Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/phonetisaurus-0.7.8/src/3rdparty/sparsehash/google/sparsehash/densehashtable.h
Examining data/phonetisaurus-0.7.8/src/3rdparty/sparsehash/google/sparsehash/hashtable-common.h
Examining data/phonetisaurus-0.7.8/src/3rdparty/sparsehash/google/sparsehash/libc_allocator_with_realloc.h
Examining data/phonetisaurus-0.7.8/src/3rdparty/sparsehash/google/sparsehash/sparseconfig.h
Examining data/phonetisaurus-0.7.8/src/3rdparty/sparsehash/google/sparsehash/sparsehashtable.h
Examining data/phonetisaurus-0.7.8/src/3rdparty/sparsehash/google/type_traits.h
Examining data/phonetisaurus-0.7.8/src/3rdparty/utfcpp/utf8/checked.h
Examining data/phonetisaurus-0.7.8/src/3rdparty/utfcpp/utf8/core.h
Examining data/phonetisaurus-0.7.8/src/3rdparty/utfcpp/utf8/unchecked.h
Examining data/phonetisaurus-0.7.8/src/3rdparty/utfcpp/utf8.h
Examining data/phonetisaurus-0.7.8/src/Arpa2Fst.cpp
Examining data/phonetisaurus-0.7.8/src/Arpa2Fst.hpp
Examining data/phonetisaurus-0.7.8/src/ARPA2WFST.hpp
Examining data/phonetisaurus-0.7.8/src/FstPathFinder.cpp
Examining data/phonetisaurus-0.7.8/src/FstPathFinder.hpp
Examining data/phonetisaurus-0.7.8/src/LatticePruner.cpp
Examining data/phonetisaurus-0.7.8/src/LatticePruner.hpp
Examining data/phonetisaurus-0.7.8/src/M2MFstAligner.hpp
Examining data/phonetisaurus-0.7.8/src/M2MFstAlignerB.hpp
Examining data/phonetisaurus-0.7.8/src/MBRDecoder.hpp
Examining data/phonetisaurus-0.7.8/src/phonetisaurus-arpa2fst.cpp
Examining data/phonetisaurus-0.7.8/src/Phonetisaurus.cpp
Examining data/phonetisaurus-0.7.8/src/Phonetisaurus.hpp
Examining data/phonetisaurus-0.7.8/src/PhonetisaurusE2F.cpp
Examining data/phonetisaurus-0.7.8/src/PhonetisaurusE2F.hpp
Examining data/phonetisaurus-0.7.8/src/PhonetisaurusOmega.cpp
Examining data/phonetisaurus-0.7.8/src/PhonetisaurusOmega.hpp
Examining data/phonetisaurus-0.7.8/src/phonetisaurus-g2p.cpp
Examining data/phonetisaurus-0.7.8/src/phonetisaurus-arpa2wfst-omega.cpp
Examining data/phonetisaurus-0.7.8/src/phonetisaurus-g2p-omega.cpp
Examining data/phonetisaurus-0.7.8/src/ARPA2WFST.cpp
Examining data/phonetisaurus-0.7.8/src/M2MFstAlignerB.cpp
Examining data/phonetisaurus-0.7.8/src/phonetisaurus-align.cpp
Examining data/phonetisaurus-0.7.8/src/MBRDecoder.cpp
Examining data/phonetisaurus-0.7.8/src/M2MFstAligner.cpp
Examining data/phonetisaurus-0.7.8/src/util.hpp
Examining data/phonetisaurus-0.7.8/src/util.cpp
Examining data/phonetisaurus-0.7.8/tests/get-syms.cpp
Examining data/phonetisaurus-0.7.8/tests/phonetisaurus-e2f.cpp
Examining data/phonetisaurus-0.7.8/tests/phonetisaurus-perp.cpp
FINAL RESULTS:
data/phonetisaurus-0.7.8/src/3rdparty/sparsehash/google/type_traits.h:86:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char dummy[2];
data/phonetisaurus-0.7.8/src/ARPA2WFST.cpp:44:14: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
arpa_lm_fp.open( _lm.c_str() );
data/phonetisaurus-0.7.8/src/ARPA2WFST.cpp:187:6: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
if( atoi(parts[2].c_str())>0 )
data/phonetisaurus-0.7.8/src/ARPA2WFST.cpp:188:24: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
max_order = (size_t)atoi(parts[1].c_str())>max_order ? atoi(parts[1].c_str()) : max_order;
data/phonetisaurus-0.7.8/src/ARPA2WFST.cpp:188:59: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
max_order = (size_t)atoi(parts[1].c_str())>max_order ? atoi(parts[1].c_str()) : max_order;
data/phonetisaurus-0.7.8/src/ARPA2WFST.cpp:201:18: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
