Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/mlpy-3.5.0+ds/mlpy/libml/src/unique.c
Examining data/mlpy-3.5.0+ds/mlpy/libml/src/sampling.c
Examining data/mlpy-3.5.0+ds/mlpy/libml/src/ttest.c
Examining data/mlpy-3.5.0+ds/mlpy/libml/src/mlg.c
Examining data/mlpy-3.5.0+ds/mlpy/libml/src/alloc.c
Examining data/mlpy-3.5.0+ds/mlpy/libml/src/parser.c
Examining data/mlpy-3.5.0+ds/mlpy/libml/src/tree.c
Examining data/mlpy-3.5.0+ds/mlpy/libml/src/rn.c
Examining data/mlpy-3.5.0+ds/mlpy/libml/src/sort.c
Examining data/mlpy-3.5.0+ds/mlpy/libml/src/rsfn.c
Examining data/mlpy-3.5.0+ds/mlpy/libml/src/svm.c
Examining data/mlpy-3.5.0+ds/mlpy/libml/src/read_data.c
Examining data/mlpy-3.5.0+ds/mlpy/libml/src/trrn.c
Examining data/mlpy-3.5.0+ds/mlpy/libml/src/ml.h
Examining data/mlpy-3.5.0+ds/mlpy/libml/src/nn.c
Examining data/mlpy-3.5.0+ds/mlpy/libml/src/dist.c
Examining data/mlpy-3.5.0+ds/mlpy/libml/src/matrix.c
Examining data/mlpy-3.5.0+ds/mlpy/libml/src/get_line.c
Examining data/mlpy-3.5.0+ds/mlpy/kernel/c_kernel.c
Examining data/mlpy-3.5.0+ds/mlpy/kernel/c_kernel.h
Examining data/mlpy-3.5.0+ds/mlpy/fastcluster/fastcluster/src/fastcluster_R.cpp
Examining data/mlpy-3.5.0+ds/mlpy/fastcluster/fastcluster/src/stdint.h
Examining data/mlpy-3.5.0+ds/mlpy/fastcluster/fastcluster/src/fastcluster_python.cpp
Examining data/mlpy-3.5.0+ds/mlpy/fastcluster/fastcluster/src/fastcluster.cpp
Examining data/mlpy-3.5.0+ds/mlpy/dtw/cdtw.h
Examining data/mlpy-3.5.0+ds/mlpy/dtw/cdtw.c
Examining data/mlpy-3.5.0+ds/mlpy/kmeans/c_kmeans.h
Examining data/mlpy-3.5.0+ds/mlpy/kmeans/c_kmeans.c
Examining data/mlpy-3.5.0+ds/mlpy/lcs/clcs.h
Examining data/mlpy-3.5.0+ds/mlpy/lcs/clcs.c
Examining data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-scale.c
Examining data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-predict.c
Examining data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm.cpp
Examining data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-train.c
Examining data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm.h
Examining data/mlpy-3.5.0+ds/mlpy/findpeaks/c_findpeaks.h
Examining data/mlpy-3.5.0+ds/mlpy/findpeaks/c_findpeaks.c
Examining data/mlpy-3.5.0+ds/mlpy/wavelet/dwt.c
Examining data/mlpy-3.5.0+ds/mlpy/wavelet/uwt.c
Examining data/mlpy-3.5.0+ds/mlpy/bordacount/borda.c
Examining data/mlpy-3.5.0+ds/mlpy/adatron/c_adatron.h
Examining data/mlpy-3.5.0+ds/mlpy/adatron/c_adatron.c
Examining data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/linear.h
Examining data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/predict.c
Examining data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/tron.h
Examining data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/blas/dscal.c
Examining data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/blas/daxpy.c
Examining data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/blas/blas.h
Examining data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/blas/dnrm2.c
Examining data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/blas/ddot.c
Examining data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/blas/blasp.h
Examining data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/train.c
Examining data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/tron.cpp
Examining data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/linear.cpp
Examining data/mlpy-3.5.0+ds/mlpy/hcluster/hc.c
Examining data/mlpy-3.5.0+ds/mlpy/canberra/c_canberra.h
Examining data/mlpy-3.5.0+ds/mlpy/canberra/c_canberra.c
FINAL RESULTS:
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/linear.cpp:38:2: [4] (format) vsprintf:
Potential format string problem (CWE-134). Make format string constant.
