The following issues were found

src/ccmain/recogtraining.cpp
2 issues
fopen - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 50 Column: 23 CWE codes: 362

                  output_fname[lastdot - output_fname.c_str()] = '\0';
  }
  output_fname += ".txt";
  FILE *output_file = fopen(output_fname.c_str(), "a+");
  if (output_file == nullptr) {
    tprintf("Error: Could not open file %s\n", output_fname.c_str());
    ASSERT_HOST(output_file);
  }
  return output_file;

            

Reported by FlawFinder.

fopen - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 95 Column: 20 CWE codes: 362

                }
  box_fname += ".box";
  // ReadNextBox() will close box_file
  FILE *box_file = fopen(box_fname.c_str(), "r");
  if (box_file == nullptr) {
    tprintf("Error: Could not open file %s\n", box_fname.c_str());
    ASSERT_HOST(box_file);
  }


            

Reported by FlawFinder.

src/textord/colpartition.cpp
2 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1761 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                part->left_margin_ = left_margin_;
  part->right_margin_ = right_margin_;
  part->bounding_box_ = bounding_box_;
  memcpy(part->special_blobs_densities_, special_blobs_densities_,
         sizeof(special_blobs_densities_));
  part->median_bottom_ = median_bottom_;
  part->median_top_ = median_top_;
  part->median_height_ = median_height_;
  part->median_left_ = median_left_;

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1806 Column: 8 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              #endif // !GRAPHICS_DISABLED

// Keep in sync with BlobRegionType.
static char kBlobTypes[BRT_COUNT + 1] = "NHSRIUVT";

// Prints debug information on this.
void ColPartition::Print() const {
  int y = MidY();
  tprintf(

            

Reported by FlawFinder.

src/textord/fpchop.h
2 issues
There is an unknown macro here somewhere. Configuration is required. If ELISTIZEH is a macro then please configure it.
Error

Line: 59

                C_OUTLINE_FRAG(const C_OUTLINE_FRAG &other) = delete;
};

ELISTIZEH(C_OUTLINE_FRAG)

extern INT_VAR_H(textord_fp_chop_error);

ROW *fixed_pitch_words( // find lines
    TO_ROW *row,        // row to do

            

Reported by Cppcheck.

There is an unknown macro here somewhere. Configuration is required. If ELISTIZEH is a macro then please configure it.
Error

Line: 59

                C_OUTLINE_FRAG(const C_OUTLINE_FRAG &other) = delete;
};

ELISTIZEH(C_OUTLINE_FRAG)

extern INT_VAR_H(textord_fp_chop_error);

ROW *fixed_pitch_words( // find lines
    TO_ROW *row,        // row to do

            

Reported by Cppcheck.

src/training/ambiguous_words.cpp
2 issues
fopen - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 65 Column: 22 CWE codes: 362

                api.Init(tessdata_dir, lang.c_str(), tesseract::OEM_TESSERACT_ONLY, nullptr, 0, &vars_vec,
           &vars_values, false);
  tesseract::Dict &dict = api.tesseract()->getDict();
  FILE *input_file = fopen(input_file_str, "rb");
  if (input_file == nullptr) {
    tesseract::tprintf("Failed to open input wordlist file %s\n", input_file_str);
    exit(1);
  }
  char str[CHARS_PER_LINE];

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 70 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                  tesseract::tprintf("Failed to open input wordlist file %s\n", input_file_str);
    exit(1);
  }
  char str[CHARS_PER_LINE];

  // Read word list and call Dict::NoDangerousAmbig() for each word
  // to record ambiguities in the output file.
  while (fgets(str, CHARS_PER_LINE, input_file) != nullptr) {
    tesseract::chomp_string(str); // remove newline

            

Reported by FlawFinder.

src/training/cntraining.cpp
2 issues
fopen - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 124 Column: 26 CWE codes: 362

                int tessoptind = 1;
  while ((PageName = GetNextFilename(argc, argv, tessoptind)) != nullptr) {
    printf("Reading %s ...\n", PageName);
    FILE *TrainingPage = fopen(PageName, "rb");
    ASSERT_HOST(TrainingPage);
    if (TrainingPage) {
      ReadTrainingSamples(FeatureDefs, PROGRAM_FEATURE_TYPE, 100, nullptr, TrainingPage, &CharList);
      fclose(TrainingPage);
      ++num_fonts;

            

Reported by FlawFinder.

fopen - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 207 Column: 10 CWE codes: 362

                }
  Filename += "normproto";
  printf("\nWriting %s ...", Filename.c_str());
  File = fopen(Filename.c_str(), "wb");
  ASSERT_HOST(File);
  fprintf(File, "%0d\n", feature_desc->NumParams);
  WriteParamDesc(File, feature_desc->NumParams, feature_desc->ParamDesc);
  iterate(LabeledProtoList) {
    LabeledProto = reinterpret_cast<LABELEDLIST>(LabeledProtoList->first_node());

