Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/liblinear-2.3.0+dfsg/linear.cpp
Examining data/liblinear-2.3.0+dfsg/linear.h
Examining data/liblinear-2.3.0+dfsg/matlab/linear_model_matlab.c
Examining data/liblinear-2.3.0+dfsg/matlab/linear_model_matlab.h
Examining data/liblinear-2.3.0+dfsg/matlab/libsvmwrite.c
Examining data/liblinear-2.3.0+dfsg/matlab/predict.c
Examining data/liblinear-2.3.0+dfsg/matlab/train.c
Examining data/liblinear-2.3.0+dfsg/matlab/libsvmread.c
Examining data/liblinear-2.3.0+dfsg/tron.h
Examining data/liblinear-2.3.0+dfsg/svm-scale.c
Examining data/liblinear-2.3.0+dfsg/tron.cpp
Examining data/liblinear-2.3.0+dfsg/predict.c
Examining data/liblinear-2.3.0+dfsg/train.c

FINAL RESULTS:

data/liblinear-2.3.0+dfsg/linear.cpp:41:2:  [4] (format) vsprintf:
  Potential format string problem (CWE-134). Make format string constant.
	vsprintf(buf,fmt,ap);
data/liblinear-2.3.0+dfsg/linear.cpp:2934:6:  [4] (buffer) fscanf:
  The scanf() family's %s operation, without a limit specification, permits
  buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
  different input function. If the scanf format is influenceable by an
  attacker, it's exploitable.
	if (fscanf(_stream, _format, _var) != 1)\
data/liblinear-2.3.0+dfsg/predict.c:11:44:  [4] (format) printf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
static int (*info)(const char *fmt,...) = &printf;
data/liblinear-2.3.0+dfsg/train.c:329:2:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
	strcpy(input_file_name, argv[i]);
data/liblinear-2.3.0+dfsg/train.c:332:3:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
		strcpy(model_file_name,argv[i+1]);
data/liblinear-2.3.0+dfsg/train.c:340:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
		sprintf(model_file_name,"%s.model",p);
data/liblinear-2.3.0+dfsg/tron.cpp:52:2:  [4] (format) vsprintf:
  Potential format string problem (CWE-134). Make format string constant.
	vsprintf(buf,fmt,ap);
data/liblinear-2.3.0+dfsg/matlab/train.c:401:2:  [3] (random) srand:
  This function is not sufficiently random for security-related functions
  such as key and nonce creation (CWE-327). Use a more secure technique for
  acquiring random values.
	srand(1);
data/liblinear-2.3.0+dfsg/predict.c:193:16:  [3] (buffer) getopt:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
	while ((opt = getopt(argc, argv, "b:q")) != -1) {
data/liblinear-2.3.0+dfsg/linear.cpp:21:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy((void *)dst,(void *)src,sizeof(T)*n);
data/liblinear-2.3.0+dfsg/linear.cpp:38:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char buf[BUFSIZ];
data/liblinear-2.3.0+dfsg/linear.cpp:2878:13:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	FILE *fp = fopen(model_file_name,"w");
data/liblinear-2.3.0+dfsg/linear.cpp:2951:13:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	FILE *fp = fopen(model_file_name,"r");
data/liblinear-2.3.0+dfsg/linear.cpp:2976:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char cmd[81];
data/liblinear-2.3.0+dfsg/matlab/libsvmread.c:61:13:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	FILE *fp = fopen(filename,"r");
data/liblinear-2.3.0+dfsg/matlab/libsvmread.c:191:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char filename[256];
data/liblinear-2.3.0+dfsg/matlab/libsvmwrite.c:28:13:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	FILE *fp = fopen(filename,"w");
data/liblinear-2.3.0+dfsg/matlab/libsvmwrite.c:97:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		char filename[256];
data/liblinear-2.3.0+dfsg/matlab/predict.c:234:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char cmd[CMD_LEN];
data/liblinear-2.3.0+dfsg/matlab/predict.c:267:4:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
			char *argv[CMD_LEN/2];
data/liblinear-2.3.0+dfsg/matlab/predict.c:288:28:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
						prob_estimate_flag = atoi(argv[i]);
data/liblinear-2.3.0+dfsg/matlab/train.c:153:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char cmd[CMD_LEN];
data/liblinear-2.3.0+dfsg/matlab/train.c:154:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char *argv[CMD_LEN/2];
data/liblinear-2.3.0+dfsg/matlab/train.c:204:25:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
				param.solver_type = atoi(argv[i]);
data/liblinear-2.3.0+dfsg/matlab/train.c:223:15:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
				nr_fold = atoi(argv[i]);
data/liblinear-2.3.0+dfsg/matlab/train.c:234:45:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
				param.weight_label[param.nr_weight-1] = atoi(&argv[i-1][2]);
data/liblinear-2.3.0+dfsg/predict.c:217:10:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	input = fopen(argv[optind],"r");
data/liblinear-2.3.0+dfsg/predict.c:224:11:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	output = fopen(argv[optind+2],"w");
data/liblinear-2.3.0+dfsg/svm-scale.c:86:5:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	fp=fopen(argv[i],"r");
data/liblinear-2.3.0+dfsg/svm-scale.c:115:16:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		fp_restore = fopen(restore_filename,"r");
data/liblinear-2.3.0+dfsg/svm-scale.c:268:19:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		FILE *fp_save = fopen(save_filename,"w");
data/liblinear-2.3.0+dfsg/train.c:133:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char input_file_name[1024];
data/liblinear-2.3.0+dfsg/train.c:134:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char model_file_name[1024];
data/liblinear-2.3.0+dfsg/train.c:394:13:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	FILE *fp = fopen(filename,"r");
data/liblinear-2.3.0+dfsg/tron.cpp:49:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char buf[BUFSIZ];
data/liblinear-2.3.0+dfsg/tron.cpp:118:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(w_new, w, sizeof(double)*n);
data/liblinear-2.3.0+dfsg/tron.cpp:162:4:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			memcpy(w, w_new, sizeof(double)*n);
data/liblinear-2.3.0+dfsg/matlab/libsvmread.c:49:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		len = (int) strlen(line);
data/liblinear-2.3.0+dfsg/predict.c:39:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		len = (int) strlen(line);
data/liblinear-2.3.0+dfsg/svm-scale.c:122:7:  [1] (buffer) fgetc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
		c = fgetc(fp_restore);
data/liblinear-2.3.0+dfsg/svm-scale.c:221:11:  [1] (buffer) fgetc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
		if((c = fgetc(fp_restore)) == 'y')
data/liblinear-2.3.0+dfsg/svm-scale.c:231:7:  [1] (buffer) fgetc:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
		if (fgetc(fp_restore) == 'x')
data/liblinear-2.3.0+dfsg/svm-scale.c:351:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		len = (int) strlen(line);
data/liblinear-2.3.0+dfsg/train.c:107:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		len = (int) strlen(line);

ANALYSIS SUMMARY:

Hits = 44
Lines analyzed = 6103 in approximately 0.18 seconds (33279 lines/second)
Physical Source Lines of Code (SLOC) = 5054
Hits@level = [0]  81 [1]   7 [2]  28 [3]   2 [4]   7 [5]   0
Hits@level+ = [0+] 125 [1+]  44 [2+]  37 [3+]   9 [4+]   7 [5+]   0
Hits/KSLOC@level+ = [0+] 24.7329 [1+] 8.70598 [2+] 7.32093 [3+] 1.78077 [4+] 1.38504 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.