Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/shapeit4-4.1.3+dfsg/src/containers/bitmatrix.h
Examining data/shapeit4-4.1.3+dfsg/src/containers/genotype_set.cpp
Examining data/shapeit4-4.1.3+dfsg/src/containers/genotype_set.h
Examining data/shapeit4-4.1.3+dfsg/src/containers/haplotype_set.cpp
Examining data/shapeit4-4.1.3+dfsg/src/containers/haplotype_set.h
Examining data/shapeit4-4.1.3+dfsg/src/containers/variant_map.cpp
Examining data/shapeit4-4.1.3+dfsg/src/containers/variant_map.h
Examining data/shapeit4-4.1.3+dfsg/src/io/genotype_reader.h
Examining data/shapeit4-4.1.3+dfsg/src/io/genotype_reader1.cpp
Examining data/shapeit4-4.1.3+dfsg/src/io/genotype_reader2.cpp
Examining data/shapeit4-4.1.3+dfsg/src/io/gmap_reader.cpp
Examining data/shapeit4-4.1.3+dfsg/src/io/gmap_reader.h
Examining data/shapeit4-4.1.3+dfsg/src/io/haplotype_writer.cpp
Examining data/shapeit4-4.1.3+dfsg/src/io/haplotype_writer.h
Examining data/shapeit4-4.1.3+dfsg/src/main.cpp
Examining data/shapeit4-4.1.3+dfsg/src/models/haplotype_segment_double.cpp
Examining data/shapeit4-4.1.3+dfsg/src/models/haplotype_segment_double.h
Examining data/shapeit4-4.1.3+dfsg/src/models/haplotype_segment_single.cpp
Examining data/shapeit4-4.1.3+dfsg/src/models/haplotype_segment_single.h
Examining data/shapeit4-4.1.3+dfsg/src/modules/builder.cpp
Examining data/shapeit4-4.1.3+dfsg/src/modules/builder.h
Examining data/shapeit4-4.1.3+dfsg/src/modules/pbwt_solver.cpp
Examining data/shapeit4-4.1.3+dfsg/src/modules/pbwt_solver.h
Examining data/shapeit4-4.1.3+dfsg/src/objects/compute_job.cpp
Examining data/shapeit4-4.1.3+dfsg/src/objects/compute_job.h
Examining data/shapeit4-4.1.3+dfsg/src/objects/genotype/genotype_build.cpp
Examining data/shapeit4-4.1.3+dfsg/src/objects/genotype/genotype_header.h
Examining data/shapeit4-4.1.3+dfsg/src/objects/genotype/genotype_managment.cpp
Examining data/shapeit4-4.1.3+dfsg/src/objects/genotype/genotype_mask.cpp
Examining data/shapeit4-4.1.3+dfsg/src/objects/genotype/genotype_prune.cpp
Examining data/shapeit4-4.1.3+dfsg/src/objects/genotype/genotype_sweep.cpp
Examining data/shapeit4-4.1.3+dfsg/src/objects/hmm_parameters.cpp
Examining data/shapeit4-4.1.3+dfsg/src/objects/hmm_parameters.h
Examining data/shapeit4-4.1.3+dfsg/src/objects/variant.cpp
Examining data/shapeit4-4.1.3+dfsg/src/objects/variant.h
Examining data/shapeit4-4.1.3+dfsg/src/phaser/phaser_algorithm.cpp
Examining data/shapeit4-4.1.3+dfsg/src/phaser/phaser_finalise.cpp
Examining data/shapeit4-4.1.3+dfsg/src/phaser/phaser_header.h
Examining data/shapeit4-4.1.3+dfsg/src/phaser/phaser_initialise.cpp
Examining data/shapeit4-4.1.3+dfsg/src/phaser/phaser_management.cpp
Examining data/shapeit4-4.1.3+dfsg/src/phaser/phaser_parameters.cpp
Examining data/shapeit4-4.1.3+dfsg/src/utils/basic_algos.h
Examining data/shapeit4-4.1.3+dfsg/src/utils/basic_stats.h
Examining data/shapeit4-4.1.3+dfsg/src/utils/compressed_io.h
Examining data/shapeit4-4.1.3+dfsg/src/utils/otools.h
Examining data/shapeit4-4.1.3+dfsg/src/utils/random_number.h
Examining data/shapeit4-4.1.3+dfsg/src/utils/string_utils.h
Examining data/shapeit4-4.1.3+dfsg/src/utils/timer.h
Examining data/shapeit4-4.1.3+dfsg/src/utils/verbose.h
FINAL RESULTS:
data/shapeit4-4.1.3+dfsg/src/containers/bitmatrix.h:70:39: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
union { unsigned int x[2]; unsigned char b[8]; } m4x8d;
data/shapeit4-4.1.3+dfsg/src/io/gmap_reader.cpp:45:18: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
int curr_bp = atoi(tokens[0].c_str());
data/shapeit4-4.1.3+dfsg/src/models/haplotype_segment_double.h:157:11: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
