Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/xloadimage-4.1/buildshar.c
Examining data/xloadimage-4.1/libconfig.c
Examining data/xloadimage-4.1/cmuwmraster.h
Examining data/xloadimage-4.1/fbm.h
Examining data/xloadimage-4.1/img.h
Examining data/xloadimage-4.1/mac.h
Examining data/xloadimage-4.1/mcidas.h
Examining data/xloadimage-4.1/mrmcpyrght.h
Examining data/xloadimage-4.1/niff.h
Examining data/xloadimage-4.1/pbm.h
Examining data/xloadimage-4.1/pcx.h
Examining data/xloadimage-4.1/pds.h
Examining data/xloadimage-4.1/sunraster.h
Examining data/xloadimage-4.1/xwd.h
Examining data/xloadimage-4.1/value.c
Examining data/xloadimage-4.1/mac.c
Examining data/xloadimage-4.1/mc_tables.c
Examining data/xloadimage-4.1/clip.c
Examining data/xloadimage-4.1/dither.c
Examining data/xloadimage-4.1/fill.c
Examining data/xloadimage-4.1/smooth.c
Examining data/xloadimage-4.1/undither.c
Examining data/xloadimage-4.1/jpeg/ansi2knr.c
Examining data/xloadimage-4.1/jpeg/ckconfig.c
Examining data/xloadimage-4.1/jpeg/example.c
Examining data/xloadimage-4.1/jpeg/jbsmooth.c
Examining data/xloadimage-4.1/jpeg/jcarith.c
Examining data/xloadimage-4.1/jpeg/jccolor.c
Examining data/xloadimage-4.1/jpeg/jcdeflts.c
Examining data/xloadimage-4.1/jpeg/jcexpand.c
Examining data/xloadimage-4.1/jpeg/jchuff.c
Examining data/xloadimage-4.1/jpeg/jcmain.c
Examining data/xloadimage-4.1/jpeg/jcmaster.c
Examining data/xloadimage-4.1/jpeg/jcmcu.c
Examining data/xloadimage-4.1/jpeg/jconfig.h
Examining data/xloadimage-4.1/jpeg/jcpipe.c
Examining data/xloadimage-4.1/jpeg/jcsample.c
Examining data/xloadimage-4.1/jpeg/jdarith.c
Examining data/xloadimage-4.1/jpeg/jdcolor.c
Examining data/xloadimage-4.1/jpeg/jddeflts.c
Examining data/xloadimage-4.1/jpeg/jdhuff.c
Examining data/xloadimage-4.1/jpeg/jdmain.c
Examining data/xloadimage-4.1/jpeg/jdmaster.c
Examining data/xloadimage-4.1/jpeg/jdmcu.c
Examining data/xloadimage-4.1/jpeg/jdpipe.c
Examining data/xloadimage-4.1/jpeg/jdsample.c
Examining data/xloadimage-4.1/jpeg/jerror.c
Examining data/xloadimage-4.1/jpeg/jfwddct.c
Examining data/xloadimage-4.1/jpeg/jinclude.h
Examining data/xloadimage-4.1/jpeg/jmemansi.c
Examining data/xloadimage-4.1/jpeg/jmemdos.c
Examining data/xloadimage-4.1/jpeg/jmemdos.h
Examining data/xloadimage-4.1/jpeg/jmemmgr.c
Examining data/xloadimage-4.1/jpeg/jmemname.c
Examining data/xloadimage-4.1/jpeg/jmemnobs.c
Examining data/xloadimage-4.1/jpeg/jmemsys.c
Examining data/xloadimage-4.1/jpeg/jmemsys.h
Examining data/xloadimage-4.1/jpeg/jpegdata.h
Examining data/xloadimage-4.1/jpeg/jquant1.c
Examining data/xloadimage-4.1/jpeg/jquant2.c
Examining data/xloadimage-4.1/jpeg/jrdgif.c
Examining data/xloadimage-4.1/jpeg/jrdjfif.c
Examining data/xloadimage-4.1/jpeg/jrdppm.c
Examining data/xloadimage-4.1/jpeg/jrdrle.c
Examining data/xloadimage-4.1/jpeg/jrdtarga.c
Examining data/xloadimage-4.1/jpeg/jrevdct.c
Examining data/xloadimage-4.1/jpeg/jutils.c
Examining data/xloadimage-4.1/jpeg/jversion.h
Examining data/xloadimage-4.1/jpeg/jwrgif.c
Examining data/xloadimage-4.1/jpeg/jwrjfif.c
Examining data/xloadimage-4.1/jpeg/jwrppm.c
Examining data/xloadimage-4.1/jpeg/jwrrle.c
Examining data/xloadimage-4.1/jpeg/jwrtarga.c
Examining data/xloadimage-4.1/tiff/machdep.h
Examining data/xloadimage-4.1/tiff/mkg3states.c
Examining data/xloadimage-4.1/tiff/mkspans.c
Examining data/xloadimage-4.1/tiff/prototypes.h
Examining data/xloadimage-4.1/tiff/t4.h
Examining data/xloadimage-4.1/tiff/tif_aux.c
Examining data/xloadimage-4.1/tiff/tif_ccittrle.c
Examining data/xloadimage-4.1/tiff/tif_close.c
Examining data/xloadimage-4.1/tiff/tif_compat.c
Examining data/xloadimage-4.1/tiff/tif_compress.c
Examining data/xloadimage-4.1/tiff/tif_dir.c
Examining data/xloadimage-4.1/tiff/tif_dirinfo.c
Examining data/xloadimage-4.1/tiff/tif_dirread.c
Examining data/xloadimage-4.1/tiff/tif_dirwrite.c
Examining data/xloadimage-4.1/tiff/tif_dumpmode.c
Examining data/xloadimage-4.1/tiff/tif_error.c
Examining data/xloadimage-4.1/tiff/tif_fax3.c
Examining data/xloadimage-4.1/tiff/tif_fax3.h
Examining data/xloadimage-4.1/tiff/tif_fax4.c
Examining data/xloadimage-4.1/tiff/tif_flush.c
Examining data/xloadimage-4.1/tiff/tif_getimage.c
Examining data/xloadimage-4.1/tiff/tif_jpeg.c
Examining data/xloadimage-4.1/tiff/tif_lzw.c
Examining data/xloadimage-4.1/tiff/tif_machdep.c
Examining data/xloadimage-4.1/tiff/tif_next.c
Examining data/xloadimage-4.1/tiff/tif_open.c
Examining data/xloadimage-4.1/tiff/tif_packbits.c
Examining data/xloadimage-4.1/tiff/tif_print.c
Examining data/xloadimage-4.1/tiff/tif_read.c
Examining data/xloadimage-4.1/tiff/tif_strip.c
Examining data/xloadimage-4.1/tiff/tif_swab.c
Examining data/xloadimage-4.1/tiff/tif_thunder.c
Examining data/xloadimage-4.1/tiff/tiff.h
Examining data/xloadimage-4.1/tiff/tif_tile.c
Examining data/xloadimage-4.1/tiff/tif_version.c
Examining data/xloadimage-4.1/tiff/tif_warning.c
Examining data/xloadimage-4.1/tiff/tif_write.c
Examining data/xloadimage-4.1/tiff/tiffcompat.h
Examining data/xloadimage-4.1/tiff/tiffio.h
Examining data/xloadimage-4.1/tiff/tiffioP.h
Examining data/xloadimage-4.1/pbm.c
Examining data/xloadimage-4.1/bright.c
Examining data/xloadimage-4.1/cmuwmraster.c
Examining data/xloadimage-4.1/copyright.h
Examining data/xloadimage-4.1/faces.c
Examining data/xloadimage-4.1/fbm.c
Examining data/xloadimage-4.1/gif.c
Examining data/xloadimage-4.1/gif.h
Examining data/xloadimage-4.1/halftone.c
Examining data/xloadimage-4.1/image.h
Examining data/xloadimage-4.1/imagetypes.h
Examining data/xloadimage-4.1/kljcpyrght.h
Examining data/xloadimage-4.1/misc.c
Examining data/xloadimage-4.1/misc.h
Examining data/xloadimage-4.1/niff.c
Examining data/xloadimage-4.1/options.h
Examining data/xloadimage-4.1/pcx.c
Examining data/xloadimage-4.1/pdsuncomp.c
Examining data/xloadimage-4.1/rle.c
Examining data/xloadimage-4.1/rle.h
Examining data/xloadimage-4.1/rlelib.h
Examining data/xloadimage-4.1/send.c
Examining data/xloadimage-4.1/sunraster.c
Examining data/xloadimage-4.1/tgncpyrght.h
Examining data/xloadimage-4.1/vff.c
Examining data/xloadimage-4.1/vicar.c
Examining data/xloadimage-4.1/xbitmap.c
Examining data/xloadimage-4.1/xloadimage.h
Examining data/xloadimage-4.1/xpixmap.c
Examining data/xloadimage-4.1/xwd.c
Examining data/xloadimage-4.1/merge.c
Examining data/xloadimage-4.1/rlelib.c
Examining data/xloadimage-4.1/config.c
Examining data/xloadimage-4.1/imagetypes.c
Examining data/xloadimage-4.1/img.c
Examining data/xloadimage-4.1/packtar.c
Examining data/xloadimage-4.1/new.c
Examining data/xloadimage-4.1/mcidas.c
Examining data/xloadimage-4.1/reduce.c
Examining data/xloadimage-4.1/rotate.c
Examining data/xloadimage-4.1/window.c
Examining data/xloadimage-4.1/zio.c
Examining data/xloadimage-4.1/zoom.c
Examining data/xloadimage-4.1/root.c
Examining data/xloadimage-4.1/png.c
Examining data/xloadimage-4.1/autoconfig.c
Examining data/xloadimage-4.1/jpeg.c
Examining data/xloadimage-4.1/uufilter.c
Examining data/xloadimage-4.1/xloadimage.c
Examining data/xloadimage-4.1/tiff.c
Examining data/xloadimage-4.1/compress.c
Examining data/xloadimage-4.1/options.c

FINAL RESULTS:

data/xloadimage-4.1/autoconfig.c:249:3:  [5] (buffer) gets:
  Does not check for buffer overflows (CWE-120, CWE-20). Use fgets() instead.
