Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/vanessa-socket-0.0.13/libvanessa_socket/vanessa_socket_daemon.c
Examining data/vanessa-socket-0.0.13/libvanessa_socket/unused.h
Examining data/vanessa-socket-0.0.13/libvanessa_socket/vanessa_socket_handler.c
Examining data/vanessa-socket-0.0.13/libvanessa_socket/vanessa_socket_server.c
Examining data/vanessa-socket-0.0.13/libvanessa_socket/vanessa_socket_pipe.c
Examining data/vanessa-socket-0.0.13/libvanessa_socket/vanessa_socket.h
Examining data/vanessa-socket-0.0.13/libvanessa_socket/vanessa_socket_client.c
Examining data/vanessa-socket-0.0.13/vanessa_socket_pipe/options.c
Examining data/vanessa-socket-0.0.13/vanessa_socket_pipe/vanessa_socket_pipe.c
Examining data/vanessa-socket-0.0.13/vanessa_socket_pipe/options.h
Examining data/vanessa-socket-0.0.13/vanessa_socket_pipe/vanessa_socket_pipe_config.h

FINAL RESULTS:

data/vanessa-socket-0.0.13/vanessa_socket_pipe/vanessa_socket_pipe.c:163:3:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
  strcpy(from_to_str, from_host_str);
data/vanessa-socket-0.0.13/vanessa_socket_pipe/vanessa_socket_pipe.c:165:3:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
  strcat(from_to_str, from_serv_str);
data/vanessa-socket-0.0.13/vanessa_socket_pipe/vanessa_socket_pipe.c:167:3:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
  strcat(from_to_str, to_host_str);
data/vanessa-socket-0.0.13/vanessa_socket_pipe/vanessa_socket_pipe.c:169:3:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
  strcat(from_to_str, to_serv_str);
data/vanessa-socket-0.0.13/libvanessa_socket/vanessa_socket_client.c:349:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(&timeout, &tv, sizeof(tv));
data/vanessa-socket-0.0.13/libvanessa_socket/vanessa_socket_client.c:425:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(&(*addr)[i].sin_addr.s_addr, hp->h_addr_list[i],
data/vanessa-socket-0.0.13/libvanessa_socket/vanessa_socket_daemon.c:111:6:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	if (open("/dev/null", O_RDONLY) < 0) {
data/vanessa-socket-0.0.13/libvanessa_socket/vanessa_socket_daemon.c:114:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	if ((open("/dev/console", O_WRONLY | O_APPEND) < 0) &&
data/vanessa-socket-0.0.13/libvanessa_socket/vanessa_socket_daemon.c:115:4:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
			open("/dev/null", O_WRONLY | O_APPEND) < 0) {
data/vanessa-socket-0.0.13/libvanessa_socket/vanessa_socket_daemon.c:118:7:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	if ((open("/dev/console", O_WRONLY | O_APPEND) < 0) &&
data/vanessa-socket-0.0.13/libvanessa_socket/vanessa_socket_daemon.c:119:4:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
			open("/dev/null", O_WRONLY | O_APPEND) < 0) {
data/vanessa-socket-0.0.13/libvanessa_socket/vanessa_socket_daemon.c:228:17:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
		gid = (gid_t) atoi(group);
data/vanessa-socket-0.0.13/libvanessa_socket/vanessa_socket_daemon.c:247:17:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
		uid = (uid_t) atoi(user);
data/vanessa-socket-0.0.13/libvanessa_socket/vanessa_socket_server.c:454:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(return_from, &from, addrlen);
data/vanessa-socket-0.0.13/libvanessa_socket/vanessa_socket_server.c:699:8:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	const char *fromv[3];
data/vanessa-socket-0.0.13/vanessa_socket_pipe/options.c:167:32:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
	opt_i(&opt->connection_limit, atoi(optarg), 0);
data/vanessa-socket-0.0.13/vanessa_socket_pipe/options.c:195:23:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
	opt_i(&opt->timeout, atoi(optarg), 0);
data/vanessa-socket-0.0.13/vanessa_socket_pipe/vanessa_socket_pipe.c:63:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char from_to_str[((NI_MAXHOST+NI_MAXSERV+1)*2)+2];
data/vanessa-socket-0.0.13/vanessa_socket_pipe/vanessa_socket_pipe.c:64:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char from_host_str[NI_MAXHOST];
data/vanessa-socket-0.0.13/vanessa_socket_pipe/vanessa_socket_pipe.c:65:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char to_host_str[NI_MAXHOST];
data/vanessa-socket-0.0.13/vanessa_socket_pipe/vanessa_socket_pipe.c:66:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char from_serv_str[NI_MAXSERV];
data/vanessa-socket-0.0.13/vanessa_socket_pipe/vanessa_socket_pipe.c:67:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char to_serv_str[NI_MAXSERV];
data/vanessa-socket-0.0.13/vanessa_socket_pipe/vanessa_socket_pipe.c:166:3:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
  strcat(from_to_str, "->");
data/vanessa-socket-0.0.13/libvanessa_socket/vanessa_socket_daemon.c:315:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	for (offset = strlen(str) - 1; offset > -1; offset--) {
data/vanessa-socket-0.0.13/libvanessa_socket/vanessa_socket_pipe.c:54:10:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	bytes = read(fd, buf, count);
data/vanessa-socket-0.0.13/vanessa_socket_pipe/vanessa_socket_pipe.c:164:3:  [1] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant character.
  strcat(from_to_str, ":");
data/vanessa-socket-0.0.13/vanessa_socket_pipe/vanessa_socket_pipe.c:168:3:  [1] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant character.
  strcat(from_to_str, ":");

ANALYSIS SUMMARY:

Hits = 27
Lines analyzed = 3537 in approximately 0.12 seconds (30067 lines/second)
Physical Source Lines of Code (SLOC) = 1663
Hits@level = [0]   4 [1]   4 [2]  19 [3]   0 [4]   4 [5]   0
Hits@level+ = [0+]  31 [1+]  27 [2+]  23 [3+]   4 [4+]   4 [5+]   0
Hits/KSLOC@level+ = [0+] 18.641 [1+] 16.2357 [2+] 13.8304 [3+] 2.40529 [4+] 2.40529 [5+]   0
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.