Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/sdpb-1.0/src/BlockDiagonalMatrix.cpp
Examining data/sdpb-1.0/src/BlockDiagonalMatrix.h
Examining data/sdpb-1.0/src/Matrix.cpp
Examining data/sdpb-1.0/src/Matrix.h
Examining data/sdpb-1.0/src/Polynomial.h
Examining data/sdpb-1.0/src/SDP.cpp
Examining data/sdpb-1.0/src/SDP.h
Examining data/sdpb-1.0/src/SDPSolver.cpp
Examining data/sdpb-1.0/src/SDPSolver.h
Examining data/sdpb-1.0/src/SDPSolverIO.cpp
Examining data/sdpb-1.0/src/Timers.h
Examining data/sdpb-1.0/src/Vector.h
Examining data/sdpb-1.0/src/main.cpp
Examining data/sdpb-1.0/src/mpack/Mlsame.cpp
Examining data/sdpb-1.0/src/mpack/Mxerbla.cpp
Examining data/sdpb-1.0/src/mpack/Raxpy.cpp
Examining data/sdpb-1.0/src/mpack/Rcopy.cpp
Examining data/sdpb-1.0/src/mpack/Rdot.cpp
Examining data/sdpb-1.0/src/mpack/Rgemm.cpp
Examining data/sdpb-1.0/src/mpack/RgemmParallel.cpp
Examining data/sdpb-1.0/src/mpack/Rgemv.cpp
Examining data/sdpb-1.0/src/mpack/Rger.cpp
Examining data/sdpb-1.0/src/mpack/Rgetf2.cpp
Examining data/sdpb-1.0/src/mpack/Rgetrf.cpp
Examining data/sdpb-1.0/src/mpack/Rgetrs.cpp
Examining data/sdpb-1.0/src/mpack/Rlae2.cpp
Examining data/sdpb-1.0/src/mpack/Rlaev2.cpp
Examining data/sdpb-1.0/src/mpack/Rlamch.cpp
Examining data/sdpb-1.0/src/mpack/Rlanst.cpp
Examining data/sdpb-1.0/src/mpack/Rlansy.cpp
Examining data/sdpb-1.0/src/mpack/Rlapy2.cpp
Examining data/sdpb-1.0/src/mpack/Rlarf.cpp
Examining data/sdpb-1.0/src/mpack/Rlarfb.cpp
Examining data/sdpb-1.0/src/mpack/Rlarfg.cpp
Examining data/sdpb-1.0/src/mpack/Rlarft.cpp
Examining data/sdpb-1.0/src/mpack/Rlartg.cpp
Examining data/sdpb-1.0/src/mpack/Rlascl.cpp
Examining data/sdpb-1.0/src/mpack/Rlaset.cpp
Examining data/sdpb-1.0/src/mpack/Rlasr.cpp
Examining data/sdpb-1.0/src/mpack/Rlasrt.cpp
Examining data/sdpb-1.0/src/mpack/Rlassq.cpp
Examining data/sdpb-1.0/src/mpack/Rlaswp.cpp
Examining data/sdpb-1.0/src/mpack/Rlatrd.cpp
Examining data/sdpb-1.0/src/mpack/Rnrm2.cpp
Examining data/sdpb-1.0/src/mpack/Rorg2l.cpp
Examining data/sdpb-1.0/src/mpack/Rorg2r.cpp
Examining data/sdpb-1.0/src/mpack/Rorgql.cpp
Examining data/sdpb-1.0/src/mpack/Rorgqr.cpp
Examining data/sdpb-1.0/src/mpack/Rorgtr.cpp
Examining data/sdpb-1.0/src/mpack/Rpotf2.cpp
Examining data/sdpb-1.0/src/mpack/Rpotf2Stabilized.cpp
Examining data/sdpb-1.0/src/mpack/Rpotrf.cpp
Examining data/sdpb-1.0/src/mpack/RpotrfStabilized.cpp
Examining data/sdpb-1.0/src/mpack/Rrot.cpp
Examining data/sdpb-1.0/src/mpack/Rrotg.cpp
Examining data/sdpb-1.0/src/mpack/Rscal.cpp
Examining data/sdpb-1.0/src/mpack/Rsteqr.cpp
Examining data/sdpb-1.0/src/mpack/Rsterf.cpp
Examining data/sdpb-1.0/src/mpack/Rswap.cpp
Examining data/sdpb-1.0/src/mpack/Rsyev.cpp
Examining data/sdpb-1.0/src/mpack/Rsymv.cpp
Examining data/sdpb-1.0/src/mpack/Rsyr2.cpp
Examining data/sdpb-1.0/src/mpack/Rsyr2k.cpp
Examining data/sdpb-1.0/src/mpack/Rsyrk.cpp
Examining data/sdpb-1.0/src/mpack/Rsytd2.cpp
Examining data/sdpb-1.0/src/mpack/Rsytrd.cpp
Examining data/sdpb-1.0/src/mpack/Rtrmm.cpp
Examining data/sdpb-1.0/src/mpack/Rtrmv.cpp
Examining data/sdpb-1.0/src/mpack/Rtrsm.cpp
Examining data/sdpb-1.0/src/mpack/Rtrsv.cpp
Examining data/sdpb-1.0/src/mpack/iMlaenv.cpp
Examining data/sdpb-1.0/src/mpack/iRamax.cpp
Examining data/sdpb-1.0/src/mpack/mblas.h
Examining data/sdpb-1.0/src/mpack/mblas_gmp.h
Examining data/sdpb-1.0/src/mpack/mblas_mpfr.h
Examining data/sdpb-1.0/src/mpack/mlapack.h
Examining data/sdpb-1.0/src/mpack/mlapack_gmp.h
Examining data/sdpb-1.0/src/mpack/mlapack_mpfr.h
Examining data/sdpb-1.0/src/mpack/mpack_config.h
Examining data/sdpb-1.0/src/mpack/mpreal.h
Examining data/sdpb-1.0/src/mpack/mutils_gmp.h
Examining data/sdpb-1.0/src/mpack/mutils_mpfr.h
Examining data/sdpb-1.0/src/parse.h
Examining data/sdpb-1.0/src/serialize.h
Examining data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp
Examining data/sdpb-1.0/src/tinyxml2/tinyxml2.h
Examining data/sdpb-1.0/src/types.h
Examining data/sdpb-1.0/src/parse.cpp
FINAL RESULTS:
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1764:9: [4] (format) vfprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
vfprintf( _fp, format, va );
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1782:19: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
int len = vsnprintf( 0, 0, format, va );
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1787:9: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
vsnprintf( p, len+1, format, va );
data/sdpb-1.0/src/tinyxml2/tinyxml2.h:97:24: [4] (format) snprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
#define TIXML_SNPRINTF snprintf
data/sdpb-1.0/src/tinyxml2/tinyxml2.h:98:24: [4] (buffer) sscanf:
The scanf() family's %s operation, without a limit specification, permits
buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
