Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/python-skbio-0.5.6/skbio/alignment/_lib/ssw.c Examining data/python-skbio-0.5.6/skbio/alignment/_lib/ssw.h Examining data/python-skbio-0.5.6/skbio/alignment/_ssw_wrapper.c Examining data/python-skbio-0.5.6/skbio/diversity/_phylogenetic.c Examining data/python-skbio-0.5.6/skbio/metadata/_intersection.c Examining data/python-skbio-0.5.6/skbio/stats/__subsample.c FINAL RESULTS: data/python-skbio-0.5.6/skbio/alignment/_ssw_wrapper.c:800:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(__PYX_DEFAULT_STRING_ENCODING, default_encoding_c); data/python-skbio-0.5.6/skbio/diversity/_phylogenetic.c:792:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(__PYX_DEFAULT_STRING_ENCODING, default_encoding_c); data/python-skbio-0.5.6/skbio/metadata/_intersection.c:783:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(__PYX_DEFAULT_STRING_ENCODING, default_encoding_c); data/python-skbio-0.5.6/skbio/stats/__subsample.c:792:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(__PYX_DEFAULT_STRING_ENCODING, default_encoding_c); data/python-skbio-0.5.6/skbio/alignment/_ssw_wrapper.c:14543:18: [3] (random) setstate: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. if (!setstate) PyErr_Clear(); data/python-skbio-0.5.6/skbio/alignment/_ssw_wrapper.c:14544:18: [3] (random) setstate: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. if (!setstate || __Pyx_setup_reduce_is_named(setstate, __pyx_n_s_setstate_cython)) { data/python-skbio-0.5.6/skbio/alignment/_ssw_wrapper.c:14544:58: [3] (random) setstate: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. if (!setstate || __Pyx_setup_reduce_is_named(setstate, __pyx_n_s_setstate_cython)) { data/python-skbio-0.5.6/skbio/alignment/_ssw_wrapper.c:14565:16: [3] (random) setstate: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. Py_XDECREF(setstate); data/python-skbio-0.5.6/skbio/metadata/_intersection.c:12533:18: [3] (random) setstate: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. if (!setstate) PyErr_Clear(); data/python-skbio-0.5.6/skbio/metadata/_intersection.c:12534:18: [3] (random) setstate: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. if (!setstate || __Pyx_setup_reduce_is_named(setstate, __pyx_n_s_setstate_cython)) { data/python-skbio-0.5.6/skbio/metadata/_intersection.c:12534:58: [3] (random) setstate: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. if (!setstate || __Pyx_setup_reduce_is_named(setstate, __pyx_n_s_setstate_cython)) { data/python-skbio-0.5.6/skbio/metadata/_intersection.c:12555:16: [3] (random) setstate: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. Py_XDECREF(setstate); data/python-skbio-0.5.6/skbio/alignment/_ssw_wrapper.c:753:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char ascii_chars[128]; data/python-skbio-0.5.6/skbio/alignment/_ssw_wrapper.c:14577:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char warning[200]; data/python-skbio-0.5.6/skbio/alignment/_ssw_wrapper.c:16662:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char ctversion[4], rtversion[4]; data/python-skbio-0.5.6/skbio/alignment/_ssw_wrapper.c:16666:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char message[200]; data/python-skbio-0.5.6/skbio/diversity/_phylogenetic.c:745:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char ascii_chars[128]; data/python-skbio-0.5.6/skbio/diversity/_phylogenetic.c:8006:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char warning[200]; data/python-skbio-0.5.6/skbio/diversity/_phylogenetic.c:9510:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char ctversion[4], rtversion[4]; data/python-skbio-0.5.6/skbio/diversity/_phylogenetic.c:9514:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char message[200]; data/python-skbio-0.5.6/skbio/metadata/_intersection.c:736:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char ascii_chars[128]; data/python-skbio-0.5.6/skbio/metadata/_intersection.c:13351:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char ctversion[4], rtversion[4]; data/python-skbio-0.5.6/skbio/metadata/_intersection.c:13355:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char message[200]; data/python-skbio-0.5.6/skbio/stats/__subsample.c:745:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char ascii_chars[128]; data/python-skbio-0.5.6/skbio/stats/__subsample.c:6832:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char warning[200]; data/python-skbio-0.5.6/skbio/stats/__subsample.c:8336:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char ctversion[4], rtversion[4]; data/python-skbio-0.5.6/skbio/stats/__subsample.c:8340:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char message[200]; data/python-skbio-0.5.6/skbio/alignment/_lib/ssw.c:71:13: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). int32_t