            

Reported by FlawFinder.

src/training/combine_tessdata.cpp
2 issues
strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 83 Column: 27 CWE codes: 126

                } else if (argc == 2) {
    printf("Combining tessdata files\n");
    std::string lang = argv[1];
    char *last = &argv[1][strlen(argv[1]) - 1];
    if (*last != '.') {
      lang += '.';
    }
    std::string output_file = lang;
    output_file += kTrainedDataSuffix;

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 120 Column: 31 CWE codes: 126

                  } else { // extract all the components
      for (i = 0; i < tesseract::TESSDATA_NUM_ENTRIES; ++i) {
        std::string filename = argv[3];
        char *last = &argv[3][strlen(argv[3]) - 1];
        if (*last != '.') {
          filename += '.';
        }
        filename += tesseract::kTessdataFileSuffixes[i];
        errno = 0;

            

Reported by FlawFinder.

src/training/common/errorcounter.cpp
2 issues
snprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 458 Column: 3 CWE codes: 134
Suggestion: Use a constant for the format specification

                    "OKjunk=%.4g%%, Badjunk=%.4g%%";
  constexpr size_t max_str_len = sizeof(format_str) + kMaxExtraLength * (CT_SIZE - 1) + 1;
  char formatted_str[max_str_len];
  snprintf(formatted_str, max_str_len, format_str, rates[CT_UNICHAR_TOP1_ERR] * 100.0,
           rates[CT_UNICHAR_TOP2_ERR] * 100.0, rates[CT_UNICHAR_TOPN_ERR] * 100.0,
           rates[CT_UNICHAR_TOPTOP_ERR] * 100.0, rates[CT_OK_MULTI_UNICHAR] * 100.0,
           rates[CT_OK_JOINED] * 100.0, rates[CT_OK_BROKEN] * 100.0, rates[CT_REJECT] * 100.0,
           rates[CT_FONT_ATTR_ERR] * 100.0, rates[CT_OK_MULTI_FONT] * 100.0, rates[CT_NUM_RESULTS],
           rates[CT_RANK], 100.0 * rates[CT_REJECTED_JUNK], 100.0 * rates[CT_ACCEPTED_JUNK]);

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 457 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                    "Answers=%.3g, Rank=%.3g, "
      "OKjunk=%.4g%%, Badjunk=%.4g%%";
  constexpr size_t max_str_len = sizeof(format_str) + kMaxExtraLength * (CT_SIZE - 1) + 1;
  char formatted_str[max_str_len];
  snprintf(formatted_str, max_str_len, format_str, rates[CT_UNICHAR_TOP1_ERR] * 100.0,
           rates[CT_UNICHAR_TOP2_ERR] * 100.0, rates[CT_UNICHAR_TOPN_ERR] * 100.0,
           rates[CT_UNICHAR_TOPTOP_ERR] * 100.0, rates[CT_OK_MULTI_UNICHAR] * 100.0,
           rates[CT_OK_JOINED] * 100.0, rates[CT_OK_BROKEN] * 100.0, rates[CT_REJECT] * 100.0,
           rates[CT_FONT_ATTR_ERR] * 100.0, rates[CT_OK_MULTI_FONT] * 100.0, rates[CT_NUM_RESULTS],

            

Reported by FlawFinder.

unittest/validator_test.cc
1 issues
syntax error
Error

Line: 28

              
// The majority of Validator is tested by the script-specific tests of its
// subclasses, but the MostFrequentViramaScript function is worth a unittest.
TEST(ValidatorTest, MostFrequentViramaScript) {
  // The most frequent virama script should come out correct, despite
  // distractions from other scripts.
  EXPECT_EQ(ViramaScript::kTelugu, TestableValidator::TestableMostFrequentViramaScript({0xc05}));
  // It is still Telugu surrounded by Latin.
  EXPECT_EQ(ViramaScript::kTelugu,

            

Reported by Cppcheck.

java/com/google/scrollview/ui/SVCheckboxMenuItem.java
1 issues
Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 32

               * Constructs a new menulistitem which possesses a flag that can be toggled.
 */
class SVCheckboxMenuItem extends SVAbstractMenuItem {
  public boolean bvalue;

  SVCheckboxMenuItem(int id, String name, boolean val) {
    super(id, name, new JCheckBoxMenuItem(name, val));
    bvalue = val;
  }

            

Reported by PMD.

src/api/lstmboxrenderer.cpp
1 issues
strcpy - Does not check for buffer overflows when copying to destination [MS-banned]
Security

Line: 85 Column: 3 CWE codes: 120
Suggestion: Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused)

                  lstm_box_str += "\n"; // end of PAGE
  }
  char *ret = new char[lstm_box_str.length() + 1];
  strcpy(ret, lstm_box_str.c_str());
  delete res_it;
  return ret;
}

/**********************************************************************

            

Reported by FlawFinder.