vsprintf(buf,fmt,ap);
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/train.c:215:2: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(input_file_name, argv[i]);
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/train.c:218:3: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(model_file_name,argv[i+1]);
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/train.c:226:3: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(model_file_name,"%s.model",p);
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/tron.cpp:39:2: [4] (format) vsprintf:
Potential format string problem (CWE-134). Make format string constant.
vsprintf(buf,fmt,ap);
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-train.c:261:2: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(input_file_name, argv[i]);
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-train.c:264:3: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(model_file_name,argv[i+1]);
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-train.c:272:3: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(model_file_name,"%s.model",p);
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm.cpp:51:2: [4] (format) vsprintf:
Potential format string problem (CWE-134). Make format string constant.
vsprintf(buf,fmt,ap);
data/mlpy-3.5.0+ds/mlpy/libml/src/ml.h:26:9: [3] (random) drand48:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
#define drand48() (((float) rand())/((float) RAND_MAX))
data/mlpy-3.5.0+ds/mlpy/libml/src/ml.h:27:21: [3] (random) srand:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
#define srand48(x) (srand((x)))
data/mlpy-3.5.0+ds/mlpy/libml/src/rsfn.c:1092:20: [3] (random) drand48:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
for(k0=(int)(drand48()*svm->end_support_i),k=k0;k<svm->end_support_i+k0;k++){
data/mlpy-3.5.0+ds/mlpy/libml/src/rsfn.c:1103:20: [3] (random) drand48:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
for(k0=(int)(drand48()*svm->end_support_i),k=k0;k<svm->end_support_i+k0;k++){
data/mlpy-3.5.0+ds/mlpy/libml/src/sampling.c:13:13: [3] (random) drand48:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
y[i] = n * drand48();
data/mlpy-3.5.0+ds/mlpy/libml/src/sampling.c:26:10: [3] (random) drand48:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
j = n * drand48();
data/mlpy-3.5.0+ds/mlpy/libml/src/sampling.c:55:7: [3] (random) drand48:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
rU = drand48();
data/mlpy-3.5.0+ds/mlpy/libml/src/sampling.c:84:19: [3] (random) drand48:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
rT = totalmass * drand48();
data/mlpy-3.5.0+ds/mlpy/libml/src/svm.c:981:20: [3] (random) drand48:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
for(k0=(int)(drand48()*svm->end_support_i),k=k0;k<svm->end_support_i+k0;k++){
data/mlpy-3.5.0+ds/mlpy/libml/src/svm.c:992:20: [3] (random) drand48:
This function is not sufficiently random for security-related functions
such as key and nonce creation (CWE-327). Use a more secure technique for
acquiring random values.
for(k0=(int)(drand48()*svm->end_support_i),k=k0;k<svm->end_support_i+k0;k++){
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/linear.cpp:19:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((void *)dst,(void *)src,sizeof(T)*n);
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/linear.cpp:35:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUFSIZ];
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/linear.cpp:2089:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *fp = fopen(model_file_name,"w");
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/linear.cpp:2124:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *fp = fopen(model_file_name,"r");
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/linear.cpp:2137:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cmd[81];
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/predict.c:174:32: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
flag_predict_probability = atoi(argv[i]);
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/predict.c:186:10: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
input = fopen(argv[i],"r");
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/predict.c:193:11: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
output = fopen(argv[i+2],"w");
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/train.c:87:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char input_file_name[1024];
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/train.c:88:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char model_file_name[1024];
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/train.c:164:25: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
param.solver_type = atoi(argv[i]);
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/train.c:183:45: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
param.weight_label[param.nr_weight-1] = atoi(&argv[i-1][2]);
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/train.c:189:15: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
nr_fold = atoi(argv[i]);
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/train.c:245:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *fp = fopen(filename,"r");
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/tron.cpp:36:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUFSIZ];
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/tron.cpp:92:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(w_new, w, sizeof(double)*n);
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/tron.cpp:128:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(w, w_new, sizeof(double)*n);
data/mlpy-3.5.0+ds/mlpy/libml/src/read_data.c:27:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if(!(fp = fopen(file, "r"))){
data/mlpy-3.5.0+ds/mlpy/libml/src/read_data.c:166:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if(!(fp = fopen(file, "r"))){
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-predict.c:175:27: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
predict_probability = atoi(argv[i]);
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-predict.c:185:10: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
input = fopen(argv[i],"r");
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-predict.c:192:11: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
