The following issues were found

src/ccutil/mainblk.cpp
2 issues
getenv - Environment variables are untrustable input if they can be set by an attacker. They can have any content and length, and the same variable can be set more than once
Security

Line: 47 Column: 27 CWE codes: 807 20
Suggestion: Check environment variables carefully before using them 

              void CCUtil::main_setup(const std::string &argv0, const std::string &basename) {
  imagebasename = basename; /**< name of image */

  char *tessdata_prefix = getenv("TESSDATA_PREFIX");

  if (!argv0.empty()) {
    /* Use tessdata prefix from the command line. */
    datadir = argv0;
  } else if (tessdata_prefix) {

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 58 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              #if defined(_WIN32)
  } else if (datadir.empty() || _access(datadir.c_str(), 0) != 0) {
    /* Look for tessdata in directory of executable. */
    char path[_MAX_PATH];
    DWORD length = GetModuleFileName(nullptr, path, sizeof(path));
    if (length > 0 && length < sizeof(path)) {
      char *separator = std::strrchr(path, '\\');
      if (separator != nullptr) {
        *separator = '\0';

Reported by FlawFinder.

src/training/unicharset/lstmtrainer.cpp
2 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1389 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                    best_model_data_ = model_data;
    }
    best_error_rate_ = error_rate;
    memcpy(best_error_rates_, error_rates_, sizeof(error_rates_));
    best_iteration_ = iteration;
    best_error_history_.push_back(error_rate);
    best_error_iterations_.push_back(iteration);
    // Compute 2% decay time.
    double two_percent_more = error_rate + 2.0;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1421 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                  }
  }
  worst_error_rate_ = error_rate;
  memcpy(worst_error_rates_, error_rates_, sizeof(error_rates_));
  worst_iteration_ = iteration;
  return result;
}

} // namespace tesseract.

Reported by FlawFinder.

src/ccutil/helpers.h
2 issues
strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 89 Column: 37 CWE codes: 126 

              
// Remove newline (if any) at the end of the string.
inline void chomp_string(char *str) {
  int last_index = static_cast<int>(strlen(str)) - 1;
  while (last_index >= 0 && (str[last_index] == '\n' || str[last_index] == '\r')) {
    str[last_index--] = '\0';
  }
}

Reported by FlawFinder.

fgetc - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 97 Column: 7 CWE codes: 120 20 

              
// Advance the current pointer of the file if it points to a newline character.
inline void SkipNewline(FILE *file) {
  if (fgetc(file) != '\n') {
    fseek(file, -1, SEEK_CUR);
  }
}

// return the smallest multiple of block_size greater than or equal to n.

Reported by FlawFinder.

src/ccutil/ambigs.cpp
2 issues
strcat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 321 Column: 5 CWE codes: 120
Suggestion: Consider using strcat_s, strncat, strlcat, or snprintf (warning: strncat is easily misused) 

                  if (!(token = strtok_r(nullptr, kAmbigDelimiters, &next_token))) {
      break;
    }
    strcat(replacement_string, token);
    if (!unicharset.contains_unichar(token)) {
      if (debug_level) {
        tprintf(kIllegalUnicharMsg, token);
      }
      break;

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 87 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

                // GCC frame size warning.
  const int kBufferSize = 10 + 2 * kMaxAmbigStringSize;
  char *buffer = new char[kBufferSize];
  char replacement_string[kMaxAmbigStringSize];
  UNICHAR_ID test_unichar_ids[MAX_AMBIG_SIZE + 1];
  int line_num = 0;
  int type = NOT_AMBIG;

  // Determine the version of the ambigs file.

Reported by FlawFinder.

src/wordrec/findseam.cpp
2 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 106 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              void Wordrec::choose_best_seam(SeamQueue *seam_queue, const SPLIT *split, PRIORITY priority,
                               SEAM **seam_result, TBLOB *blob, SeamPile *seam_pile) {
  SEAM *seam;
  char str[80];
  float my_priority;
  /* Add seam of split */
  my_priority = priority;
  if (split != nullptr) {
    TPOINT split_point = split->point1->pos;

Reported by FlawFinder.

sprintf - Does not check for buffer overflows
Security

Line: 136 Column: 7 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf 

                      seam->FullPriority(bbox.left(), bbox.right(), chop_overlap_knob, chop_centered_maxwidth,
                           chop_center_knob, chop_width_change_knob);
    if (chop_debug) {
      sprintf(str, "Full my_priority %0.0f,  ", my_priority);
      seam->Print(str);
    }

    if ((*seam_result == nullptr || (*seam_result)->priority() > my_priority) &&
        my_priority < chop_ok_split) {

Reported by FlawFinder.

src/ccmain/control.cpp
2 issues
fopen - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 122 Column: 27 CWE codes: 362 

                  if (word_box.major_overlap(target_word_box)) {
      if (backup_config_file_ == nullptr) {
        backup_config_file_ = kBackUpConfigFile;
        FILE *config_fp = fopen(backup_config_file_, "wb");
        if (config_fp == nullptr) {
          tprintf("Error, failed to open file \"%s\"\n", backup_config_file_);
        } else {
          ParamUtils::PrintParams(config_fp, params());
          fclose(config_fp);

