Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/uni2ascii-4.18/putu8.c
Examining data/uni2ascii-4.18/exitcode.h
Examining data/uni2ascii-4.18/UTF8in.c
Examining data/uni2ascii-4.18/GetWord.c
Examining data/uni2ascii-4.18/SetFormat.c
Examining data/uni2ascii-4.18/uni2ascii.c
Examining data/uni2ascii-4.18/enttbl.c
Examining data/uni2ascii-4.18/utf8error.h
Examining data/uni2ascii-4.18/formats.h
Examining data/uni2ascii-4.18/enttbl.h
Examining data/uni2ascii-4.18/unicode.h
Examining data/uni2ascii-4.18/u2a_endian.h
Examining data/uni2ascii-4.18/endian.c
Examining data/uni2ascii-4.18/ascii2uni.c

FINAL RESULTS:

data/uni2ascii-4.18/ascii2uni.c:359:6:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
     sprintf(aDfmt,"%s%%n",Formats[HTMLD]);
data/uni2ascii-4.18/ascii2uni.c:360:6:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
     sprintf(aHfmt,"%s%%n",Formats[HTMLX]);
data/uni2ascii-4.18/ascii2uni.c:390:15:  [4] (buffer) sscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function. If the scanf format is influenceable by an
  attacker, it's exploitable.
	 Converted = sscanf(str,afmt,&enam,&NConsumed);
data/uni2ascii-4.18/ascii2uni.c:402:15:  [4] (buffer) sscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function. If the scanf format is influenceable by an
  attacker, it's exploitable.
	 Converted = sscanf(str,afmt,&b1,&b2,&b3,&NConsumed);
data/uni2ascii-4.18/ascii2uni.c:420:15:  [4] (buffer) sscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function. If the scanf format is influenceable by an
  attacker, it's exploitable.
	 Converted = sscanf(str,afmt,&num,&NConsumed);
data/uni2ascii-4.18/ascii2uni.c:542:6:  [4] (buffer) sscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function. If the scanf format is influenceable by an
  attacker, it's exploitable.
	 if(sscanf(iptr,SplitFormat,&SplitStr,&num,&NConsumed)) {
data/uni2ascii-4.18/ascii2uni.c:560:8:  [4] (buffer) sscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function. If the scanf format is influenceable by an
  attacker, it's exploitable.
	   if(sscanf(iptr,aHfmt,&num,&NConsumed) > 0) {
data/uni2ascii-4.18/ascii2uni.c:581:8:  [4] (buffer) sscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function. If the scanf format is influenceable by an
  attacker, it's exploitable.
	   if(sscanf(iptr,aDfmt,&num,&NConsumed) > 0) {
data/uni2ascii-4.18/ascii2uni.c:603:6:  [4] (buffer) sscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function. If the scanf format is influenceable by an
  attacker, it's exploitable.
	 if(sscanf(iptr,afmt,&enam,&NConsumed) > 0) {
data/uni2ascii-4.18/ascii2uni.c:627:13:  [4] (buffer) sscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function. If the scanf format is influenceable by an
  attacker, it's exploitable.
	 Converted=sscanf(iptr,afmt,&b1,&b2,&b3,&NConsumed);
data/uni2ascii-4.18/ascii2uni.c:659:14:  [4] (buffer) sscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function. If the scanf format is influenceable by an
  attacker, it's exploitable.
	 if((last = sscanf(iptr,afmt,&num,&NConsumed)) > 0) {
data/uni2ascii-4.18/uni2ascii.c:3151:2:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
	printf(fmt,c);
data/uni2ascii-4.18/uni2ascii.c:3160:2:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
	printf(fmt,c);
data/uni2ascii-4.18/uni2ascii.c:3170:2:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
	printf(fmt,c);
data/uni2ascii-4.18/uni2ascii.c:3180:19:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
	  if(c > 0xFFFF) printf(AboveBMPfmt,c);
data/uni2ascii-4.18/uni2ascii.c:3181:9:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
	  else printf(WithinBMPfmt,c);
data/uni2ascii-4.18/uni2ascii.c:3188:13:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
	      else printf(fmt,c);
data/uni2ascii-4.18/uni2ascii.c:3192:13:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
	      else printf(fmt,c);
data/uni2ascii-4.18/uni2ascii.c:3205:8:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
	      printf(fmt,b1,b2,b3);