  gets(buf);
data/xloadimage-4.1/autoconfig.c:377:3:  [5] (buffer) gets:
  Does not check for buffer overflows (CWE-120, CWE-20). Use fgets() instead.
  gets(buf);
data/xloadimage-4.1/autoconfig.c:454:7:  [5] (buffer) gets:
  Does not check for buffer overflows (CWE-120, CWE-20). Use fgets() instead.
      gets(buf);
data/xloadimage-4.1/autoconfig.c:472:7:  [5] (buffer) gets:
  Does not check for buffer overflows (CWE-120, CWE-20). Use fgets() instead.
      gets(X11_inc);
data/xloadimage-4.1/autoconfig.c:500:7:  [5] (buffer) gets:
  Does not check for buffer overflows (CWE-120, CWE-20). Use fgets() instead.
      gets(X11_lib);
data/xloadimage-4.1/autoconfig.c:519:7:  [5] (buffer) gets:
  Does not check for buffer overflows (CWE-120, CWE-20). Use fgets() instead.
      gets(X11_name);
data/xloadimage-4.1/autoconfig.c:565:3:  [5] (buffer) gets:
  Does not check for buffer overflows (CWE-120, CWE-20). Use fgets() instead.
  gets(cc);
data/xloadimage-4.1/autoconfig.c:578:7:  [5] (buffer) gets:
  Does not check for buffer overflows (CWE-120, CWE-20). Use fgets() instead.
      gets(buf);
data/xloadimage-4.1/autoconfig.c:586:7:  [5] (buffer) gets:
  Does not check for buffer overflows (CWE-120, CWE-20). Use fgets() instead.
      gets(buf);
data/xloadimage-4.1/autoconfig.c:597:7:  [5] (buffer) gets:
  Does not check for buffer overflows (CWE-120, CWE-20). Use fgets() instead.
      gets(opt_flags);
data/xloadimage-4.1/autoconfig.c:611:3:  [5] (buffer) gets:
  Does not check for buffer overflows (CWE-120, CWE-20). Use fgets() instead.
  gets(install_dir);
data/xloadimage-4.1/autoconfig.c:130:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(buf, "echo %s", pattern);
data/xloadimage-4.1/autoconfig.c:131:7:  [4] (shell) popen:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
  p = popen(buf, "r");
data/xloadimage-4.1/autoconfig.c:173:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(libname, "%s/lib%s.*", *d, name);
data/xloadimage-4.1/autoconfig.c:187:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(pathname, "%s/%s", *d, name);
data/xloadimage-4.1/autoconfig.c:202:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(fullname, "%s/%s", *d, name);
data/xloadimage-4.1/autoconfig.c:217:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(libname, "lib%s.*", &name[2]); /* skip -l and glob */
data/xloadimage-4.1/autoconfig.c:219:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(libname, X11_name);
data/xloadimage-4.1/autoconfig.c:224:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(fullname, "%s/%s", *d, libname);
data/xloadimage-4.1/autoconfig.c:252:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(&cflags[strlen(cflags)], " -D%s", define);
data/xloadimage-4.1/autoconfig.c:253:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(&optional_srcs[strlen(optional_srcs)], " %s", srcname);
data/xloadimage-4.1/autoconfig.c:254:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(&optional_libs[strlen(optional_libs)], " %s/%s", libdir, libname);
data/xloadimage-4.1/autoconfig.c:430:7:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
      strcat(libs, tsl->name);
data/xloadimage-4.1/autoconfig.c:448:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(include_path, "%s/X11", X11DirList[i].inc_dir);
data/xloadimage-4.1/autoconfig.c:449:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(lib_path, "%s/libX11.*", X11DirList[i].lib_dir);
data/xloadimage-4.1/autoconfig.c:460:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(X11_inc, X11DirList[i].inc_dir);
data/xloadimage-4.1/autoconfig.c:461:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(X11_lib, X11DirList[i].lib_dir);
data/xloadimage-4.1/autoconfig.c:481:7:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
      sprintf(buf, "%s/X11", X11_inc);
data/xloadimage-4.1/autoconfig.c:510:7:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
      sprintf(buf, "%s/libX11.*", X11_lib);
data/xloadimage-4.1/autoconfig.c:523:4:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
	  sprintf(tmp, "lib%s.*", &X11_name[2]); /* skip -l and glob */
data/xloadimage-4.1/autoconfig.c:525:4:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
	  strcpy(tmp, X11_name);
data/xloadimage-4.1/autoconfig.c:526:2:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
	sprintf(buf, "%s/%s", X11_lib, tmp);
data/xloadimage-4.1/autoconfig.c:567:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(cc, DEF_CC);
data/xloadimage-4.1/autoconfig.c:599:2:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
	strcpy(opt_flags, DEF_OPT_FLAGS);
data/xloadimage-4.1/autoconfig.c:613:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(install_dir, DEF_INSTALL_DIR);
data/xloadimage-4.1/bright.c:192:2:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
	sprintf(newimage->title, "%s (normalized)", image->title);
data/xloadimage-4.1/config.c:290:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(buf, "%s/.xloadimagerc", pw->pw_dir);
data/xloadimage-4.1/config.c:292:9:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
  if (! access(buf, R_OK)) {
data/xloadimage-4.1/config.c:307:10:  [4] (race) access:
  This usually indicates a security flaw. If an attacker can change anything
  along the path between the call to access() and the file's actual use
  (e.g., by moving files), the attacker can exploit the race condition
  (CWE-362/CWE-367!). Set up the correct permissions (e.g., using setuid())
  and try to open the file directly.
  return(access(fullname, R_OK)); /* we can read it */
data/xloadimage-4.1/config.c:319:3:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
  strcpy(fullname, name);
data/xloadimage-4.1/config.c:335:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(fullname, "%s%s", Paths[p], name);
data/xloadimage-4.1/config.c:337:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(fullname, "%s/%s", Paths[p], name);
data/xloadimage-4.1/config.c:348:7:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
      sprintf(fullname, "%s%s%s", Paths[p], name, Exts[e]);
data/xloadimage-4.1/config.c:350:7:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
      sprintf(fullname, "%s/%s%s", Paths[p], name, Exts[e]);
data/xloadimage-4.1/config.c:363:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(fullname, "%s%s", name, Exts[e]);
data/xloadimage-4.1/config.c:391:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(buf, "directory %s", Paths[a]);
data/xloadimage-4.1/config.c:393:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(buf, "ls %s", Paths[a]);
data/xloadimage-4.1/config.c:395:9:  [4] (shell) system:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
    if (system(buf) < 0) {
data/xloadimage-4.1/config.c:511:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(ptr, buf1);
data/xloadimage-4.1/dither.c:75:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(image->title, "%s (dithered)", cimage->title);
data/xloadimage-4.1/halftone.c:181:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(image->title, "%s (halftoned)", cimage->title);
data/xloadimage-4.1/image.h:322:34:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
#define debug(ARGS) if (_Xdebug) printf ARGS
data/xloadimage-4.1/img.c:403:7:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
      printf(depthError, header.im_nplanes);
data/xloadimage-4.1/img.c:594:5:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
    printf(depthError, xheader.im_nplanes);
data/xloadimage-4.1/jpeg.c:22:20:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
# define debug(xx)	fprintf(stderr,xx)
data/xloadimage-4.1/jpeg/ansi2knr.c:181:15:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
	extern char *strcat(), *strchr(), *strcpy(), *strupr();
data/xloadimage-4.1/jpeg/ansi2knr.c:181:37:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
	extern char *strcat(), *strchr(), *strcpy(), *strupr();
data/xloadimage-4.1/jpeg/example.c:306:3:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
  fprintf(stderr, msgtext,
data/xloadimage-4.1/jpeg/jerror.c:39:3:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
  fprintf(stderr, msgtext,
data/xloadimage-4.1/jpeg/jmemdos.c:293:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(tracemsg, "Failed to create temporary file %s", info->temp_name);
data/xloadimage-4.1/jpeg/jmemdos.c:302:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(tracemsg, "Opened DOS file %d  %s", handle, info->temp_name);
data/xloadimage-4.1/jpeg/jmemname.c:99:5:  [4] (format) sprintf:
  Potential format string problem (CWE-134). Make format string constant.
