Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/sprai-0.9.9.23+dfsg1/bfmt72s.c
Examining data/sprai-0.9.9.23+dfsg1/col2fqcell.h
Examining data/sprai-0.9.9.23+dfsg1/m52bfmt7.c
Examining data/sprai-0.9.9.23+dfsg1/myrealigner.c
Examining data/sprai-0.9.9.23+dfsg1/nss2v_v3.c
FINAL RESULTS:
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:476:18: [4] (buffer) sscanf:
The scanf() family's %s operation, without a limit specification, permits
buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
different input function.
scanfret = sscanf(buf,"%s %d %d %s %d %d %lf %lf %lf %s %s", sam.qname, &blast.sstart, &blast.send, sam.rname, &blast.qstart, &blast.qend, &blast.bitscore, &blast.evalue, &blast.pident, sam.seq, sam.qual);/* sam.qual <- sseq */
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:499:18: [4] (buffer) sscanf:
The scanf() family's %s operation, without a limit specification, permits
buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
different input function.
scanfret = sscanf(buf,"%s %s %lf %lf %d %d %s %d %d", sam.qname, sam.rname, &blast.bitscore, &blast.pident, &blast.qstart, &blast.qend, strand, &blast.sstart, &blast.send);
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:603:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(prev_ref_name, sam.rname);
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:604:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(prev_que_name, sam.qname);
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:629:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(prev_que_name, sam.qname);
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:630:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(prev_ref_name, sam.rname);
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:822:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(bufq, &sam.qual[h_trim]);
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:824:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(sam.qual, bufq);
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:825:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(bufq, &sam.seq[h_trim]);
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:827:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(sam.seq, bufq);
data/sprai-0.9.9.23+dfsg1/m52bfmt7.c:120:16: [4] (buffer) sscanf:
The scanf() family's %s operation, without a limit specification, permits
buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
different input function.
scanfret = sscanf(buf,"%s %d %d %d %s %s %d %d %d %s %d %d %d %d %d %d %s %s %s", qname,&qlen,&qstt,&qend,&qstrand,sname,&slen,&sstt,&send,&sstrand,&score,&nMatch,&nMismatch,&nIns,&nDel,&mapqv,qseq,ali,sseq);
data/sprai-0.9.9.23+dfsg1/myrealigner.c:308:11: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(chrname, &sbuf[1]);
data/sprai-0.9.9.23+dfsg1/myrealigner.c:321:9: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(buf4printComment,&sbuf[1]);
data/sprai-0.9.9.23+dfsg1/myrealigner.c:363:7: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(buffer,sbuf);
data/sprai-0.9.9.23+dfsg1/nss2v_v3.c:483:13: [4] (buffer) sscanf:
The scanf() family's %s operation, without a limit specification, permits
buffer overflows (CWE-120, CWE-20). Specify a limit to %s, or use a
different input function.
sretval = sscanf(t_sam->buf,"%s\t%d\t%s\t%d\t%d\t%s\t%s\t%d\t%d\t%s\t%s\t%s\t%s\n",
data/sprai-0.9.9.23+dfsg1/nss2v_v3.c:883:7: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(prevchr,t_sam->rname);
data/sprai-0.9.9.23+dfsg1/nss2v_v3.c:890:7: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy(prevchr, t_sam->rname);
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:275:19: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while((result=getopt(argc,argv,"iuUe:c:dbxgtprl:")) != -1){
data/sprai-0.9.9.23+dfsg1/m52bfmt7.c:32:19: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while((result=getopt(argc,argv,"s")) != -1){
data/sprai-0.9.9.23+dfsg1/myrealigner.c:1049:14: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while((r=getopt(argc,argv,"w:m:fqb:B:cnd:vl:")) != -1){
data/sprai-0.9.9.23+dfsg1/nss2v_v3.c:796:19: [3] (buffer) getopt:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while((result=getopt(argc,argv,"v:r:s")) != -1){
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:249:1: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char fqname[1024];
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:268:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char strand[255];
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:278:16: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
LSEQ=atoi(optarg);
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:325:31: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
opt_chimeric_filter=atoi(optarg);
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:360:7: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy(msg,"on");
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:408:10: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fp = fopen(in_blastn,"r");
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:973:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(sam->rnext,"%d,%d,%d,%d",blast->sstart,blast->send,blast->qstart,blast->qend);
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:976:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(sam->rnext,"%d,%d,%d,%d",blast->qstart,blast->qend,blast->sstart,blast->send);
data/sprai-0.9.9.23+dfsg1/col2fqcell.h:25:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char max_qvs[6];
data/sprai-0.9.9.23+dfsg1/m52bfmt7.c:68:10: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
fp = fopen(in_m5,"r");
data/sprai-0.9.9.23+dfsg1/myrealigner.c:1052:25: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
MaxFragSize = atoi(optarg);
data/sprai-0.9.9.23+dfsg1/myrealigner.c:1060:22: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
BandSize = atoi(optarg);
data/sprai-0.9.9.23+dfsg1/myrealigner.c:1084:27: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
minimum_ballots=atoi(optarg);
data/sprai-0.9.9.23+dfsg1/myrealigner.c:1092:27: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
maximum_ballots=atoi(optarg);
data/sprai-0.9.9.23+dfsg1/myrealigner.c:1133:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
input = fopen(argv[1+hitnum],"r");
data/sprai-0.9.9.23+dfsg1/nss2v_v3.c:103:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char as[LAUX];
data/sprai-0.9.9.23+dfsg1/nss2v_v3.c:104:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char ev[LAUX];
data/sprai-0.9.9.23+dfsg1/nss2v_v3.c:302:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[32];
data/sprai-0.9.9.23+dfsg1/nss2v_v3.c:306:5: [2] (buffer) sprintf:
Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
vsnprintf. Risk is low because the source has a constant maximum length.
