Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/utf8proc-2.5.0/bench/bench.c
Examining data/utf8proc-2.5.0/bench/icu.c
Examining data/utf8proc-2.5.0/bench/unistring.c
Examining data/utf8proc-2.5.0/bench/util.c
Examining data/utf8proc-2.5.0/bench/util.h
Examining data/utf8proc-2.5.0/test/case.c
Examining data/utf8proc-2.5.0/test/charwidth.c
Examining data/utf8proc-2.5.0/test/custom.c
Examining data/utf8proc-2.5.0/test/graphemetest.c
Examining data/utf8proc-2.5.0/test/iterate.c
Examining data/utf8proc-2.5.0/test/misc.c
Examining data/utf8proc-2.5.0/test/normtest.c
Examining data/utf8proc-2.5.0/test/printproperty.c
Examining data/utf8proc-2.5.0/test/tests.c
Examining data/utf8proc-2.5.0/test/tests.h
Examining data/utf8proc-2.5.0/test/valid.c
Examining data/utf8proc-2.5.0/utf8proc.c
Examining data/utf8proc-2.5.0/utf8proc.h
Examining data/utf8proc-2.5.0/utf8proc_data.c

FINAL RESULTS:

data/utf8proc-2.5.0/test/tests.c:13:11:  [4] (format) vfprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
          vfprintf(stderr, format, args);
data/utf8proc-2.5.0/bench/util.c:15:13:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	 FILE *f = fopen(filename, "r");
data/utf8proc-2.5.0/test/graphemetest.c:7:26:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    FILE *f = argc > 1 ? fopen(argv[1], "r") : NULL;
data/utf8proc-2.5.0/test/iterate.c:19:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char tmp[16];
data/utf8proc-2.5.0/test/iterate.c:20:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(tmp, buf, len);
data/utf8proc-2.5.0/test/iterate.c:36:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char buf[16];
data/utf8proc-2.5.0/test/normtest.c:14:27:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
     FILE *f = argc > 1 ? fopen(argv[1], "r") : NULL;
data/utf8proc-2.5.0/test/normtest.c:15:6:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
     char source[1024], NFC[1024], NFD[1024], NFKC[1024], NFKD[1024];
data/utf8proc-2.5.0/test/printproperty.c:22:13:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
            strcat((char*)cstr, "N/A");
data/utf8proc-2.5.0/test/custom.c:23:11:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    check(strlen((char*) output) == 6, "incorrect output length");
data/utf8proc-2.5.0/test/misc.c:13:11:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    check(strlen((char*) nfc_out) == 5, "incorrect nfc length");
data/utf8proc-2.5.0/test/misc.c:17:11:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    check(strlen((char*) nfd_out) == 5, "incorrect nfd length");
data/utf8proc-2.5.0/test/misc.c:31:11:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    check(strlen((char*) output) == 4, "incorrect NFKC_Casefold+stripna length");
data/utf8proc-2.5.0/test/misc.c:36:11:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    check(strlen((char*) output) == 7, "incorrect NFKC_Casefold length");
data/utf8proc-2.5.0/utf8proc.c:126:49:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  const utf8proc_uint8_t *str, utf8proc_ssize_t strlen, utf8proc_int32_t *dst
data/utf8proc-2.5.0/utf8proc.c:132:8:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if (!strlen) return 0;
data/utf8proc-2.5.0/utf8proc.c:133:17:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  end = str + ((strlen < 0) ? 4 : strlen);
data/utf8proc-2.5.0/utf8proc.c:133:35:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  end = str + ((strlen < 0) ? 4 : strlen);
data/utf8proc-2.5.0/utf8proc.c:495:49:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  const utf8proc_uint8_t *str, utf8proc_ssize_t strlen,
data/utf8proc-2.5.0/utf8proc.c:498:43:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    return utf8proc_decompose_custom(str, strlen, buffer, bufsize, options, NULL, NULL);
data/utf8proc-2.5.0/utf8proc.c:502:49:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  const utf8proc_uint8_t *str, utf8proc_ssize_t strlen,
data/utf8proc-2.5.0/utf8proc.c:527:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        if (rpos >= strlen) break;
data/utf8proc-2.5.0/utf8proc.c:705:49:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  const utf8proc_uint8_t *str, utf8proc_ssize_t strlen, utf8proc_uint8_t **dstptr, utf8proc_option_t options
data/utf8proc-2.5.0/utf8proc.c:707:37:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    return utf8proc_map_custom(str, strlen, dstptr, options, NULL, NULL);
data/utf8proc-2.5.0/utf8proc.c:711:49:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  const utf8proc_uint8_t *str, utf8proc_ssize_t strlen, utf8proc_uint8_t **dstptr, utf8proc_option_t options,
data/utf8proc-2.5.0/utf8proc.c:717:43:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  result = utf8proc_decompose_custom(str, strlen, NULL, 0, options, custom_func, custom_data);
data/utf8proc-2.5.0/utf8proc.c:721:43:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  result = utf8proc_decompose_custom(str, strlen, buffer, result, options, custom_func, custom_data);
data/utf8proc-2.5.0/utf8proc.h:432:100:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
UTF8PROC_DLLEXPORT utf8proc_ssize_t utf8proc_iterate(const utf8proc_uint8_t *str, utf8proc_ssize_t strlen, utf8proc_int32_t *codepoint_ref);
data/utf8proc-2.5.0/utf8proc.h:518:49:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  const utf8proc_uint8_t *str, utf8proc_ssize_t strlen,
data/utf8proc-2.5.0/utf8proc.h:529:49:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  const utf8proc_uint8_t *str, utf8proc_ssize_t strlen,
data/utf8proc-2.5.0/utf8proc.h:680:49:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  const utf8proc_uint8_t *str, utf8proc_ssize_t strlen, utf8proc_uint8_t **dstptr, utf8proc_option_t options
data/utf8proc-2.5.0/utf8proc.h:690:49:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  const utf8proc_uint8_t *str, utf8proc_ssize_t strlen, utf8proc_uint8_t **dstptr, utf8proc_option_t options,

ANALYSIS SUMMARY:

Hits = 32
Lines analyzed = 17374 in approximately 1.21 seconds (14316 lines/second)
Physical Source Lines of Code (SLOC) = 16577
Hits@level = [0]  54 [1]  23 [2]   8 [3]   0 [4]   1 [5]   0
Hits@level+ = [0+]  86 [1+]  32 [2+]   9 [3+]   1 [4+]   1 [5+]   0
Hits/KSLOC@level+ = [0+] 5.18791 [1+] 1.93039 [2+] 0.542921 [3+] 0.0603245 [4+] 0.0603245 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.