    sprintf(fname, TEMP_FILE_NAME, TEMP_DIRECTORY, next_file_num);
data/xloadimage-4.1/jpeg/jmemname.c:117:3:  [4] (format) sprintf:
  Potential format string problem (CWE-134). Make format string constant.
  sprintf(fname, TEMP_FILE_NAME, TEMP_DIRECTORY, next_file_num);
data/xloadimage-4.1/jpeg/jmemname.c:118:3:  [4] (tmpfile) mktemp:
  Temporary file race condition (CWE-377).
  mktemp(fname);		/* make sure file name is unique */
data/xloadimage-4.1/jpeg/jmemname.c:220:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(tracemsg, "Failed to create temporary file %s", info->temp_name);
data/xloadimage-4.1/jpeg/jmemname.c:227:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(tracemsg, "Using temp file %s", info->temp_name);
data/xloadimage-4.1/new.c:106:3:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
  strcpy(d, s);
data/xloadimage-4.1/packtar.c:28:5:  [4] (shell) execlp:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
    execlp(a0, a0, a1, a2, a3, a4, a5, a6, a7, a8);
data/xloadimage-4.1/packtar.c:81:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(dir_name, "xloadimage.%s.%s", VERSION, PATCHLEVEL);
data/xloadimage-4.1/packtar.c:82:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(tar_name, "xloadimage.%s.%s.tar", VERSION, PATCHLEVEL);
data/xloadimage-4.1/pbm.c:541:2:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
	fprintf(f, (normal ? "%d %d %d " : "%c%c%c"),
data/xloadimage-4.1/png.c:33:20:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
# define debug(xx)	fprintf(stderr,xx)
data/xloadimage-4.1/rle.c:23:20:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
# define debug(xx)	fprintf(stderr,xx)
data/xloadimage-4.1/smooth.c:31:7:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
      sprintf(new->title, "%s (smoothed)", image->title);
data/xloadimage-4.1/tiff/tif_error.c:41:2:  [4] (format) vfprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
	vfprintf(stderr, fmt, ap);
data/xloadimage-4.1/tiff/tif_open.c:178:2:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
	strcpy(tif->tif_name, name);
data/xloadimage-4.1/tiff/tif_warning.c:42:2:  [4] (format) vfprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
	vfprintf(stderr, fmt, ap);
data/xloadimage-4.1/undither.c:36:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf ( nimage->title, "%s (grayscaled)", oimage->title );
data/xloadimage-4.1/uufilter.c:78:11:  [4] (buffer) sscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function.
      if (sscanf(buf, "begin %o %s", &mode, tmp) != 2) {
data/xloadimage-4.1/xbitmap.c:158:9:  [4] (buffer) sscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function.
    if (sscanf(line,"#define %s %d", name_and_type, &value) == 2) {
data/xloadimage-4.1/xbitmap.c:173:9:  [4] (buffer) sscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function.
    if (sscanf(line, "static short %s = {", name_and_type) == 1) {
data/xloadimage-4.1/xbitmap.c:177:10:  [4] (buffer) sscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function.
    if ((sscanf(line,"static unsigned char %s = {", name_and_type) == 1) ||
data/xloadimage-4.1/xbitmap.c:178:3:  [4] (buffer) sscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function.
	(sscanf(line, "static char %s = {", name_and_type) == 1)) {
data/xloadimage-4.1/xpixmap.c:73:11:  [4] (buffer) sscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function.
      if (sscanf(buf, "#define %s %d", what, &value) != 2) {
data/xloadimage-4.1/xpixmap.c:107:15:  [4] (buffer) sscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function.
    else if ((sscanf(buf, "static char * %s", what) == 1) &&
data/xloadimage-4.1/xpixmap.c:191:9:  [4] (buffer) sscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function.
    if (sscanf(buf, "static char * %s", what) == 1)
data/xloadimage-4.1/zio.c:237:26:  [4] (shell) popen:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
      if (! (zf->stream= popen(buf, "r"))) {
data/xloadimage-4.1/config.c:443:7:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
  p = getenv("HOME");
data/xloadimage-4.1/config.c:482:16:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
	strncat(buf1, getenv(buf2), BUFSIZ - strlen (buf1) - 1);
data/xloadimage-4.1/jpeg/jmemdos.c:50:15:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
extern char * getenv PP((const char * name));
data/xloadimage-4.1/jpeg/jmemdos.c:131:31:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if ((env = (const char *) getenv("TMP")) == NULL)
data/xloadimage-4.1/jpeg/jmemdos.c:132:33:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
      if ((env = (const char *) getenv("TEMP")) == NULL)
data/xloadimage-4.1/jpeg/jmemmgr.c:42:15:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
extern char * getenv PP((const char * name));
data/xloadimage-4.1/jpeg/jmemmgr.c:1089:19:  [3] (buffer) getenv:
  Environment variables are untrustable input if they can be set by an
  attacker. They can have any content and length, and the same variable can
  be set more than once (CWE-807, CWE-20). Check environment variables
  carefully before using them.
    if ((memenv = getenv("JPEGMEM")) != NULL) {
data/xloadimage-4.1/autoconfig.c:106:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char config_style[6]; /* configuration style */
data/xloadimage-4.1/autoconfig.c:107:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char cflags[4096];    /* flags passed to C compiler */
data/xloadimage-4.1/autoconfig.c:108:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char libs[4096];      /* extra libraries */
data/xloadimage-4.1/autoconfig.c:109:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char X11_inc[1024];   /* X11 include path */
data/xloadimage-4.1/autoconfig.c:110:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char X11_lib[1024];   /* X11 library path */
data/xloadimage-4.1/autoconfig.c:111:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char X11_name[1024];  /* X11 library name */
data/xloadimage-4.1/autoconfig.c:112:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char cc[1024];        /* C compiler */
data/xloadimage-4.1/autoconfig.c:113:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char opt_flags[1024]; /* optimization flags */
data/xloadimage-4.1/autoconfig.c:114:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char ranlib[1024];    /* ranlib program or /bin/true */
data/xloadimage-4.1/autoconfig.c:115:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char install_dir[1024]; /* install directory */
data/xloadimage-4.1/autoconfig.c:116:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char optional_srcs[4096]; /* optional source files */
data/xloadimage-4.1/autoconfig.c:117:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char optional_libs[4096]; /* optional libraries */
data/xloadimage-4.1/autoconfig.c:125:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  static char buf[1024];
data/xloadimage-4.1/autoconfig.c:170:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char libname[1024];
data/xloadimage-4.1/autoconfig.c:184:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char pathname[1024];
data/xloadimage-4.1/autoconfig.c:198:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char fullname[1024];
data/xloadimage-4.1/autoconfig.c:212:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char libname[1024];
data/xloadimage-4.1/autoconfig.c:213:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char fullname[1024];
data/xloadimage-4.1/autoconfig.c:238:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[1024];
data/xloadimage-4.1/autoconfig.c:260:7:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  f = fopen("Make.conf", "w");
data/xloadimage-4.1/autoconfig.c:330:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[1024];       /* misc input buffer */
data/xloadimage-4.1/autoconfig.c:340:7:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
      strcpy(config_style, "-auto");
data/xloadimage-4.1/autoconfig.c:341:7:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
      strcpy(cc, "cc");
data/xloadimage-4.1/autoconfig.c:347:7:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
      strcpy(X11_name, "-lX11");
data/xloadimage-4.1/autoconfig.c:348:7:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
      strcpy(ranlib, "ranlib");
data/xloadimage-4.1/autoconfig.c:349:7:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
      strcpy(install_dir, "/usr/local/bin");
data/xloadimage-4.1/autoconfig.c:372:3:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
  strcpy(config_style, "-skip");
data/xloadimage-4.1/autoconfig.c:382:5:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
    strcat(cflags, " -DDEBUG");
data/xloadimage-4.1/autoconfig.c:405:5:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
    strcat(cflags, " -DIS_BSD");
data/xloadimage-4.1/autoconfig.c:408:5:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
    strcat(cflags, " -DSYSV"); /* needed for <X11/Xos.h> at least */
data/xloadimage-4.1/autoconfig.c:416:5:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
    strcat(cflags, " -DHAS_SELECT_INCLUDE");
data/xloadimage-4.1/autoconfig.c:420:5:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
    strcat(cflags, " -DHAS_POLL");
data/xloadimage-4.1/autoconfig.c:429:7:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
      strcat(libs, " -l");
data/xloadimage-4.1/autoconfig.c:436:5:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
    strcpy(ranlib, "ranlib");
data/xloadimage-4.1/autoconfig.c:439:5:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
    strcpy(ranlib, "/bin/true");
data/xloadimage-4.1/autoconfig.c:445:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char include_path[1024];
data/xloadimage-4.1/autoconfig.c:446:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char lib_path[1024];
data/xloadimage-4.1/autoconfig.c:462:5:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
    strcpy(X11_name, "-lX11");
data/xloadimage-4.1/autoconfig.c:507:2:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
	strcpy(X11_name, "-lX11");
data/xloadimage-4.1/autoconfig.c:512:2:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
	strcpy(X11_name, "-lX11");
data/xloadimage-4.1/autoconfig.c:521:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char tmp[1024];
data/xloadimage-4.1/autoconfig.c:545:2:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
	strcpy(X11_name, "-lX11");
data/xloadimage-4.1/autoconfig.c:571:5:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
    strcpy(opt_flags, "-g");
data/xloadimage-4.1/autoconfig.c:581:7:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
      strcpy(opt_flags, "-O -fstrength-reduce -finline-functions");
data/xloadimage-4.1/autoconfig.c:588:2:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
	strcat(opt_flags, " -fforce-mem -fforce-addr");
data/xloadimage-4.1/config.c:33:8:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static char         *Paths[BUFSIZ];
data/xloadimage-4.1/config.c:34:8:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static char         *Exts[BUFSIZ];
data/xloadimage-4.1/config.c:98:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char          buf[BUFSIZ];
data/xloadimage-4.1/config.c:99:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char          filter_name[BUFSIZ];
data/xloadimage-4.1/config.c:105:13:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  if (! (f= fopen(name, "r")))
data/xloadimage-4.1/config.c:275:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char           buf[BUFSIZ];
data/xloadimage-4.1/config.c:282:3:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
  sprintf(buf, "/sys$login:xloadimage.rc");
data/xloadimage-4.1/config.c:328:3:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
  strcat(fullname, ".Z");
data/xloadimage-4.1/config.c:342:5:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
    strcat(fullname, ".Z");
data/xloadimage-4.1/config.c:355:7:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
      strcat(fullname, ".Z");
data/xloadimage-4.1/config.c:367:5:  [2] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused). Risk is low because the
  source is a constant string.
