Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/rhonabwy-0.9.12/include/rhonabwy.h
Examining data/rhonabwy-0.9.12/src/jwe.c
Examining data/rhonabwy-0.9.12/src/jwk.c
Examining data/rhonabwy-0.9.12/src/jwks.c
Examining data/rhonabwy-0.9.12/src/jws.c
Examining data/rhonabwy-0.9.12/src/jwt.c
Examining data/rhonabwy-0.9.12/src/misc.c
Examining data/rhonabwy-0.9.12/test/jwe_aesgcm.c
Examining data/rhonabwy-0.9.12/test/jwe_core.c
Examining data/rhonabwy-0.9.12/test/jwe_dir.c
Examining data/rhonabwy-0.9.12/test/jwe_rsa.c
Examining data/rhonabwy-0.9.12/test/jwk_export.c
Examining data/rhonabwy-0.9.12/test/jwk_import.c
Examining data/rhonabwy-0.9.12/test/jwks_core.c
Examining data/rhonabwy-0.9.12/test/jws_core.c
Examining data/rhonabwy-0.9.12/test/jws_ecdsa.c
Examining data/rhonabwy-0.9.12/test/jws_hmac.c
Examining data/rhonabwy-0.9.12/test/jws_rsa.c
Examining data/rhonabwy-0.9.12/test/jws_rsapss.c
Examining data/rhonabwy-0.9.12/test/jwt_core.c
Examining data/rhonabwy-0.9.12/test/jwt_encrypt.c
Examining data/rhonabwy-0.9.12/test/jwt_nested.c
Examining data/rhonabwy-0.9.12/test/jwt_sign.c
Examining data/rhonabwy-0.9.12/test/misc.c
Examining data/rhonabwy-0.9.12/test/jwk_core.c
Examining data/rhonabwy-0.9.12/tools/rnbyc/rnbyc.c

FINAL RESULTS:

