Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/soapaligner-2.20/BWTAln.c
Examining data/soapaligner-2.20/BWT.c
Examining data/soapaligner-2.20/DNACount.c
Examining data/soapaligner-2.20/extratools.c
Examining data/soapaligner-2.20/HSP.c
Examining data/soapaligner-2.20/kstring.c
Examining data/soapaligner-2.20/MemManager.c
Examining data/soapaligner-2.20/MiscUtilities.c
Examining data/soapaligner-2.20/PairMatch.c
Examining data/soapaligner-2.20/r250.c
Examining data/soapaligner-2.20/SeqIO.c
Examining data/soapaligner-2.20/soapio.c
Examining data/soapaligner-2.20/stdaln.c
Examining data/soapaligner-2.20/TextConverter.c
Examining data/soapaligner-2.20/Timing.c
Examining data/soapaligner-2.20/BWTAln.h
Examining data/soapaligner-2.20/BWT.h
Examining data/soapaligner-2.20/DNACount.h
Examining data/soapaligner-2.20/extratools.h
Examining data/soapaligner-2.20/HSP.h
Examining data/soapaligner-2.20/kstring.h
Examining data/soapaligner-2.20/Match.h
Examining data/soapaligner-2.20/MemManager.h
Examining data/soapaligner-2.20/MiscUtilities.h
Examining data/soapaligner-2.20/r250.h
Examining data/soapaligner-2.20/SeqIO.h
Examining data/soapaligner-2.20/soap.h
Examining data/soapaligner-2.20/soapio.h
Examining data/soapaligner-2.20/stdaln.h
Examining data/soapaligner-2.20/TextConverter.h
Examining data/soapaligner-2.20/Timing.h
Examining data/soapaligner-2.20/TypeNLimit.h
Examining data/soapaligner-2.20/Match.c
Examining data/soapaligner-2.20/soap.c
FINAL RESULTS:
data/soapaligner-2.20/HSP.c:96:4: [4] (buffer) fscanf:
The scanf() family's %s operation, without a limit specification, permits
buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
different input function.
fscanf(annotationFile, "%s\n", hsp->chrName[i]);
data/soapaligner-2.20/Timing.c:165:3: [4] (format) fprintf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
fprintf(file, secondDisplay, sec);
data/soapaligner-2.20/kstring.c:10:6: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
l = vsnprintf(s->s + s->l, s->m - s->l, fmt, ap);
data/soapaligner-2.20/kstring.c:17:7: [4] (format) vsnprintf:
If format strings can be influenced by an attacker, they can be exploited,
and note that sprintf variations do not always \0-terminate (CWE-134). Use
a constant for the format specification.
l = vsnprintf(s->s + s->l, s->m - s->l, fmt, ap);
data/soapaligner-2.20/kstring.h:27:2: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(s->s + s->l, p);
data/soapaligner-2.20/soapio.c:93:3: [4] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf.
sprintf(alnSeq->name, ">%s_%d", chrName[(blockList+n)->chrID], st-blockStart+ori+1);
data/soapaligner-2.20/soap.c:180:13: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while((c = getopt(argc, argv, "a:b:D:o:2:u:m:x:M:AK:l:v:U:g:w:i:e:q:c:Rz:r:B:s:p:tn:h"))!=-1){
data/soapaligner-2.20/HSP.c:40:30: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
void HSPFillCharMap(unsigned char charMap[255]) {
data/soapaligner-2.20/HSP.c:54:36: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
void HSPFillComplementMap(unsigned char complementMap[255]) {
data/soapaligner-2.20/HSP.c:85:54: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (AnnotationFileName != NULL && (annotationFile = fopen(AnnotationFileName, "r"))){
data/soapaligner-2.20/HSP.c:144:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char charMap[255];
data/soapaligner-2.20/HSP.c:147:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char buffer[PACKED_BUFFER_SIZE];
data/soapaligner-2.20/HSP.c:148:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char packedBuffer[PACKED_BUFFER_SIZE / 4];
data/soapaligner-2.20/HSP.h:49:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char chrName[MAX_SEQ_NAME_LENGTH];
data/soapaligner-2.20/HSP.h:59:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char text[MAX_SEQ_NAME_LENGTH+1];
data/soapaligner-2.20/HSP.h:90:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const char dnaChar[16] = {'A', 'C', 'G', 'T', 'M', 'R', 'S', 'V', 'W', 'Y', 'H', 'K', 'D', 'B', 'N', 'L'};
data/soapaligner-2.20/HSP.h:91:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const char dnaComplement[16] = {'T', 'G', 'C', 'A', 'K', 'Y', 'S', 'B', 'W', 'R', 'D', 'M', 'H', 'V', 'N', 'L'};
data/soapaligner-2.20/HSP.h:92:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const char ambiguityCount[16] = { 1 , 1 , 1 , 1 , 2 , 2 , 2 , 3 , 2 , 2 , 3 , 2 , 3 , 3 , 4 , 0 };
