Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/fastqtl-2.184+dfsg/src/analysisPermutationSequence.cpp
Examining data/fastqtl-2.184+dfsg/src/df.cpp
Examining data/fastqtl-2.184+dfsg/src/analysisPermutationInteraction.cpp
Examining data/fastqtl-2.184+dfsg/src/utils/utils.cpp
Examining data/fastqtl-2.184+dfsg/src/utils/ranker.h
Examining data/fastqtl-2.184+dfsg/src/utils/utils.h
Examining data/fastqtl-2.184+dfsg/src/utils/tabix.cpp
Examining data/fastqtl-2.184+dfsg/src/utils/tabix.hpp
Examining data/fastqtl-2.184+dfsg/src/residualizer.cpp
Examining data/fastqtl-2.184+dfsg/src/analysisPermutationPerGroup.cpp
Examining data/fastqtl-2.184+dfsg/src/management.cpp
Examining data/fastqtl-2.184+dfsg/src/analysisNominal.cpp
Examining data/fastqtl-2.184+dfsg/src/commands.cpp
Examining data/fastqtl-2.184+dfsg/src/analysisMapping.cpp
Examining data/fastqtl-2.184+dfsg/src/readPhenotypes.cpp
Examining data/fastqtl-2.184+dfsg/src/mle.cpp
Examining data/fastqtl-2.184+dfsg/src/analysisPermutation.cpp
Examining data/fastqtl-2.184+dfsg/src/data.h
Examining data/fastqtl-2.184+dfsg/src/fastQTL.cpp
Examining data/fastqtl-2.184+dfsg/src/region.h
Examining data/fastqtl-2.184+dfsg/src/readGroups.cpp
Examining data/fastqtl-2.184+dfsg/src/readThresholds.cpp
Examining data/fastqtl-2.184+dfsg/src/readInteractions.cpp
Examining data/fastqtl-2.184+dfsg/src/readGenotypes.cpp
Examining data/fastqtl-2.184+dfsg/src/readInclusionsExclusions.cpp
Examining data/fastqtl-2.184+dfsg/src/readCovariates.cpp
Examining data/fastqtl-2.184+dfsg/src/residualizer.h
FINAL RESULTS:
data/fastqtl-2.184+dfsg/src/utils/tabix.cpp:16:12: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcat(strcpy(fnidx, cfilename), ".tbi");
data/fastqtl-2.184+dfsg/src/fastQTL.cpp:197:7: [3] (random) srand:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
else srand(options["seed"].as < int > ());
data/fastqtl-2.184+dfsg/src/analysisPermutationSequence.cpp:30:65: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
for (int t = 0 ; t < tokens.size() ; t++ ) P.back().push_back(atoi(tokens[t].c_str()) - 1);
data/fastqtl-2.184+dfsg/src/fastQTL.cpp:109:12: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (!LOG.open(options["log"].as < string > ())) {
data/fastqtl-2.184+dfsg/src/fastQTL.cpp:232:17: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
int nChunks = atoi(options["commands"].as < vector < string > > ()[0].c_str());
data/fastqtl-2.184+dfsg/src/readGenotypes.cpp:74:28: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
genotype_pos.push_back(atoi(str[1].c_str()));
data/fastqtl-2.184+dfsg/src/readGenotypes.cpp:91:18: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
int a0 = atoi(field[idx_field].substr(0, 1).c_str());
data/fastqtl-2.184+dfsg/src/readGenotypes.cpp:92:18: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
int a1 = atoi(field[idx_field].substr(2, 1).c_str());
data/fastqtl-2.184+dfsg/src/readPhenotypes.cpp:62:30: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
phenotype_start.push_back(atoi(str[1].c_str()) + 1); //convert to 1-based, tabix works on 1-based coordinates and all other files are 1-based
data/fastqtl-2.184+dfsg/src/readPhenotypes.cpp:63:28: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
phenotype_end.push_back(atoi(str[2].c_str()));
data/fastqtl-2.184+dfsg/src/readPhenotypes.cpp:108:30: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
phenotype_start.push_back(atoi(str[1].c_str()) + 1); //convert to 1-based, tabix works on 1-based coordinates and all other files are 1-based
data/fastqtl-2.184+dfsg/src/readPhenotypes.cpp:109:28: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
phenotype_end.push_back(atoi(str[2].c_str()));
data/fastqtl-2.184+dfsg/src/region.h:53:13: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
start = atoi(pos_split[0].c_str());
data/fastqtl-2.184+dfsg/src/region.h:54:11: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
end = atoi(pos_split[1].c_str());
data/fastqtl-2.184+dfsg/src/utils/tabix.cpp:16:5: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant string.
