Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/ivar-1.2.3+dfsg/src/alignment.cpp
Examining data/ivar-1.2.3+dfsg/src/alignment.h
Examining data/ivar-1.2.3+dfsg/src/allele_functions.cpp
Examining data/ivar-1.2.3+dfsg/src/allele_functions.h
Examining data/ivar-1.2.3+dfsg/src/bam_to_bed.cpp
Examining data/ivar-1.2.3+dfsg/src/call_consensus.cpp
Examining data/ivar-1.2.3+dfsg/src/call_consensus_pileup.cpp
Examining data/ivar-1.2.3+dfsg/src/call_consensus_pileup.h
Examining data/ivar-1.2.3+dfsg/src/call_variants.cpp
Examining data/ivar-1.2.3+dfsg/src/call_variants.h
Examining data/ivar-1.2.3+dfsg/src/get_common_variants.cpp
Examining data/ivar-1.2.3+dfsg/src/get_common_variants.h
Examining data/ivar-1.2.3+dfsg/src/get_masked_amplicons.cpp
Examining data/ivar-1.2.3+dfsg/src/get_masked_amplicons.h
Examining data/ivar-1.2.3+dfsg/src/ivar.cpp
Examining data/ivar-1.2.3+dfsg/src/parse_gff.cpp
Examining data/ivar-1.2.3+dfsg/src/parse_gff.h
Examining data/ivar-1.2.3+dfsg/src/primer_bed.cpp
Examining data/ivar-1.2.3+dfsg/src/primer_bed.h
Examining data/ivar-1.2.3+dfsg/src/ref_seq.cpp
Examining data/ivar-1.2.3+dfsg/src/ref_seq.h
Examining data/ivar-1.2.3+dfsg/src/remove_reads_from_amplicon.cpp
Examining data/ivar-1.2.3+dfsg/src/remove_reads_from_amplicon.h
Examining data/ivar-1.2.3+dfsg/src/suffix_tree.cpp
Examining data/ivar-1.2.3+dfsg/src/suffix_tree.h
Examining data/ivar-1.2.3+dfsg/src/trim_primer_quality.cpp
Examining data/ivar-1.2.3+dfsg/src/trim_primer_quality.h
Examining data/ivar-1.2.3+dfsg/src/vcf_writer.cpp
Examining data/ivar-1.2.3+dfsg/src/vcf_writer.h
Examining data/ivar-1.2.3+dfsg/tests/check_quality_trim.cpp
Examining data/ivar-1.2.3+dfsg/tests/test_allele_depth.cpp
Examining data/ivar-1.2.3+dfsg/tests/test_call_consensus_from_plup.cpp
Examining data/ivar-1.2.3+dfsg/tests/test_common_variants.cpp
Examining data/ivar-1.2.3+dfsg/tests/test_consensus_min_depth.cpp
Examining data/ivar-1.2.3+dfsg/tests/test_consensus_seq_id.cpp
Examining data/ivar-1.2.3+dfsg/tests/test_consensus_threshold.cpp
Examining data/ivar-1.2.3+dfsg/tests/test_getmasked.cpp
Examining data/ivar-1.2.3+dfsg/tests/test_primer_bed.cpp
Examining data/ivar-1.2.3+dfsg/tests/test_primer_trim.cpp
Examining data/ivar-1.2.3+dfsg/tests/test_primer_trim_edge_cases.cpp
Examining data/ivar-1.2.3+dfsg/tests/test_ref_seq.cpp
Examining data/ivar-1.2.3+dfsg/tests/test_removereads.cpp
Examining data/ivar-1.2.3+dfsg/tests/test_trim.cpp
Examining data/ivar-1.2.3+dfsg/tests/test_unpaired_trim.cpp
Examining data/ivar-1.2.3+dfsg/tests/test_variants.cpp

FINAL RESULTS:

data/ivar-1.2.3+dfsg/src/call_consensus_pileup.cpp:138:3:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
  strcpy(o, out_file.c_str());
data/ivar-1.2.3+dfsg/src/trim_primer_quality.cpp:316:3:  [4] (buffer) strcat:
  Does not check for buffer overflows when concatenating to destination
  [MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
  snprintf (warning: strncat is easily misused).
