Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/probalign-1.4/FileBuffer.h
Examining data/probalign-1.4/ComputeAlignment.cc
Examining data/probalign-1.4/EvolutionaryTree.h
Examining data/probalign-1.4/Matrix.h
Examining data/probalign-1.4/MultiSequence.h
Examining data/probalign-1.4/PostProbs.cc
Examining data/probalign-1.4/ReadMatrix.cc
Examining data/probalign-1.4/Sequence.h
Examining data/probalign-1.4/SparseMatrix.h
Examining data/probalign-1.4/SafeVector.h
Examining data/probalign-1.4/Main.cc

FINAL RESULTS:

data/probalign-1.4/Main.cc:777:7:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
		    strcpy(matrixtype, argv[++i]);
data/probalign-1.4/Sequence.h:154:5:  [4] (buffer) sscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function.
    sscanf (header.c_str(), "%s", name);
data/probalign-1.4/FileBuffer.h:27:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buffer[BufferSize];
data/probalign-1.4/Main.cc:68:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char *aminos, *bases, matrixtype[20] = "gonnet_160";
data/probalign-1.4/Main.cc:111:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char input[30];
data/probalign-1.4/Main.cc:560:7:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
		    strcpy(matrixtype, "nuc_simple");
data/probalign-1.4/Matrix.h:11:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char monomers[26];  /* amino or nucleic acid order */ 
data/probalign-1.4/PostProbs.cc:35:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char input[30];
data/probalign-1.4/PostProbs.cc:62:1:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
char proteins[20];
data/probalign-1.4/PostProbs.cc:74:8:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
extern char aminos[26], matrixtype[20], bases[26];
data/probalign-1.4/PostProbs.cc:145:7:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fo = fopen("revpartdump", "a");
data/probalign-1.4/PostProbs.cc:903:5:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
    strcpy(sequences[0].title, "seq0");
data/probalign-1.4/PostProbs.cc:907:5:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
    strcpy(sequences[1].title, "seq1");
data/probalign-1.4/PostProbs.cc:918:16:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	FILE *dump1 = fopen("dump1", "a");
data/probalign-1.4/ReadMatrix.cc:19:8:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
extern char *aminos, *bases, matrixtype[20];
data/probalign-1.4/ReadMatrix.cc:32:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char input[30];
data/probalign-1.4/ReadMatrix.cc:54:4:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
	  strcpy(matrixtype, "gonnet_160");
data/probalign-1.4/ReadMatrix.cc:57:4:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
	  strcpy(matrixtype, "nuc_simple");
data/probalign-1.4/ReadMatrix.cc:60:4:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
	  strcpy(matrixtype, "CUSTOM");
data/probalign-1.4/ReadMatrix.cc:147:5:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
    strcpy(argument.input, "tempin");
data/probalign-1.4/Sequence.h:153:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char name[1024];
data/probalign-1.4/FileBuffer.h:58:12:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
      file.read (buffer, BufferSize);
data/probalign-1.4/Main.cc:293:25:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		cerr << a << "   " << strlen(seq1->GetString().
data/probalign-1.4/Main.cc:295:25:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		cerr << b << "   " << strlen(seq2->GetString().
data/probalign-1.4/PostProbs.cc:136:12:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    len0 = strlen(sequences[0].text);
data/probalign-1.4/PostProbs.cc:137:12:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    len1 = strlen(sequences[1].text);
data/probalign-1.4/PostProbs.cc:595:12:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    len0 = strlen(sequences[0].text);
data/probalign-1.4/PostProbs.cc:596:12:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    len1 = strlen(sequences[1].text);
data/probalign-1.4/PostProbs.cc:900:27:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    sequences[0].length = strlen((char *) seq1.c_str());
data/probalign-1.4/PostProbs.cc:904:27:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    sequences[1].length = strlen((char *) seq2.c_str());
data/probalign-1.4/ReadMatrix.cc:102:17:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    basecount = strlen(bases);

ANALYSIS SUMMARY:

Hits = 31
Lines analyzed = 4932 in approximately 0.12 seconds (39668 lines/second)
Physical Source Lines of Code (SLOC) = 3003
Hits@level = [0]  45 [1]  10 [2]  19 [3]   0 [4]   2 [5]   0
Hits@level+ = [0+]  76 [1+]  31 [2+]  21 [3+]   2 [4+]   2 [5+]   0
Hits/KSLOC@level+ = [0+] 25.308 [1+] 10.323 [2+] 6.99301 [3+] 0.666001 [4+] 0.666001 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.