Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/haskell-skein-1.0.9.4/c_impl/optimized/brg_endian.h
Examining data/haskell-skein-1.0.9.4/c_impl/optimized/skein.c
Examining data/haskell-skein-1.0.9.4/c_impl/optimized/skein.h
Examining data/haskell-skein-1.0.9.4/c_impl/optimized/skein_block.c
Examining data/haskell-skein-1.0.9.4/c_impl/optimized/skein_debug.c
Examining data/haskell-skein-1.0.9.4/c_impl/optimized/skein_debug.h
Examining data/haskell-skein-1.0.9.4/c_impl/optimized/skein_iv.h
Examining data/haskell-skein-1.0.9.4/c_impl/optimized/skein_port.h
Examining data/haskell-skein-1.0.9.4/c_impl/reference/skein.c
Examining data/haskell-skein-1.0.9.4/c_impl/reference/skein.h
Examining data/haskell-skein-1.0.9.4/c_impl/reference/skein_block.c
Examining data/haskell-skein-1.0.9.4/c_impl/reference/skein_debug.c
Examining data/haskell-skein-1.0.9.4/c_impl/reference/skein_debug.h
Examining data/haskell-skein-1.0.9.4/c_impl/reference/skein_port.h
FINAL RESULTS:
data/haskell-skein-1.0.9.4/c_impl/optimized/skein_debug.c:24:26: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
if (i % 4 == 0) printf(INDENT);
data/haskell-skein-1.0.9.4/c_impl/optimized/skein_debug.c:49:26: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
if (i %16 == 0) printf(INDENT);
data/haskell-skein-1.0.9.4/c_impl/optimized/skein_debug.c:198:13: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
printf((h->T[1] & SKEIN_T1_FLAG_FIRST) ? " First":" ");
data/haskell-skein-1.0.9.4/c_impl/optimized/skein_debug.c:199:13: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
printf((h->T[1] & SKEIN_T1_FLAG_FINAL) ? " Final":" ");
data/haskell-skein-1.0.9.4/c_impl/optimized/skein_debug.c:200:13: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
printf((h->T[1] & SKEIN_T1_FLAG_BIT_PAD) ? " Pad" :" ");
data/haskell-skein-1.0.9.4/c_impl/reference/skein_debug.c:24:26: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
if (i % 4 == 0) printf(INDENT);
data/haskell-skein-1.0.9.4/c_impl/reference/skein_debug.c:49:26: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
if (i %16 == 0) printf(INDENT);
data/haskell-skein-1.0.9.4/c_impl/reference/skein_debug.c:198:13: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
printf((h->T[1] & SKEIN_T1_FLAG_FIRST) ? " First":" ");
data/haskell-skein-1.0.9.4/c_impl/reference/skein_debug.c:199:13: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
printf((h->T[1] & SKEIN_T1_FLAG_FINAL) ? " Final":" ");
data/haskell-skein-1.0.9.4/c_impl/reference/skein_debug.c:200:13: [4] (format) printf:
If format strings can be influenced by an attacker, they can be exploited
(CWE-134). Use a constant for the format specification.
printf((h->T[1] & SKEIN_T1_FLAG_BIT_PAD) ? " Pad" :" ");
data/haskell-skein-1.0.9.4/c_impl/optimized/skein.c:98:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->X,cfg.b,sizeof(cfg.b)); /* copy over into ctx->X[] */
data/haskell-skein-1.0.9.4/c_impl/optimized/skein.c:146:17: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&ctx->b[ctx->h.bCnt],msg,n);
data/haskell-skein-1.0.9.4/c_impl/optimized/skein.c:170:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&ctx->b[ctx->h.bCnt],msg,msgByteCnt);
data/haskell-skein-1.0.9.4/c_impl/optimized/skein.c:207:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->X,X,sizeof(X)); /* restore the counter mode key for next time */
data/haskell-skein-1.0.9.4/c_impl/optimized/skein.c:296:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->X,cfg.b,sizeof(cfg.b)); /* copy over into ctx->X[] */
data/haskell-skein-1.0.9.4/c_impl/optimized/skein.c:344:17: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&ctx->b[ctx->h.bCnt],msg,n);
data/haskell-skein-1.0.9.4/c_impl/optimized/skein.c:368:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&ctx->b[ctx->h.bCnt],msg,msgByteCnt);
data/haskell-skein-1.0.9.4/c_impl/optimized/skein.c:405:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->X,X,sizeof(X)); /* restore the counter mode key for next time */
data/haskell-skein-1.0.9.4/c_impl/optimized/skein.c:493:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->X,cfg.b,sizeof(cfg.b)); /* copy over into ctx->X[] */
data/haskell-skein-1.0.9.4/c_impl/optimized/skein.c:541:17: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&ctx->b[ctx->h.bCnt],msg,n);
