Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/tkdnd-2.6/unix/tkUnixSelect.c Examining data/tkdnd-2.6/unix/TkDND_XDND.c Examining data/tkdnd-2.6/unix/Cursors.c Examining data/tkdnd-2.6/win/OleDND.h Examining data/tkdnd-2.6/win/TkDND_OleDND.cpp FINAL RESULTS: data/tkdnd-2.6/win/OleDND.h:732:17: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy((char *) szTempStr, Tcl_GetStringResult(interp)); data/tkdnd-2.6/win/OleDND.h:741:17: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy((char *) szTempStr, Tcl_GetStringResult(interp)); data/tkdnd-2.6/win/OleDND.h:1062:11: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(file_name, (char *) szTempStr); data/tkdnd-2.6/win/OleDND.h:1064:11: [4] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). strcat(file_name, (char *) file_descriptor.cFileName); data/tkdnd-2.6/win/TkDND_OleDND.cpp:216:13: [4] (buffer) lstrcpyW: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). lstrcpyW((LPWSTR) ptr_u, (LPWSTR) unicode); data/tkdnd-2.6/win/TkDND_OleDND.cpp:285:15: [4] (buffer) lstrcpyW: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). lstrcpyW(CurPosition, pszFileName); data/tkdnd-2.6/unix/TkDND_XDND.c:1427:24: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. data = (unsigned char *) Tcl_GetString(objv[7]); data/tkdnd-2.6/unix/tkUnixSelect.c:102:13: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[12]; data/tkdnd-2.6/unix/tkUnixSelect.c:104:6: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(buf, "0x%04x", (unsigned short) *propPtr); data/tkdnd-2.6/unix/tkUnixSelect.c:113:13: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[12]; data/tkdnd-2.6/unix/tkUnixSelect.c:115:6: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(buf, "0x%x", (unsigned int) *propPtr); data/tkdnd-2.6/win/OleDND.h:427:5: [2] (buffer) TCHAR: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. TCHAR szTempStr[80]; data/tkdnd-2.6/win/OleDND.h:453:7: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(dest, source, len); data/tkdnd-2.6/win/OleDND.h:471:5: [2] (buffer) TCHAR: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. TCHAR szTempStr[MAX_PATH+2]; data/tkdnd-2.6/win/OleDND.h:531:7: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char tmp[64]; data/tkdnd-2.6/win/OleDND.h:555:13: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(tmp, "0x%08x", fetc.cfFormat); data/tkdnd-2.6/win/OleDND.h:935:11: [2] (buffer) TCHAR: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. TCHAR szFile[MAX_PATH+2]; data/tkdnd-2.6/win/OleDND.h:1060:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char file_name[MAX_PATH+1]; data/tkdnd-2.6/win/TkDND_OleDND.cpp:227:20: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. ptr = (char *) GlobalLock(m_pstgmed[i].hGlobal); data/tkdnd-2.6/win/TkDND_OleDND.cpp:228:13: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(ptr, Tcl_GetString(objv[4]), nDataLength); data/tkdnd-2.6/win/TkDND_OleDND.cpp:279:37: [2] (buffer) TCHAR: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. TCHAR *pszFileName = (TCHAR *) data/tkdnd-2.6/win/TkDND_OleDND.cpp:311:16: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. ptr = (char *) GlobalLock(m_pstgmed[i].hGlobal); data/tkdnd-2.6/win/TkDND_OleDND.cpp:312:9: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(ptr, bytes, nDataLength); data/tkdnd-2.6/win/OleDND.h:1063:11: [1] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant character. strcat(file_name, "\\"); ANALYSIS SUMMARY: Hits = 24 Lines analyzed = 3998 in approximately 0.13 seconds (30779 lines/second) Physical Source Lines of Code (SLOC) = 3160 Hits@level = [0] 13 [1] 1 [2] 17 [3] 0 [4] 6 [5] 0 Hits@level+ = [0+] 37 [1+] 24 [2+] 23 [3+] 6 [4+] 6 [5+] 0 Hits/KSLOC@level+ = [0+] 11.7089 [1+] 7.59494 [2+] 7.27848 [3+] 1.89873 [4+] 1.89873 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.