Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/tm-align-20190822+dfsg/TMalign.cpp Examining data/tm-align-20190822+dfsg/TMscore.cpp FINAL RESULTS: data/tm-align-20190822+dfsg/TMalign.cpp:3672:9: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(dest, "m %18s %14s %14s %14s\n", "t[m]", "u[m][0]", "u[m][1]", "u[m][2]"); data/tm-align-20190822+dfsg/TMscore.cpp:3944:9: [4] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. sprintf(dest, "m %18s %14s %14s %14s\n", "t[m]", "u[m][0]", "u[m][1]", "u[m][2]"); data/tm-align-20190822+dfsg/TMalign.cpp:397:9: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fin.open(filename.c_str()); data/tm-align-20190822+dfsg/TMalign.cpp:520:15: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). L=atoi(line.c_str()); data/tm-align-20190822+dfsg/TMalign.cpp:733:9: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fin.open(filename.c_str()); data/tm-align-20190822+dfsg/TMalign.cpp:823:18: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). else if (atoi(resi_vec1[i1].substr(0,4).c_str())<= data/tm-align-20190822+dfsg/TMalign.cpp:824:18: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). atoi(resi_vec2[i2].substr(0,4).c_str())) data/tm-align-20190822+dfsg/TMalign.cpp:3132:9: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fin.open(xname.c_str()); data/tm-align-20190822+dfsg/TMalign.cpp:3384:9: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fin.open(yname.c_str()); data/tm-align-20190822+dfsg/TMalign.cpp:3615:12: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fp.open((pml_list[i]+".pml").c_str()); data/tm-align-20190822+dfsg/TMalign.cpp:3624:8: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fp.open((fname_super).c_str()); data/tm-align-20190822+dfsg/TMalign.cpp:3627:8: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fp.open((fname_super+"_all").c_str()); data/tm-align-20190822+dfsg/TMalign.cpp:3630:8: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fp.open((fname_super+"_atm").c_str()); data/tm-align-20190822+dfsg/TMalign.cpp:3633:8: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fp.open((fname_super+"_all_atm").c_str()); data/tm-align-20190822+dfsg/TMalign.cpp:3636:8: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fp.open((fname_super+"_all_atm_lig").c_str()); data/tm-align-20190822+dfsg/TMalign.cpp:3639:8: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fp.open((fname_super+".pdb").c_str()); data/tm-align-20190822+dfsg/TMalign.cpp:3667:10: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fout.open(fname_matrix, ios::out | ios::trunc); data/tm-align-20190822+dfsg/TMalign.cpp:3671:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char dest[1000]; data/tm-align-20190822+dfsg/TMalign.cpp:3676:13: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(dest, "%d %18.10f %14.10f %14.10f %14.10f\n", k, t[k], u[k][0], u[k][1], u[k][2]); data/tm-align-20190822+dfsg/TMalign.cpp:3695:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. const char *chainID1, const char *chainID2, data/tm-align-20190822+dfsg/TMalign.cpp:3695:33: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. const char *chainID1, const char *chainID2, data/tm-align-20190822+dfsg/TMalign.cpp:3921:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. const char *seqx, const char *seqy, const char *secx, const char *secy, data/tm-align-20190822+dfsg/TMalign.cpp:3921:29: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. const char *seqx, const char *seqy, const char *secx, const char *secy, data/tm-align-20190822+dfsg/TMalign.cpp:3921:47: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. const char *seqx, const char *seqy, const char *secx, const char *secy, data/tm-align-20190822+dfsg/TMalign.cpp:3921:65: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. const char *seqx, const char *seqy, const char *secx, const char *secy, data/tm-align-20190822+dfsg/TMalign.cpp:4526:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. const char *seqx, const char *seqy, const char *secx, const char *secy, data/tm-align-20190822+dfsg/TMalign.cpp:4526:29: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. const char *seqx, const char *seqy, const char *secx, const char *secy, data/tm-align-20190822+dfsg/TMalign.cpp:4526:47: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. const char *seqx, const char *seqy, const char *secx, const char *secy, data/tm-align-20190822+dfsg/TMalign.cpp:4526:65: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. const char *seqx, const char *seqy, const char *secx, const char *secy, data/tm-align-20190822+dfsg/TMalign.cpp:4748:23: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). a_opt=atoi(argv[i + 1]); data/tm-align-20190822+dfsg/TMalign.cpp:4788:24: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). infmt1_opt=atoi(argv[i + 1]); i++; data/tm-align-20190822+dfsg/TMalign.cpp:4792:24: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). infmt2_opt=atoi(argv[i + 1]); i++; data/tm-align-20190822+dfsg/TMalign.cpp:4796:21: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). ter_opt=atoi(argv[i + 1]); i++; data/tm-align-20190822+dfsg/TMalign.cpp:4800:23: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). split_opt=atoi(argv[i + 1]); i++; data/tm-align-20190822+dfsg/TMalign.cpp:4828:24: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). outfmt_opt=atoi(argv[i + 1]); i++; data/tm-align-20190822+dfsg/TMalign.cpp:4836:24: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). byresi_opt=atoi(argv[i + 