Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/r-bioc-edger-3.32.0+dfsg/src/R_add_prior_count.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/R_ave_log_cpm.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/R_calculate_cpm.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/R_check_poisson_bound.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/R_compute_apl.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/R_compute_nbdev.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/R_exact_test_by_deviance.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/R_fit_levenberg.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/R_fit_one_group.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/R_get_one_way_fitted.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/R_initialize_levenberg.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/R_loess_by_col.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/R_maximize_interpolant.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c Examining data/r-bioc-edger-3.32.0+dfsg/src/R_simple_good_turing.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/add_prior.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/add_prior.h Examining data/r-bioc-edger-3.32.0+dfsg/src/adj_coxreid.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/fmm_spline.c Examining data/r-bioc-edger-3.32.0+dfsg/src/glm.h Examining data/r-bioc-edger-3.32.0+dfsg/src/glm_levenberg.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/glm_one_group.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/init.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/interpolator.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/interpolator.h Examining data/r-bioc-edger-3.32.0+dfsg/src/nbdev.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/objects.cpp Examining data/r-bioc-edger-3.32.0+dfsg/src/objects.h Examining data/r-bioc-edger-3.32.0+dfsg/src/utils.h FINAL RESULTS: data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:422:9: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fin = fopen(filename,"r"); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:476:9: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fin = fopen(filename,"r"); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:1200:9: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fin = fopen(filename,"r"); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:1202:14: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). finRev = fopen(filename2, "r"); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:1401:10: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fout = fopen(output, "w"); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:1432:10: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fout = fopen(output, "w"); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:393:8: [1] (buffer) fgetc: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). ch=fgetc(fin); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:438:5: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(new_barcode->sequence, line, barcode_length); // copy the barcode line up to the length of the barcode into the barcode struct data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:445:7: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(new_barcode->sequenceRev, token, barcode_length_rev); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:450:7: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(new_barcode->sequence2, token, barcode2_length); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:493:5: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(new_hairpin->sequence, line, hairpin_length); // copy the data retrieved (stored in line) to our new_hairpin struct data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:521:53: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). locate_sequence_in_trie(trie_node *trie_head, char *read, int *found_position) { data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:530:22: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). long read_length = strlen(read); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:530:29: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). long read_length = strlen(read); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:539:14: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). base = read[j]; data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:568:50: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). mismatch_trie_aux(trie_node *current_node, char *read, int pos, int mismatch_left, bool original_pos) { data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:599:34: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). if (Base_In_Node(current_node, read[pos])) { data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:600:32: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). match = Get_Links_Position(read[pos]); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:601:70: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). index = mismatch_trie_aux(current_node->links[Get_Links_Position(read[pos])], data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:602:13: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). read, pos + 1, mismatch_left, original_pos); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:617:57: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). index = mismatch_trie_aux(current_node->links[i], read, pos + 1, mismatch_left - 1, original_pos); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:629:53: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). locate_mismatch_in_trie(trie_node *trie_head, char *read, int sequence_length, int mismatch_count, int *found_position, bool original_pos) { data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:645:13: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). int len = strlen(read); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:645:20: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). int len = strlen(read); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:648:42: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). index = mismatch_trie_aux(trie_head, read, i, mismatch_count, original_pos); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:800:22: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). locate_barcode(char *read, int *found_position) { data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:809:73: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). int barcode_index = locate_sequence_in_trie(barcode_single_trie_head, read, found_position); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:816:71: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). barcode_index = locate_mismatch_in_trie(barcode_single_trie_head, read, barcode_length, barcode_n_mismatch, found_position, true); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:828:29: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). locate_barcode_paired(char *read, char *read_rev, int *found_position, int *found2_position) { data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:848:70: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). barcode1_index = locate_sequence_in_trie(barcode_single_trie_head, read, &found_for_position); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:860:5: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(barcode1, read + found_for_position, barcode_length); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:862:5: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(barcode2, read_rev + found_rev_position, barcode_length_rev); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:874:20: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). int read_len = strlen(read); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:874:27: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). int read_len = strlen(read); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:875:21: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). int read2_len = strlen(read_rev); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:913:35: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). locate_barcode_dualIndexing(char *read, int *found_position, int *found2_position){ data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:929:70: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). barcode1_index = locate_sequence_in_trie(barcode_single_trie_head, read, &found_for_position); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:941:5: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(barcode1, read + found_for_position, barcode_length); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:943:5: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(barcode2, read + found_dual_position, barcode2_length); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:955:20: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). int read_len = strlen(read); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:955:27: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). int read_len = strlen(read); data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:996:22: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). locate_hairpin(char *read, int *barcode_found_position, int *hairpin_found_position) { data/r-bioc-edger-3.32.0+dfsg/src/R_process_hairpin_reads.c:1257:24: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). this_read_length = strlen(line); ANALYSIS SUMMARY: Hits = 43 Lines analyzed = 3867 in approximately 0.14 seconds (27520 lines/second) Physical Source Lines of Code (SLOC) = 2515 Hits@level = [0] 6 [1] 37 [2] 6 [3] 0 [4] 0 [5] 0 Hits@level+ = [0+] 49 [1+] 43 [2+] 6 [3+] 0 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 19.4831 [1+] 17.0974 [2+] 2.38569 [3+] 0 [4+] 0 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.