current_order = atoi(&line[0]);
data/phonetisaurus-0.7.8/src/Arpa2Fst.cpp:44:14: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
arpa_lm_fp.open( arpa_lm.c_str() );
data/phonetisaurus-0.7.8/src/Arpa2Fst.cpp:208:22: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
max_order = (size_t)atoi(&line[6])>max_order ? atoi(&line[6]) : max_order;
data/phonetisaurus-0.7.8/src/Arpa2Fst.cpp:208:49: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
max_order = (size_t)atoi(&line[6])>max_order ? atoi(&line[6]) : max_order;
data/phonetisaurus-0.7.8/src/Arpa2Fst.cpp:219:18: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
current_order = atoi(&line[0]);
data/phonetisaurus-0.7.8/src/M2MFstAligner.cpp:114:14: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
seq1_max = atoi(params[2].c_str());
data/phonetisaurus-0.7.8/src/M2MFstAligner.cpp:115:14: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
seq2_max = atoi(params[3].c_str());
data/phonetisaurus-0.7.8/src/M2MFstAlignerB.cpp:119:14: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
seq1_max = atoi(params[2].c_str());
data/phonetisaurus-0.7.8/src/M2MFstAlignerB.cpp:120:14: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
seq2_max = atoi(params[3].c_str());
data/phonetisaurus-0.7.8/src/phonetisaurus-align.cpp:155:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char keybuf[16];
data/phonetisaurus-0.7.8/src/phonetisaurus-align.cpp:207:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(keybuf, "%0*d", generate_keys, i+1);
data/phonetisaurus-0.7.8/src/phonetisaurus-g2p-omega.cpp:39:11: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
test_fp.open( _input.c_str() );
data/phonetisaurus-0.7.8/src/phonetisaurus-g2p.cpp:74:11: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
test_fp.open( testset_file.c_str() );
data/phonetisaurus-0.7.8/tests/phonetisaurus-e2f.cpp:73:13: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
test_fp.open( FLAGS_input.c_str() );
data/phonetisaurus-0.7.8/src/FstPathFinder.cpp:65:11: [1] (buffer) equal:
Function does not check the second iterator for over-read conditions
(CWE-126). This function is often discouraged by most C++ coding standards
in favor of its safer alternatives provided since C++14. Consider using a
form of this function that checks the second iterator before potentially
overflowing it.
if( equal( path.begin(), path.end(), paths[i].path.begin() ) ){
data/phonetisaurus-0.7.8/src/util.cpp:63:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
char* end = str+strlen(str)+1; // end iterator
data/phonetisaurus-0.7.8/src/util.cpp:73:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int start = strlen(str) - strlen(str_j);
data/phonetisaurus-0.7.8/src/util.cpp:73:31: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int start = strlen(str) - strlen(str_j);
data/phonetisaurus-0.7.8/src/util.cpp:74:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int end = strlen(str) - strlen(str_i);
data/phonetisaurus-0.7.8/src/util.cpp:74:31: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int end = strlen(str) - strlen(str_i);
ANALYSIS SUMMARY:
Hits = 25
Lines analyzed = 9852 in approximately 0.28 seconds (35169 lines/second)
Physical Source Lines of Code (SLOC) = 5846
Hits@level = [0] 3 [1] 6 [2] 19 [3] 0 [4] 0 [5] 0
Hits@level+ = [0+] 28 [1+] 25 [2+] 19 [3+] 0 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 4.7896 [1+] 4.27643 [2+] 3.25009 [3+] 0 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.