strcat(strcpy(fnidx, cfilename), ".tbi");
data/fastqtl-2.184+dfsg/src/utils/utils.cpp:449:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[128];
data/fastqtl-2.184+dfsg/src/utils/utils.cpp:469:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
inp.open(f.c_str(), ifstream::in);
data/fastqtl-2.184+dfsg/src/utils/utils.cpp:482:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
out.open(f.c_str());
data/fastqtl-2.184+dfsg/src/utils/utils.cpp:552:2: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
open(filename, binary);
data/fastqtl-2.184+dfsg/src/utils/utils.cpp:563:13: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
bool ifile::open(string filename, bool binary) {
data/fastqtl-2.184+dfsg/src/utils/utils.cpp:567:6: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd.open(file.c_str(), ios::in | ios::binary);
data/fastqtl-2.184+dfsg/src/utils/utils.cpp:570:6: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd.open(file.c_str(), ios::in | ios::binary);
data/fastqtl-2.184+dfsg/src/utils/utils.cpp:573:6: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd.open(file.c_str(), ios::in | ios::binary);
data/fastqtl-2.184+dfsg/src/utils/utils.cpp:575:6: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd.open(file.c_str());
data/fastqtl-2.184+dfsg/src/utils/utils.cpp:605:2: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
open(filename, binary);
data/fastqtl-2.184+dfsg/src/utils/utils.cpp:616:13: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
bool ofile::open(string filename, bool binary) {
data/fastqtl-2.184+dfsg/src/utils/utils.cpp:620:6: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd.open(file.c_str(), ios::out | ios::binary);
data/fastqtl-2.184+dfsg/src/utils/utils.cpp:623:6: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd.open(file.c_str(), ios::out | ios::binary);
data/fastqtl-2.184+dfsg/src/utils/utils.cpp:626:6: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd.open(file.c_str(), ios::out | ios::binary);
data/fastqtl-2.184+dfsg/src/utils/utils.cpp:628:6: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd.open(file.c_str());
data/fastqtl-2.184+dfsg/src/utils/utils.cpp:662:13: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
bool lfile::open(string filename) {
data/fastqtl-2.184+dfsg/src/utils/utils.cpp:665:5: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd.open(file.c_str());
data/fastqtl-2.184+dfsg/src/utils/utils.h:249:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
bool open(string filename, bool binary = false);
data/fastqtl-2.184+dfsg/src/utils/utils.h:267:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
bool open(string filename, bool binary = false);
data/fastqtl-2.184+dfsg/src/utils/utils.h:286:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
bool open(string filename = "file.log");
data/fastqtl-2.184+dfsg/src/utils/tabix.cpp:15:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
char *fnidx = (char*) calloc(strlen(cfilename) + 5, 1);
data/fastqtl-2.184+dfsg/src/utils/utils.cpp:524:6: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
fd.read((char*)&nb, sizeof(int));
data/fastqtl-2.184+dfsg/src/utils/utils.cpp:532:7: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
fd.read(&byte_char, 1);
data/fastqtl-2.184+dfsg/src/utils/utils.cpp:584:7: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!read((char*)&s, sizeof(int))) return false;
data/fastqtl-2.184+dfsg/src/utils/utils.cpp:586:7: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (!read(buffer, s)) return false;
ANALYSIS SUMMARY:
Hits = 40
Lines analyzed = 4026 in approximately 0.19 seconds (20659 lines/second)
Physical Source Lines of Code (SLOC) = 2918
Hits@level = [0] 0 [1] 5 [2] 33 [3] 1 [4] 1 [5] 0
Hits@level+ = [0+] 40 [1+] 40 [2+] 35 [3+] 2 [4+] 1 [5+] 0
Hits/KSLOC@level+ = [0+] 13.708 [1+] 13.708 [2+] 11.9945 [3+] 0.685401 [4+] 0.3427 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.