    strcat(fullname, ".Z");
data/xloadimage-4.1/config.c:381:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char         buf[BUFSIZ];
data/xloadimage-4.1/config.c:456:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
{ char buf1[BUFSIZ], buf2[BUFSIZ];
data/xloadimage-4.1/faces.c:90:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char          fname[BUFSIZ];
data/xloadimage-4.1/faces.c:91:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char          lname[BUFSIZ];
data/xloadimage-4.1/faces.c:92:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char          buf[BUFSIZ];
data/xloadimage-4.1/fbm.c:129:24:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
  fbmin_img_width    = atoi(phdr.cols);
data/xloadimage-4.1/fbm.c:130:24:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
  fbmin_img_height   = atoi(phdr.rows);
data/xloadimage-4.1/fbm.c:131:24:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
  fbmin_img_depth    = atoi(phdr.planes);
data/xloadimage-4.1/fbm.c:132:24:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
  fbmin_img_bits     = atoi(phdr.bits);
data/xloadimage-4.1/fbm.c:133:24:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
  fbmin_img_rowlen   = atoi(phdr.rowlen);
data/xloadimage-4.1/fbm.c:134:24:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
  fbmin_img_plnlen   = atoi(phdr.plnlen);
data/xloadimage-4.1/fbm.c:135:24:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
  fbmin_img_clrlen   = atoi(phdr.clrlen);
data/xloadimage-4.1/fbm.c:137:24:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
  fbmin_img_physbits = atoi(phdr.physbits);
data/xloadimage-4.1/fbm.h:34:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char	magic[8];		/* 2 bytes FBM_MAGIC number */
data/xloadimage-4.1/fbm.h:35:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char	cols[8];		/* Width in pixels */
data/xloadimage-4.1/fbm.h:36:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char	rows[8];		/* Height in pixels */
data/xloadimage-4.1/fbm.h:37:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char	planes[8];		/* Depth (1 for B+W, 3 for RGB) */
data/xloadimage-4.1/fbm.h:38:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char	bits[8];		/* Bits per pixel */
data/xloadimage-4.1/fbm.h:39:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char	physbits[8];		/* Bits to store each pixel */
data/xloadimage-4.1/fbm.h:40:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char	rowlen[12];		/* Length of a row in bytes */
data/xloadimage-4.1/fbm.h:41:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char	plnlen[12];		/* Length of a plane in bytes */
data/xloadimage-4.1/fbm.h:42:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char	clrlen[12];		/* Length of colormap in bytes */
data/xloadimage-4.1/fbm.h:43:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char	aspect[12];		/* ratio of Y to X of one pixel */
data/xloadimage-4.1/fbm.h:44:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char	title[FBM_MAX_TITLE];	/* Null terminated title */
data/xloadimage-4.1/fbm.h:45:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char	credits[FBM_MAX_TITLE];	/* Null terminated credits */
data/xloadimage-4.1/image.h:52:14:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
#if !defined(bcopy) && !defined(memcpy)
data/xloadimage-4.1/image.h:52:33:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
#if !defined(bcopy) && !defined(memcpy)
data/xloadimage-4.1/image.h:53:9:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
#define bcopy(S,D,L) memcpy((void *)(D),(void *)(S),(L))
data/xloadimage-4.1/image.h:53:22:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
#define bcopy(S,D,L) memcpy((void *)(D),(void *)(S),(L))
data/xloadimage-4.1/image.h:79:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char          buf[BUFSIZ];
data/xloadimage-4.1/imagetypes.c:29:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
{ char    fullname[BUFSIZ];
data/xloadimage-4.1/imagetypes.c:108:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
{ char fullname[BUFSIZ];
data/xloadimage-4.1/imagetypes.c:136:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char typename[32];
data/xloadimage-4.1/img.c:66:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char x_id [4];         /* must contain "XIMG" */
data/xloadimage-4.1/img.c:94:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
unsigned char           *ptr, Muster[ALL_PLANES][BUFSIZ], tmp[BUFSIZ];
data/xloadimage-4.1/img.c:96:17:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static unsigned char    *bitplane[ALL_PLANES], *lastbitplane;
data/xloadimage-4.1/img.c:377:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char    extention[5];
data/xloadimage-4.1/jpeg.c:102:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char buf[JMSG_LENGTH_MAX];
data/xloadimage-4.1/jpeg.c:500:20:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    if ((outfile = fopen(file, "w")) == NULL) {
data/xloadimage-4.1/jpeg/ansi2knr.c:237:9:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		out = fopen(argv[2], "w");
data/xloadimage-4.1/jpeg/ansi2knr.c:243:7:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	in = fopen(argv[1], "r");
data/xloadimage-4.1/jpeg/example.c:253:28:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  if ((cinfo.output_file = fopen(filename, "wb")) == NULL) {
data/xloadimage-4.1/jpeg/example.c:541:27:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  if ((cinfo.input_file = fopen(filename, "rb")) == NULL) {
data/xloadimage-4.1/jpeg/jchuff.c:33:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char huffsize[257];
data/xloadimage-4.1/jpeg/jcmain.c:364:13:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  if ((fp = fopen(filename, "r")) == NULL) {
data/xloadimage-4.1/jpeg/jcmain.c:670:29:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    if ((cinfo.input_file = fopen(argv[file_index], READ_BINARY)) == NULL) {
data/xloadimage-4.1/jpeg/jcmain.c:691:30:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    if ((cinfo.output_file = fopen(outfilename, WRITE_BINARY)) == NULL) {
data/xloadimage-4.1/jpeg/jdhuff.c:30:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char huffsize[257];
data/xloadimage-4.1/jpeg/jdmain.c:445:29:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    if ((cinfo.input_file = fopen(argv[file_index], READ_BINARY)) == NULL) {
data/xloadimage-4.1/jpeg/jdmain.c:466:30:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    if ((cinfo.output_file = fopen(outfilename, WRITE_BINARY)) == NULL) {
data/xloadimage-4.1/jpeg/jinclude.h:88:32:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
#define MEMCOPY(dest,src,size)	memcpy((void *)(dest), (const void *)(src), (size_t)(size))
data/xloadimage-4.1/jpeg/jinclude.h:93:32:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
#define MEMCOPY(dest,src,size)	bcopy((const void *)(src), (void *)(dest), (size_t)(size))
data/xloadimage-4.1/jpeg/jinclude.h:97:32:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
#define MEMCOPY(dest,src,size)	memcpy((void *)(dest), (const void *)(src), (size_t)(size))
data/xloadimage-4.1/jpeg/jmemansi.c:131:26:  [2] (tmpfile) tmpfile:
  Function tmpfile() has a security flaw on some systems (e.g., older System
  V systems) (CWE-377).
