Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/lua-sec-0.9/src/compat.h Examining data/lua-sec-0.9/src/config.c Examining data/lua-sec-0.9/src/context.c Examining data/lua-sec-0.9/src/context.h Examining data/lua-sec-0.9/src/ec.c Examining data/lua-sec-0.9/src/ec.h Examining data/lua-sec-0.9/src/luasocket/buffer.c Examining data/lua-sec-0.9/src/luasocket/buffer.h Examining data/lua-sec-0.9/src/luasocket/io.c Examining data/lua-sec-0.9/src/luasocket/io.h Examining data/lua-sec-0.9/src/luasocket/socket.h Examining data/lua-sec-0.9/src/luasocket/timeout.c Examining data/lua-sec-0.9/src/luasocket/timeout.h Examining data/lua-sec-0.9/src/luasocket/usocket.c Examining data/lua-sec-0.9/src/luasocket/usocket.h Examining data/lua-sec-0.9/src/luasocket/wsocket.c Examining data/lua-sec-0.9/src/luasocket/wsocket.h Examining data/lua-sec-0.9/src/options.c Examining data/lua-sec-0.9/src/options.h Examining data/lua-sec-0.9/src/ssl.c Examining data/lua-sec-0.9/src/ssl.h Examining data/lua-sec-0.9/src/x509.c Examining data/lua-sec-0.9/src/x509.h Examining data/lua-sec-0.9/lua-sec.h FINAL RESULTS: data/lua-sec-0.9/src/context.c:684:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(ctx->alpn, (void*)*out, *outlen); data/lua-sec-0.9/src/luasocket/buffer.h:33:5: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char data[BUF_SIZE]; /* storage space for buffer data */ data/lua-sec-0.9/src/ssl.c:701:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[256] = {0}; data/lua-sec-0.9/src/x509.c:96:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy((void*)&addr4.sin_addr, src, sizeof(struct in_addr)); data/lua-sec-0.9/src/x509.c:103:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy((void*)&addr6.sin6_addr, src, sizeof(struct in6_addr)); data/lua-sec-0.9/src/x509.c:137:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buffer[256]; data/lua-sec-0.9/src/x509.c:190:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char dst[INET6_ADDRSTRLEN]; data/lua-sec-0.9/src/x509.c:453:12: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char buffer[EVP_MAX_MD_SIZE]; data/lua-sec-0.9/src/x509.c:454:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char hex_buffer[EVP_MAX_MD_SIZE*2]; data/lua-sec-0.9/src/context.c:158:5: [1] (buffer) strncpy: Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned] (CWE-120). strncpy(buf, lua_tostring(L, -1), size); data/lua-sec-0.9/src/context.c:161:17: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). return (int)strlen(buf); data/lua-sec-0.9/src/luasocket/usocket.c:334:29: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). long taken = (long) read(*ps, data, count); ANALYSIS SUMMARY: Hits = 12 Lines analyzed = 4932 in approximately 0.14 seconds (35900 lines/second) Physical Source Lines of Code (SLOC) = 3526 Hits@level = [0] 10 [1] 3 [2] 9 [3] 0 [4] 0 [5] 0 Hits@level+ = [0+] 22 [1+] 12 [2+] 9 [3+] 0 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 6.23936 [1+] 3.40329 [2+] 2.55247 [3+] 0 [4+] 0 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.