data/soapaligner-2.20/HSP.h:93:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static const char ambiguityMatch[16][4] = {{0, 0, 0, 0},
data/soapaligner-2.20/Match.c:42:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy((alnSeq->itemList+i)->cigar, cigar, n_cigar*sizeof(unsigned short)); \
data/soapaligner-2.20/Match.c:120:5: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(alnSeq->itemList->cigar, cigar, n_cigar*sizeof(unsigned short));
data/soapaligner-2.20/MemManager.c:303:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(temp, address, min(newMemSize, oldMemSize));
data/soapaligner-2.20/MiscUtilities.c:439:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char defaultText[17] = "checkDuplicate()";
data/soapaligner-2.20/MiscUtilities.c:707:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(destinationAddress, sourceAddress, copyWordLength * 4);
data/soapaligner-2.20/MiscUtilities.c:760:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(destAddr, srcAddr, copyWordLength * 4);
data/soapaligner-2.20/MiscUtilities.c:840:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(destAddr, srcAddr, copyWordLength * 4);
data/soapaligner-2.20/SeqIO.c:18:17: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
extern unsigned char charMap[256];
data/soapaligner-2.20/SeqIO.c:19:17: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
extern unsigned char complementMap[256];
data/soapaligner-2.20/SeqIO.c:20:14: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
extern const char ambiguityCount[16];
data/soapaligner-2.20/SeqIO.h:34:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char name[MAX_NAME_LEN];
data/soapaligner-2.20/TextConverter.c:602:3: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(buffer1, buffer2, bufferSize);
data/soapaligner-2.20/TextConverter.c:680:11: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char tempChar[4];
data/soapaligner-2.20/Timing.c:120:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char secondDisplay[8] = "%0.0f s";
data/soapaligner-2.20/TypeNLimit.h:51:18: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
#define fopen64 fopen
data/soapaligner-2.20/TypeNLimit.h:62:18: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
#define fopen64 fopen
data/soapaligner-2.20/extratools.c:12:12: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
int fin = open(fileName, O_RDONLY);
data/soapaligner-2.20/extratools.c:52:19: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if(!(inFile = fopen(fileName, "r"))) return;
data/soapaligner-2.20/soap.c:53:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char readAFileName[MAX_FILENAME_LEN] = "";
data/soapaligner-2.20/soap.c:54:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char readBFileName[MAX_FILENAME_LEN] = "";
data/soapaligner-2.20/soap.c:55:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char outFileName[MAX_FILENAME_LEN] = "";
data/soapaligner-2.20/soap.c:56:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char outUnpairFileName[MAX_FILENAME_LEN] = "";
data/soapaligner-2.20/soap.c:57:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char outUnmapFileName[MAX_FILENAME_LEN] = "";
data/soapaligner-2.20/soap.c:59:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char database_prefix[MAX_FILENAME_LEN] = "";
data/soapaligner-2.20/soap.c:61:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char AnnotationSuffix[MAX_SUFFIX_LEN] = ".ann";
data/soapaligner-2.20/soap.c:62:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char PackedDNASuffix[MAX_SUFFIX_LEN] = ".pac";
data/soapaligner-2.20/soap.c:63:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char BWTCodeSuffix[MAX_SUFFIX_LEN] = ".bwt";
data/soapaligner-2.20/soap.c:64:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char BWTOccValueSuffix[MAX_SUFFIX_LEN] = ".fmv";
data/soapaligner-2.20/soap.c:65:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char SaValueSuffix[MAX_SUFFIX_LEN] = ".sa";
data/soapaligner-2.20/soap.c:67:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char RevPackedDNASuffix[MAX_SUFFIX_LEN] = ".rev.pac";
data/soapaligner-2.20/soap.c:68:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char RevBWTCodeSuffix[MAX_SUFFIX_LEN] = ".rev.bwt";