  if ((info->temp_file = tmpfile()) == NULL)
data/xloadimage-4.1/jpeg/jmemdos.c:143:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(ptr, "JPG%03d.TMP", next_file_num);
data/xloadimage-4.1/jpeg/jmemdos.c:145:18:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    if ((tfile = fopen(fname, READ_BINARY)) == NULL)
data/xloadimage-4.1/jpeg/jmemdos.c:288:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char tracemsg[TEMP_NAME_LENGTH+40];
data/xloadimage-4.1/jpeg/jmemdos.c:338:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char endbuffer[2];
data/xloadimage-4.1/jpeg/jmemdos.c:359:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    ((char FAR *) buffer_address)[byte_count - 1L] = endbuffer[0];
data/xloadimage-4.1/jpeg/jmemdos.c:370:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char endbuffer[2];
data/xloadimage-4.1/jpeg/jmemdos.c:391:22:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    endbuffer[0] = ((char FAR *) buffer_address)[byte_count - 1L];
data/xloadimage-4.1/jpeg/jmemdos.c:465:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char bytes[18];		/* Misaligned fields in here! */
data/xloadimage-4.1/jpeg/jmemdos.h:109:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char temp_name[TEMP_NAME_LENGTH]; /* name if it's a file */
data/xloadimage-4.1/jpeg/jmemname.c:100:18:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    if ((tfile = fopen(fname, READ_BINARY)) == NULL)
data/xloadimage-4.1/jpeg/jmemname.c:215:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char tracemsg[TEMP_NAME_LENGTH+40];
data/xloadimage-4.1/jpeg/jmemname.c:218:26:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  if ((info->temp_file = fopen(info->temp_name, RW_BINARY)) == NULL) {
data/xloadimage-4.1/jpeg/jmemsys.h:101:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char temp_name[TEMP_NAME_LENGTH]; /* name of temp file */
data/xloadimage-4.1/jpeg/jpegdata.h:213:6:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	    char ehufsi[256];	/* length of code for each symbol */
data/xloadimage-4.1/jpeg/jrdgif.c:69:8:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static char code_buf[256+4];	/* current input data block */
data/xloadimage-4.1/jpeg/jrdgif.c:152:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[256];
data/xloadimage-4.1/jpeg/jrdgif.c:370:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char hdrbuf[10];		/* workspace for reading control blocks */
data/xloadimage-4.1/jpeg/jwrgif.c:92:8:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static char packetbuf[256];	/* workspace for accumulating packet */
data/xloadimage-4.1/jpeg/jwrjfif.c:199:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char dc_in_use[NUM_ARITH_TBLS];
data/xloadimage-4.1/jpeg/jwrjfif.c:200:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char ac_in_use[NUM_ARITH_TBLS];
data/xloadimage-4.1/jpeg/jwrjfif.c:356:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char qt_in_use[NUM_QUANT_TBLS];
data/xloadimage-4.1/jpeg/jwrrle.c:165:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char cmapcomment[80];
data/xloadimage-4.1/jpeg/jwrrle.c:186:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(cmapcomment, "color_map_length=%d", number_colors);
data/xloadimage-4.1/jpeg/jwrtarga.c:55:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char targaheader[18];
data/xloadimage-4.1/libconfig.c:39:7:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  f = fopen("tiff.conf", "w");
data/xloadimage-4.1/libconfig.c:74:7:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  f = fopen("jpeg.conf", "w");
data/xloadimage-4.1/libconfig.c:128:7:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  f = fopen("jpeg.conf.h", "w");
data/xloadimage-4.1/libconfig.c:157:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char c[2];
data/xloadimage-4.1/mcidas.c:35:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
{ static char buf[30];
data/xloadimage-4.1/mcidas.h:34:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
/* 25 */ char	comments[COMMENTLEN] ;
data/xloadimage-4.1/mcidas.h:49:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
/* 52 */ char	stype[TYPELEN] ;
data/xloadimage-4.1/mcidas.h:50:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
/* 53 */ char	ctype[TYPELEN] ;
data/xloadimage-4.1/mcidas.h:59:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
/*   1 */ char	type[TYPELEN] ;
data/xloadimage-4.1/mcidas.h:66:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
/* 121 */ char	memo[COMMENTLEN] ;
data/xloadimage-4.1/misc.c:31:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
{ static char buf[32];
data/xloadimage-4.1/misc.c:45:5:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
    sprintf(buf, "Signal %d", sig);
data/xloadimage-4.1/misc.c:152:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
{ char errortext[BUFSIZ];
data/xloadimage-4.1/niff.c:202:12:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  if (!(f= fopen(filename, "w"))) {
data/xloadimage-4.1/niff.h:23:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char red[2];
data/xloadimage-4.1/niff.h:24:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char green[2];
data/xloadimage-4.1/niff.h:25:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char blue[2];
data/xloadimage-4.1/niff.h:29:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char magic[4];     /* NIFF magic number */
data/xloadimage-4.1/niff.h:30:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char version[4];   /* NIFF version */
data/xloadimage-4.1/niff.h:31:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char width[4];     /* image dimensions */
data/xloadimage-4.1/niff.h:32:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char height[4];
data/xloadimage-4.1/niff.h:33:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char depth[4];     /* image depth in bits (true depth, not rounded) */
data/xloadimage-4.1/niff.h:35:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char cmap_size[4]; /* size of colormap; zero NIFF_TRUE */
data/xloadimage-4.1/niff.h:36:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char title_len[4]; /* length of image title */
data/xloadimage-4.1/options.c:254:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
{ char buf[BUFSIZ];
data/xloadimage-4.1/options.c:879:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  static char option_name[BUFSIZ];
data/xloadimage-4.1/options.c:880:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  static char option_value[BUFSIZ];
data/xloadimage-4.1/packtar.c:46:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char new_file[1024];
data/xloadimage-4.1/packtar.c:75:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char dir_name[1024];
data/xloadimage-4.1/packtar.c:76:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char tar_name[1024];
data/xloadimage-4.1/pbm.c:478:7:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  f = fopen(file, "w");
data/xloadimage-4.1/pbm.h:9:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char width[2];
data/xloadimage-4.1/pbm.h:10:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char height[2];
data/xloadimage-4.1/pdsuncomp.c:356:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char buf[2];
data/xloadimage-4.1/pdsuncomp.c:369:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char buf[2];
data/xloadimage-4.1/pdsuncomp.c:417:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  static char obuf[2048];
data/xloadimage-4.1/pdsuncomp.c:418:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char ibuf[2048];
data/xloadimage-4.1/pdsuncomp.c:436:2:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	bcopy(obuf + out_ptr, buf, size);
data/xloadimage-4.1/pdsuncomp.c:441:2:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	bcopy(obuf + out_ptr, buf, out_length - out_ptr);
data/xloadimage-4.1/reduce.c:377:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[BUFSIZ];
data/xloadimage-4.1/rle.c:334:4:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	  memcpy(bufp,&scan[0][0],x_len);
data/xloadimage-4.1/rle.h:112:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char    sv_bits[256/8];
data/xloadimage-4.1/rlelib.c:352:18:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
union { short s; char c[2]; } arg;
data/xloadimage-4.1/rlelib.c:1120:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	    bfill( (char *)scanline[-1], globals->sv_xmax + 1, 0 );
data/xloadimage-4.1/rlelib.c:1123:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		bfill( (char *)scanline[nc], globals->sv_xmax+1,
data/xloadimage-4.1/rotate.c:45:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[BUFSIZ];			/* New title                   */
data/xloadimage-4.1/send.c:21:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char buf[MAXERRORLEN+1];
data/xloadimage-4.1/send.c:444:7:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      bcopy(image->data, data, ((image->width + 7) / 8) * image->height);
data/xloadimage-4.1/sunraster.h:14:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char magic[4];   /* magic number */
data/xloadimage-4.1/sunraster.h:15:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char width[4];   /* width of image in pixels */
data/xloadimage-4.1/sunraster.h:16:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char height[4];  /* height of image in pixels */
data/xloadimage-4.1/sunraster.h:17:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char depth[4];   /* depth of each pixel */
data/xloadimage-4.1/sunraster.h:18:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char length[4];  /* length of the image in bytes */
data/xloadimage-4.1/sunraster.h:19:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char type[4];    /* format of file */
data/xloadimage-4.1/sunraster.h:20:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char maptype[4]; /* type of colormap */
data/xloadimage-4.1/sunraster.h:21:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char maplen[4];  /* length of colormap in bytes */
data/xloadimage-4.1/tiff.c:127:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  static char buf[32];
data/xloadimage-4.1/tiff.c:303:4:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	  bcopy(row, dest, dest_line_len);
data/xloadimage-4.1/tiff.c:399:2:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	bcopy(row, dest_line, dest_line_len);
data/xloadimage-4.1/tiff.c:433:4:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	  bcopy(row, dest_line, dest_line_len);
data/xloadimage-4.1/tiff/machdep.h:248:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char		b[8];