data/haskell-skein-1.0.9.4/c_impl/optimized/skein.c:565:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&ctx->b[ctx->h.bCnt],msg,msgByteCnt);
data/haskell-skein-1.0.9.4/c_impl/optimized/skein.c:602:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->X,X,sizeof(X)); /* restore the counter mode key for next time */
data/haskell-skein-1.0.9.4/c_impl/optimized/skein.c:691:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->X,X,sizeof(X)); /* restore the counter mode key for next time */
data/haskell-skein-1.0.9.4/c_impl/optimized/skein.c:720:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->X,X,sizeof(X)); /* restore the counter mode key for next time */
data/haskell-skein-1.0.9.4/c_impl/optimized/skein.c:749:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->X,X,sizeof(X)); /* restore the counter mode key for next time */
data/haskell-skein-1.0.9.4/c_impl/optimized/skein_port.h:58:49: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
#define Skein_Put64_LSB_First(dst08,src64,bCnt) memcpy(dst08,src64,bCnt)
data/haskell-skein-1.0.9.4/c_impl/optimized/skein_port.h:59:49: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
#define Skein_Get64_LSB_First(dst64,src08,wCnt) memcpy(dst64,src08,8*(wCnt))
data/haskell-skein-1.0.9.4/c_impl/reference/skein.c:128:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->X,cfg.b,sizeof(cfg.b)); /* copy over into ctx->X[] */
data/haskell-skein-1.0.9.4/c_impl/reference/skein.c:171:17: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&ctx->b[ctx->h.bCnt],msg,n);
data/haskell-skein-1.0.9.4/c_impl/reference/skein.c:195:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&ctx->b[ctx->h.bCnt],msg,msgByteCnt);
data/haskell-skein-1.0.9.4/c_impl/reference/skein.c:231:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->X,X,sizeof(X)); /* restore the counter mode key for next time */
data/haskell-skein-1.0.9.4/c_impl/reference/skein.c:309:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->X,cfg.b,sizeof(cfg.b)); /* copy over into ctx->X[] */
data/haskell-skein-1.0.9.4/c_impl/reference/skein.c:352:17: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&ctx->b[ctx->h.bCnt],msg,n);
data/haskell-skein-1.0.9.4/c_impl/reference/skein.c:376:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&ctx->b[ctx->h.bCnt],msg,msgByteCnt);
data/haskell-skein-1.0.9.4/c_impl/reference/skein.c:413:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->X,X,sizeof(X)); /* restore the counter mode key for next time */
data/haskell-skein-1.0.9.4/c_impl/reference/skein.c:492:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->X,cfg.b,sizeof(cfg.b)); /* copy over into ctx->X[] */
data/haskell-skein-1.0.9.4/c_impl/reference/skein.c:535:17: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&ctx->b[ctx->h.bCnt],msg,n);
data/haskell-skein-1.0.9.4/c_impl/reference/skein.c:559:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(&ctx->b[ctx->h.bCnt],msg,msgByteCnt);
data/haskell-skein-1.0.9.4/c_impl/reference/skein.c:596:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->X,X,sizeof(X)); /* restore the counter mode key for next time */
data/haskell-skein-1.0.9.4/c_impl/reference/skein.c:685:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->X,X,sizeof(X)); /* restore the counter mode key for next time */
data/haskell-skein-1.0.9.4/c_impl/reference/skein.c:714:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->X,X,sizeof(X)); /* restore the counter mode key for next time */
data/haskell-skein-1.0.9.4/c_impl/reference/skein.c:743:9: [2] (buffer) memcpy:
Does not check for buffer overflows when copying to destination (CWE-120).
Make sure destination can always hold the source data.
memcpy(ctx->X,X,sizeof(X)); /* restore the counter mode key for next time */
ANALYSIS SUMMARY:
Hits = 42
Lines analyzed = 4319 in approximately 0.18 seconds (23407 lines/second)
Physical Source Lines of Code (SLOC) = 3175
Hits@level = [0] 70 [1] 0 [2] 32 [3] 0 [4] 10 [5] 0
Hits@level+ = [0+] 112 [1+] 42 [2+] 42 [3+] 10 [4+] 10 [5+] 0
Hits/KSLOC@level+ = [0+] 35.2756 [1+] 13.2283 [2+] 13.2283 [3+] 3.14961 [4+] 3.14961 [5+] 0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.