Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/probalign-1.4/FileBuffer.h Examining data/probalign-1.4/ComputeAlignment.cc Examining data/probalign-1.4/EvolutionaryTree.h Examining data/probalign-1.4/Matrix.h Examining data/probalign-1.4/MultiSequence.h Examining data/probalign-1.4/PostProbs.cc Examining data/probalign-1.4/ReadMatrix.cc Examining data/probalign-1.4/Sequence.h Examining data/probalign-1.4/SparseMatrix.h Examining data/probalign-1.4/SafeVector.h Examining data/probalign-1.4/Main.cc FINAL RESULTS: data/probalign-1.4/Main.cc:777:7: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(matrixtype, argv[++i]); data/probalign-1.4/Sequence.h:154:5: [4] (buffer) sscanf: The scanf() family's %s operation, without a limit specification, permits buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a different input function. sscanf (header.c_str(), "%s", name); data/probalign-1.4/FileBuffer.h:27:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buffer[BufferSize]; data/probalign-1.4/Main.cc:68:1: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char *aminos, *bases, matrixtype[20] = "gonnet_160"; data/probalign-1.4/Main.cc:111:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char input[30]; data/probalign-1.4/Main.cc:560:7: [2] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). Risk is low because the source is a constant string. strcpy(matrixtype, "nuc_simple"); data/probalign-1.4/Matrix.h:11:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char monomers[26]; /* amino or nucleic acid order */ data/probalign-1.4/PostProbs.cc:35:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char input[30]; data/probalign-1.4/PostProbs.cc:62:1: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char proteins[20]; data/probalign-1.4/PostProbs.cc:74:8: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. extern char aminos[26], matrixtype[20], bases[26]; data/probalign-1.4/PostProbs.cc:145:7: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fo = fopen("revpartdump", "a"); data/probalign-1.4/PostProbs.cc:903:5: [2] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). Risk is low because the source is a constant string. strcpy(sequences[0].title, "seq0"); data/probalign-1.4/PostProbs.cc:907:5: [2] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). Risk is low because the source is a constant string. strcpy(sequences[1].title, "seq1"); data/probalign-1.4/PostProbs.cc:918:16: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). FILE *dump1 = fopen("dump1", "a"); data/probalign-1.4/ReadMatrix.cc:19:8: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. extern char *aminos, *bases, matrixtype[20]; data/probalign-1.4/ReadMatrix.cc:32:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char input[30]; data/probalign-1.4/ReadMatrix.cc:54:4: [2] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). Risk is low because the source is a constant string. strcpy(matrixtype, "gonnet_160"); data/probalign-1.4/ReadMatrix.cc:57:4: [2] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). Risk is low because the source is a constant string. strcpy(matrixtype, "nuc_simple"); data/probalign-1.4/ReadMatrix.cc:60:4: [2] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). Risk is low because the source is a constant string. strcpy(matrixtype, "CUSTOM"); data/probalign-1.4/ReadMatrix.cc:147:5: [2] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). Risk is low because the source is a constant string. strcpy(argument.input, "tempin"); data/probalign-1.4/Sequence.h:153:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char name[1024]; data/probalign-1.4/FileBuffer.h:58:12: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). file.read (buffer, BufferSize); data/probalign-1.4/Main.cc:293:25: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). cerr << a << " " << strlen(seq1->GetString(). data/probalign-1.4/Main.cc:295:25: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). cerr << b << " " << strlen(seq2->GetString(). data/probalign-1.4/PostProbs.cc:136:12: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). len0 = strlen(sequences[0].text); data/probalign-1.4/PostProbs.cc:137:12: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). len1 = strlen(sequences[1].text); data/probalign-1.4/PostProbs.cc:595:12: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). len0 = strlen(sequences[0].text); data/probalign-1.4/PostProbs.cc:596:12: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). len1 = strlen(sequences[1].text); data/probalign-1.4/PostProbs.cc:900:27: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). sequences[0].length = strlen((char *) seq1.c_str()); data/probalign-1.4/PostProbs.cc:904:27: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). sequences[1].length = strlen((char *) seq2.c_str()); data/probalign-1.4/ReadMatrix.cc:102:17: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). basecount = strlen(bases); ANALYSIS SUMMARY: Hits = 31 Lines analyzed = 4932 in approximately 0.12 seconds (39668 lines/second) Physical Source Lines of Code (SLOC) = 3003 Hits@level = [0] 45 [1] 10 [2] 19 [3] 0 [4] 2 [5] 0 Hits@level+ = [0+] 76 [1+] 31 [2+] 21 [3+] 2 [4+] 2 [5+] 0 Hits/KSLOC@level+ = [0+] 25.308 [1+] 10.323 [2+] 6.99301 [3+] 0.666001 [4+] 0.666001 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.