read; //alignment ending position on read, 0-based data/python-skbio-0.5.6/skbio/alignment/_lib/ssw.c:82:19: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). const int8_t* read; data/python-skbio-0.5.6/skbio/alignment/_lib/ssw.c:551:32: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). const int8_t* read, data/python-skbio-0.5.6/skbio/alignment/_lib/ssw.c:620:51: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). temp2 = h_b[d] + mat[ref[j] * n + read[i]]; data/python-skbio-0.5.6/skbio/alignment/_lib/ssw.c:743:36: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). s_profile* ssw_init (const int8_t* read, const int32_t readLen, const int8_t* mat, const int32_t n, const int8_t score_size) { data/python-skbio-0.5.6/skbio/alignment/_lib/ssw.c:756:36: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). p->profile_byte = qP_byte (read, mat, readLen, n, bias); data/python-skbio-0.5.6/skbio/alignment/_lib/ssw.c:758:72: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). if (score_size == 1 || score_size == 2) p->profile_word = qP_word (read, mat, readLen, n); data/python-skbio-0.5.6/skbio/alignment/_lib/ssw.c:759:15: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). p->read = read; data/python-skbio-0.5.6/skbio/alignment/_lib/ssw.c:816:29: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). r->read_end1 = bests[0].read; data/python-skbio-0.5.6/skbio/alignment/_lib/ssw.c:828:38: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). read_reverse = seq_reverse(prof->read, r->read_end1); data/python-skbio-0.5.6/skbio/alignment/_lib/ssw.c:839:54: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). r->read_begin1 = r->read_end1 - bests_reverse[0].read; data/python-skbio-0.5.6/skbio/alignment/_lib/ssw.h:72:36: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). s_profile* ssw_init (const int8_t* read, const int32_t readLen, const int8_t* mat, const int32_t n, const int8_t score_size); data/python-skbio-0.5.6/skbio/alignment/_ssw_wrapper.c:677:87: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). #define __Pyx_PyByteArray_FromString(s) PyByteArray_FromStringAndSize((const char*)s, strlen((const char*)s)) data/python-skbio-0.5.6/skbio/alignment/_ssw_wrapper.c:798:52: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). __PYX_DEFAULT_STRING_ENCODING = (char*) malloc(strlen(default_encoding_c) + 1); data/python-skbio-0.5.6/skbio/alignment/_ssw_wrapper.c:16710:65: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). return __Pyx_PyUnicode_FromStringAndSize(c_str, (Py_ssize_t)strlen(c_str)); data/python-skbio-0.5.6/skbio/diversity/_phylogenetic.c:669:87: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). #define __Pyx_PyByteArray_FromString(s) PyByteArray_FromStringAndSize((const char*)s, strlen((const char*)s)) data/python-skbio-0.5.6/skbio/diversity/_phylogenetic.c:790:52: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). __PYX_DEFAULT_STRING_ENCODING = (char*) malloc(strlen(default_encoding_c) + 1); data/python-skbio-0.5.6/skbio/diversity/_phylogenetic.c:9558:65: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). return __Pyx_PyUnicode_FromStringAndSize(c_str, (Py_ssize_t)strlen(c_str)); data/python-skbio-0.5.6/skbio/metadata/_intersection.c:660:87: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). #define __Pyx_PyByteArray_FromString(s) PyByteArray_FromStringAndSize((const char*)s, strlen((const char*)s)) data/python-skbio-0.5.6/skbio/metadata/_intersection.c:781:52: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). __PYX_DEFAULT_STRING_ENCODING = (char*) malloc(strlen(default_encoding_c) + 1); data/python-skbio-0.5.6/skbio/metadata/_intersection.c:13399:65: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). return __Pyx_PyUnicode_FromStringAndSize(c_str, (Py_ssize_t)strlen(c_str)); data/python-skbio-0.5.6/skbio/stats/__subsample.c:669:87: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). #define __Pyx_PyByteArray_FromString(s) PyByteArray_FromStringAndSize((const char*)s, strlen((const char*)s)) data/python-skbio-0.5.6/skbio/stats/__subsample.c:790:52: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). __PYX_DEFAULT_STRING_ENCODING = (char*) malloc(strlen(default_encoding_c) + 1); data/python-skbio-0.5.6/skbio/stats/__subsample.c:8384:65: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). return __Pyx_PyUnicode_FromStringAndSize(c_str, (Py_ssize_t)strlen(c_str)); ANALYSIS SUMMARY: Hits = 51 Lines analyzed = 49932 in approximately 1.58 seconds (31508 lines/second) Physical Source Lines of Code (SLOC) = 36216 Hits@level = [0] 5 [1] 24 [2] 15 [3] 8 [4] 4 [5] 0 Hits@level+ = [0+] 56 [1+] 51 [2+] 27 [3+] 12 [4+] 4 [5+] 0 Hits/KSLOC@level+ = [0+] 1.54628 [1+] 1.40822 [2+] 0.745527 [3+] 0.331345 [4+] 0.110448 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.