Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/r-bioc-shortread-1.48.0/src/Biostrings_stubs.c
Examining data/r-bioc-shortread-1.48.0/src/IRanges_stubs.c
Examining data/r-bioc-shortread-1.48.0/src/R_init_ShortRead.c
Examining data/r-bioc-shortread-1.48.0/src/S4Vectors_stubs.c
Examining data/r-bioc-shortread-1.48.0/src/ShortRead.h
Examining data/r-bioc-shortread-1.48.0/src/XVector_stubs.c
Examining data/r-bioc-shortread-1.48.0/src/alphabet.c
Examining data/r-bioc-shortread-1.48.0/src/call.h
Examining data/r-bioc-shortread-1.48.0/src/const.h
Examining data/r-bioc-shortread-1.48.0/src/count.c
Examining data/r-bioc-shortread-1.48.0/src/io.c
Examining data/r-bioc-shortread-1.48.0/src/io_bowtie.c
Examining data/r-bioc-shortread-1.48.0/src/io_soap.c
Examining data/r-bioc-shortread-1.48.0/src/maqmap_m.h
Examining data/r-bioc-shortread-1.48.0/src/readBfaToc.cc
Examining data/r-bioc-shortread-1.48.0/src/read_maq_map.cc
Examining data/r-bioc-shortread-1.48.0/src/sampler.c
Examining data/r-bioc-shortread-1.48.0/src/trim.c
Examining data/r-bioc-shortread-1.48.0/src/trim.h
Examining data/r-bioc-shortread-1.48.0/src/util.c
Examining data/r-bioc-shortread-1.48.0/src/xsnap.c
FINAL RESULTS:
data/r-bioc-shortread-1.48.0/src/io.c:111:17: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
snprintf(gzbuf, gzbuf_n, fmt, idbuf0, readbuf, idbuf1, qualbuf);
data/r-bioc-shortread-1.48.0/src/io.c:116:17: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
snprintf(gzbuf, gzbuf_n, fmt, idbuf0, readbuf, idbuf1, qualbuf);
data/r-bioc-shortread-1.48.0/src/io.c:120:17: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
if (fprintf(fout, fmt, idbuf0, readbuf, idbuf1, qualbuf) < 0) {
data/r-bioc-shortread-1.48.0/src/xsnap.c:107:5: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(buffer->baseclass, baseclass);
data/r-bioc-shortread-1.48.0/src/xsnap.c:243:5: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(class, "%sSet", baseclass);
data/r-bioc-shortread-1.48.0/src/io.c:92:16: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fout = fopen(CHAR(STRING_ELT(fname, 0)), CHAR(STRING_ELT(fmode, 0)));
data/r-bioc-shortread-1.48.0/src/io.c:223:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[LINEBUF_SIZE + 1];
data/r-bioc-shortread-1.48.0/src/io.c:277:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char linebuf[LINEBUF_SIZE];
data/r-bioc-shortread-1.48.0/src/io.c:585:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char linebuf[LINEBUF_SIZE],
data/r-bioc-shortread-1.48.0/src/io.c:628:22: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
lane[irec] = atoi(elt[2]);
data/r-bioc-shortread-1.48.0/src/io.c:629:22: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
tile[irec] = atoi(elt[3]);
data/r-bioc-shortread-1.48.0/src/io.c:630:19: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
x[irec] = atoi(elt[4]);
data/r-bioc-shortread-1.48.0/src/io.c:631:19: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
y[irec] = atoi(elt[5]);
data/r-bioc-shortread-1.48.0/src/io.c:637:38: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
pairedReadNumber[irec] = atoi(elt[7]);
data/r-bioc-shortread-1.48.0/src/io.c:645:30: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
position[irec] = atoi(elt[12]);
data/r-bioc-shortread-1.48.0/src/io.c:664:30: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
alignQuality[irec] = atoi(elt[15]);
data/r-bioc-shortread-1.48.0/src/io.c:708:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[LINEBUF_SIZE];
data/r-bioc-shortread-1.48.0/src/io_bowtie.c:21:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char linebuf[LINEBUF_SIZE],
data/r-bioc-shortread-1.48.0/src/io_bowtie.c:52:26: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
position[irec] = atoi(elt[3]) + 1; /* leftmost-aligned, 0-based */
data/r-bioc-shortread-1.48.0/src/io_bowtie.c:59:25: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
similar[irec] = atoi(elt[6]); /* previous: 'reserved' */
data/r-bioc-shortread-1.48.0/src/io_soap.c:22:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char linebuf[LINEBUF_SIZE],
data/r-bioc-shortread-1.48.0/src/io_soap.c:53:36: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