sprintf(buf, "lists[%i]", i);
data/sprai-0.9.9.23+dfsg1/nss2v_v3.c:803:26: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
valid_voters = atoi(optarg);
data/sprai-0.9.9.23+dfsg1/nss2v_v3.c:815:17: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
tmp = atoi(optarg);
data/sprai-0.9.9.23+dfsg1/nss2v_v3.c:855:14: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
IN_SAM = fopen(argv[1+hitnum],"r");
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:432:19: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
line_length = strlen(buf);
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:445:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
line_length = strlen(buf);
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:525:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int len = strlen(sam.seq);
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:556:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int len = strlen(sam.seq);
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:720:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int len_sseq = strlen(sam.qual);
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:723:24: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(len_sseq != strlen(sam.seq)){
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:756:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int endpos=strlen(sam.seq)-1;
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:784:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int endpos=strlen(sam.qual)-1;
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:810:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int endpos=strlen(sam.qual)-1;
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:823:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
bufq[strlen(bufq)-t_trim]='\0';
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:826:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
bufq[strlen(bufq)-t_trim]='\0';
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:900:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int loop=strlen(sam->seq);
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:930:19: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for(i=0,len=strlen(sam->seq),loop=len/2; i<loop; ++i){
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:935:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
for(i=0,loop=strlen(sam->seq); i<loop; ++i){
data/sprai-0.9.9.23+dfsg1/bfmt72s.c:984:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int len = strlen(q);
data/sprai-0.9.9.23+dfsg1/m52bfmt7.c:127:20: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int qnamelen = strlen(qname);
data/sprai-0.9.9.23+dfsg1/myrealigner.c:290:9: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
i = strlen(sbuf);
data/sprai-0.9.9.23+dfsg1/myrealigner.c:346:12: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(strlen(buffer) != strlen(qbuf)){
data/sprai-0.9.9.23+dfsg1/myrealigner.c:346:30: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if(strlen(buffer) != strlen(qbuf)){
data/sprai-0.9.9.23+dfsg1/myrealigner.c:353:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if((int)strlen(buffer)>MaxDepth){
data/sprai-0.9.9.23+dfsg1/myrealigner.c:369:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
if((int)strlen(buffer)>MaxDepth){
data/sprai-0.9.9.23+dfsg1/myrealigner.c:505:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int limit = strlen(seq);
data/sprai-0.9.9.23+dfsg1/nss2v_v3.c:372:13: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int len = strlen(t_sam->cigar_string);
data/sprai-0.9.9.23+dfsg1/nss2v_v3.c:414:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int loop = strlen(seq);
data/sprai-0.9.9.23+dfsg1/nss2v_v3.c:465:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
line_length = strlen(buf);
data/sprai-0.9.9.23+dfsg1/nss2v_v3.c:472:21: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
line_length = strlen(buf);
data/sprai-0.9.9.23+dfsg1/nss2v_v3.c:497:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
t_sam->tlen = strlen(t_sam->seq);
data/sprai-0.9.9.23+dfsg1/nss2v_v3.c:510:15: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int len = strlen(t_sam->seq);
data/sprai-0.9.9.23+dfsg1/nss2v_v3.c:914:22: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
int length = strlen(t_sam->seq);
ANALYSIS SUMMARY:
Hits = 72
Lines analyzed = 4028 in approximately 0.12 seconds (33825 lines/second)
Physical Source Lines of Code (SLOC) = 3428
Hits@level = [0] 236 [1] 29 [2] 22 [3] 4 [4] 17 [5] 0
Hits@level+ = [0+] 308 [1+] 72 [2+] 43 [3+] 21 [4+] 17 [5+] 0
Hits/KSLOC@level+ = [0+] 89.8483 [1+] 21.0035 [2+] 12.5438 [3+] 6.12602 [4+] 4.95916 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.