Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/rhonabwy-0.9.12/include/rhonabwy.h Examining data/rhonabwy-0.9.12/src/jwe.c Examining data/rhonabwy-0.9.12/src/jwk.c Examining data/rhonabwy-0.9.12/src/jwks.c Examining data/rhonabwy-0.9.12/src/jws.c Examining data/rhonabwy-0.9.12/src/jwt.c Examining data/rhonabwy-0.9.12/src/misc.c Examining data/rhonabwy-0.9.12/test/jwe_aesgcm.c Examining data/rhonabwy-0.9.12/test/jwe_core.c Examining data/rhonabwy-0.9.12/test/jwe_dir.c Examining data/rhonabwy-0.9.12/test/jwe_rsa.c Examining data/rhonabwy-0.9.12/test/jwk_export.c Examining data/rhonabwy-0.9.12/test/jwk_import.c Examining data/rhonabwy-0.9.12/test/jwks_core.c Examining data/rhonabwy-0.9.12/test/jws_core.c Examining data/rhonabwy-0.9.12/test/jws_ecdsa.c Examining data/rhonabwy-0.9.12/test/jws_hmac.c Examining data/rhonabwy-0.9.12/test/jws_rsa.c Examining data/rhonabwy-0.9.12/test/jws_rsapss.c Examining data/rhonabwy-0.9.12/test/jwt_core.c Examining data/rhonabwy-0.9.12/test/jwt_encrypt.c Examining data/rhonabwy-0.9.12/test/jwt_nested.c Examining data/rhonabwy-0.9.12/test/jwt_sign.c Examining data/rhonabwy-0.9.12/test/misc.c Examining data/rhonabwy-0.9.12/test/jwk_core.c Examining data/rhonabwy-0.9.12/tools/rnbyc/rnbyc.c FINAL RESULTS: data/rhonabwy-0.9.12/tools/rnbyc/rnbyc.c:703:19: [3] (buffer) getopt_long: Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20). Check implementation on installation, or limit the size of all string inputs. next_option = getopt_long(argc, argv, short_options, long_options, NULL); data/rhonabwy-0.9.12/src/jwe.c:125:12: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char iv[96] = {0}, iv_b64url[192] = {0}, * key = NULL, cipherkey[64] = {0}, cipherkey_b64url[128] = {0}, tag[128] = {0}, tag_b64url[256] = {0}; data/rhonabwy-0.9.12/src/jwe.c:206:12: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char iv[96] = {0}, * key = NULL, cipherkey[64] = {0}, tag[128] = {0}, tag_b64url[256] = {0}; data/rhonabwy-0.9.12/src/jwe.c:323:7: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(ptext, data, data_len); data/rhonabwy-0.9.12/src/jwe.c:428:12: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char al[8], * compute_hmac = NULL; data/rhonabwy-0.9.12/src/jwe.c:440:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(compute_hmac, jwe->header_b64url, aad_size); data/rhonabwy-0.9.12/src/jwe.c:442:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(compute_hmac+hmac_size, jwe->iv, jwe->iv_len); data/rhonabwy-0.9.12/src/jwe.c:444:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(compute_hmac+hmac_size, ciphertext, cyphertext_len); data/rhonabwy-0.9.12/src/jwe.c:446:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(compute_hmac+hmac_size, al, 8); data/rhonabwy-0.9.12/src/jwe.c:570:9: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(jwe->payload, payload, payload_len); data/rhonabwy-0.9.12/src/jwe.c:607:9: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(jwe->key, key, key_len); data/rhonabwy-0.9.12/src/jwe.c:672:9: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(jwe->iv, iv, iv_len); data/rhonabwy-0.9.12/src/jwe.c:1351:12: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char inf_out[256] = {0}, tag[128], * tag_b64url = NULL; data/rhonabwy-0.9.12/src/jwe.c:1413:23: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(jwe->payload+jwe->payload_len, inf_out, infstream.total_out); data/rhonabwy-0.9.12/src/jwe.c:1770:40: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. if (o_base64url_decode((unsigned char *)str_array[0], o_strlen(str_array[0]), NULL, &header_len) && data/rhonabwy-0.9.12/src/jwe.c:1771:40: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. o_base64url_decode((unsigned char *)str_array[2], o_strlen(str_array[2]), NULL, &iv_len) && data/rhonabwy-0.9.12/src/jwe.c:1772:40: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. o_base64url_decode((unsigned char *)str_array[3], o_strlen(str_array[3]), NULL, &cypher_len) && data/rhonabwy-0.9.12/src/jwe.c:1773:40: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. o_base64url_decode((unsigned char *)str_array[4], o_strlen(str_array[4]), NULL, &tag_len)) { data/rhonabwy-0.9.12/src/jwe.c:1783:45: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. if (!o_base64url_decode((unsigned char *)str_array[0], o_strlen(str_array[0]), (unsigned char *)str_header, &header_len)) { data/rhonabwy-0.9.12/src/jwe.c:1811:45: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. if (!o_base64url_decode((unsigned char *)str_array[2], o_strlen(str_array[2]), iv, &iv_len)) { data/rhonabwy-0.9.12/src/jwe.c:1824:42: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. jwe->header_b64url = (unsigned char *)o_strdup(str_array[0]); data/rhonabwy-0.9.12/src/jwe.c:1826:49: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. jwe->encrypted_key_b64url = (unsigned char *)o_strdup(str_array[1]); data/rhonabwy-0.9.12/src/jwe.c:1828:38: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. jwe->iv_b64url = (unsigned char *)o_strdup(str_array[2]); data/rhonabwy-0.9.12/src/jwe.c:1830:46: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. jwe->ciphertext_b64url = (unsigned char *)o_strdup(str_array[3]); data/rhonabwy-0.9.12/src/jwe.c:1832:44: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. jwe->auth_tag_b64url = (unsigned char *)o_strdup(str_array[4]); data/rhonabwy-0.9.12/src/jwk.c:1340:12: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char kid[64], kid_b64[128]; data/rhonabwy-0.9.12/src/jws.c:305:11: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(binary_sig + r_out_padding, r.data + r_padding, r.size - r_padding); data/rhonabwy-0.9.12/src/jws.c:306:11: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(binary_sig + (r.size - r_padding + r_out_padding) + s_out_padding, s.data + s_padding, (s.size - s_padding)); data/rhonabwy-0.9.12/src/jws.c:686:9: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(jws->payload, payload, payload_len); data/rhonabwy-0.9.12/src/jws.c:1140:40: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. if (o_base64url_decode((unsigned char *)str_array[0], o_strlen(str_array[0]), NULL, &header_len) && o_base64url_decode((unsigned char *)str_array[1], o_strlen(str_array[1]), NULL, &payload_len)) { data/rhonabwy-0.9.12/src/jws.c:1140:136: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. if (o_base64url_decode((unsigned char *)str_array[0], o_strlen(str_array[0]), NULL, &header_len) && o_base64url_decode((unsigned char *)str_array[1], o_strlen(str_array[1]), NULL, &payload_len)) { data/rhonabwy-0.9.12/src/jws.c:1150:45: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. if (!o_base64url_decode((unsigned char *)str_array[0], o_strlen(str_array[0]), (unsigned char *)str_header, &header_len)) { data/rhonabwy-0.9.12/src/jws.c:1174:45: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. if (!o_base64url_decode((unsigned char *)str_array[1], o_strlen(str_array[1]), jws->payload, &jws->payload_len)) { data/rhonabwy-0.9.12/src/jws.c:1181:42: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. jws->header_b64url = (unsigned char *)o_strdup(str_array[0]); data/rhonabwy-0.9.12/src/jws.c:1186:47: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. jws->signature_b64url = (unsigned char *)o_strdup(str_array[2]); data/rhonabwy-0.9.12/test/jwe_core.c:677:12: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char key[512]; data/rhonabwy-0.9.12/test/jwe_core.c:688:3: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(key, jwe->key, jwe->key_len); data/rhonabwy-0.9.12/test/jwk_export.c:577:12: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char data[4096]; data/rhonabwy-0.9.12/test/jwk_export.c:641:12: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char key[128] = {0}; data/rhonabwy-0.9.12/test/jwk_import.c:1021:12: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char der_decoded[4096]; data/rhonabwy-0.9.12/test/jwks_core.c:332:12: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char out[4096]; data/rhonabwy-0.9.12/tools/rnbyc/rnbyc.c:129:7: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). f = fopen (file_path, "w+"); data/rhonabwy-0.9.12/tools/rnbyc/rnbyc.c:150:7: [2] (misc) fopen: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). f = fopen (file_path, "rb"); data/rhonabwy-0.9.12/tools/rnbyc/rnbyc.c:179:5: [2] (buffer) memcpy: Does not check for buffer overflows when copying to destination (CWE-120). Make sure destination can always hold the source data. memcpy(out+length, buffer, read_length); data/rhonabwy-0.9.12/tools/rnbyc/rnbyc.c:177:25: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). while ((read_length = read(0, buffer, size)) > 0) { ANALYSIS SUMMARY: Hits = 45 Lines analyzed = 20837 in approximately 0.76 seconds (27273 lines/second) Physical Source Lines of Code (SLOC) = 16701 Hits@level = [0] 111 [1] 1 [2] 43 [3] 1 [4] 0 [5] 0 Hits@level+ = [0+] 156 [1+] 45 [2+] 44 [3+] 1 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 9.34076 [1+] 2.69445 [2+] 2.63457 [3+] 0.0598767 [4+] 0 [5+] 0 Dot directories skipped = 2 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.