Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/grabix-0.1.7/bgzf.c
Examining data/grabix-0.1.7/bgzf.h
Examining data/grabix-0.1.7/grabix.h
Examining data/grabix-0.1.7/grabix_main.cpp
Examining data/grabix-0.1.7/khash.h
Examining data/grabix-0.1.7/grabix.cpp

FINAL RESULTS:

data/grabix-0.1.7/grabix.cpp:254:5:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
int random(string bgzf_file, uint64_t K)
data/grabix-0.1.7/grabix.cpp:276:9:  [3] (random) srand:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
        srand(seed);
data/grabix-0.1.7/grabix.h:47:5:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
int random(string bgzf_file, uint64_t K);
data/grabix-0.1.7/grabix_main.cpp:35:13:  [3] (random) random:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
            random(bgzf_file, N);
data/grabix-0.1.7/bgzf.c:54:30:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
#define _bgzf_open(fn, mode) fopen((fn), (mode))
data/grabix-0.1.7/bgzf.c:155:14:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		if ((fpw = fopen(path, "w")) == 0) return 0;
data/grabix-0.1.7/bgzf.c:199:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(dst, g_magic, BLOCK_HEADER_LENGTH); // the last two bytes are a place holder for the length of the block
data/grabix-0.1.7/bgzf.c:277:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(fp->uncompressed_block, p->block, BGZF_MAX_BLOCK_SIZE);
data/grabix-0.1.7/bgzf.c:306:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(kh_val(h, k).block, fp->uncompressed_block, BGZF_MAX_BLOCK_SIZE);
data/grabix-0.1.7/bgzf.c:333:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(compressed_block, header, BLOCK_HEADER_LENGTH);
data/grabix-0.1.7/bgzf.c:365:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(output, buffer + fp->block_offset, copy_length);
data/grabix-0.1.7/bgzf.c:413:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(w->mt->blk[i], w->buf, clen);
data/grabix-0.1.7/bgzf.c:479:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(mt->blk[mt->curr], fp->uncompressed_block, fp->block_offset);
data/grabix-0.1.7/bgzf.c:524:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy((uint8_t*)fp->uncompressed_block + fp->block_offset, input, copy_length);
data/grabix-0.1.7/bgzf.c:576:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(buffer + fp->block_offset, input, copy_length);
data/grabix-0.1.7/bgzf.c:698:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(str->s + str->l, buf + fp->block_offset, l);
data/grabix-0.1.7/grabix.cpp:160:28:  [2] (integer) atol:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
        index.header_end = atol(line.c_str());
data/grabix-0.1.7/grabix.cpp:163:27:  [2] (integer) atol:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
        index.num_lines = atol(line.c_str());
data/grabix-0.1.7/grabix.cpp:167:43:  [2] (integer) atol:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
            index.chunk_offsets.push_back(atol(line.c_str()));
data/grabix-0.1.7/grabix_main.cpp:25:33:  [2] (integer) atol:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
            int64_t from_line = atol(argv[3]);
data/grabix-0.1.7/grabix_main.cpp:28:27:  [2] (integer) atol:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
                to_line = atol(argv[4]);
data/grabix-0.1.7/grabix_main.cpp:34:24:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
            size_t N = atoi(argv[3]);

ANALYSIS SUMMARY:

Hits = 22
Lines analyzed = 1883 in approximately 0.11 seconds (16965 lines/second)
Physical Source Lines of Code (SLOC) = 1238
Hits@level = [0]   5 [1]   0 [2]  18 [3]   4 [4]   0 [5]   0
Hits@level+ = [0+]  27 [1+]  22 [2+]  22 [3+]   4 [4+]   0 [5+]   0
Hits/KSLOC@level+ = [0+] 21.8094 [1+] 17.7706 [2+] 17.7706 [3+] 3.23102 [4+]   0 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.