output = fopen(argv[i+2],"w");
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-scale.c:84:5: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fp=fopen(argv[i],"r");
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-scale.c:112:16: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fp_restore = fopen(restore_filename,"r");
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-scale.c:235:19: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *fp_save = fopen(save_filename,"w");
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-train.c:85:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char input_file_name[1024];
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-train.c:86:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char model_file_name[1024];
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-train.c:193:22: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
param.svm_type = atoi(argv[i]);
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-train.c:196:25: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
param.kernel_type = atoi(argv[i]);
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-train.c:199:20: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
param.degree = atoi(argv[i]);
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-train.c:223:23: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
param.shrinking = atoi(argv[i]);
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-train.c:226:25: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
param.probability = atoi(argv[i]);
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-train.c:234:15: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
nr_fold = atoi(argv[i]);
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-train.c:245:45: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
param.weight_label[param.nr_weight-1] = atoi(&argv[i-1][2]);
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-train.c:281:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *fp = fopen(filename,"r");
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm.cpp:22:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((void *)dst,(void *)src,sizeof(T)*n);
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm.cpp:48:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUFSIZ];
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm.cpp:2582:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *fp = fopen(model_file_name,"w");
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm.cpp:2690:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *fp = fopen(model_file_name,"rb");
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm.cpp:2703:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cmd[81];
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/linear.cpp:2140:3: [1] (buffer) fscanf:
It's unclear if the %s limit in the format string is small enough
(CWE-120). Check that the limit is sufficiently small, or use a different
input function.
fscanf(fp,"%80s",cmd);
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/linear.cpp:2143:4: [1] (buffer) fscanf:
It's unclear if the %s limit in the format string is small enough
(CWE-120). Check that the limit is sufficiently small, or use a different
input function.
fscanf(fp,"%80s",cmd);
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/predict.c:34:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = (int) strlen(line);
data/mlpy-3.5.0+ds/mlpy/liblinear/liblinear/train.c:66:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = (int) strlen(line);
data/mlpy-3.5.0+ds/mlpy/libml/src/get_line.c:30:12: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while((c=fgetc(fp)) != EOF && c != '\n'){
data/mlpy-3.5.0+ds/mlpy/libml/src/get_line.c:42:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(strlen(*line)>0)
data/mlpy-3.5.0+ds/mlpy/libml/src/get_line.c:48:8: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(strlen(*line)>0){
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-predict.c:28:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = (int) strlen(line);
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-scale.c:119:7: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c = fgetc(fp_restore);
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-scale.c:210:11: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if((c = fgetc(fp_restore)) == 'y')
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-scale.c:219:7: [1] (buffer) fgetc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (fgetc(fp_restore) == 'x') {
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-scale.c:312:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = (int) strlen(line);
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm-train.c:76:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = (int) strlen(line);
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm.cpp:2681:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = (int) strlen(line);
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm.cpp:2706:3: [1] (buffer) fscanf:
It's unclear if the %s limit in the format string is small enough
(CWE-120). Check that the limit is sufficiently small, or use a different
input function.
fscanf(fp,"%80s",cmd);
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm.cpp:2710:4: [1] (buffer) fscanf:
It's unclear if the %s limit in the format string is small enough
(CWE-120). Check that the limit is sufficiently small, or use a different
input function.
fscanf(fp,"%80s",cmd);
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm.cpp:2732:4: [1] (buffer) fscanf:
It's unclear if the %s limit in the format string is small enough
(CWE-120). Check that the limit is sufficiently small, or use a different
input function.
fscanf(fp,"%80s",cmd);
data/mlpy-3.5.0+ds/mlpy/libsvm/libsvm/svm.cpp:2801:13: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
int c = getc(fp);
ANALYSIS SUMMARY:
Hits = 77
Lines analyzed = 20675 in approximately 0.55 seconds (37416 lines/second)
Physical Source Lines of Code (SLOC) = 15987
Hits@level = [0] 614 [1] 18 [2] 40 [3] 10 [4] 9 [5] 0
Hits@level+ = [0+] 691 [1+] 77 [2+] 59 [3+] 19 [4+] 9 [5+] 0
Hits/KSLOC@level+ = [0+] 43.2226 [1+] 4.81641 [2+] 3.6905 [3+] 1.18847 [4+] 0.562957 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.