Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/r-cran-sparsesvd-0.2/src/main.c
Examining data/r-cran-sparsesvd-0.2/src/svdlib.c
Examining data/r-cran-sparsesvd-0.2/src/svdlib.h
Examining data/r-cran-sparsesvd-0.2/src/svdutil.c
Examining data/r-cran-sparsesvd-0.2/src/svdutil.h
Examining data/r-cran-sparsesvd-0.2/src/las2.c

FINAL RESULTS:

data/r-cran-sparsesvd-0.2/src/svdlib.c:318:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(title, "SVDLIBC v. %s", SVDVersion);
data/r-cran-sparsesvd-0.2/src/svdutil.c:133:15:  [4] (shell) popen:
  This causes a new program to execute and is difficult to use safely
  (CWE-78). try using a library call that implements the same functionality
  if available.
  if ((pipe = popen(pipeName, mode))) registerPipe(pipe);
data/r-cran-sparsesvd-0.2/src/svdutil.c:139:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(buf, "%s < %s 2>/dev/null", command, fileName);
data/r-cran-sparsesvd-0.2/src/svdutil.c:187:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(fileBuf, "%s.gz", fileName);
data/r-cran-sparsesvd-0.2/src/svdutil.c:191:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(fileBuf, "%s.Z", fileName);
data/r-cran-sparsesvd-0.2/src/svdutil.c:195:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(fileBuf, "%s.bz2", fileName);
data/r-cran-sparsesvd-0.2/src/svdutil.c:199:3:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
  sprintf(fileBuf, "%s.bz", fileName);
data/r-cran-sparsesvd-0.2/src/svdutil.c:210:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(buf, "%s %s \"%s\"", BZIP2, op, fileName);
data/r-cran-sparsesvd-0.2/src/svdutil.c:212:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(buf, "%s %s \"%s\"", COMPRESS, op, fileName);
data/r-cran-sparsesvd-0.2/src/svdutil.c:214:5:  [4] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf.
    sprintf(buf, "%s %s \"%s\"", ZIP, op, fileName);
data/r-cran-sparsesvd-0.2/src/svdlib.c:258:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char line[128];
data/r-cran-sparsesvd-0.2/src/svdlib.c:317:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char title[32];
data/r-cran-sparsesvd-0.2/src/svdutil.c:138:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[MAX_FILENAME];
data/r-cran-sparsesvd-0.2/src/svdutil.c:159:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char fileBuf[MAX_FILENAME];
data/r-cran-sparsesvd-0.2/src/svdutil.c:185:12:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    return fopen(fileName, "r");
data/r-cran-sparsesvd-0.2/src/svdutil.c:207:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[MAX_FILENAME];
data/r-cran-sparsesvd-0.2/src/svdutil.c:232:21:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  return (append) ? fopen(fileName, "a") : fopen(fileName, "w");
data/r-cran-sparsesvd-0.2/src/svdutil.c:232:44:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  return (append) ? fopen(fileName, "a") : fopen(fileName, "w");
data/r-cran-sparsesvd-0.2/src/svdutil.c:151:12:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  int ls = strlen(s);
data/r-cran-sparsesvd-0.2/src/svdutil.c:152:12:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  int lt = strlen(t);

ANALYSIS SUMMARY:

Hits = 20
Lines analyzed = 3627 in approximately 0.13 seconds (28755 lines/second)
Physical Source Lines of Code (SLOC) = 2008
Hits@level = [0]  30 [1]   2 [2]   8 [3]   0 [4]  10 [5]   0
Hits@level+ = [0+]  50 [1+]  20 [2+]  18 [3+]  10 [4+]  10 [5+]   0
Hits/KSLOC@level+ = [0+] 24.9004 [1+] 9.96016 [2+] 8.96414 [3+] 4.98008 [4+] 4.98008 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.