Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/utf8proc-2.5.0/bench/bench.c Examining data/utf8proc-2.5.0/bench/icu.c Examining data/utf8proc-2.5.0/bench/unistring.c Examining data/utf8proc-2.5.0/bench/util.c Examining data/utf8proc-2.5.0/bench/util.h Examining data/utf8proc-2.5.0/test/case.c Examining data/utf8proc-2.5.0/test/charwidth.c Examining data/utf8proc-2.5.0/test/custom.c Examining data/utf8proc-2.5.0/test/graphemetest.c Examining data/utf8proc-2.5.0/test/iterate.c Examining data/utf8proc-2.5.0/test/misc.c Examining data/utf8proc-2.5.0/test/normtest.c Examining data/utf8proc-2.5.0/test/printproperty.c Examining data/utf8proc-2.5.0/test/tests.c Examining data/utf8proc-2.5.0/test/tests.h Examining data/utf8proc-2.5.0/test/valid.c Examining data/utf8proc-2.5.0/utf8proc.c Examining data/utf8proc-2.5.0/utf8proc.h Examining data/utf8proc-2.5.0/utf8proc_data.c FINAL RESULTS: data/utf8proc-2.5.0/test/tests.c:13:11: [4] (format) vfprintf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. vfprintf(stderr, format, args); data/utf8proc-2.5.0/bench/util.c:15:13: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). FILE *f = fopen(filename, "r"); data/utf8proc-2.5.0/test/graphemetest.c:7:26: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). FILE *f = argc > 1 ? fopen(argv[1], "r") : NULL; data/utf8proc-2.5.0/test/iterate.c:19:14: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char tmp[16]; data/utf8proc-2.5.0/test/iterate.c:20:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(tmp, buf, len); data/utf8proc-2.5.0/test/iterate.c:36:14: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char buf[16]; data/utf8proc-2.5.0/test/normtest.c:14:27: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). FILE *f = argc > 1 ? fopen(argv[1], "r") : NULL; data/utf8proc-2.5.0/test/normtest.c:15:6: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char source[1024], NFC[1024], NFD[1024], NFKC[1024], NFKD[1024]; data/utf8proc-2.5.0/test/printproperty.c:22:13: [2] (buffer) strcat: Does not check for buffer overflows when concatenating to destination [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused). Risk is low because the source is a constant string. strcat((char*)cstr, "N/A"); data/utf8proc-2.5.0/test/custom.c:23:11: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). check(strlen((char*) output) == 6, "incorrect output length"); data/utf8proc-2.5.0/test/misc.c:13:11: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). check(strlen((char*) nfc_out) == 5, "incorrect nfc length"); data/utf8proc-2.5.0/test/misc.c:17:11: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). check(strlen((char*) nfd_out) == 5, "incorrect nfd length"); data/utf8proc-2.5.0/test/misc.c:31:11: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). check(strlen((char*) output) == 4, "incorrect NFKC_Casefold+stripna length"); data/utf8proc-2.5.0/test/misc.c:36:11: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). check(strlen((char*) output) == 7, "incorrect NFKC_Casefold length"); data/utf8proc-2.5.0/utf8proc.c:126:49: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). const utf8proc_uint8_t *str, utf8proc_ssize_t strlen, utf8proc_int32_t *dst data/utf8proc-2.5.0/utf8proc.c:132:8: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (!strlen) return 0; data/utf8proc-2.5.0/utf8proc.c:133:17: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). end = str + ((strlen < 0) ? 4 : strlen); data/utf8proc-2.5.0/utf8proc.c:133:35: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). end = str + ((strlen < 0) ? 4 : strlen); data/utf8proc-2.5.0/utf8proc.c:495:49: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). const utf8proc_uint8_t *str, utf8proc_ssize_t strlen, data/utf8proc-2.5.0/utf8proc.c:498:43: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). return utf8proc_decompose_custom(str, strlen, buffer, bufsize, options, NULL, NULL); data/utf8proc-2.5.0/utf8proc.c:502:49: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). const utf8proc_uint8_t *str, utf8proc_ssize_t strlen, data/utf8proc-2.5.0/utf8proc.c:527:21: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (rpos >= strlen) break; data/utf8proc-2.5.0/utf8proc.c:705:49: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). const utf8proc_uint8_t *str, utf8proc_ssize_t strlen, utf8proc_uint8_t **dstptr, utf8proc_option_t options data/utf8proc-2.5.0/utf8proc.c:707:37: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). return utf8proc_map_custom(str, strlen, dstptr, options, NULL, NULL); data/utf8proc-2.5.0/utf8proc.c:711:49: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). const utf8proc_uint8_t *str, utf8proc_ssize_t strlen, utf8proc_uint8_t **dstptr, utf8proc_option_t options, data/utf8proc-2.5.0/utf8proc.c:717:43: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). result = utf8proc_decompose_custom(str, strlen, NULL, 0, options, custom_func, custom_data); data/utf8proc-2.5.0/utf8proc.c:721:43: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). result = utf8proc_decompose_custom(str, strlen, buffer, result, options, custom_func, custom_data); data/utf8proc-2.5.0/utf8proc.h:432:100: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). UTF8PROC_DLLEXPORT utf8proc_ssize_t utf8proc_iterate(const utf8proc_uint8_t *str, utf8proc_ssize_t strlen, utf8proc_int32_t *codepoint_ref); data/utf8proc-2.5.0/utf8proc.h:518:49: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). const utf8proc_uint8_t *str, utf8proc_ssize_t strlen, data/utf8proc-2.5.0/utf8proc.h:529:49: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). const utf8proc_uint8_t *str, utf8proc_ssize_t strlen, data/utf8proc-2.5.0/utf8proc.h:680:49: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). const utf8proc_uint8_t *str, utf8proc_ssize_t strlen, utf8proc_uint8_t **dstptr, utf8proc_option_t options data/utf8proc-2.5.0/utf8proc.h:690:49: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). const utf8proc_uint8_t *str, utf8proc_ssize_t strlen, utf8proc_uint8_t **dstptr, utf8proc_option_t options, ANALYSIS SUMMARY: Hits = 32 Lines analyzed = 17374 in approximately 1.21 seconds (14316 lines/second) Physical Source Lines of Code (SLOC) = 16577 Hits@level = [0] 54 [1] 23 [2] 8 [3] 0 [4] 1 [5] 0 Hits@level+ = [0+] 86 [1+] 32 [2+] 9 [3+] 1 [4+] 1 [5+] 0 Hits/KSLOC@level+ = [0+] 5.18791 [1+] 1.93039 [2+] 0.542921 [3+] 0.0603245 [4+] 0.0603245 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.