Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/ataqv-1.2.1+ds/src/cpp/Exceptions.hpp
Examining data/ataqv-1.2.1+ds/src/cpp/Features.cpp
Examining data/ataqv-1.2.1+ds/src/cpp/Features.hpp
Examining data/ataqv-1.2.1+ds/src/cpp/HTS.cpp
Examining data/ataqv-1.2.1+ds/src/cpp/HTS.hpp
Examining data/ataqv-1.2.1+ds/src/cpp/IO.cpp
Examining data/ataqv-1.2.1+ds/src/cpp/IO.hpp
Examining data/ataqv-1.2.1+ds/src/cpp/Metrics.cpp
Examining data/ataqv-1.2.1+ds/src/cpp/Metrics.hpp
Examining data/ataqv-1.2.1+ds/src/cpp/Peaks.cpp
Examining data/ataqv-1.2.1+ds/src/cpp/Peaks.hpp
Examining data/ataqv-1.2.1+ds/src/cpp/Utils.cpp
Examining data/ataqv-1.2.1+ds/src/cpp/Utils.hpp
Examining data/ataqv-1.2.1+ds/src/cpp/Version.hpp
Examining data/ataqv-1.2.1+ds/src/cpp/ataqv.cpp
Examining data/ataqv-1.2.1+ds/src/cpp/json.hpp
Examining data/ataqv-1.2.1+ds/src/cpp/run_ataqv_tests.cpp
Examining data/ataqv-1.2.1+ds/src/cpp/test_features.cpp
Examining data/ataqv-1.2.1+ds/src/cpp/test_hts.cpp
Examining data/ataqv-1.2.1+ds/src/cpp/test_io.cpp
Examining data/ataqv-1.2.1+ds/src/cpp/test_metrics.cpp
Examining data/ataqv-1.2.1+ds/src/cpp/test_peaks.cpp
Examining data/ataqv-1.2.1+ds/src/cpp/test_utils.cpp
Examining data/ataqv-1.2.1+ds/src/cpp/catch.hpp

FINAL RESULTS:

data/ataqv-1.2.1+ds/src/cpp/ataqv.cpp:263:17:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
    while ((c = getopt_long(argc, argv, "", long_options, &option_index)) != -1) {
data/ataqv-1.2.1+ds/src/cpp/catch.hpp:7875:18:  [3] (random) srand:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
            std::srand( config.rngSeed() );
data/ataqv-1.2.1+ds/src/cpp/IO.cpp:11:15:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    FILE* f = fopen(filename.c_str(), "rb");
data/ataqv-1.2.1+ds/src/cpp/Utils.cpp:157:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char timestamp[22];
data/ataqv-1.2.1+ds/src/cpp/catch.hpp:1609:23:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    struct TrueType { char sizer[1]; };
data/ataqv-1.2.1+ds/src/cpp/catch.hpp:1610:24:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    struct FalseType { char sizer[2]; };
data/ataqv-1.2.1+ds/src/cpp/catch.hpp:2785:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char storage[sizeof(T)];
data/ataqv-1.2.1+ds/src/cpp/catch.hpp:5651:14:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
        void open() {
data/ataqv-1.2.1+ds/src/cpp/catch.hpp:5731:26:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
                section->open();
data/ataqv-1.2.1+ds/src/cpp/catch.hpp:5767:26:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
                tracker->open();
data/ataqv-1.2.1+ds/src/cpp/catch.hpp:6850:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        char data[bufferSize];
data/ataqv-1.2.1+ds/src/cpp/catch.hpp:6887:15:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
        m_ofs.open( filename.c_str() );
data/ataqv-1.2.1+ds/src/cpp/catch.hpp:8043:21:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
                    char asChar[sizeof (int)];
data/ataqv-1.2.1+ds/src/cpp/catch.hpp:8807:16:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
        static char line[CATCH_CONFIG_CONSOLE_WIDTH] = {0};
data/ataqv-1.2.1+ds/src/cpp/json.hpp:8221:38:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
                        static const char hexify[16] =
data/ataqv-1.2.1+ds/src/cpp/IO.cpp:16:13:  [1] (buffer) fgetc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
        if (fgetc(f) == 0x1f && fgetc(f) == 0x8b) {
data/ataqv-1.2.1+ds/src/cpp/IO.cpp:16:33:  [1] (buffer) fgetc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
        if (fgetc(f) == 0x1f && fgetc(f) == 0x8b) {
data/ataqv-1.2.1+ds/src/cpp/json.hpp:11359:89:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
              m_lexer(reinterpret_cast<const typename lexer::lexer_char_t*>(buff), std::strlen(buff))

ANALYSIS SUMMARY:

Hits = 18
Lines analyzed = 28002 in approximately 0.63 seconds (44452 lines/second)
Physical Source Lines of Code (SLOC) = 18680
Hits@level = [0]   1 [1]   3 [2]  13 [3]   2 [4]   0 [5]   0
Hits@level+ = [0+]  19 [1+]  18 [2+]  15 [3+]   2 [4+]   0 [5+]   0
Hits/KSLOC@level+ = [0+] 1.01713 [1+] 0.963597 [2+] 0.802998 [3+] 0.107066 [4+]   0 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.