data/soapaligner-2.20/soap.c:69:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char RevBWTOccValueSuffix[MAX_SUFFIX_LEN] = ".rev.fmv";
data/soapaligner-2.20/soap.c:71:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char LookupTableSuffix[MAX_SUFFIX_LEN] = ".lkt";
data/soapaligner-2.20/soap.c:72:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char RevLookupTableSuffix[MAX_SUFFIX_LEN] = ".rev.lkt";
data/soapaligner-2.20/soap.c:73:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char HighOccHashTableSuffix[MAX_SUFFIX_LEN] = ".hot";
data/soapaligner-2.20/soap.c:76:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char AnnotationFileName[MAX_FILENAME_LEN+MAX_SUFFIX_LEN] = "";
data/soapaligner-2.20/soap.c:77:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char PackedDNAFileName[MAX_FILENAME_LEN+MAX_SUFFIX_LEN] = "";
data/soapaligner-2.20/soap.c:78:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char BWTCodeFileName[MAX_FILENAME_LEN+MAX_SUFFIX_LEN] = "";
data/soapaligner-2.20/soap.c:79:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char BWTOccValueFileName[MAX_FILENAME_LEN+MAX_SUFFIX_LEN] = "";
data/soapaligner-2.20/soap.c:80:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char SaValueFileName[MAX_FILENAME_LEN+MAX_SUFFIX_LEN] = "";
data/soapaligner-2.20/soap.c:83:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char RevPackedDNAFileName[MAX_FILENAME_LEN+MAX_SUFFIX_LEN] = "";
data/soapaligner-2.20/soap.c:84:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char RevBWTCodeFileName[MAX_FILENAME_LEN+MAX_SUFFIX_LEN] = "";
data/soapaligner-2.20/soap.c:85:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char RevBWTOccValueFileName[MAX_FILENAME_LEN+MAX_SUFFIX_LEN] = "";
data/soapaligner-2.20/soap.c:88:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char LookupTableFileName[MAX_FILENAME_LEN+MAX_SUFFIX_LEN] = "";
data/soapaligner-2.20/soap.c:89:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char RevLookupTableFileName[MAX_FILENAME_LEN+MAX_SUFFIX_LEN] = "";
data/soapaligner-2.20/soap.c:90:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char HighOccHashTableFileName[MAX_FILENAME_LEN+MAX_SUFFIX_LEN] = "";
data/soapaligner-2.20/soap.c:105:10: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char charMap[256];
data/soapaligner-2.20/soap.c:106:10: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char complementMap[256];
data/soapaligner-2.20/soap.c:200:20: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
opt->min_ins = atoi(optarg);
data/soapaligner-2.20/soap.c:203:20: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
opt->max_ins = atoi(optarg);
data/soapaligner-2.20/soap.c:212:20: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
opt->aln_len = atoi(optarg);
data/soapaligner-2.20/soap.c:216:18: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
opt->mode = atoi(optarg);
data/soapaligner-2.20/soap.c:223:23: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
opt->cutoff = min(atoi(optarg), MAX_ALN);
data/soapaligner-2.20/soap.c:226:23: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
opt->max_mm = min(atoi(optarg), MAX_MISMATCH);
data/soapaligner-2.20/soap.c:229:24: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
opt->gap_len = min(atoi(optarg), MAX_GAP_LEN);
data/soapaligner-2.20/soap.c:232:19: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
opt->gap_fb = atoi(optarg);
data/soapaligner-2.20/soap.c:238:22: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
opt->zero_qual = atoi(optarg);
data/soapaligner-2.20/soap.c:241:15: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
opt->rr = atoi(optarg);
data/soapaligner-2.20/soap.c:247:15: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
opt->ns = atoi(optarg);
data/soapaligner-2.20/soap.c:250:22: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
opt->bisulfite = atoi(optarg);
data/soapaligner-2.20/soap.c:253:17: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
opt->uniq = atoi(optarg);
data/soapaligner-2.20/soap.c:256:20: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
opt->min_len = atoi(optarg);
data/soapaligner-2.20/soap.c:261:25: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
opt->nthreads = min(atoi(optarg), MAX_PTHREADS);
data/soapaligner-2.20/soap.c:265:18: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
opt->chain = atoi(optarg);