data/xloadimage-4.1/tiff/machdep.h:255:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char		b[4];
data/xloadimage-4.1/tiff/mkg3states.c:156:18:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
typedef	unsigned char NullModeTable[MAX_NULLPREFIX][256];
data/xloadimage-4.1/tiff/mkg3states.c:158:18:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
typedef	unsigned char HorizModeTable[MAX_HORIZPREFIX][256];
data/xloadimage-4.1/tiff/mkg3states.c:233:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char	horiz_mode_color[MAX_HORIZPREFIX];
data/xloadimage-4.1/tiff/mkg3states.c:236:17:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static	unsigned char bit_mask[8] =
data/xloadimage-4.1/tiff/mkspans.c:14:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char runs[256];
data/xloadimage-4.1/tiff/mkspans.c:33:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char runs[2][256];
data/xloadimage-4.1/tiff/tif_aux.c:145:5:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
				bcopy(tf[0], tf[i], n * sizeof (u_short));
data/xloadimage-4.1/tiff/tif_compat.c:111:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char name[256];
data/xloadimage-4.1/tiff/tif_dir.c:51:4:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			bcopy(cp, *cpp, len);
data/xloadimage-4.1/tiff/tif_dir.c:62:3:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		bcopy(wp, *wpp, n);
data/xloadimage-4.1/tiff/tif_dir.c:72:3:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		bcopy(wp, *wpp, n);
data/xloadimage-4.1/tiff/tif_dir.c:82:3:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		bcopy(wp, *wpp, n);
data/xloadimage-4.1/tiff/tif_dir.c:152:3:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		bcopy(cp[i], tab, nw);
data/xloadimage-4.1/tiff/tif_dirread.c:159:4:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			bcopy(tif->tif_base + off, &dircount, sizeof (short));
data/xloadimage-4.1/tiff/tif_dirread.c:171:4:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			bcopy(tif->tif_base + off, dir,
data/xloadimage-4.1/tiff/tif_dirread.c:175:4:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			bcopy(tif->tif_base + off, &tif->tif_nextdiroff,
data/xloadimage-4.1/tiff/tif_dirread.c:631:3:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		bcopy(tif->tif_base + dir->tdir_offset, cp, cc);
data/xloadimage-4.1/tiff/tif_dirread.c:671:3:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		bcopy(&l, cp, dir->tdir_count);
data/xloadimage-4.1/tiff/tif_dirread.c:918:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		char c[2];
data/xloadimage-4.1/tiff/tif_dirwrite.c:187:2:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	bcopy(td->td_fieldsset, fields, sizeof (fields));
data/xloadimage-4.1/tiff/tif_dirwrite.c:543:33:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		if (!TIFFWriteData(tif, dir, (char *)table[i]))
data/xloadimage-4.1/tiff/tif_dirwrite.c:565:3:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		bcopy(cp, &dir->tdir_offset, dir->tdir_count);
data/xloadimage-4.1/tiff/tif_dirwrite.c:697:35:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		if (!TIFFWriteData(tif, &tdir, (char *)tab[i]))
data/xloadimage-4.1/tiff/tif_dumpmode.c:84:3:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		bcopy(pp, tif->tif_rawcp, n);
data/xloadimage-4.1/tiff/tif_dumpmode.c:131:3:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		bcopy(tif->tif_rawcp, buf, cc);
data/xloadimage-4.1/tiff/tif_fax3.c:379:5:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
				bcopy(buf, sp->b.refline, sp->b.rowbytes);
data/xloadimage-4.1/tiff/tif_fax3.c:1038:5:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
				bcopy(bp, sp->b.refline, sp->b.rowbytes);
data/xloadimage-4.1/tiff/tif_fax4.c:85:3:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		bcopy(buf, sp->refline, sp->rowbytes);
data/xloadimage-4.1/tiff/tif_fax4.c:107:3:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		bcopy(bp, sp->refline, sp->rowbytes);
data/xloadimage-4.1/tiff/tif_machdep.c:154:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char		b[8];
data/xloadimage-4.1/tiff/tif_machdep.c:161:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char		b[4];
data/xloadimage-4.1/tiff/tif_next.c:96:4:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			bcopy(bp, row, scanline);
data/xloadimage-4.1/tiff/tif_next.c:110:4:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			bcopy(bp+4, row+off, n);
data/xloadimage-4.1/tiff/tif_packbits.c:257:4:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			bcopy(bp, op, ++n);
data/xloadimage-4.1/tiff/tif_read.c:223:3:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		bcopy(tif->tif_base + td->td_stripoffset[strip], buf, size);
data/xloadimage-4.1/tiff/tif_read.c:420:3:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		bcopy(tif->tif_base + td->td_stripoffset[tile], buf, size);
data/xloadimage-4.1/tiff/tif_swab.c:105:16:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
const unsigned char TIFFBitRevTable[256] = {
data/xloadimage-4.1/tiff/tif_swab.c:107:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
unsigned char TIFFBitRevTable[256] = {
data/xloadimage-4.1/tiff/tif_swab.c:143:16:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
const unsigned char TIFFNoBitRevTable[256] = {
data/xloadimage-4.1/tiff/tif_swab.c:145:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
unsigned char TIFFNoBitRevTable[256] = {
data/xloadimage-4.1/tiff/tiffcompat.h:92:9:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
#define	bcopy(src,dst,len)	memcpy((char *)dst, (char *)src, len)
data/xloadimage-4.1/tiff/tiffcompat.h:92:28:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
#define	bcopy(src,dst,len)	memcpy((char *)dst, (char *)src, len)
data/xloadimage-4.1/tiff/tiffcompat.h:110:40:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
#define	TIFFOpenFile(name, mode, prot)	open(name, mode)
data/xloadimage-4.1/tiff/tiffcompat.h:113:40:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
#define	TIFFOpenFile(name, mode, prot)	open(name, mode|O_BINARY, prot)
data/xloadimage-4.1/tiff/tiffcompat.h:115:40:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
#define	TIFFOpenFile(name, mode, prot)	open(name, mode, prot)
data/xloadimage-4.1/tiff/tiffio.h:61:23:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
extern const unsigned char TIFFBitRevTable[256];
data/xloadimage-4.1/tiff/tiffio.h:62:23:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
extern const unsigned char TIFFNoBitRevTable[256];
data/xloadimage-4.1/tiff/tiffio.h:65:17:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
extern unsigned char TIFFBitRevTable[256];
data/xloadimage-4.1/tiff/tiffio.h:66:17:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
extern unsigned char TIFFNoBitRevTable[256];
data/xloadimage-4.1/uufilter.c:27:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[1024];
data/xloadimage-4.1/uufilter.c:53:11:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    inf = fopen(infilename, "r");
data/xloadimage-4.1/uufilter.c:75:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char tmp[1024];
data/xloadimage-4.1/uufilter.c:85:12:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    outf = fopen(outfilename, "w");
data/xloadimage-4.1/vff.c:38:8:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static char *header[MAX_HEAD_LINES];
data/xloadimage-4.1/vff.c:40:17:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static unsigned char rm[256], gm[256], bm[256];
data/xloadimage-4.1/vff.c:55:6:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
     char buf[4];
data/xloadimage-4.1/vff.c:258:6:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
     char buf[HEAD_BUF_SIZE];
data/xloadimage-4.1/vff.c:343:9:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	       bcopy(buf, header[lines], count);
data/xloadimage-4.1/vff.c:369:6:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
     char buf[4];
data/xloadimage-4.1/vicar.c:18:11:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
FILE *fp,*fopen();
data/xloadimage-4.1/vicar.c:20:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char labstr[80];
data/xloadimage-4.1/vicar.c:38:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char IDENT[7];
data/xloadimage-4.1/vicar.c:41:16:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  if ( ! (fp = fopen(fullname,"r")) ) 
data/xloadimage-4.1/vicar.c:56:8:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  fp = fopen(fullname,"r");
data/xloadimage-4.1/window.c:264:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
{ static char buf[BUFSIZ];
data/xloadimage-4.1/window.c:603:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char def_geom[30];
data/xloadimage-4.1/window.c:927:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      char buf[128];
data/xloadimage-4.1/xbitmap.c:131:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char          line[MAX_SIZE];
data/xloadimage-4.1/xbitmap.c:132:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char          name_and_type[MAX_SIZE];
data/xloadimage-4.1/xloadimage.c:346:7:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      bcopy(root_weave_bits, newimage->data,
data/xloadimage-4.1/xpixmap.c:40:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char           buf[BUFSIZ];
data/xloadimage-4.1/xpixmap.c:41:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char           what[BUFSIZ];
data/xloadimage-4.1/zio.c:80:5:  [2] (buffer) bcopy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    bcopy(zf->dataptr->buf + zf->bufptr, buf + bread, readlen);
data/xloadimage-4.1/zio.c:145:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char   buf[BUFSIZ];
data/xloadimage-4.1/zio.c:226:21:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
                    strcpy(s, "'\"'\"'");
data/xloadimage-4.1/zio.c:253:20:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
      (zf->stream= fopen(name, "r", "ctx=bin", "ctx=stm", "rfm=stmlf"))
data/xloadimage-4.1/zio.c:255:20:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
      (zf->stream= fopen(name, "r"))
data/xloadimage-4.1/zoom.c:43:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
{ char          buf[BUFSIZ];
data/xloadimage-4.1/autoconfig.c:252:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  sprintf(&cflags[strlen(cflags)], " -D%s", define);
data/xloadimage-4.1/autoconfig.c:253:26:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  sprintf(&optional_srcs[strlen(optional_srcs)], " %s", srcname);
