Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/kraken2-2.1.1/src/aa_translate.cc
Examining data/kraken2-2.1.1/src/aa_translate.h
Examining data/kraken2-2.1.1/src/build_db.cc
Examining data/kraken2-2.1.1/src/classify.cc
Examining data/kraken2-2.1.1/src/compact_hash.cc
Examining data/kraken2-2.1.1/src/compact_hash.h
Examining data/kraken2-2.1.1/src/dump_table.cc
Examining data/kraken2-2.1.1/src/estimate_capacity.cc
Examining data/kraken2-2.1.1/src/hyperloglogplus-bias.h
Examining data/kraken2-2.1.1/src/hyperloglogplus.cc
Examining data/kraken2-2.1.1/src/hyperloglogplus.h
Examining data/kraken2-2.1.1/src/kraken2_data.h
Examining data/kraken2-2.1.1/src/kraken2_headers.h
Examining data/kraken2-2.1.1/src/kv_store.h
Examining data/kraken2-2.1.1/src/lookup_accession_numbers.cc
Examining data/kraken2-2.1.1/src/mmap_file.cc
Examining data/kraken2-2.1.1/src/mmap_file.h
Examining data/kraken2-2.1.1/src/mmscanner.cc
Examining data/kraken2-2.1.1/src/mmscanner.h
Examining data/kraken2-2.1.1/src/mmtest.cc
Examining data/kraken2-2.1.1/src/omp_hack.cc
Examining data/kraken2-2.1.1/src/omp_hack.h
Examining data/kraken2-2.1.1/src/readcounts.h
Examining data/kraken2-2.1.1/src/reports.cc
Examining data/kraken2-2.1.1/src/reports.h
Examining data/kraken2-2.1.1/src/seqreader.cc
Examining data/kraken2-2.1.1/src/seqreader.h
Examining data/kraken2-2.1.1/src/taxonomy.cc
Examining data/kraken2-2.1.1/src/taxonomy.h
Examining data/kraken2-2.1.1/src/utilities.cc
Examining data/kraken2-2.1.1/src/utilities.h
FINAL RESULTS:
data/kraken2-2.1.1/src/build_db.cc:454:17: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while ((opt = getopt(argc, argv, "?hB:b:c:FH:m:n:o:t:k:l:M:p:r:s:S:T:X")) != -1) {
data/kraken2-2.1.1/src/classify.cc:741:17: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while ((opt = getopt(argc, argv, "h?H:t:o:T:p:R:C:U:O:Q:g:nmzqPSMK")) != -1) {
data/kraken2-2.1.1/src/dump_table.cc:98:17: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while ((opt = getopt(argc, argv, "?hH:t:o:O:p:zms")) != -1) {
data/kraken2-2.1.1/src/estimate_capacity.cc:92:17: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while ((opt = getopt(argc, argv, "?hk:l:n:S:T:B:p:X")) != -1) {
data/kraken2-2.1.1/src/classify.cc:326:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[1024] = "";
data/kraken2-2.1.1/src/classify.cc:327:11: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(buffer, " kraken:taxid|%llu",
data/kraken2-2.1.1/src/classify.cc:765:28: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
opts.num_threads = atoi(optarg);
data/kraken2-2.1.1/src/classify.cc:770:35: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
opts.minimum_hit_groups = atoi(optarg);
data/kraken2-2.1.1/src/classify.cc:804:38: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
opts.minimum_quality_score = atoi(optarg);
data/kraken2-2.1.1/src/compact_hash.cc:61:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((char *) &capacity_, ptr, sizeof(capacity_));
data/kraken2-2.1.1/src/compact_hash.cc:63:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((char *) &size_, ptr, sizeof(size_));
data/kraken2-2.1.1/src/compact_hash.cc:65:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((char *) &key_bits_, ptr, sizeof(key_bits_));
data/kraken2-2.1.1/src/compact_hash.cc:67:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((char *) &value_bits_, ptr, sizeof(value_bits_));
data/kraken2-2.1.1/src/dump_table.cc:125:28: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
opts.num_threads = atoi(optarg);
data/kraken2-2.1.1/src/mmap_file.cc:39:9: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fd_ = open(filename, mode, 0666);
data/kraken2-2.1.1/src/mmap_file.cc:78:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[thread_ct][page_size];
data/kraken2-2.1.1/src/mmap_file.cc:91:7: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf[thread], fptr_ + pos, this_page_size);
data/kraken2-2.1.1/src/reports.cc:123:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char pct_buffer[10] = "";
data/kraken2-2.1.1/src/reports.cc:124:3: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(pct_buffer, "%6.2f", 100.0 * clade_counter.readCount() / total_seqs);