nEquallyBestHits[offset] = atoi(elt[3]);
data/r-bioc-shortread-1.48.0/src/io_soap.c:55:33: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
alignedLength[offset] = atoi(elt[5]);
data/r-bioc-shortread-1.48.0/src/io_soap.c:58:28: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
position[offset] = atoi(elt[8]); /* leftmost-aligned, 1-based */
data/r-bioc-shortread-1.48.0/src/io_soap.c:59:29: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
typeOfHit[offset] = atoi(elt[9]);
data/r-bioc-shortread-1.48.0/src/maqmap_m.h:50:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[MAX_NAMELEN];
data/r-bioc-shortread-1.48.0/src/readBfaToc.cc:20:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char seq_name[201];
data/r-bioc-shortread-1.48.0/src/readBfaToc.cc:25:9: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fp = fopen( CHAR(STRING_ELT(bfa_filename,0)), "r" );
data/r-bioc-shortread-1.48.0/src/readBfaToc.cc:27:7: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[300];
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:29:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char readseqbuf[ max_readlen ], fastqbuf[ max_readlen ];
data/r-bioc-shortread-1.48.0/src/sampler.c:144:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((char *) x.ptr, start, (buf - start) * sizeof(Rbyte));
data/r-bioc-shortread-1.48.0/src/sampler.c:241:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(intern_record, record, len * sizeof(Rbyte));
data/r-bioc-shortread-1.48.0/src/sampler.c:319:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(bytes, record, len * sizeof(Rbyte));
data/r-bioc-shortread-1.48.0/src/sampler.c:357:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf, scratch->bytes, scratch->len * sizeof(Rbyte));
data/r-bioc-shortread-1.48.0/src/sampler.c:359:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf + scratch->len, RAW(bin), len * sizeof(Rbyte));
data/r-bioc-shortread-1.48.0/src/sampler.c:365:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buf, RAW(bin), buflen * sizeof(Rbyte));
data/r-bioc-shortread-1.48.0/src/sampler.c:389:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(tail, buf, len * sizeof(Rbyte));
data/r-bioc-shortread-1.48.0/src/sampler.c:510:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(scratch->bytes, RAW(bin), len * sizeof(Rbyte));
data/r-bioc-shortread-1.48.0/src/sampler.c:515:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(bytes, scratch->bytes, buflen * sizeof(Rbyte));
data/r-bioc-shortread-1.48.0/src/sampler.c:516:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(bytes + buflen, RAW(bin), len * sizeof(Rbyte));
data/r-bioc-shortread-1.48.0/src/sampler.c:550:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(tail, buf, len * sizeof(Rbyte));
data/r-bioc-shortread-1.48.0/src/util.c:198:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char linebuf[LINEBUF_SIZE];
data/r-bioc-shortread-1.48.0/src/util.c:199:17: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((file = fopen(CHAR(STRING_ELT(filename, 0)), "rb")) == NULL)
data/r-bioc-shortread-1.48.0/src/util.c:296:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char map[256];
data/r-bioc-shortread-1.48.0/src/xsnap.c:73:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(node->curr, s, w);
data/r-bioc-shortread-1.48.0/src/xsnap.c:86:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(RAW(seq), node->buf, n_raw);
data/r-bioc-shortread-1.48.0/src/xsnap.c:196:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char classname[40]; /* longest string should be "DNAStringSet" */
data/r-bioc-shortread-1.48.0/src/io.c:40:9: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(buf, chars_holder.ptr, chars_holder.length);
data/r-bioc-shortread-1.48.0/src/io.c:241:13: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (read >= n_reads) {
data/r-bioc-shortread-1.48.0/src/io_bowtie.c:60:24: [1] (buffer) mismatch:
Function does not check the second iterator for over-read conditions
(CWE-126). This function is often discouraged by most C++ coding standards
in favor of its safer alternatives provided since C++14. Consider using a
form of this function that checks the second iterator before potentially
overflowing it.