data/uni2ascii-4.18/uni2ascii.c:3207:11:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
	    else printf(fmt,c);
data/uni2ascii-4.18/ascii2uni.c:275:17:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
   while( (oc = getopt(ac,av,":Z:a:hLmpqv")) != EOF){
data/uni2ascii-4.18/uni2ascii.c:2810:16:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
  while( (oc = getopt(ac,av,":Aa:BcdeEfhlLnPpqsS:vwyxZ:")) != EOF){
data/uni2ascii-4.18/UTF8in.c:38:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static const char TrailingBytesForUTF8[256] = {
data/uni2ascii-4.18/UTF8in.c:94:19:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  static unsigned char c[6];
data/uni2ascii-4.18/ascii2uni.c:69:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char vnum[11+1];
data/uni2ascii-4.18/ascii2uni.c:207:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char afmt [AFMTSIZE];
data/uni2ascii-4.18/ascii2uni.c:208:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char aHfmt [8+2+1];
data/uni2ascii-4.18/ascii2uni.c:209:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char aDfmt [8+2+1];
data/uni2ascii-4.18/ascii2uni.c:210:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char cbuf[5];
data/uni2ascii-4.18/ascii2uni.c:211:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char fmt_itoa[12];
data/uni2ascii-4.18/ascii2uni.c:232:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char SplitStr[3];
data/uni2ascii-4.18/ascii2uni.c:233:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char enam[16];
data/uni2ascii-4.18/ascii2uni.c:234:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char tmpstr [16];
data/uni2ascii-4.18/ascii2uni.c:332:13:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
     infp = fopen(av[optind],"r");
data/uni2ascii-4.18/uni2ascii.c:63:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char msg [MSGSIZE];
data/uni2ascii-4.18/uni2ascii.c:76:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char vnum[11+1];
data/uni2ascii-4.18/uni2ascii.c:220:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char c[4];
data/uni2ascii-4.18/uni2ascii.c:2908:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    infd = open(av[optind],O_RDONLY);
data/uni2ascii-4.18/GetWord.c:38:7:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    c=getc(fp);
data/uni2ascii-4.18/SetFormat.c:72:6:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if(strlen(fs) == 1) {
data/uni2ascii-4.18/UTF8in.c:102:15:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  BytesRead = read(fd,(void *) c,1);
data/uni2ascii-4.18/UTF8in.c:116:17:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    BytesRead = read(fd,(void *) &c[BytesSoFar+1],(size_t) (BytesNeeded-BytesSoFar));
data/uni2ascii-4.18/ascii2uni.c:243:11:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  ssize_t read;
data/uni2ascii-4.18/ascii2uni.c:470:41:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
   while (NULL != (lbuf = fgetln(infp, &read))) {
data/uni2ascii-4.18/ascii2uni.c:568:39:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	         NConsumed = 3 /* "&#x" */ + strlen(fmt_itoa) + 1 /* ";" */;
data/uni2ascii-4.18/ascii2uni.c:589:38:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	         NConsumed = 2 /* "&#" */ + strlen(fmt_itoa) + 1 /* ";" */;
data/uni2ascii-4.18/ascii2uni.c:604:52:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	   if (NConsumed == -1) NConsumed = 1 /* "&" */ + strlen(enam) + 1 /* ";" */;
data/uni2ascii-4.18/uni2ascii.c:3050:20:  [1] (buffer) getchar:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
      while( (ch = getchar()) != EOF) { 

ANALYSIS SUMMARY:

Hits = 48
Lines analyzed = 5479 in approximately 0.15 seconds (36546 lines/second)
Physical Source Lines of Code (SLOC) = 4981
Hits@level = [0] 265 [1]  10 [2]  16 [3]   2 [4]  20 [5]   0
Hits@level+ = [0+] 313 [1+]  48 [2+]  38 [3+]  22 [4+]  20 [5+]   0
Hits/KSLOC@level+ = [0+] 62.8388 [1+] 9.63662 [2+] 7.62899 [3+] 4.41678 [4+] 4.01526 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.