Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/libmd-1.0.1/src/sha256hl.c
Examining data/libmd-1.0.1/src/md4hl.c
Examining data/libmd-1.0.1/src/sha2.c
Examining data/libmd-1.0.1/src/md5.c
Examining data/libmd-1.0.1/src/helper.c
Examining data/libmd-1.0.1/src/sha1.c
Examining data/libmd-1.0.1/src/md2.c
Examining data/libmd-1.0.1/src/md4.c
Examining data/libmd-1.0.1/src/rmd160.c
Examining data/libmd-1.0.1/src/sha384hl.c
Examining data/libmd-1.0.1/src/sha1hl.c
Examining data/libmd-1.0.1/src/md5hl.c
Examining data/libmd-1.0.1/src/md2hl.c
Examining data/libmd-1.0.1/src/rmd160hl.c
Examining data/libmd-1.0.1/src/sha512hl.c
Examining data/libmd-1.0.1/test/sha2.c
Examining data/libmd-1.0.1/test/md5.c
Examining data/libmd-1.0.1/test/sha1.c
Examining data/libmd-1.0.1/test/md2.c
Examining data/libmd-1.0.1/test/test.h
Examining data/libmd-1.0.1/test/md4.c
Examining data/libmd-1.0.1/test/rmd160.c
Examining data/libmd-1.0.1/include/md4.h
Examining data/libmd-1.0.1/include/sha1.h
Examining data/libmd-1.0.1/include/sha256.h
Examining data/libmd-1.0.1/include/ripemd.h
Examining data/libmd-1.0.1/include/sha.h
Examining data/libmd-1.0.1/include/sha512.h
Examining data/libmd-1.0.1/include/sha2.h
Examining data/libmd-1.0.1/include/md2.h
Examining data/libmd-1.0.1/include/rmd160.h
Examining data/libmd-1.0.1/include/md5.h

FINAL RESULTS:

data/libmd-1.0.1/include/md2.h:16:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char C[16];		/* checksum */
data/libmd-1.0.1/include/md2.h:17:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char X[48];		/* input buffer */
data/libmd-1.0.1/src/helper.c:61:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	if ((fd = open(filename, O_RDONLY)) < 0)
data/libmd-1.0.1/src/md2.c:45:17:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
static unsigned char S[256] = {
data/libmd-1.0.1/src/md2.c:127:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(&context->X[context->i], &input[idx], (size_t)piece);
data/libmd-1.0.1/src/md2.c:134:19:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
MD2Final(unsigned char digest[16], MD2_CTX *context)
data/libmd-1.0.1/src/md2.c:151:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(digest, &context->X[0], (size_t)16);
data/libmd-1.0.1/src/md2hl.c:61:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	if ((fd = open(filename, O_RDONLY)) < 0)
data/libmd-1.0.1/src/md4.c:81:4:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			memcpy(ctx->buffer + have, input, need);
data/libmd-1.0.1/src/md4.c:98:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(ctx->buffer + have, input, len);
data/libmd-1.0.1/src/md4.c:127:19:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
MD4Final(unsigned char digest[MD4_DIGEST_LENGTH], MD4_CTX *ctx)
data/libmd-1.0.1/src/md4hl.c:61:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	if ((fd = open(filename, O_RDONLY)) < 0)
data/libmd-1.0.1/src/md5.c:80:4:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			memcpy(ctx->buffer + have, input, need);
data/libmd-1.0.1/src/md5.c:97:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(ctx->buffer + have, input, len);
data/libmd-1.0.1/src/md5.c:126:19:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
MD5Final(unsigned char digest[MD5_DIGEST_LENGTH], MD5_CTX *ctx)
data/libmd-1.0.1/src/md5hl.c:61:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	if ((fd = open(filename, O_RDONLY)) < 0)
data/libmd-1.0.1/src/rmd160.c:116:4:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			memcpy(ctx->buffer + have, input, need);
data/libmd-1.0.1/src/rmd160.c:128:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(ctx->buffer + have, input+off, len-off);
data/libmd-1.0.1/src/rmd160.c:169:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(x, block, RMD160_BLOCK_LENGTH);
data/libmd-1.0.1/src/rmd160hl.c:61:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	if ((fd = open(filename, O_RDONLY)) < 0)
data/libmd-1.0.1/src/sha1.c:114:8:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	(void)memcpy(block, buffer, SHA1_BLOCK_LENGTH);
data/libmd-1.0.1/src/sha1.c:192:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		(void)memcpy(&context->buffer[j], data, (i = 64-j));
data/libmd-1.0.1/src/sha1.c:200:8:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	(void)memcpy(&context->buffer[j], &data[i], len - i);
data/libmd-1.0.1/src/sha1hl.c:61:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	if ((fd = open(filename, O_RDONLY)) < 0)
data/libmd-1.0.1/src/sha2.c:255:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(context->state.st32, sha256_initial_hash_value,
data/libmd-1.0.1/src/sha2.c:435:4:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			memcpy(&context->buffer[usedspace], data, freespace);
data/libmd-1.0.1/src/sha2.c:442:4:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			memcpy(&context->buffer[usedspace], data, len);
data/libmd-1.0.1/src/sha2.c:458:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(context->buffer, data, len);
data/libmd-1.0.1/src/sha2.c:522:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(digest, context->state.st32, SHA256_DIGEST_LENGTH);
data/libmd-1.0.1/src/sha2.c:536:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(context->state.st64, sha512_initial_hash_value,
data/libmd-1.0.1/src/sha2.c:717:4:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			memcpy(&context->buffer[usedspace], data, freespace);
data/libmd-1.0.1/src/sha2.c:724:4:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
			memcpy(&context->buffer[usedspace], data, len);
data/libmd-1.0.1/src/sha2.c:740:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(context->buffer, data, len);
data/libmd-1.0.1/src/sha2.c:804:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(digest, context->state.st64, SHA512_DIGEST_LENGTH);
data/libmd-1.0.1/src/sha2.c:817:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(context->state.st64, sha384_initial_hash_value,
data/libmd-1.0.1/src/sha2.c:841:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(digest, context->state.st64, SHA384_DIGEST_LENGTH);
data/libmd-1.0.1/src/sha256hl.c:61:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	if ((fd = open(filename, O_RDONLY)) < 0)
data/libmd-1.0.1/src/sha384hl.c:61:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	if ((fd = open(filename, O_RDONLY)) < 0)
data/libmd-1.0.1/src/sha512hl.c:61:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
	if ((fd = open(filename, O_RDONLY)) < 0)
data/libmd-1.0.1/test/test.h:60:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char hash_str_got[name##_DIGEST_STRING_LENGTH]; \
data/libmd-1.0.1/src/helper.c:75:15:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	while ((nr = read(fd, buffer, MIN(sizeof(buffer), len))) > 0) {
data/libmd-1.0.1/src/md2hl.c:75:15:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	while ((nr = read(fd, buffer, MIN(sizeof(buffer), len))) > 0) {
data/libmd-1.0.1/src/md4hl.c:75:15:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	while ((nr = read(fd, buffer, MIN(sizeof(buffer), len))) > 0) {
data/libmd-1.0.1/src/md5hl.c:75:15:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	while ((nr = read(fd, buffer, MIN(sizeof(buffer), len))) > 0) {
data/libmd-1.0.1/src/rmd160hl.c:75:15:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	while ((nr = read(fd, buffer, MIN(sizeof(buffer), len))) > 0) {
data/libmd-1.0.1/src/sha1hl.c:75:15:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	while ((nr = read(fd, buffer, MIN(sizeof(buffer), len))) > 0) {
data/libmd-1.0.1/src/sha256hl.c:75:15:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	while ((nr = read(fd, buffer, MIN(sizeof(buffer), len))) > 0) {
data/libmd-1.0.1/src/sha384hl.c:75:15:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	while ((nr = read(fd, buffer, MIN(sizeof(buffer), len))) > 0) {
data/libmd-1.0.1/src/sha512hl.c:75:15:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
	while ((nr = read(fd, buffer, MIN(sizeof(buffer), len))) > 0) {
data/libmd-1.0.1/test/md5.c:49:25:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	md5_append(&pms, data, strlen(data));
data/libmd-1.0.1/test/test.h:65:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	name##Data(data, strlen(data), hash_str_got); \
data/libmd-1.0.1/test/test.h:69:27:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	name##Update(&ctx, data, strlen(data)); \
data/libmd-1.0.1/test/test.h:74:27:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	name##Update(&ctx, data, strlen(data)); \

ANALYSIS SUMMARY:

Hits = 53
Lines analyzed = 3975 in approximately 0.16 seconds (24210 lines/second)
Physical Source Lines of Code (SLOC) = 2597
Hits@level = [0]   0 [1]  13 [2]  40 [3]   0 [4]   0 [5]   0
Hits@level+ = [0+]  53 [1+]  53 [2+]  40 [3+]   0 [4+]   0 [5+]   0
Hits/KSLOC@level+ = [0+] 20.4082 [1+] 20.4082 [2+] 15.4024 [3+]   0 [4+]   0 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.