different input function.
#define TIXML_SSCANF sscanf
data/sdpb-1.0/src/mpack/iMlaenv.cpp:218:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char Mlaname[MLANAMESIZE + 1] = "000000";
data/sdpb-1.0/src/parse.cpp:53:10: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
return atoi(xml->GetText());
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:105:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( _start, str, len+1 );
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:217:25: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[10] = { 0 };
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1063:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char endTag[2] = { *p, 0 };
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1130:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUF_SIZE];
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1138:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUF_SIZE];
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1146:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUF_SIZE];
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1153:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUF_SIZE];
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1160:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUF_SIZE];
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1591:10: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fp = fopen( filename, "rb" );
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1645:10: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fp = fopen( filename, "w" );
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1678:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( _charBuffer, p, len );
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1716:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf1[LEN] = { 0 };
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1717:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf2[LEN] = { 0 };
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1780:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( p, _accumulator.Mem(), len+1 );
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1882:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUF_SIZE];
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1890:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUF_SIZE];
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1898:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUF_SIZE];
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1906:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUF_SIZE];
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1964:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUF_SIZE];
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1972:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUF_SIZE];
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1980:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUF_SIZE];
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1988:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUF_SIZE];
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1996:5: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[BUF_SIZE];
data/sdpb-1.0/src/tinyxml2/tinyxml2.h:259:13: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy( newMem, _mem, sizeof(T)*_size ); // warning: not using constructors, only works for PODs
data/sdpb-1.0/src/tinyxml2/tinyxml2.h:376:9: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char mem[SIZE];
data/sdpb-1.0/src/mpack/iMlaenv.cpp:220:11: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen(name);
data/sdpb-1.0/src/mpack/iMlaenv.cpp:221:5: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy(Mlaname, name, (len > MLANAMESIZE) ? MLANAMESIZE : len);
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:103:18: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t len = strlen( str );
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:117:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
size_t length = strlen( endTag );
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1618:10: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if ( read != size ) {
data/sdpb-1.0/src/tinyxml2/tinyxml2.cpp:1675:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
len = strlen( p );
ANALYSIS SUMMARY:
Hits = 38
Lines analyzed = 21874 in approximately 0.61 seconds (35695 lines/second)
Physical Source Lines of Code (SLOC) = 12762
Hits@level = [0] 7 [1] 6 [2] 27 [3] 0 [4] 5 [5] 0
Hits@level+ = [0+] 45 [1+] 38 [2+] 32 [3+] 5 [4+] 5 [5+] 0
Hits/KSLOC@level+ = [0+] 3.52609 [1+] 2.97759 [2+] 2.50744 [3+] 0.391788 [4+] 0.391788 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.