1]); i++; data/tm-align-20190822+dfsg/TMalign.cpp:4844:24: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). mirror_opt=atoi(argv[i + 1]); i++; data/tm-align-20190822+dfsg/TMalign.cpp:4848:21: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). het_opt=atoi(argv[i + 1]); i++; data/tm-align-20190822+dfsg/TMscore.cpp:310:9: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fin.open(filename.c_str()); data/tm-align-20190822+dfsg/TMscore.cpp:433:15: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). L=atoi(line.c_str()); data/tm-align-20190822+dfsg/TMscore.cpp:646:9: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fin.open(filename.c_str()); data/tm-align-20190822+dfsg/TMscore.cpp:736:18: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). else if (atoi(resi_vec1[i1].substr(0,4).c_str())<= data/tm-align-20190822+dfsg/TMscore.cpp:737:18: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). atoi(resi_vec2[i2].substr(0,4).c_str())) data/tm-align-20190822+dfsg/TMscore.cpp:3543:9: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fin.open(xname.c_str()); data/tm-align-20190822+dfsg/TMscore.cpp:3729:9: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fin.open(yname.c_str()); data/tm-align-20190822+dfsg/TMscore.cpp:3900:12: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fp.open((pml_list[i]+".pml").c_str()); data/tm-align-20190822+dfsg/TMscore.cpp:3909:8: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fp.open((fname_super).c_str()); data/tm-align-20190822+dfsg/TMscore.cpp:3912:8: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fp.open((fname_super+"_atm").c_str()); data/tm-align-20190822+dfsg/TMscore.cpp:3915:8: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fp.open((fname_super+".pdb").c_str()); data/tm-align-20190822+dfsg/TMscore.cpp:3939:10: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fout.open(fname_matrix, ios::out | ios::trunc); data/tm-align-20190822+dfsg/TMscore.cpp:3943:9: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char dest[1000]; data/tm-align-20190822+dfsg/TMscore.cpp:3948:13: [2] (buffer) sprintf: Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or vsnprintf. Risk is low because the source has a constant maximum length. sprintf(dest, "%d %18.10f %14.10f %14.10f %14.10f\n", k, t[k], u[k][0], u[k][1], u[k][2]); data/tm-align-20190822+dfsg/TMscore.cpp:4101:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. const char *seqx, const char *seqy, const char *secx, const char *secy, data/tm-align-20190822+dfsg/TMscore.cpp:4101:29: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. const char *seqx, const char *seqy, const char *secx, const char *secy, data/tm-align-20190822+dfsg/TMscore.cpp:4101:47: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. const char *seqx, const char *seqy, const char *secx, const char *secy, data/tm-align-20190822+dfsg/TMscore.cpp:4101:65: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. const char *seqx, const char *seqy, const char *secx, const char *secy, data/tm-align-20190822+dfsg/TMscore.cpp:4710:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. const char *chainID1, const char *chainID2, data/tm-align-20190822+dfsg/TMscore.cpp:4710:33: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. const char *chainID1, const char *chainID2, data/tm-align-20190822+dfsg/TMscore.cpp:4885:23: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). a_opt=atoi(argv[i + 1]); data/tm-align-20190822+dfsg/TMscore.cpp:4913:24: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). infmt1_opt=atoi(argv[i + 1]); i++; data/tm-align-20190822+dfsg/TMscore.cpp:4917:24: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). infmt2_opt=atoi(argv[i + 1]); i++; data/tm-align-20190822+dfsg/TMscore.cpp:4921:21: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). ter_opt=atoi(argv[i + 1]); i++; data/tm-align-20190822+dfsg/TMscore.cpp:4925:23: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). split_opt=atoi(argv[i + 1]); i++; data/tm-align-20190822+dfsg/TMscore.cpp:4953:24: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). outfmt_opt=atoi(argv[i + 1]); i++; data/tm-align-20190822+dfsg/TMscore.cpp:4961:24: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). mirror_opt=atoi(argv[i + 1]); i++; data/tm-align-20190822+dfsg/TMscore.cpp:4965:21: [2] (integer) atoi: Unless checked, the resulting number can exceed the expected range (CWE-190). If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended). het_opt=atoi(argv[i + 1]); i++; data/tm-align-20190822+dfsg/TMalign.cpp:3112:16: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). for (i=0;i<strlen(seqM);i++) data/tm-align-20190822+dfsg/TMalign.cpp:3776:9: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(fname_matrix)) data/tm-align-20190822+dfsg/TMscore.cpp:3522:16: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). for (i=0;i<strlen(seqM);i++) data/tm-align-20190822+dfsg/TMscore.cpp:4772:20: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). for (i=0;i<strlen(seqM);i++) data/tm-align-20190822+dfsg/TMscore.cpp:4818:9: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(fname_matrix)) ANALYSIS SUMMARY: Hits = 71 Lines analyzed = 10368 in approximately 0.29 seconds (35803 lines/second) Physical Source Lines of Code (SLOC) = 8596 Hits@level = [0] 61 [1] 5 [2] 64 [3] 0 [4] 2 [5] 0 Hits@level+ = [0+] 132 [1+] 71 [2+] 66 [3+] 2 [4+] 2 [5+] 0 Hits/KSLOC@level+ = [0+] 15.356 [1+] 8.25966 [2+] 7.67799 [3+] 0.232666 [4+] 0.232666 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.