data/rhonabwy-0.9.12/tools/rnbyc/rnbyc.c:703:19:  [3] (buffer) getopt_long:
  Some older implementations do not protect against internal buffer overflows
  (CWE-120, CWE-20). Check implementation on installation, or limit the size
  of all string inputs.
    next_option = getopt_long(argc, argv, short_options, long_options, NULL);
data/rhonabwy-0.9.12/src/jwe.c:125:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char iv[96] = {0}, iv_b64url[192] = {0}, * key = NULL, cipherkey[64] = {0}, cipherkey_b64url[128] = {0}, tag[128] = {0}, tag_b64url[256] = {0};
data/rhonabwy-0.9.12/src/jwe.c:206:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char iv[96] = {0}, * key = NULL, cipherkey[64] = {0}, tag[128] = {0}, tag_b64url[256] = {0};
data/rhonabwy-0.9.12/src/jwe.c:323:7:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
      memcpy(ptext, data, data_len);
data/rhonabwy-0.9.12/src/jwe.c:428:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char al[8], * compute_hmac = NULL;
data/rhonabwy-0.9.12/src/jwe.c:440:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(compute_hmac, jwe->header_b64url, aad_size);
data/rhonabwy-0.9.12/src/jwe.c:442:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(compute_hmac+hmac_size, jwe->iv, jwe->iv_len);
data/rhonabwy-0.9.12/src/jwe.c:444:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(compute_hmac+hmac_size, ciphertext, cyphertext_len);
data/rhonabwy-0.9.12/src/jwe.c:446:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(compute_hmac+hmac_size, al, 8);
data/rhonabwy-0.9.12/src/jwe.c:570:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(jwe->payload, payload, payload_len);
data/rhonabwy-0.9.12/src/jwe.c:607:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(jwe->key, key, key_len);
data/rhonabwy-0.9.12/src/jwe.c:672:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(jwe->iv, iv, iv_len);
data/rhonabwy-0.9.12/src/jwe.c:1351:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char inf_out[256] = {0}, tag[128], * tag_b64url = NULL;
data/rhonabwy-0.9.12/src/jwe.c:1413:23:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
                      memcpy(jwe->payload+jwe->payload_len, inf_out, infstream.total_out);
data/rhonabwy-0.9.12/src/jwe.c:1770:40:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      if (o_base64url_decode((unsigned char *)str_array[0], o_strlen(str_array[0]), NULL, &header_len) && 
data/rhonabwy-0.9.12/src/jwe.c:1771:40:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
          o_base64url_decode((unsigned char *)str_array[2], o_strlen(str_array[2]), NULL, &iv_len) &&
data/rhonabwy-0.9.12/src/jwe.c:1772:40:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
          o_base64url_decode((unsigned char *)str_array[3], o_strlen(str_array[3]), NULL, &cypher_len) &&
data/rhonabwy-0.9.12/src/jwe.c:1773:40:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
          o_base64url_decode((unsigned char *)str_array[4], o_strlen(str_array[4]), NULL, &tag_len)) {
data/rhonabwy-0.9.12/src/jwe.c:1783:45:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
          if (!o_base64url_decode((unsigned char *)str_array[0], o_strlen(str_array[0]), (unsigned char *)str_header, &header_len)) {
data/rhonabwy-0.9.12/src/jwe.c:1811:45:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
          if (!o_base64url_decode((unsigned char *)str_array[2], o_strlen(str_array[2]), iv, &iv_len)) {
data/rhonabwy-0.9.12/src/jwe.c:1824:42:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
          jwe->header_b64url = (unsigned char *)o_strdup(str_array[0]);
data/rhonabwy-0.9.12/src/jwe.c:1826:49:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
          jwe->encrypted_key_b64url = (unsigned char *)o_strdup(str_array[1]);
data/rhonabwy-0.9.12/src/jwe.c:1828:38:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
          jwe->iv_b64url = (unsigned char *)o_strdup(str_array[2]);
data/rhonabwy-0.9.12/src/jwe.c:1830:46:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
          jwe->ciphertext_b64url = (unsigned char *)o_strdup(str_array[3]);
data/rhonabwy-0.9.12/src/jwe.c:1832:44:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
          jwe->auth_tag_b64url = (unsigned char *)o_strdup(str_array[4]);
data/rhonabwy-0.9.12/src/jwk.c:1340:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char kid[64], kid_b64[128];
data/rhonabwy-0.9.12/src/jws.c:305:11:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
          memcpy(binary_sig + r_out_padding, r.data + r_padding, r.size - r_padding);
data/rhonabwy-0.9.12/src/jws.c:306:11:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
          memcpy(binary_sig + (r.size - r_padding + r_out_padding) + s_out_padding, s.data + s_padding, (s.size - s_padding));
data/rhonabwy-0.9.12/src/jws.c:686:9:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
        memcpy(jws->payload, payload, payload_len);
data/rhonabwy-0.9.12/src/jws.c:1140:40:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      if (o_base64url_decode((unsigned char *)str_array[0], o_strlen(str_array[0]), NULL, &header_len) && o_base64url_decode((unsigned char *)str_array[1], o_strlen(str_array[1]), NULL, &payload_len)) {
data/rhonabwy-0.9.12/src/jws.c:1140:136:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      if (o_base64url_decode((unsigned char *)str_array[0], o_strlen(str_array[0]), NULL, &header_len) && o_base64url_decode((unsigned char *)str_array[1], o_strlen(str_array[1]), NULL, &payload_len)) {
data/rhonabwy-0.9.12/src/jws.c:1150:45:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
          if (!o_base64url_decode((unsigned char *)str_array[0], o_strlen(str_array[0]), (unsigned char *)str_header, &header_len)) {
data/rhonabwy-0.9.12/src/jws.c:1174:45:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
          if (!o_base64url_decode((unsigned char *)str_array[1], o_strlen(str_array[1]), jws->payload, &jws->payload_len)) {
data/rhonabwy-0.9.12/src/jws.c:1181:42:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
          jws->header_b64url = (unsigned char *)o_strdup(str_array[0]);
data/rhonabwy-0.9.12/src/jws.c:1186:47:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
            jws->signature_b64url = (unsigned char *)o_strdup(str_array[2]);
data/rhonabwy-0.9.12/test/jwe_core.c:677:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char key[512];
data/rhonabwy-0.9.12/test/jwe_core.c:688:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
  memcpy(key, jwe->key, jwe->key_len);
data/rhonabwy-0.9.12/test/jwk_export.c:577:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char data[4096];
data/rhonabwy-0.9.12/test/jwk_export.c:641:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char key[128] = {0};
data/rhonabwy-0.9.12/test/jwk_import.c:1021:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char der_decoded[4096];
data/rhonabwy-0.9.12/test/jwks_core.c:332:12:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
  unsigned char out[4096];
data/rhonabwy-0.9.12/tools/rnbyc/rnbyc.c:129:7:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  f = fopen (file_path, "w+");
data/rhonabwy-0.9.12/tools/rnbyc/rnbyc.c:150:7:  [2] (misc) fopen:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
  f = fopen (file_path, "rb");
data/rhonabwy-0.9.12/tools/rnbyc/rnbyc.c:179:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
    memcpy(out+length, buffer, read_length);
data/rhonabwy-0.9.12/tools/rnbyc/rnbyc.c:177:25:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
  while ((read_length = read(0, buffer, size)) > 0) {

ANALYSIS SUMMARY:

Hits = 45
Lines analyzed = 20837 in approximately 0.76 seconds (27273 lines/second)
Physical Source Lines of Code (SLOC) = 16701
Hits@level = [0] 111 [1]   1 [2]  43 [3]   1 [4]   0 [5]   0
Hits@level+ = [0+] 156 [1+]  45 [2+]  44 [3+]   1 [4+]   0 [5+]   0
Hits/KSLOC@level+ = [0+] 9.34076 [1+] 2.69445 [2+] 2.63457 [3+] 0.0598767 [4+]   0 [5+]   0
Dot directories skipped = 2 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.