Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/simka-1.5.2/src/core/KmerCountCompressor.hpp
Examining data/simka-1.5.2/src/core/Simka.cpp
Examining data/simka-1.5.2/src/core/Simka.hpp
Examining data/simka-1.5.2/src/core/SimkaAlgorithm.hpp
Examining data/simka-1.5.2/src/core/SimkaDistance.cpp
Examining data/simka-1.5.2/src/core/SimkaDistance.hpp
Examining data/simka-1.5.2/src/core/main.cpp
Examining data/simka-1.5.2/src/core/SimkaAlgorithm.cpp
Examining data/simka-1.5.2/src/core/SimkaCommons.hpp
Examining data/simka-1.5.2/src/minikc/MiniKC.hpp
Examining data/simka-1.5.2/src/minikc/SimkaCountProcess.cpp
Examining data/simka-1.5.2/src/simkaMin/MurmurHash3.cpp
Examining data/simka-1.5.2/src/simkaMin/MurmurHash3.h
Examining data/simka-1.5.2/src/simkaMin/SimkaMinAppend.hpp
Examining data/simka-1.5.2/src/simkaMin/SimkaMinCommons.hpp
Examining data/simka-1.5.2/src/simkaMin/SimkaMinCount.hpp
Examining data/simka-1.5.2/src/simkaMin/SimkaMinDistance.hpp
Examining data/simka-1.5.2/src/simkaMin/SimkaMinDistanceMatrixExporter.hpp
Examining data/simka-1.5.2/src/simkaMin/SimkaMinDistanceMatrixMerger.hpp
Examining data/simka-1.5.2/src/simkaMin/SimkaMinInfos.hpp
Examining data/simka-1.5.2/src/simkaMin/SimkaMin.cpp
Examining data/simka-1.5.2/src/SimkaCount.cpp
Examining data/simka-1.5.2/src/SimkaMerge.cpp
Examining data/simka-1.5.2/src/SimkaPotara.hpp
Examining data/simka-1.5.2/src/SimkaPotara.cpp
FINAL RESULTS:
data/simka-1.5.2/src/SimkaCount.cpp:323:5: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(command.c_str());
data/simka-1.5.2/src/SimkaMerge.cpp:31:29: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
using namespace gatb::core::system;
data/simka-1.5.2/src/SimkaMerge.cpp:32:29: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
using namespace gatb::core::system::impl;
data/simka-1.5.2/src/SimkaPotara.hpp:281:4: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(command.c_str());
data/simka-1.5.2/src/SimkaPotara.hpp:283:4: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(command.c_str());
data/simka-1.5.2/src/SimkaPotara.hpp:285:4: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(command.c_str());
data/simka-1.5.2/src/SimkaPotara.hpp:287:4: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(command.c_str());
data/simka-1.5.2/src/SimkaPotara.hpp:289:4: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(command.c_str());
data/simka-1.5.2/src/SimkaPotara.hpp:291:4: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(command.c_str());
data/simka-1.5.2/src/SimkaPotara.hpp:293:4: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(command.c_str());
data/simka-1.5.2/src/SimkaPotara.hpp:295:4: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(command.c_str());
data/simka-1.5.2/src/SimkaPotara.hpp:297:4: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(command.c_str());
data/simka-1.5.2/src/SimkaPotara.hpp:301:4: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(command.c_str());
data/simka-1.5.2/src/SimkaPotara.hpp:303:4: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(command.c_str());
data/simka-1.5.2/src/SimkaPotara.hpp:844:4: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(("echo \"" + str + "\" > " + logFilename).c_str());
data/simka-1.5.2/src/SimkaPotara.hpp:860:5: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(("chmod 755 " + jobFilename).c_str());
data/simka-1.5.2/src/SimkaPotara.hpp:869:5: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(submitCommand.c_str());
data/simka-1.5.2/src/SimkaPotara.hpp:873:5: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(command.c_str());
data/simka-1.5.2/src/SimkaPotara.hpp:1008:5: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(("echo \"" + str + "\" > " + logFilename).c_str());
data/simka-1.5.2/src/SimkaPotara.hpp:1014:6: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(("chmod 755 " + jobFilename).c_str());
data/simka-1.5.2/src/SimkaPotara.hpp:1023:6: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(submitCommand.c_str());
