Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/splash-2.10.1/src/read_data_pbob_utils.c
Examining data/splash-2.10.1/src/read_data_cactus_hdf5_utils.c
Examining data/splash-2.10.1/src/H5Part/H5PartF.c
Examining data/splash-2.10.1/src/H5Part/H5PartAttribF.c
Examining data/splash-2.10.1/src/read_data_gadget_hdf5_utils.c
Examining data/splash-2.10.1/src/read_data_falcON_hdf5_utils.cc
Examining data/splash-2.10.1/src/read_data_snsph_utils.c
Examining data/splash-2.10.1/src/read_data_silo_utils.c
Examining data/splash-2.10.1/src/read_data_amuse_hdf5_utils.c
Examining data/splash-2.10.1/src/read_data_flash_hdf5_utils.c
FINAL RESULTS:
data/splash-2.10.1/src/read_data_amuse_hdf5_utils.c:312:7: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(name,datasetname);
data/splash-2.10.1/src/read_data_amuse_hdf5_utils.c:335:10: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(name,datasetname);
data/splash-2.10.1/src/read_data_cactus_hdf5_utils.c:144:10: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(Dataset[i].name,name);
data/splash-2.10.1/src/read_data_cactus_hdf5_utils.c:147:10: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(name,Dataset[iorder[i]-1].name);
data/splash-2.10.1/src/read_data_cactus_hdf5_utils.c:152:11: [4] (buffer) sscanf:
The scanf() family's %s operation, without a limit specification, permits
buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
different input function.
if (sscanf(name, "%s it=%i tl=%i rl=%i c=%i",
data/splash-2.10.1/src/read_data_falcON_hdf5_utils.cc:582:5: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(flds,field.first.c_str());
data/splash-2.10.1/src/read_data_amuse_hdf5_utils.c:18:45: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
int read_amuse_hdf5_dataset(hid_t group_id, char *datasetname, int itype, int maxtypes, int npartoftype[maxtypes],
data/splash-2.10.1/src/read_data_amuse_hdf5_utils.c:77:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[256];
data/splash-2.10.1/src/read_data_amuse_hdf5_utils.c:164:27: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
void read_amuse_hdf5_data(char *filename,
data/splash-2.10.1/src/read_data_amuse_hdf5_utils.c:175:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char groupname[12];
data/splash-2.10.1/src/read_data_amuse_hdf5_utils.c:176:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char datasetname[256];
data/splash-2.10.1/src/read_data_amuse_hdf5_utils.c:199:10: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(groupname,"00000000%02i",itype+1);
data/splash-2.10.1/src/read_data_amuse_hdf5_utils.c:259:29: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *datasetname,
data/splash-2.10.1/src/read_data_amuse_hdf5_utils.c:271:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[256];
data/splash-2.10.1/src/read_data_amuse_hdf5_utils.c:365:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[256];
data/splash-2.10.1/src/read_data_cactus_hdf5_utils.c:26:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[LEN_NAME];
data/splash-2.10.1/src/read_data_cactus_hdf5_utils.c:114:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[LEN_NAME];
data/splash-2.10.1/src/read_data_cactus_hdf5_utils.c:115:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char thorn[LEN_NAME],thornprev[LEN_NAME];
data/splash-2.10.1/src/read_data_cactus_hdf5_utils.c:253:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name_attr[256];
data/splash-2.10.1/src/read_data_falcON_hdf5_utils.cc:666:40: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
const auto lines = argc<3? 10 : std::atoi(argv[2]);
data/splash-2.10.1/src/read_data_falcON_hdf5_utils.cc:667:40: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
const auto debug = argc<4? 0 : std::atoi(argv[3]);
data/splash-2.10.1/src/read_data_flash_hdf5_utils.c:72:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[80];
data/splash-2.10.1/src/read_data_flash_hdf5_utils.c:294:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[256];
data/splash-2.10.1/src/read_data_gadget_hdf5_utils.c:18:45: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
int read_gadgethdf5_dataset(hid_t group_id, char *datasetname, int itype, int maxtypes, int npartoftype[maxtypes],
data/splash-2.10.1/src/read_data_gadget_hdf5_utils.c:28:30: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
void read_gadget_hdf5_header(char *filename,
