Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/libtfbs-perl-0.7.1/Ext/lib/pwm_search.h
Examining data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c
Examining data/libtfbs-perl-0.7.1/Ext/pwmsearch.c
Examining data/libtfbs-perl-0.7.1/blib/lib/pwm_search.h
Examining data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c
FINAL RESULTS:
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:65:4: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(args.counts_file, matrixfile);
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:66:4: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(args.seq_file, seqfile);
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:68:4: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(args.name, tfname);
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:69:4: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(args.class, tfclass);
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:328:7: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy( __ERR__[NUM_ERRS - 1],msg );
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:370:7: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
{ strcpy(pargs->counts_file,argv[1]);
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:371:7: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(pargs->seq_file,argv[2]);
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:393:16: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(pargs->mask_file,argv[arg_count+1]);
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:401:16: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(pargs->name,argv[arg_count+1]);
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:409:16: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(pargs->class,argv[arg_count+1]);
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:565:7: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(seq_id,line+1);
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:621:7: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(msg,"seq_id=%s\nlength=%ld\n",
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:65:4: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(args.counts_file, matrixfile);
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:66:4: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(args.seq_file, seqfile);
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:68:4: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(args.name, tfname);
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:69:4: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(args.class, tfclass);
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:124:4: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(stderr,msg);
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:328:7: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy( __ERR__[NUM_ERRS - 1],msg );
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:370:7: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
{ strcpy(pargs->counts_file,argv[1]);
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:371:7: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(pargs->seq_file,argv[2]);
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:393:16: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(pargs->mask_file,argv[arg_count+1]);
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:401:16: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(pargs->name,argv[arg_count+1]);
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:409:16: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(pargs->class,argv[arg_count+1]);
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:565:7: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(seq_id,line+1);
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:621:7: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(msg,"seq_id=%s\nlength=%ld\n",
data/libtfbs-perl-0.7.1/Ext/lib/pwm_search.h:35:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char *__ERR__[MAXERR];
data/libtfbs-perl-0.7.1/Ext/lib/pwm_search.h:94:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char counts_file[FNAMELEN+1]; /* file name, count matrix */
data/libtfbs-perl-0.7.1/Ext/lib/pwm_search.h:95:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char mask_file[FNAMELEN+1]; /* file name, masked seq output,
data/libtfbs-perl-0.7.1/Ext/lib/pwm_search.h:97:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char seq_file[FNAMELEN+1]; /* file name, sequences */
data/libtfbs-perl-0.7.1/Ext/lib/pwm_search.h:98:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[FNAMELEN+1]; /* TF name */
data/libtfbs-perl-0.7.1/Ext/lib/pwm_search.h:99:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char class[FNAMELEN+1]; /* TF structural class */
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:80:18: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
else if ( (fp=fopen(args.seq_file,"r")) == NULL )
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:84:21: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
else if ( (outfp=fopen(outfile,"w")) == NULL )
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:451:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ( (fp=fopen(pargs->counts_file,"r")) == NULL )
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:531:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char msg[2*MAX_LINE];
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:539:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char line[MAX_LINE]; // was static
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:645:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char seq[SEQLEN+1];
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:646:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char seqid[SEQNAMELEN+1];
data/libtfbs-perl-0.7.1/blib/lib/pwm_search.h:35:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char *__ERR__[MAXERR];
data/libtfbs-perl-0.7.1/blib/lib/pwm_search.h:94:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char counts_file[FNAMELEN+1]; /* file name, count matrix */
data/libtfbs-perl-0.7.1/blib/lib/pwm_search.h:95:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char mask_file[FNAMELEN+1]; /* file name, masked seq output,
data/libtfbs-perl-0.7.1/blib/lib/pwm_search.h:97:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char seq_file[FNAMELEN+1]; /* file name, sequences */
data/libtfbs-perl-0.7.1/blib/lib/pwm_search.h:98:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[FNAMELEN+1]; /* TF name */
data/libtfbs-perl-0.7.1/blib/lib/pwm_search.h:99:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char class[FNAMELEN+1]; /* TF structural class */
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:80:18: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
else if ( (fp=fopen(args.seq_file,"r")) == NULL )
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:84:21: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
else if ( (outfp=fopen(outfile,"w")) == NULL )
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:451:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ( (fp=fopen(pargs->counts_file,"r")) == NULL )
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:531:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char msg[2*MAX_LINE];
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:539:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char line[MAX_LINE]; // was static
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:645:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char seq[SEQLEN+1];
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:646:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char seqid[SEQNAMELEN+1];
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:325:51: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if ( (__ERR__[NUM_ERRS-1] = (char *) malloc( 1+strlen(msg) ) ) == NULL )
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:566:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
seq_id[ strlen(seq_id) -1 ] = '\0';
data/libtfbs-perl-0.7.1/Ext/lib/pwm_searchPFF.c:567:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
while (count < strlen(seq_id) && !word)
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:325:51: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if ( (__ERR__[NUM_ERRS-1] = (char *) malloc( 1+strlen(msg) ) ) == NULL )
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:566:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
seq_id[ strlen(seq_id) -1 ] = '\0';
data/libtfbs-perl-0.7.1/blib/lib/pwm_searchPFF.c:567:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
while (count < strlen(seq_id) && !word)
ANALYSIS SUMMARY:
Hits = 57
Lines analyzed = 1953 in approximately 0.07 seconds (26877 lines/second)
Physical Source Lines of Code (SLOC) = 1317
Hits@level = [0] 19 [1] 6 [2] 26 [3] 0 [4] 25 [5] 0
Hits@level+ = [0+] 76 [1+] 57 [2+] 51 [3+] 25 [4+] 25 [5+] 0
Hits/KSLOC@level+ = [0+] 57.7069 [1+] 43.2802 [2+] 38.7244 [3+] 18.9825 [4+] 18.9825 [5+] 0
Dot directories skipped = 13 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.