data/simka-1.5.2/src/SimkaPotara.hpp:1027:6: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(command.c_str());
data/simka-1.5.2/src/core/KmerCountCompressor.hpp:20:29: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
using namespace gatb::core::system;
data/simka-1.5.2/src/core/KmerCountCompressor.hpp:21:29: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
using namespace gatb::core::system::impl;
data/simka-1.5.2/src/minikc/SimkaCountProcess.cpp:24:9: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
ret = system(command.c_str());
data/simka-1.5.2/src/simkaMin/SimkaMinCount.hpp:733:3: [4] (shell) system:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
system(command.c_str());
data/simka-1.5.2/src/SimkaCount.cpp:188:24: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
IBank* bank = Bank::open(p.outputDir + "/input/" + p.bankName);
data/simka-1.5.2/src/SimkaMerge.cpp:1337:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer2[size];
data/simka-1.5.2/src/SimkaPotara.hpp:345:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer2[size];
data/simka-1.5.2/src/SimkaPotara.hpp:355:4: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer3[size];
data/simka-1.5.2/src/SimkaPotara.hpp:601:27: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
IBank* bank = Bank::open(inputDir + this->_bankNames[i]);
data/simka-1.5.2/src/SimkaPotara.hpp:641:31: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
IBank* inputbank = Bank::open(this->_banksInputFilename);
data/simka-1.5.2/src/SimkaPotara.hpp:644:23: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
IBank* bank = Bank::open(this->_outputDirTemp + "/input/" + this->_bankNames[chosenBankId]);
data/simka-1.5.2/src/core/KmerCountCompressor.hpp:126:6: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[40];
data/simka-1.5.2/src/core/KmerCountCompressor.hpp:619:22: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
_nbPartitions = atoi(numbers[0].c_str());
data/simka-1.5.2/src/core/KmerCountCompressor.hpp:620:17: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
_nbBanks = atoi(numbers[1].c_str());
data/simka-1.5.2/src/core/SimkaAlgorithm.cpp:362:24: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
IBank* bank = Bank::open(inputDir + _bankNames[i]);
data/simka-1.5.2/src/core/SimkaAlgorithm.cpp:401:24: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
IBank* bank = Bank::open(inputDir + _bankNames[i]);
data/simka-1.5.2/src/core/SimkaAlgorithm.cpp:547:22: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
IBank* bank = Bank::open(_banksInputFilename);
data/simka-1.5.2/src/core/SimkaAlgorithm.hpp:947:6: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[40];
data/simka-1.5.2/src/core/SimkaCommons.hpp:127:25: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
IBank* bank = Bank::open(subBankFilename);
data/simka-1.5.2/src/core/SimkaCommons.hpp:400:10: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char nt2binTab[128] = {
data/simka-1.5.2/src/core/SimkaDistance.cpp:610:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[200];
data/simka-1.5.2/src/simkaMin/SimkaMinAppend.hpp:109:15: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
_outputFile.open(_inputFilename1, ios::binary|ios::in);
data/simka-1.5.2/src/simkaMin/SimkaMinAppend.hpp:110:15: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
_inputFile2.open(_inputFilename2, ios::binary);
data/simka-1.5.2/src/simkaMin/SimkaMinAppend.hpp:133:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buffer[bufferSize];
data/simka-1.5.2/src/simkaMin/SimkaMinCount.hpp:905:15: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
_outputFile.open(_outputDir, ios::binary);
data/simka-1.5.2/src/simkaMin/SimkaMinCount.hpp:1136:23: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
IBank* bank = Bank::open(inputFilename);
data/simka-1.5.2/src/simkaMin/SimkaMinDistance.hpp:524:16: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