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 1711 Column: 7 CWE codes: 126 

                int hyphen_pos = -1;
  ACCEPTABLE_WERD_TYPE word_type = AC_UNACCEPTABLE;

  if (strlen(lengths) > 20) {
    return word_type;
  }

  /* Single Leading punctuation char*/

Reported by FlawFinder.

src/ccstruct/polyblk.cpp
2 issues
snprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 257 Column: 5 CWE codes: 134
Suggestion: Use a constant for the format specification 

                  window->TextAttributes("Times", 80, false, false, false);
    char temp_buff[34];
#  if !defined(_WIN32) || defined(__MINGW32__)
    snprintf(temp_buff, sizeof(temp_buff), "%" PRId32, num);
#  else
    _ltoa(num, temp_buff, 10);
#  endif
    window->Text(v.data()->x(), v.data()->y(), temp_buff);
  }

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 255 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              
  if (num > 0) {
    window->TextAttributes("Times", 80, false, false, false);
    char temp_buff[34];
#  if !defined(_WIN32) || defined(__MINGW32__)
    snprintf(temp_buff, sizeof(temp_buff), "%" PRId32, num);
#  else
    _ltoa(num, temp_buff, 10);
#  endif

Reported by FlawFinder.

src/ccstruct/pdblock.cpp
2 issues
snprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 206 Column: 5 CWE codes: 134
Suggestion: Use a constant for the format specification 

                  //                      serial,startpt.x(),startpt.y());
    char temp_buff[34];
#  if !defined(_WIN32) || defined(__MINGW32__)
    snprintf(temp_buff, sizeof(temp_buff), "%" PRId32, serial);
#  else
    _ultoa(serial, temp_buff, 10);
#  endif
    window->Text(startpt.x(), startpt.y(), temp_buff);

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 204 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

                  startpt = *(it.data()); // bottom left corner
    //              tprintf("Block %d bottom left is (%d,%d)\n",
    //                      serial,startpt.x(),startpt.y());
    char temp_buff[34];
#  if !defined(_WIN32) || defined(__MINGW32__)
    snprintf(temp_buff, sizeof(temp_buff), "%" PRId32, serial);
#  else
    _ultoa(serial, temp_buff, 10);
#  endif

Reported by FlawFinder.

src/ccstruct/matrix.h
2 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 86 Column: 7 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                  ResizeNoInit(src.dim1(), src.dim2());
    int size = num_elements();
    if (size > 0) {
      memcpy(array_, src.array_, size * sizeof(array_[0]));
    }
  }

  // Reallocates the array to the given size. Does not keep old data, but does
  // not initialize the array either.

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 506 Column: 11 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                  for (int replica = 0; replica < num_replicas; ++replica) {
      for (int start = 0; start < src_step; start += move_size) {
        for (int pos = start; pos < wrap_size; pos += src_step) {
          memcpy(dest, src + pos, sizeof(*dest) * move_size);
          dest += move_size;
        }
      }
      src += wrap_size;
    }

Reported by FlawFinder.

src/training/common/errorcounter.cpp
2 issues
snprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 458 Column: 3 CWE codes: 134
Suggestion: Use a constant for the format specification 

                    "OKjunk=%.4g%%, Badjunk=%.4g%%";
  constexpr size_t max_str_len = sizeof(format_str) + kMaxExtraLength * (CT_SIZE - 1) + 1;
  char formatted_str[max_str_len];
  snprintf(formatted_str, max_str_len, format_str, rates[CT_UNICHAR_TOP1_ERR] * 100.0,
           rates[CT_UNICHAR_TOP2_ERR] * 100.0, rates[CT_UNICHAR_TOPN_ERR] * 100.0,
           rates[CT_UNICHAR_TOPTOP_ERR] * 100.0, rates[CT_OK_MULTI_UNICHAR] * 100.0,
           rates[CT_OK_JOINED] * 100.0, rates[CT_OK_BROKEN] * 100.0, rates[CT_REJECT] * 100.0,
           rates[CT_FONT_ATTR_ERR] * 100.0, rates[CT_OK_MULTI_FONT] * 100.0, rates[CT_NUM_RESULTS],
           rates[CT_RANK], 100.0 * rates[CT_REJECTED_JUNK], 100.0 * rates[CT_ACCEPTED_JUNK]);

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 457 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

                    "Answers=%.3g, Rank=%.3g, "
      "OKjunk=%.4g%%, Badjunk=%.4g%%";
  constexpr size_t max_str_len = sizeof(format_str) + kMaxExtraLength * (CT_SIZE - 1) + 1;
  char formatted_str[max_str_len];
  snprintf(formatted_str, max_str_len, format_str, rates[CT_UNICHAR_TOP1_ERR] * 100.0,
           rates[CT_UNICHAR_TOP2_ERR] * 100.0, rates[CT_UNICHAR_TOPN_ERR] * 100.0,
           rates[CT_UNICHAR_TOPTOP_ERR] * 100.0, rates[CT_OK_MULTI_UNICHAR] * 100.0,
           rates[CT_OK_JOINED] * 100.0, rates[CT_OK_BROKEN] * 100.0, rates[CT_REJECT] * 100.0,
           rates[CT_FONT_ATTR_ERR] * 100.0, rates[CT_OK_MULTI_FONT] * 100.0, rates[CT_NUM_RESULTS],

Reported by FlawFinder.