if (a) memcpy(&prob2[i], &galleles1[0], HAP_NUMBER*sizeof(double));
data/shapeit4-4.1.3+dfsg/src/models/haplotype_segment_double.h:158:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
else memcpy(&prob2[i], &galleles0[0], HAP_NUMBER*sizeof(double));
data/shapeit4-4.1.3+dfsg/src/models/haplotype_segment_double.h:163:11: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
if (a) memcpy(&prob1[i], &galleles1[0], HAP_NUMBER*sizeof(double));
data/shapeit4-4.1.3+dfsg/src/models/haplotype_segment_double.h:164:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
else memcpy(&prob1[i], &galleles0[0], HAP_NUMBER*sizeof(double));
data/shapeit4-4.1.3+dfsg/src/models/haplotype_segment_single.h:161:11: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
if (a) memcpy(&prob2[i], &galleles1[0], HAP_NUMBER*sizeof(float));
data/shapeit4-4.1.3+dfsg/src/models/haplotype_segment_single.h:162:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
else memcpy(&prob2[i], &galleles0[0], HAP_NUMBER*sizeof(float));
data/shapeit4-4.1.3+dfsg/src/models/haplotype_segment_single.h:167:11: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
if (a) memcpy(&prob1[i], &galleles1[0], HAP_NUMBER*sizeof(float));
data/shapeit4-4.1.3+dfsg/src/models/haplotype_segment_single.h:168:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
else memcpy(&prob1[i], &galleles0[0], HAP_NUMBER*sizeof(float));
data/shapeit4-4.1.3+dfsg/src/objects/genotype/genotype_header.h:84:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char curr_dipcodes [64]; // List of diplotypes in a given segment
data/shapeit4-4.1.3+dfsg/src/objects/genotype/genotype_mask.cpp:36:12: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char prev_dipcodes [64];
data/shapeit4-4.1.3+dfsg/src/objects/genotype/genotype_prune.cpp:50:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char prev_dipcodes [64];
data/shapeit4-4.1.3+dfsg/src/objects/genotype/genotype_prune.cpp:146:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char prev_dipcodes [64];
data/shapeit4-4.1.3+dfsg/src/utils/compressed_io.h:42:20: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
file_descriptor.open(filename.c_str(), std::ios::in | std::ios::binary);
data/shapeit4-4.1.3+dfsg/src/utils/compressed_io.h:45:20: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
file_descriptor.open(filename.c_str(), std::ios::in | std::ios::binary);
data/shapeit4-4.1.3+dfsg/src/utils/compressed_io.h:47:26: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
} else file_descriptor.open(filename.c_str());
data/shapeit4-4.1.3+dfsg/src/utils/compressed_io.h:74:20: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
file_descriptor.open(filename.c_str(), std::ios::out | std::ios::binary);
data/shapeit4-4.1.3+dfsg/src/utils/compressed_io.h:77:20: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
file_descriptor.open(filename.c_str(), std::ios::out | std::ios::binary);
data/shapeit4-4.1.3+dfsg/src/utils/compressed_io.h:79:26: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
} else file_descriptor.open(filename.c_str());
data/shapeit4-4.1.3+dfsg/src/utils/verbose.h:66:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
log.open(fname.c_str());
ANALYSIS SUMMARY:
Hits = 21
Lines analyzed = 6288 in approximately 0.23 seconds (27159 lines/second)
Physical Source Lines of Code (SLOC) = 4361
Hits@level = [0] 0 [1] 0 [2] 21 [3] 0 [4] 0 [5] 0
Hits@level+ = [0+] 21 [1+] 21 [2+] 21 [3+] 0 [4+] 0 [5+] 0
Hits/KSLOC@level+ = [0+] 4.81541 [1+] 4.81541 [2+] 4.81541 [3+] 0 [4+] 0 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.