Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/libsvm-3.24+ds/matlab/libsvmread.c
Examining data/libsvm-3.24+ds/matlab/libsvmwrite.c
Examining data/libsvm-3.24+ds/matlab/svm_model_matlab.c
Examining data/libsvm-3.24+ds/matlab/svm_model_matlab.h
Examining data/libsvm-3.24+ds/matlab/svmpredict.c
Examining data/libsvm-3.24+ds/matlab/svmtrain.c
Examining data/libsvm-3.24+ds/svm-toy/qt/svm-toy.cpp
Examining data/libsvm-3.24+ds/svm.cpp
Examining data/libsvm-3.24+ds/svm.h
Examining data/libsvm-3.24+ds/svm-predict.c
Examining data/libsvm-3.24+ds/svm-scale.c
Examining data/libsvm-3.24+ds/svm-train.c
FINAL RESULTS:
data/libsvm-3.24+ds/svm-predict.c:13:44: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
static int (*info)(const char *fmt,...) = &printf;
data/libsvm-3.24+ds/svm-train.c:292:2: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(input_file_name, argv[i]);
data/libsvm-3.24+ds/svm-train.c:295:3: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(model_file_name,argv[i+1]);
data/libsvm-3.24+ds/svm-train.c:303:3: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(model_file_name,"%s.model",p);
data/libsvm-3.24+ds/svm.cpp:53:2: [4] (format) vsprintf:
Potential format string problem (CWE-134). Make format string constant.
vsprintf(buf,fmt,ap);
data/libsvm-3.24+ds/svm.cpp:2772:48: [4] (buffer) fscanf:
The scanf() family's %s operation, without a limit specification, permits
buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
different input function. If the scanf format is influenceable by an
attacker, it's exploitable.
#define FSCANF(_stream, _format, _var) do{ if (fscanf(_stream, _format, _var) != 1) return false; }while(0)
data/libsvm-3.24+ds/matlab/svmtrain.c:391:2: [3] (random) srand:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
srand(1);
data/libsvm-3.24+ds/matlab/libsvmread.c:61:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *fp = fopen(filename,"r");
data/libsvm-3.24+ds/matlab/libsvmread.c:191:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char filename[256];
data/libsvm-3.24+ds/matlab/libsvmwrite.c:28:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *fp = fopen(filename,"w");
data/libsvm-3.24+ds/matlab/libsvmwrite.c:97:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char filename[256];
data/libsvm-3.24+ds/matlab/svmpredict.c:300:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cmd[CMD_LEN], *argv[CMD_LEN/2];
data/libsvm-3.24+ds/matlab/svmpredict.c:320:28: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
prob_estimate_flag = atoi(argv[i]);
data/libsvm-3.24+ds/matlab/svmtrain.c:111:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cmd[CMD_LEN];
data/libsvm-3.24+ds/matlab/svmtrain.c:112:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char *argv[CMD_LEN/2];
data/libsvm-3.24+ds/matlab/svmtrain.c:155:22: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
param.svm_type = atoi(argv[i]);
data/libsvm-3.24+ds/matlab/svmtrain.c:158:25: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
param.kernel_type = atoi(argv[i]);
data/libsvm-3.24+ds/matlab/svmtrain.c:161:20: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
param.degree = atoi(argv[i]);
data/libsvm-3.24+ds/matlab/svmtrain.c:185:23: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
param.shrinking = atoi(argv[i]);
data/libsvm-3.24+ds/matlab/svmtrain.c:188:25: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
param.probability = atoi(argv[i]);
data/libsvm-3.24+ds/matlab/svmtrain.c:196:15: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
nr_fold = atoi(argv[i]);
data/libsvm-3.24+ds/matlab/svmtrain.c:207:45: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
param.weight_label[param.nr_weight-1] = atoi(&argv[i-1][2]);
data/libsvm-3.24+ds/svm-predict.c:214:10: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
input = fopen(argv[i],"r");
data/libsvm-3.24+ds/svm-predict.c:221:11: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