sketchFile_1.open(_inputFilename1.c_str(), ios::binary);
data/simka-1.5.2/src/simkaMin/SimkaMinDistance.hpp:526:16: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
sketchFile_2.open(_inputFilename2.c_str(), ios::binary);
data/simka-1.5.2/src/simkaMin/SimkaMinDistance.hpp:591:27: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
_distanceMatrixJaccard.open((_outputDir + "/mat_presenceAbsence_jaccard.bin").c_str(), ios::binary | ios::in);
data/simka-1.5.2/src/simkaMin/SimkaMinDistance.hpp:592:30: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
_distanceMatrixBrayCurtis.open((_outputDir + "/mat_abundance_braycurtis.bin").c_str(), ios::binary | ios::in);
data/simka-1.5.2/src/simkaMin/SimkaMinDistance.hpp:595:27: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
_distanceMatrixJaccard.open((_outputDir + "/mat_presenceAbsence_jaccard.bin").c_str(), ios::binary);
data/simka-1.5.2/src/simkaMin/SimkaMinDistance.hpp:596:30: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
_distanceMatrixBrayCurtis.open((_outputDir + "/mat_abundance_braycurtis.bin").c_str(), ios::binary);
data/simka-1.5.2/src/simkaMin/SimkaMinDistanceMatrixExporter.hpp:47:22: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
existingMatrixFile.open(existingMatrixFilename.c_str(), ios::binary);
data/simka-1.5.2/src/simkaMin/SimkaMinDistanceMatrixExporter.hpp:51:28: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
matrixFile_existingVsNew.open(newMatrixFilename_existingVsNew.c_str(), ios::binary);
data/simka-1.5.2/src/simkaMin/SimkaMinDistanceMatrixExporter.hpp:53:23: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
matrixFile_newVsNew.open(newMatrixFilename_newVsNew.c_str(), ios::binary);
data/simka-1.5.2/src/simkaMin/SimkaMinDistanceMatrixExporter.hpp:58:18: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
tempOutputFile.open(tempOutputFilename.c_str(), ios::binary);
data/simka-1.5.2/src/simkaMin/SimkaMinAppend.hpp:138:16: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
_inputFile2.read(buffer, size);
data/simka-1.5.2/src/simkaMin/SimkaMinCommons.hpp:88:8: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
file.read((char*)(&size), sizeof(size));
data/simka-1.5.2/src/simkaMin/SimkaMinCommons.hpp:90:8: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
file.read(&buffer[0], buffer.size());
data/simka-1.5.2/src/simkaMin/SimkaMinCommons.hpp:137:8: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
file.read((char*)(&kmerSize_), sizeof(kmerSize_));
data/simka-1.5.2/src/simkaMin/SimkaMinCommons.hpp:139:8: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
file.read((char*)(&sketchSize_), sizeof(sketchSize_));
data/simka-1.5.2/src/simkaMin/SimkaMinCommons.hpp:141:8: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
file.read((char*)(&seed_), sizeof(seed_));
data/simka-1.5.2/src/simkaMin/SimkaMinCommons.hpp:143:8: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
file.read((char*)(&nbDatasets_), sizeof(nbDatasets_));
data/simka-1.5.2/src/simkaMin/SimkaMinDistance.hpp:541:18: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
sketchFile_1.read((char*)&(_kmercountSketches_i[index][0]), sizeof(KmerAndCountType)*sketchSize);
data/simka-1.5.2/src/simkaMin/SimkaMinDistance.hpp:555:17: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
sketchFile_2.read((char*)&(_kmercountSketches_j[index][0]), sizeof(KmerAndCountType)*sketchSize);
data/simka-1.5.2/src/simkaMin/SimkaMinDistanceMatrixExporter.hpp:40:20: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
matrixBinaryFile.read((char*)resultRow.data(), sizeof(float)*resultRow.size());
ANALYSIS SUMMARY:
Hits = 68
Lines analyzed = 12844 in approximately 0.34 seconds (38137 lines/second)
Physical Source Lines of Code (SLOC) = 5312
Hits@level = [0] 5 [1] 10 [2] 32 [3] 0 [4] 26 [5] 0
Hits@level+ = [0+] 73 [1+] 68 [2+] 58 [3+] 26 [4+] 26 [5+] 0
Hits/KSLOC@level+ = [0+] 13.7425 [1+] 12.8012 [2+] 10.9187 [3+] 4.89458 [4+] 4.89458 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.