Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/m2crypto-0.36.0/SWIG/_lib.h
Examining data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c
Examining data/m2crypto-0.36.0/SWIG/libcrypto-compat.h
Examining data/m2crypto-0.36.0/SWIG/py3k_compat.h

FINAL RESULTS:

data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:653:3:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
  strcpy(r,name);
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:793:25:  [4] (format) _snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
#  define PyOS_snprintf _snprintf
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:795:25:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
#  define PyOS_snprintf snprintf
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:812:9:  [4] (format) vsnprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
  res = vsnprintf(buf, sizeof(buf), fmt, ap);
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:13046:26:  [4] (crypto) EVP_des_ecb:
  DES only supports a 56-bit keysize, which is too small given today's
  computers (CWE-327). Use a different patent-free encryption algorithm with
  a larger keysize, such as 3DES or AES.
  result = (EVP_CIPHER *)EVP_des_ecb();
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:13082:26:  [4] (crypto) EVP_des_cbc:
  DES only supports a 56-bit keysize, which is too small given today's
  computers (CWE-327). Use a different patent-free encryption algorithm with
  a larger keysize, such as 3DES or AES.
  result = (EVP_CIPHER *)EVP_des_cbc();
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:13118:26:  [4] (crypto) EVP_des_cfb:
  DES only supports a 56-bit keysize, which is too small given today's
  computers (CWE-327). Use a different patent-free encryption algorithm with
  a larger keysize, such as 3DES or AES.
  result = (EVP_CIPHER *)EVP_des_cfb();
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:13154:26:  [4] (crypto) EVP_des_ofb:
  DES only supports a 56-bit keysize, which is too small given today's
  computers (CWE-327). Use a different patent-free encryption algorithm with
  a larger keysize, such as 3DES or AES.
  result = (EVP_CIPHER *)EVP_des_ofb();
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:13298:26:  [4] (crypto) EVP_rc2_40_cbc:
  These keysizes are too small given today's computers (CWE-327). Use a
  different patent-free encryption algorithm with a larger keysize, such as
  3DES or AES.
  result = (EVP_CIPHER *)EVP_rc2_40_cbc();
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:604:16:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  static const char hex[17] = "0123456789abcdef";
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:765:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(newstr, cstr, len+1);
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:809:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char buf[SWIG_PYBUFFER_SIZE * 2];
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:1597:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char result[SWIG_BUFFER_SIZE];
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:1986:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char result[SWIG_BUFFER_SIZE];
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:2000:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char result[SWIG_BUFFER_SIZE];
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:2011:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  char result[SWIG_BUFFER_SIZE];
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:2145:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(pack, ptr, size);
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:2163:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(ptr, sobj->pack, size);
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:2791:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char mesg[256];
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:4207:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(ret, meth, sizeof(*meth));
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:4417:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(blob->data, from->data, from->len);
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:4539:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char err_msg[4096];
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:5213:22:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	    *cptr = (char *)memcpy((char *)malloc((len + 1)*sizeof(char)), cstr, sizeof(char)*(len + 1));
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:5367:11:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
#  define open(p, f, m) _open(p, f, m)
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:6063:14:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    unsigned char key[EVP_MAX_KEY_LENGTH];
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:9400:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(cb->password, pin, size + 1);
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:9465:5:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
    char dummy[1];
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:28874:38:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    arg1->password = (char *)(char *)memcpy((char *)malloc((size)*sizeof(char)), (const char *)(arg2), sizeof(char)*(size));
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:28932:36:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    arg1->prompt = (char *)(char *)memcpy((char *)malloc((size)*sizeof(char)), (const char *)(arg2), sizeof(char)*(size));
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:368:25:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  const char* te = tb + strlen(tb);
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:652:7:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  if (strlen(name) + 1 > (bsz - (r - buff))) return 0;
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:673:26:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  size_t lname = (name ? strlen(name) : 0);
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:678:5:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
    strncpy(r,name,lname+1);
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:846:91:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
#  define PyString_AsStringAndSize(obj, s, len) {*s = PyString_AsString(obj); *len = *s ? strlen(*s) : 0;}
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:3616:48:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  return SWIG_FromCharPtrAndSize(cptr, (cptr ? strlen(cptr) : 0));
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:4897:11:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    len = strlen(hex);
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:5238:30:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	if (psize) *psize = vptr ? (strlen((char *)vptr) + 1) : 0;
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:5368:11:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
#  define read(f, b, n) _read(f, b, n)
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:5409:15:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
        ret = read(fd, out, outl);
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:5422:9:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    n = strlen(str);
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:5444:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        ret = strlen(buf);
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:5798:43:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    if (_PyBytes_Resize(&obj, (Py_ssize_t)strlen(str))!=0)
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:8462:56:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    ext_name = PyBytes_FromStringAndSize(ext_name_str, strlen(ext_name_str));
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:9393:23:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
        size_t size = strlen(pin);
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:28873:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    size_t size = strlen((const char *)(arg2)) + 1;
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:28931:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
    size_t size = strlen((const char *)(arg2)) + 1;
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:31905:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      size_t size = strlen(name)+1;
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:31908:9:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
        strncpy(gv->name,name,size);
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:31970:15:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
              strlen(const_table[j].name)) == 0) {
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:31981:27:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
            size_t lptr = strlen(ty->name)+2*sizeof(void*)+2;
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:31985:15:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
              strncpy(buff, methods[i].ml_doc, ldoc);
data/m2crypto-0.36.0/SWIG/_m2crypto_wrap.c:31987:15:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120). Risk is low because the source is a
  constant string.
              strncpy(buff, "swig_ptr: ", 10);

ANALYSIS SUMMARY:

Hits = 52
Lines analyzed = 32666 in approximately 0.89 seconds (36669 lines/second)
Physical Source Lines of Code (SLOC) = 28429
Hits@level = [0]  19 [1]  23 [2]  20 [3]   0 [4]   9 [5]   0
Hits@level+ = [0+]  71 [1+]  52 [2+]  29 [3+]   9 [4+]   9 [5+]   0
Hits/KSLOC@level+ = [0+] 2.49745 [1+] 1.82912 [2+] 1.02009 [3+] 0.316578 [4+] 0.316578 [5+]   0
Dot directories skipped = 2 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.