Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/uvccapture-0.5/uvccapture.c Examining data/uvccapture-0.5/v4l2uvc.c Examining data/uvccapture-0.5/v4l2uvc.h FINAL RESULTS: data/uvccapture-0.5/uvccapture.c:90:5: [4] (shell) execvp: This causes a new program to execute and is difficult to use safely (CWE-78). try using a library call that implements the same functionality if available. execvp (argv[0], argv); data/uvccapture-0.5/uvccapture.c:185:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char *post_capture_command[3]; data/uvccapture-0.5/uvccapture.c:227:15: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). width = atoi (&argv[1][2]); data/uvccapture-0.5/uvccapture.c:231:16: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). height = atoi (&argv[1][2]); data/uvccapture-0.5/uvccapture.c:243:15: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). delay = atoi (&argv[1][2]); data/uvccapture-0.5/uvccapture.c:255:20: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). brightness = atoi (&argv[1][2]); data/uvccapture-0.5/uvccapture.c:259:18: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). contrast = atoi (&argv[1][2]); data/uvccapture-0.5/uvccapture.c:263:20: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). saturation = atoi (&argv[1][2]); data/uvccapture-0.5/uvccapture.c:267:14: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). gain = atoi (&argv[1][2]); data/uvccapture-0.5/uvccapture.c:271:17: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). quality = atoi (&argv[1][2]); data/uvccapture-0.5/uvccapture.c:366:14: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). file = fopen (outputfile, "wb"); data/uvccapture-0.5/v4l2uvc.c:38:17: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. static unsigned char dht_data[DHT_SIZE] = { data/uvccapture-0.5/v4l2uvc.c:142:17: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if ((vd->fd = open (vd->videodevice, O_RDWR)) == -1) { data/uvccapture-0.5/v4l2uvc.c:296:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy (vd->tmpbuffer, vd->mem[vd->buf.index], HEADERFRAME1); data/uvccapture-0.5/v4l2uvc.c:297:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy (vd->tmpbuffer + HEADERFRAME1, dht_data, DHT_SIZE); data/uvccapture-0.5/v4l2uvc.c:298:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy (vd->tmpbuffer + HEADERFRAME1 + DHT_SIZE, data/uvccapture-0.5/v4l2uvc.c:306:7: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy (vd->framebuffer, vd->mem[vd->buf.index], data/uvccapture-0.5/v4l2uvc.c:309:7: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy (vd->framebuffer, vd->mem[vd->buf.index], ANALYSIS SUMMARY: Hits = 18 Lines analyzed = 1056 in approximately 0.04 seconds (24163 lines/second) Physical Source Lines of Code (SLOC) = 921 Hits@level = [0] 77 [1] 0 [2] 17 [3] 0 [4] 1 [5] 0 Hits@level+ = [0+] 95 [1+] 18 [2+] 18 [3+] 1 [4+] 1 [5+] 0 Hits/KSLOC@level+ = [0+] 103.149 [1+] 19.544 [2+] 19.544 [3+] 1.08578 [4+] 1.08578 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.