data/kraken2-2.1.1/src/taxonomy.cc:177:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(taxo.rank_data_, rank_data.data(), rank_data.size());
data/kraken2-2.1.1/src/taxonomy.cc:181:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(taxo.name_data_, name_data.data(), name_data.size());
data/kraken2-2.1.1/src/taxonomy.cc:205:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((char *) &node_count_, ptr, sizeof(node_count_));
data/kraken2-2.1.1/src/taxonomy.cc:207:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((char *) &name_data_len_, ptr, sizeof(name_data_len_));
data/kraken2-2.1.1/src/taxonomy.cc:209:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((char *) &rank_data_len_, ptr, sizeof(rank_data_len_));
data/kraken2-2.1.1/src/taxonomy.cc:220:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char magic[strlen(FILE_MAGIC) + 1];
data/kraken2-2.1.1/src/classify.cc:135:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
idx_opt_fs.read((char *) &idx_opts, opts_filesize);
data/kraken2-2.1.1/src/compact_hash.cc:79:9: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ifs.read((char *) &capacity_, sizeof(capacity_));
data/kraken2-2.1.1/src/compact_hash.cc:80:9: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ifs.read((char *) &size_, sizeof(size_));
data/kraken2-2.1.1/src/compact_hash.cc:81:9: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ifs.read((char *) &key_bits_, sizeof(key_bits_));
data/kraken2-2.1.1/src/compact_hash.cc:82:9: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ifs.read((char *) &value_bits_, sizeof(value_bits_));
data/kraken2-2.1.1/src/compact_hash.cc:92:9: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ifs.read((char *) table_, capacity_ * sizeof(*table_));
data/kraken2-2.1.1/src/dump_table.cc:57:14: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
idx_opt_fs.read((char *) &idx_opts, sizeof(idx_opts));
data/kraken2-2.1.1/src/seqreader.cc:56:7: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ifs.read(block_buffer_, block_size);
data/kraken2-2.1.1/src/taxonomy.cc:200:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (strncmp(FILE_MAGIC, ptr, strlen(FILE_MAGIC)) != 0) {
data/kraken2-2.1.1/src/taxonomy.cc:204:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ptr += strlen(FILE_MAGIC);
data/kraken2-2.1.1/src/taxonomy.cc:220:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
char magic[strlen(FILE_MAGIC) + 1];
data/kraken2-2.1.1/src/taxonomy.cc:221:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
memset(magic, 0, strlen(FILE_MAGIC) + 1);
data/kraken2-2.1.1/src/taxonomy.cc:222:9: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ifs.read(magic, strlen(FILE_MAGIC));
data/kraken2-2.1.1/src/taxonomy.cc:222:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
ifs.read(magic, strlen(FILE_MAGIC));
data/kraken2-2.1.1/src/taxonomy.cc:225:9: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ifs.read((char *) &node_count_, sizeof(node_count_));
data/kraken2-2.1.1/src/taxonomy.cc:226:9: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ifs.read((char *) &name_data_len_, sizeof(name_data_len_));
data/kraken2-2.1.1/src/taxonomy.cc:227:9: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ifs.read((char *) &rank_data_len_, sizeof(rank_data_len_));
data/kraken2-2.1.1/src/taxonomy.cc:229:9: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ifs.read((char *) nodes_, sizeof(*nodes_) * node_count_);
data/kraken2-2.1.1/src/taxonomy.cc:231:9: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ifs.read((char *) name_data_, name_data_len_);
data/kraken2-2.1.1/src/taxonomy.cc:233:9: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
ifs.read((char *) rank_data_, rank_data_len_);
data/kraken2-2.1.1/src/taxonomy.cc:276:31: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
taxo_file.write(FILE_MAGIC, strlen(FILE_MAGIC));
ANALYSIS SUMMARY:
Hits = 46
Lines analyzed = 5186 in approximately 1.15 seconds (4498 lines/second)
Physical Source Lines of Code (SLOC) = 3995
Hits@level = [0] 4 [1] 21 [2] 21 [3] 4 [4] 0 [5] 0
Hits@level+ = [0+] 50 [1+] 46 [2+] 25 [3+] 4 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 12.5156 [1+] 11.5144 [2+] 6.25782 [3+] 1.00125 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.