Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/applications-page.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/applications-page.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/category-button.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/category-button.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/category.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/category.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/command-edit.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/command-edit.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/command.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/command.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/element.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/element.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/favorites-page.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/favorites-page.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/icon-renderer.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/icon-renderer.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/icon-size.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/icon-size.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/image-menu-item.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/launcher-icon-view.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/launcher-icon-view.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/launcher-tree-view.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/launcher-tree-view.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/launcher-view.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/launcher.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/launcher.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/page.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/page.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/plugin.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/plugin.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/profile-picture.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/profile-picture.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/query.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/query.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/recent-page.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/recent-page.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/register-plugin.c
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/resize-grip.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/resize-grip.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/run-action.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/run-action.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/search-action.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/search-action.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/search-page.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/search-page.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/settings-dialog.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/settings-dialog.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/settings.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/settings.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/slot.h
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/window.cpp
Examining data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/window.h
FINAL RESULTS:
data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/profile-picture.cpp:50:33: [3] (buffer) g_get_home_dir:
This function is synonymous with 'getenv("HOME")';it returns untrustable
input if the environment can beset by an attacker. It can have any content
and length, and the same variable can be set more than once (CWE-807,
CWE-20). Check environment variables carefully before using them.
gchar* path = g_build_filename(g_get_home_dir(), ".face", nullptr);
data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/launcher.cpp:63:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
index += strlen(quoted);
data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/launcher.cpp:79:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
index += strlen(prefix);
data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/launcher.cpp:83:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
index += strlen(quoted);
data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/launcher.cpp:212:25: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
relpath = uri + 7 + strlen(dirs[i]) - 13;
data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/search-action.cpp:113:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
pos += strlen(trimmed) + 1;
data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/search-action.cpp:118:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
pos += strlen(haystack) + 1;
data/xfce4-whiskermenu-plugin-2.4.6/panel-plugin/search-action.cpp:127:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
pos += strlen(uri) + 1;
ANALYSIS SUMMARY:
Hits = 8
Lines analyzed = 10231 in approximately 0.21 seconds (48693 lines/second)
Physical Source Lines of Code (SLOC) = 6957
Hits@level = [0] 0 [1] 7 [2] 0 [3] 1 [4] 0 [5] 0
Hits@level+ = [0+] 8 [1+] 8 [2+] 1 [3+] 1 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 1.14992 [1+] 1.14992 [2+] 0.14374 [3+] 0.14374 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.