data/splash-2.10.1/src/read_data_gadget_hdf5_utils.c:80:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[256],maindataset[256];
data/splash-2.10.1/src/read_data_gadget_hdf5_utils.c:81:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char namevels[256],namemass[256];
data/splash-2.10.1/src/read_data_gadget_hdf5_utils.c:150:8: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(maindataset,"PartType%i",i);
data/splash-2.10.1/src/read_data_gadget_hdf5_utils.c:194:4: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(name,"Coordinates");
data/splash-2.10.1/src/read_data_gadget_hdf5_utils.c:272:28: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
void read_gadget_hdf5_data(char *filename,
data/splash-2.10.1/src/read_data_gadget_hdf5_utils.c:285:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char groupname[12];
data/splash-2.10.1/src/read_data_gadget_hdf5_utils.c:286:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char datasetname[256],namevels[256],namemass[256];
data/splash-2.10.1/src/read_data_gadget_hdf5_utils.c:301:10: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(groupname,"PartType%i",itype);
data/splash-2.10.1/src/read_data_gadget_hdf5_utils.c:361:29: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *datasetname,
data/splash-2.10.1/src/read_data_gadget_hdf5_utils.c:472:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[256];
data/splash-2.10.1/src/read_data_gadget_hdf5_utils.c:529:4: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(name,"Velocities");
data/splash-2.10.1/src/read_data_gadget_hdf5_utils.c:533:7: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(name,"Velocity");
data/splash-2.10.1/src/read_data_gadget_hdf5_utils.c:543:4: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(name,"Masses");
data/splash-2.10.1/src/read_data_gadget_hdf5_utils.c:547:7: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(name,"Mass");
data/splash-2.10.1/src/read_data_silo_utils.c:111:21: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
void read_silo_data(char *filename,
data/splash-2.10.1/src/read_data_snsph_utils.c:28:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char fname[128];
data/splash-2.10.1/src/read_data_snsph_utils.c:100:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char fname[128];
data/splash-2.10.1/src/read_data_cactus_hdf5_utils.c:135:3: [1] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant character.
strcpy(thornprev,"");
data/splash-2.10.1/src/read_data_cactus_hdf5_utils.c:167:13: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(thornprev,thorn,LEN_NAME);
data/splash-2.10.1/src/read_data_falcON_hdf5_utils.cc:294:7: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
data.read(Buffer.data(),H5::PredType::NATIVE_DOUBLE,space,space);
data/splash-2.10.1/src/read_data_falcON_hdf5_utils.cc:321:7: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
data.read(Buffer.data(),H5::PredType::NATIVE_DOUBLE,
data/splash-2.10.1/src/read_data_falcON_hdf5_utils.cc:332:8: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if(read) {
data/splash-2.10.1/src/read_data_falcON_hdf5_utils.cc:411:10: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
attr.read(H5::PredType::NATIVE_UINT32,&NumSnap);
data/splash-2.10.1/src/read_data_falcON_hdf5_utils.cc:478:10: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
attr.read(H5::PredType::NATIVE_DOUBLE,time);
data/splash-2.10.1/src/read_data_falcON_hdf5_utils.cc:480:10: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
attr.read(VectorType,hper);
data/splash-2.10.1/src/read_data_falcON_hdf5_utils.cc:489:7: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
attr.read(H5::PredType::NATIVE_UINT32,&number);
data/splash-2.10.1/src/read_data_snsph_utils.c:30:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(fname, filename, *len);
data/splash-2.10.1/src/read_data_snsph_utils.c:102:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(fname, filename, *len);
ANALYSIS SUMMARY:
Hits = 53
Lines analyzed = 3856 in approximately 0.16 seconds (24666 lines/second)
Physical Source Lines of Code (SLOC) = 2809
Hits@level = [0] 168 [1] 11 [2] 36 [3] 0 [4] 6 [5] 0
Hits@level+ = [0+] 221 [1+] 53 [2+] 42 [3+] 6 [4+] 6 [5+] 0
Hits/KSLOC@level+ = [0+] 78.6757 [1+] 18.8679 [2+] 14.9519 [3+] 2.13599 [4+] 2.13599 [5+] 0
Dot directories skipped = 2 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.