  strcat(new_text, cmd);
data/ivar-1.2.3+dfsg/tests/test_consensus_seq_id.cpp:17:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(o, prefix.c_str());
data/ivar-1.2.3+dfsg/src/ivar.cpp:219:11:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
    opt = getopt( argc, argv, trim_opt_str);
data/ivar-1.2.3+dfsg/src/ivar.cpp:252:13:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
      opt = getopt( argc, argv, trim_opt_str);
data/ivar-1.2.3+dfsg/src/ivar.cpp:266:11:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
    opt = getopt( argc, argv, variants_opt_str);
data/ivar-1.2.3+dfsg/src/ivar.cpp:293:13:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
      opt = getopt( argc, argv, variants_opt_str);
data/ivar-1.2.3+dfsg/src/ivar.cpp:317:11:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
    opt = getopt( argc, argv, consensus_opt_str);
data/ivar-1.2.3+dfsg/src/ivar.cpp:354:13:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
      opt = getopt( argc, argv, consensus_opt_str);
data/ivar-1.2.3+dfsg/src/ivar.cpp:377:11:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
    opt = getopt( argc, argv, removereads_opt_str);
data/ivar-1.2.3+dfsg/src/ivar.cpp:398:13:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
      opt = getopt( argc, argv, removereads_opt_str);
data/ivar-1.2.3+dfsg/src/ivar.cpp:414:11:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
    opt = getopt( argc, argv, filtervariants_opt_str);
data/ivar-1.2.3+dfsg/src/ivar.cpp:433:13:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
      opt = getopt( argc, argv, filtervariants_opt_str);
data/ivar-1.2.3+dfsg/src/ivar.cpp:474:11:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
    opt = getopt( argc, argv, getmasked_opt_str);
data/ivar-1.2.3+dfsg/src/ivar.cpp:495:13:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
      opt = getopt( argc, argv, getmasked_opt_str);
data/ivar-1.2.3+dfsg/src/ivar.cpp:504:11:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
    opt = getopt( argc, argv, trimadapter_opt_str);
data/ivar-1.2.3+dfsg/src/ivar.cpp:525:13:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
      opt = getopt( argc, argv, trimadapter_opt_str);
data/ivar-1.2.3+dfsg/src/alignment.cpp:106:22:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
void print_alignment(char a[2][max_read_size], int n){
data/ivar-1.2.3+dfsg/src/alignment.cpp:158:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char _align[2][max_read_size];
data/ivar-1.2.3+dfsg/src/alignment.h:41:22:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
void print_alignment(char a[2][max_read_size], int n);
data/ivar-1.2.3+dfsg/src/allele_functions.cpp:218:16:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  static const char iupac[14][14] = {
data/ivar-1.2.3+dfsg/src/allele_functions.cpp:273:16:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  static const char iupac_aa[4][4][4] = {
data/ivar-1.2.3+dfsg/src/call_consensus.cpp:34:16:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  static const char iupac[4][4] = { {'A','M','R','W'},{'M','C','S','Y'},{'R','S','G','K'},{'W','Y','K','T'} };
data/ivar-1.2.3+dfsg/src/get_common_variants.cpp:98:9:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    fin.open(files[i]);
data/ivar-1.2.3+dfsg/src/parse_gff.cpp:20:21:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
      this->start = atoi(cell.c_str());
data/ivar-1.2.3+dfsg/src/parse_gff.cpp:23:19:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
      this->end = atoi(cell.c_str());
data/ivar-1.2.3+dfsg/src/parse_gff.cpp:32:21:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
      this->phase = atoi(cell.c_str());
data/ivar-1.2.3+dfsg/src/suffix_tree.cpp:278:9:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    ff2.open(f2.c_str());
data/ivar-1.2.3+dfsg/src/trim_primer_quality.cpp:253:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(b->data + b->core.l_qname, cigar, n * 4);
data/ivar-1.2.3+dfsg/src/trim_primer_quality.cpp:256:10:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  } else memcpy(b->data + b->core.l_qname, cigar, n * 4);
data/ivar-1.2.3+dfsg/src/trim_primer_quality.cpp:314:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(new_text, (*hdr)->text, strlen((*hdr)->text));
data/ivar-1.2.3+dfsg/tests/test_common_variants.cpp:15:9:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    fin.open(files[i]);
data/ivar-1.2.3+dfsg/src/alignment.cpp:63:72:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
void print_matrix(int h[][max_adapter_size], int r, int c, std::string read, std::string adap){
