Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/r-cran-bio3d-2.4-1/src/read_prmtop.cpp Examining data/r-cran-bio3d-2.4-1/src/init.c Examining data/r-cran-bio3d-2.4-1/src/read_crd.cpp Examining data/r-cran-bio3d-2.4-1/src/gzstream.h Examining data/r-cran-bio3d-2.4-1/src/utils.h Examining data/r-cran-bio3d-2.4-1/src/read_cif.cpp Examining data/r-cran-bio3d-2.4-1/src/read_pdb.cpp Examining data/r-cran-bio3d-2.4-1/src/utils.cpp Examining data/r-cran-bio3d-2.4-1/src/gzstream.cpp Examining data/r-cran-bio3d-2.4-1/src/convert.h Examining data/r-cran-bio3d-2.4-1/src/RcppExports.cpp FINAL RESULTS: data/r-cran-bio3d-2.4-1/src/gzstream.cpp:45:27: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). gzstreambuf* gzstreambuf::open( const char* name, int open_mode) { data/r-cran-bio3d-2.4-1/src/gzstream.cpp:53:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char fmode[10]; data/r-cran-bio3d-2.4-1/src/gzstream.cpp:88:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy( buffer + (4 - n_putback), gptr() - n_putback, n_putback); data/r-cran-bio3d-2.4-1/src/gzstream.cpp:142:5: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). open( name, mode); data/r-cran-bio3d-2.4-1/src/gzstream.cpp:149:20: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). void gzstreambase::open( const char* name, int open_mode) { data/r-cran-bio3d-2.4-1/src/gzstream.cpp:150:16: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). if ( ! buf.open( name, open_mode)) data/r-cran-bio3d-2.4-1/src/gzstream.h:57:1: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buffer[bufferSize]; // data buffer data/r-cran-bio3d-2.4-1/src/gzstream.h:70:14: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). gzstreambuf* open( const char* name, int open_mode); data/r-cran-bio3d-2.4-1/src/gzstream.h:84:6: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). void open( const char* name, int open_mode); data/r-cran-bio3d-2.4-1/src/gzstream.h:99:6: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). void open( const char* name, int open_mode = std::ios::in) { data/r-cran-bio3d-2.4-1/src/gzstream.h:100:15: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). gzstreambase::open( name, open_mode); data/r-cran-bio3d-2.4-1/src/gzstream.h:110:6: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). void open( const char* name, int open_mode = std::ios::out) { data/r-cran-bio3d-2.4-1/src/gzstream.h:111:15: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). gzstreambase::open( name, open_mode); data/r-cran-bio3d-2.4-1/src/read_cif.cpp:89:12: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). mystream.open(filename.c_str()); data/r-cran-bio3d-2.4-1/src/read_crd.cpp:41:10: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). myfile.open(filename.c_str()); data/r-cran-bio3d-2.4-1/src/read_pdb.cpp:99:12: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). mystream.open(filename.c_str()); data/r-cran-bio3d-2.4-1/src/read_prmtop.cpp:89:10: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). myfile.open(filename.c_str()); ANALYSIS SUMMARY: Hits = 17 Lines analyzed = 1453 in approximately 0.06 seconds (23120 lines/second) Physical Source Lines of Code (SLOC) = 953 Hits@level = [0] 0 [1] 0 [2] 17 [3] 0 [4] 0 [5] 0 Hits@level+ = [0+] 17 [1+] 17 [2+] 17 [3+] 0 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 17.8384 [1+] 17.8384 [2+] 17.8384 [3+] 0 [4+] 0 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.