output = fopen(argv[i+2],"w");
data/libsvm-3.24+ds/svm-scale.c:104:5: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fp=fopen(argv[i],"r");
data/libsvm-3.24+ds/svm-scale.c:133:16: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fp_restore = fopen(restore_filename,"r");
data/libsvm-3.24+ds/svm-scale.c:286:19: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *fp_save = fopen(save_filename,"w");
data/libsvm-3.24+ds/svm-toy/qt/svm-toy.cpp:123:23: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
param.svm_type = atoi(p);
data/libsvm-3.24+ds/svm-toy/qt/svm-toy.cpp:126:26: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
param.kernel_type = atoi(p);
data/libsvm-3.24+ds/svm-toy/qt/svm-toy.cpp:129:21: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
param.degree = atoi(p);
data/libsvm-3.24+ds/svm-toy/qt/svm-toy.cpp:153:24: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
param.shrinking = atoi(p);
data/libsvm-3.24+ds/svm-toy/qt/svm-toy.cpp:156:26: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
param.probability = atoi(p);
data/libsvm-3.24+ds/svm-toy/qt/svm-toy.cpp:162:46: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
param.weight_label[param.nr_weight-1] = atoi(p);
data/libsvm-3.24+ds/svm-toy/qt/svm-toy.cpp:289:15: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *fp = fopen(filename.toLatin1().constData(),"w");
data/libsvm-3.24+ds/svm-toy/qt/svm-toy.cpp:318:15: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *fp = fopen(filename.toLatin1().constData(),"r");
data/libsvm-3.24+ds/svm-toy/qt/svm-toy.cpp:322:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[4096];
data/libsvm-3.24+ds/svm-train.c:116:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char input_file_name[1024];
data/libsvm-3.24+ds/svm-train.c:117:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char model_file_name[1024];
data/libsvm-3.24+ds/svm-train.c:313:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *fp = fopen(filename,"r");
data/libsvm-3.24+ds/svm.cpp:24:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((void *)dst,(void *)src,sizeof(T)*n);
data/libsvm-3.24+ds/svm.cpp:50:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUFSIZ];
data/libsvm-3.24+ds/svm.cpp:2649:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *fp = fopen(model_file_name,"w");
data/libsvm-3.24+ds/svm.cpp:2781:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cmd[81];
data/libsvm-3.24+ds/svm.cpp:2889:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *fp = fopen(model_file_name,"rb");
data/libsvm-3.24+ds/matlab/libsvmread.c:49:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = (int) strlen(line);
data/libsvm-3.24+ds/svm-predict.c:35:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = (int) strlen(line);
data/libsvm-3.24+ds/svm-scale.c:140:7: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c = fgetc(fp_restore);
data/libsvm-3.24+ds/svm-scale.c:239:11: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if((c = fgetc(fp_restore)) == 'y')
data/libsvm-3.24+ds/svm-scale.c:249:7: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (fgetc(fp_restore) == 'x')
data/libsvm-3.24+ds/svm-scale.c:369:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = (int) strlen(line);
data/libsvm-3.24+ds/svm-train.c:107:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = (int) strlen(line);
data/libsvm-3.24+ds/svm.cpp:2758:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = (int) strlen(line);
data/libsvm-3.24+ds/svm.cpp:2871:13: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
int c = getc(fp);
ANALYSIS SUMMARY:
Hits = 53
Lines analyzed = 6385 in approximately 0.17 seconds (37525 lines/second)
Physical Source Lines of Code (SLOC) = 5399
Hits@level = [0] 102 [1] 9 [2] 37 [3] 1 [4] 6 [5] 0
Hits@level+ = [0+] 155 [1+] 53 [2+] 44 [3+] 7 [4+] 6 [5+] 0
Hits/KSLOC@level+ = [0+] 28.709 [1+] 9.81663 [2+] 8.14966 [3+] 1.29654 [4+] 1.11132 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.