data/ivar-1.2.3+dfsg/src/alignment.cpp:72:17:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	if(i -1 < (int)read.length())
data/ivar-1.2.3+dfsg/src/alignment.cpp:73:17:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	  std::cout << read[i-1] << " ";
data/ivar-1.2.3+dfsg/src/alignment.cpp:84:75:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
int*  get_score_cell(int h[][max_adapter_size], int i, int j, std::string read, std::string adap){
data/ivar-1.2.3+dfsg/src/alignment.cpp:89:38:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  s[0] = h[i-1][j-1] + get_sub_score(read[i-1], adap[j-1]);
data/ivar-1.2.3+dfsg/src/alignment.cpp:91:41:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  s[2] = h[i][j-1] - get_gap_penalty(1, read[i-1]);
data/ivar-1.2.3+dfsg/src/alignment.cpp:120:29:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
int* align_seqs(std::string read, std::string adap){
data/ivar-1.2.3+dfsg/src/alignment.cpp:123:9:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
    m = read.length() + 1,
data/ivar-1.2.3+dfsg/src/alignment.cpp:132:11:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  rt[1] = read.length();
data/ivar-1.2.3+dfsg/src/alignment.cpp:140:37:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
      tmp = get_score_cell(h, i, j, read, adap);
data/ivar-1.2.3+dfsg/src/alignment.cpp:169:29:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
      _align[0][_align_n] = read[max_i];
data/ivar-1.2.3+dfsg/src/alignment.cpp:183:29:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
      _align[0][_align_n] = read[max_i];
data/ivar-1.2.3+dfsg/src/alignment.h:39:72:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
void print_matrix(int h[][max_adapter_size], int r, int c, std::string read, std::string adap);
data/ivar-1.2.3+dfsg/src/alignment.h:40:75:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
int*  get_score_cell(int h[][max_adapter_size], int i, int j, std::string read, std::string adap);
data/ivar-1.2.3+dfsg/src/alignment.h:42:29:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
int* align_seqs(std::string read, std::string adap);
data/ivar-1.2.3+dfsg/src/call_consensus.cpp:54:8:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if(strlen(allele[m.ind[k]]) > max_len)
data/ivar-1.2.3+dfsg/src/call_consensus.cpp:55:17:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      max_len = strlen(allele[m.ind[k]]);
data/ivar-1.2.3+dfsg/src/call_consensus.cpp:61:14:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      if(j < strlen(allele[m.ind[k]])){
data/ivar-1.2.3+dfsg/src/call_consensus.cpp:143:12:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	      s = strlen(v->d.allele[0]) - strlen(nuc); //  > 0 Deletion. < 0 INSERTION
data/ivar-1.2.3+dfsg/src/call_consensus.cpp:143:37:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	      s = strlen(v->d.allele[0]) - strlen(nuc); //  > 0 Deletion. < 0 INSERTION
data/ivar-1.2.3+dfsg/src/call_consensus.cpp:144:22:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	      d = (s > 0) ? strlen(v->d.allele[0]) : strlen(nuc);
data/ivar-1.2.3+dfsg/src/call_consensus.cpp:144:47:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	      d = (s > 0) ? strlen(v->d.allele[0]) : strlen(nuc);
data/ivar-1.2.3+dfsg/src/call_consensus.cpp:148:81:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		std::cout << "Number: " << m.n << " Maj Allele: " << v->d.allele[m.ind[0]] << strlen(nuc) << " - Nuc Length" << nuc << " " << s << " " << d << std::endl;
data/ivar-1.2.3+dfsg/src/trim_primer_quality.cpp:312:16:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  size_t len = strlen((*hdr)->text) + strlen(cmd)+1;
data/ivar-1.2.3+dfsg/src/trim_primer_quality.cpp:312:39:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  size_t len = strlen((*hdr)->text) + strlen(cmd)+1;
data/ivar-1.2.3+dfsg/src/trim_primer_quality.cpp:314:34:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  memcpy(new_text, (*hdr)->text, strlen((*hdr)->text));
data/ivar-1.2.3+dfsg/src/trim_primer_quality.cpp:315:12:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  new_text[strlen((*hdr)->text)] = '\0';

ANALYSIS SUMMARY:

Hits = 59
Lines analyzed = 5075 in approximately 0.33 seconds (15586 lines/second)
Physical Source Lines of Code (SLOC) = 4556
Hits@level = [0]   0 [1]  27 [2]  15 [3]  14 [4]   3 [5]   0
Hits@level+ = [0+]  59 [1+]  59 [2+]  32 [3+]  17 [4+]   3 [5+]   0
Hits/KSLOC@level+ = [0+] 12.95 [1+] 12.95 [2+] 7.02371 [3+] 3.73134 [4+] 0.658472 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.