Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/quicktree-2.5/include/align.h Examining data/quicktree-2.5/include/aln2dist.h Examining data/quicktree-2.5/include/aln2tree.h Examining data/quicktree-2.5/include/buildtree.h Examining data/quicktree-2.5/include/cluster.h Examining data/quicktree-2.5/include/dist2tree.h Examining data/quicktree-2.5/include/distancemat.h Examining data/quicktree-2.5/include/options.h Examining data/quicktree-2.5/include/sequence.h Examining data/quicktree-2.5/include/tree.h Examining data/quicktree-2.5/include/util.h Examining data/quicktree-2.5/include/version.h Examining data/quicktree-2.5/src/align.c Examining data/quicktree-2.5/src/aln2dist.c Examining data/quicktree-2.5/src/aln2tree.c Examining data/quicktree-2.5/src/buildtree.c Examining data/quicktree-2.5/src/cluster.c Examining data/quicktree-2.5/src/dist2tree.c Examining data/quicktree-2.5/src/distancemat.c Examining data/quicktree-2.5/src/options.c Examining data/quicktree-2.5/src/quicktree.c Examining data/quicktree-2.5/src/sequence.c Examining data/quicktree-2.5/src/tree.c Examining data/quicktree-2.5/src/util.c FINAL RESULTS: data/quicktree-2.5/src/align.c:111:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(aln->seqs[aln->numseqs]->name, tempname); data/quicktree-2.5/src/align.c:285:7: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy( aln->seqs[thisseq]->name, name_ptr ); data/quicktree-2.5/src/distancemat.c:424:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy( (*aln_loc)->seqs[i]->name, identifier ); data/quicktree-2.5/src/sequence.c:42:5: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy( dest->name, source->name ); data/quicktree-2.5/src/util.c:135:3: [4] (format) vfprintf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. vfprintf( stderr, fmt, args); data/quicktree-2.5/src/util.c:158:3: [4] (format) vfprintf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. vfprintf( stderr, fmt, args ); data/quicktree-2.5/src/align.c:78:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char tempname[MAX_NAME_LENGTH]; data/quicktree-2.5/src/aln2dist.c:116:16: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if ((input = fopen( fname, "r" )) == NULL) data/quicktree-2.5/src/aln2tree.c:141:63: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). else if (strcmp(optname, "-boot") == 0) calc_bootstraps = atoi( optarg ); data/quicktree-2.5/src/aln2tree.c:154:16: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if ((input = fopen( fname, "r" )) == NULL) data/quicktree-2.5/src/dist2tree.c:83:23: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if ((matrixfile = fopen( argv[1], "r" )) == NULL) data/quicktree-2.5/src/distancemat.c:385:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char identifier[MAX_PHYLIP_NAME_LEN + 1]; data/quicktree-2.5/src/quicktree.c:172:63: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). else if (strcmp(optname, "-boot") == 0) calc_bootstraps = atoi( optarg ); data/quicktree-2.5/src/quicktree.c:217:16: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if ((input = fopen( fname, "r" )) == NULL) data/quicktree-2.5/src/align.c:87:16: [1] (buffer) fgetc: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). while (( c = fgetc(stream)) != EOF) { data/quicktree-2.5/src/align.c:103:11: [1] (buffer) fgetc: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). c = fgetc(stream); data/quicktree-2.5/src/align.c:106:25: [1] (buffer) fgetc: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). while ( isspace(c = fgetc(stream)) ); data/quicktree-2.5/src/align.c:127:11: [1] (buffer) fgetc: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). c = fgetc(stream); data/quicktree-2.5/src/align.c:284:57: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). aln->seqs[thisseq]->name = (char *) malloc_util( (strlen( name_ptr ) + 1) * sizeof(char)); data/quicktree-2.5/src/align.c:288:24: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). for ( last_idx = strlen(seq_ptr) - 1; strchr(whitespace, seq_ptr[last_idx]) != NULL; last_idx--); data/quicktree-2.5/src/align.c:297:24: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). for ( last_idx = strlen(seq_ptr) - 1; strchr(whitespace, seq_ptr[last_idx]) != NULL; last_idx--); data/quicktree-2.5/src/distancemat.c:410:15: [1] (buffer) fgetc: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). while(c = fgetc(handle)) { data/quicktree-2.5/src/distancemat.c:423:56: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). (*aln_loc)->seqs[i]->name = (char *) malloc_util( (strlen(identifier) + 1) * sizeof(char)); data/quicktree-2.5/src/distancemat.c:432:13: [1] (buffer) fgetc: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). c = fgetc(handle); data/quicktree-2.5/src/options.c:67:16: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). arglen = strlen(argv[optindex]); data/quicktree-2.5/src/options.c:75:36: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (matches > 1 && arglen != strlen(opt[opti].name)) data/quicktree-2.5/src/sequence.c:41:41: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). dest->name = (char *) malloc_util( (strlen(source->name)+1) * sizeof(char)); data/quicktree-2.5/src/tree.c:403:9: [1] (buffer) fscanf: It's unclear if the %s limit in the format string is small enough (CWE-120). Check that the limit is sufficiently small, or use a different input function. if (! fscanf( handle, "%1s", &c)) data/quicktree-2.5/src/tree.c:417:11: [1] (buffer) fscanf: It's unclear if the %s limit in the format string is small enough (CWE-120). Check that the limit is sufficiently small, or use a different input function. if (! fscanf( handle, "%1s", &c) || c != ',') data/quicktree-2.5/src/tree.c:427:11: [1] (buffer) fscanf: It's unclear if the %s limit in the format string is small enough (CWE-120). Check that the limit is sufficiently small, or use a different input function. if (! fscanf( handle, "%1s", &c) || c != ')') data/quicktree-2.5/src/tree.c:429:11: [1] (buffer) fscanf: It's unclear if the %s limit in the format string is small enough (CWE-120). Check that the limit is sufficiently small, or use a different input function. if (! fscanf( handle, "%1s", &c) || c != ':') data/quicktree-2.5/src/tree.c:441:42: [1] (buffer) fgetc: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). for( index=0; (newseq->name[index] = fgetc( handle )) != ':'; index++); data/quicktree-2.5/src/tree.c:484:9: [1] (buffer) fscanf: It's unclear if the %s limit in the format string is small enough (CWE-120). Check that the limit is sufficiently small, or use a different input function. if (! fscanf( handle, "%1s", &c ) || c != ',') data/quicktree-2.5/src/tree.c:492:9: [1] (buffer) fscanf: It's unclear if the %s limit in the format string is small enough (CWE-120). Check that the limit is sufficiently small, or use a different input function. if (! fscanf( handle, "%1s", &c ) || c != ',') data/quicktree-2.5/src/tree.c:500:9: [1] (buffer) fscanf: It's unclear if the %s limit in the format string is small enough (CWE-120). Check that the limit is sufficiently small, or use a different input function. if (! fscanf( handle, "%1s", &c) || c != ')') data/quicktree-2.5/src/tree.c:502:9: [1] (buffer) fscanf: It's unclear if the %s limit in the format string is small enough (CWE-120). Check that the limit is sufficiently small, or use a different input function. if (! fscanf( handle, "%1s", &c) || c != ';') ANALYSIS SUMMARY: Hits = 36 Lines analyzed = 5439 in approximately 0.21 seconds (26244 lines/second) Physical Source Lines of Code (SLOC) = 2114 Hits@level = [0] 57 [1] 22 [2] 8 [3] 0 [4] 6 [5] 0 Hits@level+ = [0+] 93 [1+] 36 [2+] 14 [3+] 6 [4+] 6 [5+] 0 Hits/KSLOC@level+ = [0+] 43.9924 [1+] 17.0293 [2+] 6.62252 [3+] 2.83822 [4+] 2.83822 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.