data/xloadimage-4.1/autoconfig.c:254:26:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  sprintf(&optional_libs[strlen(optional_libs)], " %s/%s", libdir, libname);
data/xloadimage-4.1/autoconfig.c:342:7:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
      strcpy(cflags, "");
data/xloadimage-4.1/autoconfig.c:343:7:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
      strcpy(opt_flags, "");
data/xloadimage-4.1/autoconfig.c:344:7:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
      strcpy(libs, "");
data/xloadimage-4.1/autoconfig.c:345:7:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
      strcpy(X11_inc, "");
data/xloadimage-4.1/autoconfig.c:346:7:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
      strcpy(X11_lib, "");
data/xloadimage-4.1/autoconfig.c:350:7:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
      strcpy(optional_srcs, "");
data/xloadimage-4.1/autoconfig.c:351:7:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
      strcpy(optional_libs, "");
data/xloadimage-4.1/autoconfig.c:373:3:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
  strcpy(cflags, "");
data/xloadimage-4.1/autoconfig.c:374:3:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
  strcpy(libs, "");
data/xloadimage-4.1/autoconfig.c:465:5:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
    strcpy(X11_inc, "");
data/xloadimage-4.1/autoconfig.c:478:2:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
	strcpy(X11_inc, "");
data/xloadimage-4.1/autoconfig.c:492:2:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
	strcpy(X11_inc, "");
data/xloadimage-4.1/autoconfig.c:506:2:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
	strcpy(X11_lib, "");
data/xloadimage-4.1/autoconfig.c:544:2:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
	strcpy(X11_lib, "");
data/xloadimage-4.1/autoconfig.c:553:5:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
    strcpy(X11_inc, "");
data/xloadimage-4.1/autoconfig.c:557:5:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
    strcpy(X11_lib, "");
data/xloadimage-4.1/autoconfig.c:573:10:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if ((strlen(cc) >= 3) && !strcmp(&cc[strlen(cc) - 3], "gcc")) {
data/xloadimage-4.1/autoconfig.c:573:42:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if ((strlen(cc) >= 3) && !strcmp(&cc[strlen(cc) - 3], "gcc")) {
data/xloadimage-4.1/bright.c:191:36:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	newimage->title = (char *)lmalloc(strlen(image->title) + 14);
data/xloadimage-4.1/config.c:76:9:  [1] (buffer) fgetc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    c = fgetc(f);
data/xloadimage-4.1/config.c:115:9:  [1] (buffer) fgetc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    c = fgetc(f);
data/xloadimage-4.1/config.c:134:11:  [1] (buffer) fgetc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
      c = fgetc(f);
data/xloadimage-4.1/config.c:150:6:  [1] (buffer) fgetc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	c = fgetc(f);
data/xloadimage-4.1/config.c:168:19:  [1] (buffer) fgetc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
      while ((c = fgetc(f)) != EOF) {
data/xloadimage-4.1/config.c:189:8:  [1] (buffer) fgetc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	  c = fgetc(f);
data/xloadimage-4.1/config.c:203:11:  [1] (buffer) fgetc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
      c = fgetc(f);
data/xloadimage-4.1/config.c:228:36:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      if (!strncmp(buf, PathToken, strlen(PathToken)))
data/xloadimage-4.1/config.c:230:40:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      else if (!strncmp(buf, ExtToken, strlen(ExtToken)))
data/xloadimage-4.1/config.c:232:43:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      else if (!strncmp(buf, FilterToken, strlen(FilterToken)))
data/xloadimage-4.1/config.c:259:7:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
      strncpy(filter_name, buf, BUFSIZ - 1);
data/xloadimage-4.1/config.c:473:7:  [1] (buffer) strncat:
  Easily used incorrectly (e.g., incorrectly computing the correct maximum
  size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf,
  or automatically resizing strings.
      strncat(buf1, homedir(), BUFSIZ - strlen(buf1) - 1);
data/xloadimage-4.1/config.c:473:41:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      strncat(buf1, homedir(), BUFSIZ - strlen(buf1) - 1);
data/xloadimage-4.1/config.c:475:12:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      b1 = strlen(buf1);
data/xloadimage-4.1/config.c:482:2:  [1] (buffer) strncat:
  Easily used incorrectly (e.g., incorrectly computing the correct maximum
  size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf,
  or automatically resizing strings.
	strncat(buf1, getenv(buf2), BUFSIZ - strlen (buf1) - 1);
data/xloadimage-4.1/config.c:482:39:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	strncat(buf1, getenv(buf2), BUFSIZ - strlen (buf1) - 1);
data/xloadimage-4.1/config.c:484:7:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	b1 = strlen(buf1);
data/xloadimage-4.1/config.c:509:12:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if((b2 = strlen(buf1)) > 0) {
data/xloadimage-4.1/dither.c:74:36:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    image->title = (char *)lmalloc(strlen(cimage->title) + 12);
data/xloadimage-4.1/faces.c:112:2:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
	strncpy(fname, buf + 11, BUFSIZ - 1);
data/xloadimage-4.1/faces.c:117:2:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
	strncpy(lname, buf + 10, BUFSIZ - 1);
data/xloadimage-4.1/faces.c:144:9:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  fname[strlen(fname) - 1]= ' ';
data/xloadimage-4.1/faces.c:145:3:  [1] (buffer) strncat:
  Easily used incorrectly (e.g., incorrectly computing the correct maximum
  size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf,
  or automatically resizing strings.
  strncat(fname, lname, BUFSIZ - strlen(fname) -1);
data/xloadimage-4.1/faces.c:145:34:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  strncat(fname, lname, BUFSIZ - strlen(fname) -1);
data/xloadimage-4.1/faces.c:146:9:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  fname[strlen(fname) - 1]= '\0';
data/xloadimage-4.1/fbm.c:283:7:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if (strlen(fbmin_img_title) != 0)
data/xloadimage-4.1/halftone.c:180:35:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    image->title= (char *)lmalloc(strlen(cimage->title) + 13);
data/xloadimage-4.1/imagetypes.c:48:56:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      if (!strncmp(ImageTypes[a].type, opt->info.type, strlen(opt->info.type))) {
data/xloadimage-4.1/imagetypes.c:143:5:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
    strncpy(typename, type, optptr - type);
data/xloadimage-4.1/imagetypes.c:149:7:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
      strncpy(typename, type, 31);
data/xloadimage-4.1/imagetypes.c:154:48:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if (!strncmp(ImageTypes[a].type, typename, strlen(typename))) {
data/xloadimage-4.1/img.c:379:3:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
  strncpy (extention, name+strlen(name)-4, 4);
data/xloadimage-4.1/img.c:379:28:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  strncpy (extention, name+strlen(name)-4, 4);
data/xloadimage-4.1/jpeg.c:316:38:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if (!strncmp("arithmetic", name, strlen(name))) {
data/xloadimage-4.1/jpeg.c:326:42:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    else if (!strncmp("grayscale", name, strlen(name)) ||
data/xloadimage-4.1/jpeg.c:327:35:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	     !strncmp("greyscale", name, strlen(name)) ||
data/xloadimage-4.1/jpeg.c:328:36:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	     !strncmp("monochrome", name, strlen(name))) {
data/xloadimage-4.1/jpeg.c:334:45:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    else if (!strncmp("nointerleave", name, strlen(name))) {
data/xloadimage-4.1/jpeg.c:344:44:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    else if (!strncmp("progressive", name, strlen(name))) {
data/xloadimage-4.1/jpeg.c:350:41:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    else if (!strncmp("optimize", name, strlen(name)) ||
data/xloadimage-4.1/jpeg.c:351:34:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	     !strncmp("optimise", name, strlen(name))) {
data/xloadimage-4.1/jpeg.c:357:40:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    else if (!strncmp("quality", name, strlen(name))) {
data/xloadimage-4.1/jpeg.c:379:40:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    else if (!strncmp("qtables", name, strlen(name))) {
data/xloadimage-4.1/jpeg.c:391:40:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    else if (!strncmp("restart", name, strlen(name))) {
data/xloadimage-4.1/jpeg.c:409:39:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    else if (!strncmp("sample", name, strlen(name))) {
data/xloadimage-4.1/jpeg.c:418:39:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    else if (!strncmp("smooth", name, strlen(name))) {
data/xloadimage-4.1/jpeg/ansi2knr.c:182:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	extern int strcmp(), strlen(), strncmp();
data/xloadimage-4.1/jpeg/ansi2knr.c:258:17:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			line = buf + strlen(buf);
data/xloadimage-4.1/jpeg/ansi2knr.c:323:25:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	bend = skipspace(buf + strlen(buf) - 1, -1);
data/xloadimage-4.1/jpeg/ansi2knr.c:353:13:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		   {	if ( strlen(kp) == len && !strncmp(kp, buf, len) )
data/xloadimage-4.1/jpeg/example.c:129:25:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    *ptr0++ = (JSAMPLE) getc(infile); /* red */
data/xloadimage-4.1/jpeg/example.c:130:25:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    *ptr1++ = (JSAMPLE) getc(infile); /* green */
data/xloadimage-4.1/jpeg/example.c:131:25:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    *ptr2++ = (JSAMPLE) getc(infile); /* blue */
data/xloadimage-4.1/jpeg/jcmain.c:108:12:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  if ((c = getc(cinfo->input_file)) == EOF)
data/xloadimage-4.1/jpeg/jcmain.c:299:8:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  ch = getc(file);
data/xloadimage-4.1/jpeg/jcmain.c:302:12:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
