Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/lua-luaossl-20161214/mk/vendor.cc
Examining data/lua-luaossl-20161214/src/compat52.h
Examining data/lua-luaossl-20161214/src/openssl.c

FINAL RESULTS:

data/lua-luaossl-20161214/src/openssl.c:9201:26:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
	junk.aslr = (uintptr_t)&strcpy ^ (uintptr_t)&randL_stir;
data/lua-luaossl-20161214/src/openssl.c:673:3:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
		memcpy(dst, src, m);
data/lua-luaossl-20161214/src/openssl.c:703:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(dst, unknown, n);
data/lua-luaossl-20161214/src/openssl.c:1145:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		char txt[256];
data/lua-luaossl-20161214/src/openssl.c:1186:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char txt[256] = { 0 };
data/lua-luaossl-20161214/src/openssl.c:2456:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char nib[32], bin[32], *p;
data/lua-luaossl-20161214/src/openssl.c:4550:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char txt[256];
data/lua-luaossl-20161214/src/openssl.c:4599:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char txt[256];
data/lua-luaossl-20161214/src/openssl.c:4653:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char txt[1024] = { 0 };
data/lua-luaossl-20161214/src/openssl.c:4831:3:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		char buf[INET6_ADDRSTRLEN + 1];
data/lua-luaossl-20161214/src/openssl.c:4859:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
				memcpy(ip.in6.s6_addr, txt, 16);
data/lua-luaossl-20161214/src/openssl.c:4864:5:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
				memcpy(&ip.in.s_addr, txt, 4);
data/lua-luaossl-20161214/src/openssl.c:5043:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char txt[256];
data/lua-luaossl-20161214/src/openssl.c:5057:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char txt[256];
data/lua-luaossl-20161214/src/openssl.c:5071:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char txt[256];
data/lua-luaossl-20161214/src/openssl.c:5085:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char txt[256];
data/lua-luaossl-20161214/src/openssl.c:5300:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char md[EVP_MAX_MD_SIZE];
data/lua-luaossl-20161214/src/openssl.c:5320:25:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
		static const unsigned char x[16] = "0123456789abcdef";
data/lua-luaossl-20161214/src/openssl.c:5423:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char buf[32] = "", *cp;
data/lua-luaossl-20161214/src/openssl.c:6004:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char digest[EVP_MAX_MD_SIZE];
data/lua-luaossl-20161214/src/openssl.c:7868:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(tmpbuf, proto, protolen);
data/lua-luaossl-20161214/src/openssl.c:8159:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char descr[256];
data/lua-luaossl-20161214/src/openssl.c:8702:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char md[EVP_MAX_MD_SIZE];
data/lua-luaossl-20161214/src/openssl.c:8815:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char hmac[EVP_MAX_MD_SIZE];
data/lua-luaossl-20161214/src/openssl.c:8883:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char key[EVP_MAX_KEY_LENGTH] = { 0 };
data/lua-luaossl-20161214/src/openssl.c:9095:11:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	unsigned char data[256];
data/lua-luaossl-20161214/src/openssl.c:9143:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		int fd = open("/dev/urandom", O_RDONLY|O_CLOEXEC);
data/lua-luaossl-20161214/src/openssl.c:9145:12:  [2] (misc) open:
  Check when opening files - can an attacker redirect it (via symlinks),
  force the opening of special file type (e.g., device files), move things
  around to create a race condition, control its ancestors, or change its
  contents? (CWE-362).
		int fd = open("/dev/urandom", O_RDONLY);
data/lua-luaossl-20161214/src/openssl.c:9454:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(&key, src, MIN(len, sizeof key));
data/lua-luaossl-20161214/src/openssl.c:668:13:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	size_t n = strlen(src);
data/lua-luaossl-20161214/src/openssl.c:4875:10:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			len = strlen(txt);
data/lua-luaossl-20161214/src/openssl.c:5430:7:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
	cp = strncpy(buf, (const char *)ASN1_STRING_get0_data((ASN1_STRING *)time), sizeof buf - 1);
data/lua-luaossl-20161214/src/openssl.c:9152:16:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
			ssize_t n = read(fd, data, MIN(rqstd - count, sizeof data));

ANALYSIS SUMMARY:

Hits = 33
Lines analyzed = 9814 in approximately 0.21 seconds (46918 lines/second)
Physical Source Lines of Code (SLOC) = 6763
Hits@level = [0]   1 [1]   4 [2]  28 [3]   0 [4]   1 [5]   0
Hits@level+ = [0+]  34 [1+]  33 [2+]  29 [3+]   1 [4+]   1 [5+]   0
Hits/KSLOC@level+ = [0+] 5.02735 [1+] 4.87949 [2+] 4.28804 [3+] 0.147863 [4+] 0.147863 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.