Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/fermi-lite-0.1/bubble.c
Examining data/fermi-lite-0.1/htab.c
Examining data/fermi-lite-0.1/htab.h
Examining data/fermi-lite-0.1/khash.h
Examining data/fermi-lite-0.1/kmer.h
Examining data/fermi-lite-0.1/kseq.h
Examining data/fermi-lite-0.1/ksort.h
Examining data/fermi-lite-0.1/kstring.h
Examining data/fermi-lite-0.1/ksw.h
Examining data/fermi-lite-0.1/kthread.c
Examining data/fermi-lite-0.1/kvec.h
Examining data/fermi-lite-0.1/mag.h
Examining data/fermi-lite-0.1/mrope.c
Examining data/fermi-lite-0.1/mrope.h
Examining data/fermi-lite-0.1/rld0.c
Examining data/fermi-lite-0.1/rld0.h
Examining data/fermi-lite-0.1/rle.c
Examining data/fermi-lite-0.1/rope.c
Examining data/fermi-lite-0.1/rope.h
Examining data/fermi-lite-0.1/debian/include/simde/check.h
Examining data/fermi-lite-0.1/debian/include/simde/hedley.h
Examining data/fermi-lite-0.1/debian/include/simde/simde-arch.h
Examining data/fermi-lite-0.1/debian/include/simde/simde-common.h
Examining data/fermi-lite-0.1/debian/include/simde/x86/mmx.h
Examining data/fermi-lite-0.1/debian/include/simde/x86/sse.h
Examining data/fermi-lite-0.1/debian/include/simde/x86/sse2.h
Examining data/fermi-lite-0.1/bseq.c
Examining data/fermi-lite-0.1/misc.c
Examining data/fermi-lite-0.1/example.c
Examining data/fermi-lite-0.1/internal.h
Examining data/fermi-lite-0.1/fml.h
Examining data/fermi-lite-0.1/bfc.c
Examining data/fermi-lite-0.1/bfc.h
Examining data/fermi-lite-0.1/ksw.c
Examining data/fermi-lite-0.1/mag.c
Examining data/fermi-lite-0.1/unitig.c
Examining data/fermi-lite-0.1/rle.h

FINAL RESULTS:

data/fermi-lite-0.1/debian/include/simde/check.h:45:38:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
#  define simde_errorf(format, ...) (fprintf(stderr, format, __VA_ARGS__), abort())
data/fermi-lite-0.1/debian/include/simde/hedley.h:876:79:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
#  define HEDLEY_PRINTF_FORMAT(string_idx,first_to_check) __declspec(vaformat(printf,string_idx,first_to_check))
data/fermi-lite-0.1/example.c:14:14:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((c = getopt(argc, argv, "Ae:l:r:t:c:")) >= 0) {
data/fermi-lite-0.1/ksort.h:276:14:  [3] (random) drand48:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
			j = (int)(drand48() * i);									\
data/fermi-lite-0.1/ksort.h:284:23:  [3] (random) drand48:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
			double z = 1., x = drand48(); \
data/fermi-lite-0.1/bfc.c:246:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(r->ecpos_high + 1, prev->ecpos_high, (BFC_EC_HIST_HIGH - 1) * 4);
data/fermi-lite-0.1/bfc.c:248:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	} else memcpy(r->ecpos_high, prev->ecpos_high, BFC_EC_HIST_HIGH * 4);
data/fermi-lite-0.1/bfc.c:250:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(r->ecpos + 1, prev->ecpos, (BFC_EC_HIST - 1) * 4);
data/fermi-lite-0.1/bfc.c:252:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	} else memcpy(r->ecpos, prev->ecpos, BFC_EC_HIST * 4);
data/fermi-lite-0.1/bubble.c:186:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char *seq[2], *cov[2];
data/fermi-lite-0.1/debian/include/simde/hedley.h:1277:25:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
             ((struct { char v[sizeof(void) * 2]; } *) 1) \
data/fermi-lite-0.1/debian/include/simde/x86/sse.h:1532:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(&r, mem_addr, sizeof(r.f32));
data/fermi-lite-0.1/debian/include/simde/x86/sse.h:2893:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(mem_addr, &a, sizeof(a));
data/fermi-lite-0.1/debian/include/simde/x86/sse2.h:2092:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(&r, mem_addr, sizeof(simde_float64));
data/fermi-lite-0.1/debian/include/simde/x86/sse2.h:2172:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(&r, mem_addr, sizeof(simde_float64));
data/fermi-lite-0.1/debian/include/simde/x86/sse2.h:3974:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(mem_addr, &a, sizeof(a));
data/fermi-lite-0.1/debian/include/simde/x86/sse2.h:4006:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(mem_addr, &a, sizeof(a.f64[0]));
data/fermi-lite-0.1/debian/include/simde/x86/sse2.h:4022:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(mem_addr, &a, sizeof(a));
data/fermi-lite-0.1/debian/include/simde/x86/sse2.h:4093:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(mem_addr, &a, sizeof(a));
data/fermi-lite-0.1/debian/include/simde/x86/sse2.h:4108:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(mem_addr, v, sizeof(v));
data/fermi-lite-0.1/debian/include/simde/x86/sse2.h:4110:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(mem_addr, &a, sizeof(a));
data/fermi-lite-0.1/debian/include/simde/x86/sse2.h:4124:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(mem_addr, &a, sizeof(a));
data/fermi-lite-0.1/debian/include/simde/x86/sse2.h:4138:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(mem_addr, &a, sizeof(a));
data/fermi-lite-0.1/example.c:15:28:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
		if (c == 'e') opt.ec_k = atoi(optarg);
data/fermi-lite-0.1/example.c:16:41:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
		else if (c == 'l') opt.min_asm_ovlp = atoi(optarg);
data/fermi-lite-0.1/example.c:19:38:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
		else if (c == 't') opt.n_threads = atoi(optarg);
data/fermi-lite-0.1/internal.h:6:17:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
extern unsigned char seq_nt6_table[256];
data/fermi-lite-0.1/kmer.h:97:15:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static inline char *bfc_kmer_2str(int k, const uint64_t y[2], char *buf)
data/fermi-lite-0.1/kseq.h:127:4:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			memcpy(str->s + str->l, ks->buf + ks->begin, i - ks->begin);  \
data/fermi-lite-0.1/kstring.h:88:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(s->s + s->l, p, l);
data/fermi-lite-0.1/kstring.h:113:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char buf[16];
data/fermi-lite-0.1/kstring.h:130:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char buf[16];
data/fermi-lite-0.1/kstring.h:147:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char buf[32];
data/fermi-lite-0.1/kvec.h:74:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy((v1).a, (v0).a, sizeof(type) * (v0).n);		\
data/fermi-lite-0.1/mag.c:216:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(dst, src, sizeof(magv_t));
data/fermi-lite-0.1/mag.c:219:38:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	dst->seq = calloc(dst->max_len, 1); memcpy(dst->seq, src->seq, src->len);
data/fermi-lite-0.1/mag.c:220:38:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	dst->cov = calloc(dst->max_len, 1); memcpy(dst->cov, src->cov, src->len);
data/fermi-lite-0.1/misc.c:12:10:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
unsigned char seq_nt6_table[256] = {
data/fermi-lite-0.1/rld0.c:26:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static const char LogTable256[256] = {
data/fermi-lite-0.1/rld0.c:229:24:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fp = strcmp(fn, "-")? fopen(fn, "wb") : fdopen(fileno(stdout), "wb");
data/fermi-lite-0.1/rld0.c:250:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char magic[4];
data/fermi-lite-0.1/rld0.c:255:24:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	else if ((*_fp = fp = fopen(fn, "rb")) == 0) return 0;
data/fermi-lite-0.1/rld0.c:320:10:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	e->fd = open(fn, O_RDONLY);
data/fermi-lite-0.1/rle.c:32:4:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			memcpy(cnt, bc, 48);
data/fermi-lite-0.1/rle.c:35:4:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			memcpy(cnt, bc, 48);
data/fermi-lite-0.1/rle.c:42:4:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			memcpy(cnt, ec, 48);
data/fermi-lite-0.1/rle.c:60:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(bc, cnt, 48);
data/fermi-lite-0.1/rle.c:85:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(p, tmp, n_bytes2);
data/fermi-lite-0.1/rle.c:104:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(new_block + 2, q, end - q);
data/fermi-lite-0.1/rle.c:178:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(cnt, ec, 48);
data/fermi-lite-0.1/rope.c:85:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(v->c, rope->c, 48);
data/fermi-lite-0.1/rope.c:101:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(q, p + p->n, sizeof(rpnode_t) * (rope->max_nodes>>1));
data/fermi-lite-0.1/rope.c:187:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(cy, cx, 48);
data/fermi-lite-0.1/unitig.c:399:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(d->z.seq, d->str.s, d->z.len);
data/fermi-lite-0.1/unitig.c:400:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(d->z.cov, d->cov.s, d->z.len + 1);
data/fermi-lite-0.1/unitig.c:434:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(g->v.a + g->v.n, w.d[j].v.a, w.d[j].v.n * sizeof(magv_t));
data/fermi-lite-0.1/bfc.c:101:6:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	l = strlen(s);
data/fermi-lite-0.1/kstring.h:96:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	return kputsn(p, strlen(p), s);

ANALYSIS SUMMARY:

Hits = 58
Lines analyzed = 18539 in approximately 0.56 seconds (33377 lines/second)
Physical Source Lines of Code (SLOC) = 15542
Hits@level = [0]  27 [1]   2 [2]  51 [3]   3 [4]   2 [5]   0
Hits@level+ = [0+]  85 [1+]  58 [2+]  56 [3+]   5 [4+]   2 [5+]   0
Hits/KSLOC@level+ = [0+] 5.46905 [1+] 3.73182 [2+] 3.60314 [3+] 0.321709 [4+] 0.128684 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.