Introduction: Why SAST for C/C++?
Static Application Security Testing (SAST) is a foundational practice in modern secure software development. Unlike dynamic or runtime analysis, SAST examines source code without executing it, identifying vulnerabilities early in the development lifecycle when they are cheapest and easiest to fix.
While enterprise-grade tools often dominate the conversation, lightweight, open-source alternatives like Flawfinder offer tremendous value. This is especially true for teams working with C/C++, embedded systems, or legacy codebases where simplicity, speed, and zero cost are critical.
In this article, we'll apply Flawfinder to a sample C++ program, interpret its findings, and discuss how to integrate it into a development workflow.
Why Flawfinder?
Flawfinder is a command-line static analysis tool designed specifically for C and C++. Created by David A. Wheeler, it scans source code for calls to functions known to be risky (like strcpy, gets, sprintf) which commonly lead to:
- Buffer overflows (CWE-120)
- Format string vulnerabilities (CWE-134)
- Command injection (CWE-78)
Instead of performing complex abstract syntax tree (AST) analysis, Flawfinder uses simple but effective pattern-matching against a curated database of dangerous function calls. This makes it:
✅ Blazingly fast - Scans thousands of lines of code in seconds.
✅ Lightweight - No compilation or complex setup required.
✅ Free and Open-Source - No licensing fees.
✅ Beginner-friendly - Easy to install and interpret results.
And as requested, it's not SonarQube, Snyk, Semgrep, or Veracode.
Hands-On: Scanning a C++ Project
Step 1: Installation
Installing Flawfinder is straightforward. It's available via package managers for most Linux distributions and macOS.
# On Ubuntu/Debian
sudo apt-get install flawfinder
# On macOS using Homebrew
brew install flawfinder
# Using pip (Python Package Manager)
pip install flawfinder
Verify the installation:
flawfinder --version
Step 2: Create a Sample C++ File to Scan
Let's create a simple C++ file (vulnerable_example.cpp) that contains some common security pitfalls. This will give Flawfinder something interesting to report.
// vulnerable_example.cpp
#include <iostream>
#include <cstring>
#include <cstdio>
int main() {
char src[10] = "Hello";
char dest[5]; // Oops! Too small.
// 1. Risky function: strcpy (potential buffer overflow)
strcpy(dest, src);
// 2. Risky function: sprintf (potential buffer overflow)
char buffer[10];
sprintf(buffer, "The number is %d", 42);
// 3. Risky function: gets (extremely dangerous)
// char input[50];
// gets(input); // Uncommenting this would be a major flaw!
std::cout << "Dest: " << dest << std::endl;
std::cout << "Buffer: " << buffer << std::endl;
return 0;
}
Step 3: Run the Scan
Navigate to the directory containing your source file and run Flawfinder. You can point it to a single file or an entire directory.
# Scan a single file
flawfinder vulnerable_example.cpp
# Scan the current directory and all subdirectories
flawfinder ./
Step 4: Interpreting the Results
Flawfinder's output is color-coded and ranked by risk level (0-5, where 5 is the most severe). Here's what you might see for our example:
Flawfinder version 2.0.19, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 220
Examining vulnerable_example.cpp
vulnerable_example.cpp:10: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Consider using strncpy or snprintf.
vulnerable_example.cpp:14: [4] (buffer) sprintf:
Does not check for buffer overflows when writing to destination (CWE-120).
Use snprintf or vsnprintf instead.
vulnerable_example.cpp:18: [5] (buffer) gets:
This function is extremely dangerous because it may overflow the
calling buffer. It is obsoleted by ISO/IEC 9899:1999 (C99) and
should never be used. Use fgets() instead.
FINAL RESULTS:
Hits = 3
Lines analyzed = 20 in 0.1 seconds (200 lines/second)
3 Physical Source Lines of Code (SLOC) = 20
Hits@level = [0] 0 [1] 0 [2] 0 [3] 0 [4] 2 [5] 1
Hits@level+ = [0+] 3 [1+] 3 [2+] 3 [3+] 3 [4+] 3 [5+] 1
Key takeaways from the report:
- Location: Each finding shows the file and line number.
- Risk Level:
[4]and[5]indicate high-severity issues. - Description: A brief explanation of the risk and the associated CWE.
- Recommendation: Suggests safer alternative functions.
Integrating Flawfinder into Your Workflow
To move beyond one-off scans, you can integrate Flawfinder directly into your development process.
1. Make it Part of Your CI/CD Pipeline (e.g., GitHub Actions)
You can create a simple GitHub Action to run Flawfinder on every push or pull request. Create a file in your repo at .github/workflows/flawfinder.yml:
name: SAST with Flawfinder
on: [push, pull_request]
jobs:
sast:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Install Flawfinder
run: sudo apt-get install -y flawfinder
- name: Run Flawfinder
run: flawfinder --sarflib ./
This will output the results in SARIF format, which GitHub can natively display in the "Security" tab.
2. Customizing Scans with Command-Line Options
Flawfinder offers several options to tailor the output:
# Only show high-risk issues (level 4 and 5)
flawfinder --minlevel 4 ./
# Generate a HTML report
flawfinder --html --output results.html ./
# Suppress specific known issues (e.g., a false positive on line 10)
flawfinder --falsepositive vulnerable_example.cpp:10
Limitations and Considerations
While Flawfinder is excellent for catching known dangerous patterns, it's important to understand its limitations:
- False Positives: Pattern-matching can flag safe usage of functions
- Limited Scope: Only finds issues related to its built-in database
- No Data Flow Analysis: Cannot track variables across complex function calls
For mission-critical projects, consider using Flawfinder alongside more advanced tools like Clang Static Analyzer or commercial solutions.
Conclusion: Flawfinder's Place in Your Toolbox
Flawfinder is not a silver bullet. Its pattern-matching approach can produce false positives and it won't catch complex logical flaws. However, as a fast, free, and focused tool, it is incredibly effective at what it does: catching obvious yet dangerous function calls in C/C++ code.
It serves as an excellent first line of defense, especially for developers new to secure coding practices. By integrating it early and often, you can prevent well-known vulnerability classes from ever reaching production.