data/soapaligner-2.20/soap.c:290:16: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if((fds->ifdA=open(readAFileName, O_RDONLY))==-1){
data/soapaligner-2.20/soap.c:299:17: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if((fds->ifdB=open(readBFileName, O_RDONLY))==-1){
data/soapaligner-2.20/soapio.c:53:2: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(dest->seq, ori.seq, ori.l); \
data/soapaligner-2.20/stdaln.c:32:10: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aln_nt16_table[256] = {
data/soapaligner-2.20/stdaln.c:53:10: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aln_nt4_table[256] = {
data/soapaligner-2.20/stdaln.c:74:10: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aln_aa_table[256] = {
data/soapaligner-2.20/stdaln.c:96:10: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
unsigned char aln_trans_table_eu[66] = {
data/soapaligner-2.20/HSP.c:123:46: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
MMUnitFree(hsp->chrName[i], (strlen(hsp->chrName[i])+1)*sizeof(char));
data/soapaligner-2.20/HSP.c:176:12: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c = (char)getc(FASTAFile);
data/soapaligner-2.20/HSP.c:193:13: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c = (char)getc(FASTAFile);
data/soapaligner-2.20/HSP.c:197:12: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c=(char)getc(FASTAFile);
data/soapaligner-2.20/HSP.c:201:12: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c=(char)getc(FASTAFile);
data/soapaligner-2.20/HSP.c:216:12: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
c=(char)getc(FASTAFile);
data/soapaligner-2.20/HSP.c:325:44: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
fprintf(annotationFile, "%d\t%s\n", (int)strlen(chrAnnotation[i].chrName), chrAnnotation[i].chrName);
data/soapaligner-2.20/SeqIO.c:24:6: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (read(fd, &c, 1)>0) {
data/soapaligner-2.20/SeqIO.c:45:22: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while (!feof(fp) && getc(fp)!= (int)'>');
data/soapaligner-2.20/SeqIO.c:49:13: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while ((c= getc(fp)) != ' ' && c != '\r' && c != '\t' && c != '\n' && ++l < MAX_NAME_LEN) *p++ = c;
data/soapaligner-2.20/SeqIO.c:59:31: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while (c != '\n') c = (char) getc(fp);
data/soapaligner-2.20/SeqIO.c:68:14: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while ((c = getc(fp)) != '>' && !feof(fp)) {
data/soapaligner-2.20/SeqIO.c:109:22: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while (!feof(fp) && getc(fp)!= '@');
data/soapaligner-2.20/SeqIO.c:114:14: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while ((c = getc(fp)) != '\t' && c != ' ' && c != '\n' && c != '\r' && l++ < MAX_NAME_LEN) *p++ = c;
data/soapaligner-2.20/SeqIO.c:126:24: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while (c != '\n') c = getc(fp);
data/soapaligner-2.20/SeqIO.c:135:14: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while ((c = getc(fp)) != '+' && !feof(fp)) {
data/soapaligner-2.20/SeqIO.c:163:26: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while (!feof(fp) && (c= getc(fp))!= '\n');
data/soapaligner-2.20/SeqIO.c:171:21: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while ((c = (char) getc(fp)) != '\n' && c != '\r' && !feof(fp)) {
data/soapaligner-2.20/extratools.c:16:3: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
read(fin, (*lookupTable).table + i, step * sizeof(*(*lookupTable).table));
data/soapaligner-2.20/kstring.h:21:10: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int l = strlen(p);
data/soapaligner-2.20/soapio.c:94:16: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
alnSeq->name[strlen(alnSeq->name)] = '\0';
data/soapaligner-2.20/stdaln.c:756:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (len1 < 0) len1 = strlen(seq1);
data/soapaligner-2.20/stdaln.c:757:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if (len2 < 0) len2 = strlen(seq2);
ANALYSIS SUMMARY:
Hits = 113
Lines analyzed = 12066 in approximately 0.39 seconds (30717 lines/second)
Physical Source Lines of Code (SLOC) = 8685
Hits@level = [0] 282 [1] 23 [2] 83 [3] 1 [4] 6 [5] 0
Hits@level+ = [0+] 395 [1+] 113 [2+] 90 [3+] 7 [4+] 6 [5+] 0
Hits/KSLOC@level+ = [0+] 45.4807 [1+] 13.0109 [2+] 10.3627 [3+] 0.805987 [4+] 0.690846 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.