SET_STRING_ELT(mismatch, irec, mkChar(elt[7]));
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:32:28: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
maqmap1_T<max_readlen> read;
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:106:46: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
maqmap_read1<max_readlen>( mapfile, &read );
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:107:13: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if( read.flag || read.dist ) {
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:107:26: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if( read.flag || read.dist ) {
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:113:13: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if( read.size > max_readlen )
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:115:25: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
for (j = 0; j < read.size; j++) {
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:116:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (read.seq[j] == 0)
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:119:36: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
readseqbuf[j] = enc[ read.seq[j] >> 6 & 0x03 ];
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:120:29: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
fastqbuf[j] = ( read.seq[j] & 0x3f ) + 33;
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:122:21: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
readseqbuf[ read.size ] = 0;
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:123:21: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
fastqbuf [ read.size ] = 0;
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:126:31: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
INTEGER(start)[i] = ( read.pos >> 1 ) + 1;
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:127:31: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
INTEGER(dir )[i] = ( read.pos & 0x01 ) + 1; /* '+': 1, '-': 2 */
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:128:30: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
INTEGER(seq )[i] = read.seqid + 1;
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:129:30: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
INTEGER(aq )[i] = read.map_qual;
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:130:30: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
INTEGER(mm )[i] = read.info1 & 0x0f;
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:131:30: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
INTEGER(mm24 )[i] = read.info1 >> 4;
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:132:30: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
INTEGER(errsum)[i] = read.info2;
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:133:30: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
INTEGER(nhits0)[i] = read.c[0];
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:134:30: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
INTEGER(nhits1)[i] = read.c[1];
data/r-bioc-shortread-1.48.0/src/read_maq_map.cc:135:42: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
CharAEAE_append_string( readid, read.name );
data/r-bioc-shortread-1.48.0/src/util.c:263:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
i = strlen(linebuf) - 1;
data/r-bioc-shortread-1.48.0/src/util.c:283:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t len = strlen(linebuf);
data/r-bioc-shortread-1.48.0/src/util.c:312:34: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for (unsigned int i = 0; i < strlen(linebuf); ++i)
data/r-bioc-shortread-1.48.0/src/xsnap.c:104:32: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
buffer->baseclass = Calloc(strlen(baseclass) + 1, char);
data/r-bioc-shortread-1.48.0/src/xsnap.c:127:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int w = strlen(s);
data/r-bioc-shortread-1.48.0/src/xsnap.c:242:36: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
char *class = (char *) R_alloc(strlen(baseclass) + 4, sizeof(char));
ANALYSIS SUMMARY:
Hits = 77
Lines analyzed = 3606 in approximately 0.15 seconds (24849 lines/second)
Physical Source Lines of Code (SLOC) = 2953
Hits@level = [0] 10 [1] 30 [2] 42 [3] 0 [4] 5 [5] 0
Hits@level+ = [0+] 87 [1+] 77 [2+] 47 [3+] 5 [4+] 5 [5+] 0
Hits/KSLOC@level+ = [0+] 29.4616 [1+] 26.0752 [2+] 15.916 [3+] 1.69319 [4+] 1.69319 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.