Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/yaha-0.1.83/src/AlignArgs.c
Examining data/yaha-0.1.83/src/AlignExtFrag.cpp
Examining data/yaha-0.1.83/src/AlignHelpers.c
Examining data/yaha-0.1.83/src/AlignOutput.c
Examining data/yaha-0.1.83/src/BaseSeq.c
Examining data/yaha-0.1.83/src/Compress.c
Examining data/yaha-0.1.83/src/FileHelpers.c
Examining data/yaha-0.1.83/src/FragsClumps.c
Examining data/yaha-0.1.83/src/GraphPath.cpp
Examining data/yaha-0.1.83/src/Index.c
Examining data/yaha-0.1.83/src/Main.c
Examining data/yaha-0.1.83/src/Math.c
Examining data/yaha-0.1.83/src/Math.h
Examining data/yaha-0.1.83/src/Query.c
Examining data/yaha-0.1.83/src/QueryMatch.c
Examining data/yaha-0.1.83/src/QueryState.c
Examining data/yaha-0.1.83/src/SW.cpp

FINAL RESULTS:

data/yaha-0.1.83/src/FileHelpers.c:33:5:  [4] (format) fprintf:
  If format strings can be influenced by an attacker, they can be exploited
  (CWE-134). Use a constant for the format specification.
    fprintf(stderr, str);
data/yaha-0.1.83/src/Index.c:66:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(kmerFileName, AAs->xfileName);
data/yaha-0.1.83/src/Index.c:69:5:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
    strcpy(refFileName, AAs->xfileName);
data/yaha-0.1.83/src/Main.c:497:9:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
        strcpy(AAs->gfileName, AAs->xfileName);
data/yaha-0.1.83/src/Main.c:532:9:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
        strcpy(AAs->ofileName, AAs->gfileName);
data/yaha-0.1.83/src/Main.c:538:9:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
        strcpy(AAs->ofileName, AAs->gfileName);
data/yaha-0.1.83/src/Main.c:562:9:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
        strcpy(AAs->xfileName, AAs->gfileName);
data/yaha-0.1.83/src/Main.c:563:9:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
        strcpy(strrchr(AAs->xfileName, '.'), oext);
data/yaha-0.1.83/src/Main.c:605:13:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
            strcpy(AAs->ofileName, AAs->gfileName);
data/yaha-0.1.83/src/FileHelpers.c:160:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    file = open(filename, O_RDONLY);
data/yaha-0.1.83/src/FileHelpers.c:215:18:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
        inFile = fopen(filename, "r");
data/yaha-0.1.83/src/FileHelpers.c:279:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
    file = open(filename, O_RDWR | O_CREAT | O_TRUNC, S_IRWXU | S_IRGRP | S_IROTH);
data/yaha-0.1.83/src/FileHelpers.c:299:19:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
        outFile = fopen(filename, "w");
data/yaha-0.1.83/src/GraphPath.cpp:422:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(temp, one, len);
data/yaha-0.1.83/src/GraphPath.cpp:423:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(one, two, len);
data/yaha-0.1.83/src/GraphPath.cpp:424:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(two, temp, len);
data/yaha-0.1.83/src/GraphPath.cpp:590:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(&primaries[primeIndex], pathNode, sizeof(cGraphNode_t));
data/yaha-0.1.83/src/Index.c:67:5:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
    strcpy(kmerFileName+xfileNameLen, ".kmerstats");
data/yaha-0.1.83/src/Index.c:70:5:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
    strcpy(refFileName+xfileNameLen, ".refstats");
data/yaha-0.1.83/src/Main.c:151:18:  [2] (integer) atoi:
  Unless checked, the resulting number can exceed the expected range
  (CWE-190). If source untrusted, check both minimum and maximum, even if the
  input had no minus sign (large numbers can roll over into negative number;
  consider saving to an unsigned value if that is intended).
    int retval = atoi(inString);
data/yaha-0.1.83/src/Main.c:500:9:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
        strcpy(extLoc, ".nib2");
data/yaha-0.1.83/src/Main.c:533:9:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
        strcpy(strrchr(AAs->ofileName, '.'), ".fasta");
data/yaha-0.1.83/src/Main.c:539:9:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
        strcpy(strrchr(AAs->ofileName, '.'), ".nib2");
data/yaha-0.1.83/src/Main.c:560:9:  [2] (buffer) sprintf:
  Does not check for buffer overflows (CWE-120). Use sprintf_s, snprintf, or
  vsnprintf. Risk is low because the source has a constant maximum length.
        sprintf(oext, ".X%02d_%02d_%05dS", AAs->wordLen, AAs->skipDist, AAs->maxHits);
data/yaha-0.1.83/src/Main.c:606:13:  [2] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant string.
            strcpy(strrchr(AAs->ofileName, '.'), ".nib2");
data/yaha-0.1.83/src/Index.c:64:24:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    int xfileNameLen = strlen(AAs->xfileName);
data/yaha-0.1.83/src/Main.c:138:9:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if (strlen(inString) == 1)
data/yaha-0.1.83/src/Main.c:496:41:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        AAs->gfileName = (char *)malloc(strlen(AAs->xfileName)+10);
data/yaha-0.1.83/src/Main.c:531:41:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        AAs->ofileName = (char *)malloc(strlen(AAs->gfileName)+10);
data/yaha-0.1.83/src/Main.c:537:41:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        AAs->ofileName = (char *)malloc(strlen(AAs->gfileName)+10);
data/yaha-0.1.83/src/Main.c:561:41:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        AAs->xfileName = (char *)malloc(strlen(AAs->gfileName)+20);
data/yaha-0.1.83/src/Main.c:604:45:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            AAs->ofileName = (char *)malloc(strlen(AAs->gfileName)+10);

ANALYSIS SUMMARY:

Hits = 32
Lines analyzed = 8370 in approximately 0.24 seconds (35398 lines/second)
Physical Source Lines of Code (SLOC) = 5558
Hits@level = [0] 241 [1]   7 [2]  16 [3]   0 [4]   9 [5]   0
Hits@level+ = [0+] 273 [1+]  32 [2+]  25 [3+]   9 [4+]   9 [5+]   0
Hits/KSLOC@level+ = [0+] 49.1184 [1+] 5.75747 [2+] 4.49802 [3+] 1.61929 [4+] 1.61929 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.