Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/scikit-learn-0.23.2/sklearn/linear_model/_sgd_fast_helpers.h
Examining data/scikit-learn-0.23.2/sklearn/svm/src/liblinear/_cython_blas_helpers.h
Examining data/scikit-learn-0.23.2/sklearn/svm/src/liblinear/liblinear_helper.c
Examining data/scikit-learn-0.23.2/sklearn/svm/src/liblinear/linear.cpp
Examining data/scikit-learn-0.23.2/sklearn/svm/src/liblinear/linear.h
Examining data/scikit-learn-0.23.2/sklearn/svm/src/liblinear/tron.cpp
Examining data/scikit-learn-0.23.2/sklearn/svm/src/liblinear/tron.h
Examining data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_helper.c
Examining data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_sparse_helper.c
Examining data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_template.cpp
Examining data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/svm.cpp
Examining data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/svm.h
Examining data/scikit-learn-0.23.2/sklearn/svm/src/newrand/newrand.h
Examining data/scikit-learn-0.23.2/sklearn/utils/src/MurmurHash3.cpp
Examining data/scikit-learn-0.23.2/sklearn/utils/src/MurmurHash3.h
FINAL RESULTS:
data/scikit-learn-0.23.2/sklearn/svm/src/liblinear/linear.cpp:76:2: [4] (format) vsprintf:
Potential format string problem (CWE-134). Make format string constant.
vsprintf(buf,fmt,ap);
data/scikit-learn-0.23.2/sklearn/svm/src/liblinear/tron.cpp:26:2: [4] (format) vsprintf:
Potential format string problem (CWE-134). Make format string constant.
vsprintf(buf,fmt,ap);
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/svm.cpp:114:2: [4] (format) vsprintf:
Potential format string problem (CWE-134). Make format string constant.
vsprintf(buf,fmt,ap);
data/scikit-learn-0.23.2/sklearn/svm/src/liblinear/liblinear_helper.c:199:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, model->w, len * sizeof(double));
data/scikit-learn-0.23.2/sklearn/svm/src/liblinear/linear.cpp:57:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((void *)dst,(void *)src,sizeof(T)*n);
data/scikit-learn-0.23.2/sklearn/svm/src/liblinear/linear.cpp:73:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUFSIZ];
data/scikit-learn-0.23.2/sklearn/svm/src/liblinear/linear.cpp:2760:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *fp = fopen(model_file_name,"w");
data/scikit-learn-0.23.2/sklearn/svm/src/liblinear/linear.cpp:2805:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
FILE *fp = fopen(model_file_name,"r");
data/scikit-learn-0.23.2/sklearn/svm/src/liblinear/linear.cpp:2821:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char cmd[81];
data/scikit-learn-0.23.2/sklearn/svm/src/liblinear/tron.cpp:23:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUFSIZ];
data/scikit-learn-0.23.2/sklearn/svm/src/liblinear/tron.cpp:80:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(w_new, w, sizeof(double)*n);
data/scikit-learn-0.23.2/sklearn/svm/src/liblinear/tron.cpp:116:4: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(w, w_new, sizeof(double)*n);
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_helper.c:150:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(model->nSV, nSV, model->nr_class * sizeof(int));
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_helper.c:171:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(model->probA, probA, m * sizeof(double));
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_helper.c:174:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(model->probB, probB, m * sizeof(double));
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_helper.c:231:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(temp, model->sv_coef[i], sizeof(double) * model->l);
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_helper.c:260:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (tdata, model->SV[i].values, dim * sizeof(double));
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_helper.c:267:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (data, model->sv_ind, (model->l) * sizeof(int));
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_helper.c:277:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, model->nSV, model->nr_class * sizeof(int));
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_helper.c:282:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, model->probA, dims[0] * sizeof(double));
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_helper.c:287:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, model->probB, dims[0] * sizeof(double));
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_sparse_helper.c:138:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(model->nSV, nSV, model->nr_class * sizeof(int));
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_sparse_helper.c:154:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(model->sv_coef[i], dsv_coef, (model->l) * sizeof(double));
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_sparse_helper.c:170:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(model->probA, probA, m * sizeof(double));
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_sparse_helper.c:173:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(model->probB, probB, m * sizeof(double));
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_sparse_helper.c:332:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy (data, model->sv_ind, (model->l) * sizeof(int));
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_sparse_helper.c:345:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(temp, model->sv_coef[i], sizeof(double) * model->l);
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_sparse_helper.c:361:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, model->nSV, model->nr_class * sizeof(int));
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_sparse_helper.c:371:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, model->label, model->nr_class * sizeof(int));
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_sparse_helper.c:376:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, model->probA, dims[0] * sizeof(double));
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/libsvm_sparse_helper.c:381:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(data, model->probB, dims[0] * sizeof(double));
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/svm.cpp:85:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((void *)dst,(void *)src,sizeof(T)*n);
data/scikit-learn-0.23.2/sklearn/svm/src/libsvm/svm.cpp:111:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUFSIZ];
data/scikit-learn-0.23.2/sklearn/svm/src/liblinear/linear.cpp:2824:3: [1] (buffer) fscanf:
It's unclear if the %s limit in the format string is small enough
(CWE-120). Check that the limit is sufficiently small, or use a different
input function.
fscanf(fp,"%80s",cmd);
data/scikit-learn-0.23.2/sklearn/svm/src/liblinear/linear.cpp:2827:4: [1] (buffer) fscanf:
It's unclear if the %s limit in the format string is small enough
(CWE-120). Check that the limit is sufficiently small, or use a different
input function.
fscanf(fp,"%80s",cmd);
ANALYSIS SUMMARY:
Hits = 35
Lines analyzed = 8333 in approximately 2.25 seconds (3696 lines/second)
Physical Source Lines of Code (SLOC) = 6596
Hits@level = [0] 23 [1] 2 [2] 30 [3] 0 [4] 3 [5] 0
Hits@level+ = [0+] 58 [1+] 35 [2+] 33 [3+] 3 [4+] 3 [5+] 0
Hits/KSLOC@level+ = [0+] 8.79321 [1+] 5.30625 [2+] 5.00303 [3+] 0.454821 [4+] 0.454821 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.