      ch = getc(file);
data/xloadimage-4.1/jpeg/jrdgif.c:126:12:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  if ((c = getc(infile)) == EOF)
data/xloadimage-4.1/jpeg/jrdppm.c:83:8:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  ch = getc(file);
data/xloadimage-4.1/jpeg/jrdppm.c:86:12:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
      ch = getc(file);
data/xloadimage-4.1/jpeg/jrdppm.c:193:23:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    *ptr0++ = rescale[getc(infile)];
data/xloadimage-4.1/jpeg/jrdppm.c:210:23:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    *ptr0++ = rescale[getc(infile)];
data/xloadimage-4.1/jpeg/jrdppm.c:211:23:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    *ptr1++ = rescale[getc(infile)];
data/xloadimage-4.1/jpeg/jrdppm.c:212:23:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    *ptr2++ = rescale[getc(infile)];
data/xloadimage-4.1/jpeg/jrdppm.c:227:25:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    *ptr0++ = (JSAMPLE) getc(infile);
data/xloadimage-4.1/jpeg/jrdppm.c:244:25:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    *ptr0++ = (JSAMPLE) getc(infile);
data/xloadimage-4.1/jpeg/jrdppm.c:245:25:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    *ptr1++ = (JSAMPLE) getc(infile);
data/xloadimage-4.1/jpeg/jrdppm.c:246:25:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    *ptr2++ = (JSAMPLE) getc(infile);
data/xloadimage-4.1/jpeg/jrdppm.c:347:7:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  if (getc(cinfo->input_file) != 'P')
data/xloadimage-4.1/jpeg/jrdppm.c:350:7:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  c = getc(cinfo->input_file);	/* save format discriminator for a sec */
data/xloadimage-4.1/jpeg/jrdtarga.c:87:12:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  if ((c = getc(infile)) == EOF)
data/xloadimage-4.1/jpeg/jrdtarga.c:123:29:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    tga_pixel[i] = (U_CHAR) getc(infile);
data/xloadimage-4.1/jpeg/jrdtarga.c:154:29:  [1] (buffer) getc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    tga_pixel[i] = (U_CHAR) getc(infile);
data/xloadimage-4.1/jpeg/jwrjfif.c:367:17:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	     (size_t) (strlen(cinfo->comment_text)));
data/xloadimage-4.1/new.c:105:22:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  d= (char *)lmalloc(strlen(s) + 1);
data/xloadimage-4.1/niff.c:229:28:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  valToMem((image->title ? strlen(image->title) : 0), header.title_len, 4);
data/xloadimage-4.1/niff.c:241:24:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if (image->title && (strlen(image->title) > 0)) {
data/xloadimage-4.1/niff.c:242:30:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if (fwrite(image->title, strlen(image->title), 1, f) != 1) {
data/xloadimage-4.1/options.c:215:14:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    width += strlen(Options[a].name) + 2;
data/xloadimage-4.1/options.c:218:14:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      width= strlen(Options[a].name) + 2;
data/xloadimage-4.1/options.c:232:43:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if (!strncmp(Options[a].name, option, strlen(option))) {
data/xloadimage-4.1/options.c:281:25:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    while(buf[0] && buf[strlen(buf) - 1] == '\n')
data/xloadimage-4.1/options.c:282:11:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      buf[strlen(buf) - 1]= '\0';
data/xloadimage-4.1/options.c:383:44:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if (!strncmp(arg + 1, Options[a].name, strlen(arg) - 1)) {
data/xloadimage-4.1/options.c:385:41:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	if (!strncmp(arg + 1, Options[b].name, strlen(arg) - 1))
data/xloadimage-4.1/options.c:892:5:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
    strncpy(option_name, *opt_string, MIN(BUFSIZ - 1, p - *opt_string));
data/xloadimage-4.1/options.c:897:5:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
    strncpy(option_name, *opt_string, BUFSIZ -1);
data/xloadimage-4.1/options.c:899:20:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    *opt_string += strlen(*opt_string); /* increment to end of string */
data/xloadimage-4.1/options.c:907:5:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
    strncpy(option_value, p + 1, BUFSIZ - 1);
data/xloadimage-4.1/packtar.c:49:3:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
  strncpy(new_file, dir, 1023); /* target directory */
data/xloadimage-4.1/packtar.c:51:3:  [1] (buffer) strncat:
  Easily used incorrectly (e.g., incorrectly computing the correct maximum
  size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf,
  or automatically resizing strings. Risk is low because the source is a
  constant character.
  strncat(new_file, "/", 1023 - strlen(new_file));
data/xloadimage-4.1/packtar.c:51:33:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  strncat(new_file, "/", 1023 - strlen(new_file));
data/xloadimage-4.1/packtar.c:53:3:  [1] (buffer) strncat:
  Easily used incorrectly (e.g., incorrectly computing the correct maximum
  size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf,
  or automatically resizing strings.
  strncat(new_file, old_file, 1023 - strlen(new_file));
data/xloadimage-4.1/packtar.c:53:38:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  strncat(new_file, old_file, 1023 - strlen(new_file));
data/xloadimage-4.1/pbm.c:470:34:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if (!strncmp("normal", name, strlen(name)))
data/xloadimage-4.1/pbm.c:472:36:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    else if (!strncmp("raw", name, strlen(name)))
data/xloadimage-4.1/smooth.c:30:35:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      new->title= (char *)lmalloc(strlen(image->title) + 12);
data/xloadimage-4.1/tiff.c:503:39:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if (!strncmp("compression", name, strlen(name))) {
data/xloadimage-4.1/tiff.c:504:35:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      if (!strncmp("none", value, strlen(value)))
data/xloadimage-4.1/tiff.c:506:39:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      else if (!strncmp("rle", value, strlen(value)))
data/xloadimage-4.1/tiff.c:508:41:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      else if (!strncmp("g3fax", value, strlen(value)))
data/xloadimage-4.1/tiff.c:510:41:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      else if (!strncmp("g4fax", value, strlen(value)))
data/xloadimage-4.1/tiff.c:512:39:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      else if (!strncmp("lzw", value, strlen(value)))
data/xloadimage-4.1/tiff.c:514:40:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      else if (!strncmp("jpeg", value, strlen(value)))
data/xloadimage-4.1/tiff.c:516:40:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      else if (!strncmp("next", value, strlen(value)))
data/xloadimage-4.1/tiff.c:518:40:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      else if (!strncmp("rlew", value, strlen(value)))
data/xloadimage-4.1/tiff.c:520:44:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      else if (!strncmp("packbits", value, strlen(value)) ||
data/xloadimage-4.1/tiff.c:521:32:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	       !strncmp("mac", value, strlen(value)))
data/xloadimage-4.1/tiff.c:523:47:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      else if (!strncmp("thunderscan", value, strlen(value)))
data/xloadimage-4.1/tiff/tif_compat.c:132:18:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	fab.fab$b_fns = strlen(name);
data/xloadimage-4.1/tiff/tif_dir.c:49:13:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		int len = strlen(cp)+1;
data/xloadimage-4.1/tiff/tif_dirwrite.c:560:20:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	dir->tdir_count = strlen(cp) + 1;	/* includes \0 byte */
data/xloadimage-4.1/tiff/tif_open.c:171:39:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	tif = (TIFF *)malloc(sizeof (TIFF) + strlen(name) + 1);
data/xloadimage-4.1/tiff/tiffcompat.h:162:32:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
#define	ReadOK(fd, buf, size)	(read(fd, (char *)buf, size) == size)
data/xloadimage-4.1/undither.c:35:40:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    nimage->title = (char *) lmalloc ( strlen (oimage->title) + 13 );
data/xloadimage-4.1/uufilter.c:107:11:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    len = strlen(buf) - 1;
data/xloadimage-4.1/uufilter.c:134:22:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      int line_len = strlen(buf) - 1;
data/xloadimage-4.1/vicar.c:46:3:  [1] (buffer) fscanf:
  It's unclear if the %s limit in the format string is small enough
  (CWE-120). Check that the limit is sufficiently small, or use a different
  input function.
  fscanf(fp,"%6s",IDENT);
data/xloadimage-4.1/window.c:270:3:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
  strncpy(buf, s, BUFSIZ - 1);
data/xloadimage-4.1/xbitmap.c:150:9:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if (strlen(line) == MAX_SIZE-1) {
data/xloadimage-4.1/zio.c:210:10:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if ((strlen(name) > strlen(filter->extension)) &&
data/xloadimage-4.1/zio.c:210:25:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if ((strlen(name) > strlen(filter->extension)) &&
data/xloadimage-4.1/zio.c:212:11:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		name + (strlen(name) - strlen(filter->extension)))) {
data/xloadimage-4.1/zio.c:212:26:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		name + (strlen(name) - strlen(filter->extension)))) {
data/xloadimage-4.1/zio.c:221:51:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            s = fname = (char *) lmalloc(1 + (5 * strlen(name)) + 1 + 1);
data/xloadimage-4.1/zio.c:227:11:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
					s += strlen(s);
data/xloadimage-4.1/zio.c:232:13:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
            strcpy (s, "'");

ANALYSIS SUMMARY:

Hits = 516
Lines analyzed = 54377 in approximately 1.57 seconds (34729 lines/second)
Physical Source Lines of Code (SLOC) = 36009
Hits@level = [0] 944 [1] 148 [2] 274 [3]   7 [4]  76 [5]  11
Hits@level+ = [0+] 1460 [1+] 516 [2+] 368 [3+]  94 [4+]  87 [5+]  11
Hits/KSLOC@level+ = [0+] 40.5454 [1+] 14.3298 [2+] 10.2197 [3+] 2.61046 [4+] 2.41606 [5+] 0.305479
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.