:11: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). length = strlen(psInfo.colorMode); data/tk-table-2.10.5/generic/tkTablePs.c:833:11: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (!strlen(value)) { data/tk-table-2.10.5/generic/tkTableUtil.c:144:37: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). *borderStr = (char *) ckalloc(strlen(value) + 1); data/tk-table-2.10.5/generic/tkTableUtil.c:264:22: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). size_t length = strlen(oldValue) + 1; data/tk-table-2.10.5/generic/tkTableUtil.c:357:22: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). unsigned int len = strlen(arg); ANALYSIS SUMMARY: Hits = 114 Lines analyzed = 12807 in approximately 0.36 seconds (35657 lines/second) Physical Source Lines of Code (SLOC) = 8021 Hits@level = [0] 3 [1] 29 [2] 61 [3] 0 [4] 24 [5] 0 Hits@level+ = [0+] 117 [1+] 114 [2+] 85 [3+] 24 [4+] 24 [5+] 0 Hits/KSLOC@level+ = [0+] 14.5867 [1+] 14.2127 [2+] 10.5972 [3+] 2.99215 [4+] 2.99215 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.