General purpose TLS and crypto library
This report summarizes scanner evidence for openssl/openssl, a C project with 31,138 GitHub stars. SynthScan examined 1,459,164 lines of code across 2950 source files, recording 2251 pattern matches distributed across 13 syntactic categories. The legacy adjusted pattern signal is 2.2 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 1858 finding(s).
Are imports declared and package/API names verified? 29 finding(s).
Are wrappers, guards, and repeated structures necessary? 364 finding(s).
Which changes need focused human review? 2251 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 2251 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Configurations/shared-info.pl | 1 | #! /usr/bin/env perl | COMMENT |
| LOW | Configurations/gentemplate.pm | 341 | # libraries (they end up in @foreign_objs). We get the latter any time | COMMENT |
| LOW | crypto/LPdir_unix.c | 41 | #include <limits.h> | COMMENT |
| LOW | crypto/armcap.c | 1 | /* | COMMENT |
| LOW | crypto/armcap.c | 21 | #ifdef _WIN32 | COMMENT |
| LOW | crypto/armcap.c | 81 | #elif defined(__ANDROID_API__) | COMMENT |
| LOW | crypto/armcap.c | 121 | #endif | COMMENT |
| LOW | crypto/armcap.c | 141 | #define OSSL_HWCAP_CE_SHA1 (1 << 5) | COMMENT |
| LOW | crypto/mem_sec.c | 41 | #endif | COMMENT |
| LOW | crypto/mem_sec.c | 61 | #if defined(SYS_mlock2) | COMMENT |
| LOW | crypto/ppccap.c | 1 | /* | COMMENT |
| LOW | crypto/ppccap.c | 21 | #if !defined(__power_set) | COMMENT |
| LOW | crypto/ppccap.c | 81 | if (OPENSSL_ppccap_P & PPC_MFTB) | COMMENT |
| LOW | crypto/ppccap.c | 121 | #ifndef AT_HWCAP | COMMENT |
| LOW | crypto/vms_rms.h | 21 | #define FAB_OR_NAML_FNS naml$l_long_filename_size | COMMENT |
| LOW | crypto/vms_rms.h | 41 | #else /* def NAML$C_MAXRSS */ | COMMENT |
| LOW | crypto/s390xcap.c | 21 | #include <sys/stat.h> | COMMENT |
| LOW | crypto/LPdir_win.c | 41 | #include "internal/numbers.h" | COMMENT |
| LOW | crypto/init.c | 1 | /* | COMMENT |
| LOW | crypto/init.c | 21 | #include "crypto/err.h" | COMMENT |
| LOW | crypto/info.c | 21 | #include <jitterentropy.h> | COMMENT |
| LOW | crypto/info.c | 161 | "G" /* shorthand for IMAFD_Zicsr_Zifencei */ | COMMENT |
| LOW | crypto/info.c | 221 | } while (0) | COMMENT |
| LOW | crypto/o_dir.c | 21 | #define LP_find_file_end OPENSSL_DIR_end | COMMENT |
| LOW | crypto/uid.c | 41 | #if __ANDROID_API__ >= 18 | COMMENT |
| LOW | crypto/threads_pthread.c | 21 | #ifdef REPORT_RWLOCK_CONTENTION | COMMENT |
| LOW | crypto/threads_pthread.c | 41 | #ifdef REPORT_RWLOCK_CONTENTION | COMMENT |
| LOW | crypto/threads_pthread.c | 61 | #else | COMMENT |
| LOW | crypto/LPdir_vms.c | 41 | #include <string.h> | COMMENT |
| LOW | crypto/o_fopen.c | 21 | * without extra "magic" comprise *BSD, Darwin, IRIX... | COMMENT |
| LOW | crypto/provider_core.c | 1 | /* | COMMENT |
| LOW | crypto/provider_core.c | 21 | #include "crypto/encoder.h" /* ossl_encoder_store_cache_flush */ | COMMENT |
| LOW | crypto/context.c | 1 | /* | COMMENT |
| LOW | crypto/provider_conf.c | 1 | /* | COMMENT |
| LOW | crypto/perlasm/x86_64-xlate.pl | 1 | #! /usr/bin/env perl | COMMENT |
| LOW | crypto/perlasm/x86_64-xlate.pl | 21 | # This translator is not designed to convert *arbitrary* assembler | COMMENT |
| LOW | crypto/perlasm/x86_64-xlate.pl | 41 | # ".type name,@abi-omnipotent" instead. | COMMENT |
| LOW | crypto/perlasm/x86_64-xlate.pl | 161 | # assembler ML). Using of .previous got introduced to .pl files with | COMMENT |
| LOW | crypto/perlasm/x86_64-xlate.pl | 181 | # .text$ SEGMENT ALIGN(256) 'CODE' | COMMENT |
| LOW | crypto/perlasm/x86_64-xlate.pl | 201 | # ; stack looks like: | COMMENT |
| LOW | crypto/perlasm/x86_64-xlate.pl | 601 | } | COMMENT |
| LOW | crypto/perlasm/x86_64-xlate.pl | 621 | # 3 and describe how to deduce CFA, Canonical Frame Address. This | COMMENT |
| LOW | crypto/perlasm/x86_64-xlate.pl | 921 | } | COMMENT |
| LOW | crypto/perlasm/x86_64-xlate.pl | 1481 | COMMENT | |
| LOW | crypto/perlasm/x86_64-xlate.pl | 1501 | # %r13 - - | COMMENT |
| LOW | crypto/perlasm/x86_64-xlate.pl | 1521 | # storage [without allocating a frame]. One can actually argue that | COMMENT |
| LOW | crypto/perlasm/x86_64-xlate.pl | 1541 | # endif | COMMENT |
| LOW | crypto/perlasm/x86_64-xlate.pl | 1561 | # subroutine entry point and return "exception is not handled, keep | COMMENT |
| LOW | crypto/perlasm/x86_64-xlate.pl | 1581 | # movq -24(%rcx),%rbp # restore non-volatile registers | COMMENT |
| LOW | crypto/perlasm/x86_64-xlate.pl | 1601 | # { rsp = (ULONG64 *)context->Rsp; | COMMENT |
| LOW | crypto/perlasm/x86_64-xlate.pl | 1621 | # function's module. In order to do that one has to know members' | COMMENT |
| LOW | crypto/perlasm/x86_64-xlate.pl | 1641 | # CONTEXT.Rip 248 | COMMENT |
| LOW | crypto/perlasm/x86_64-xlate.pl | 1661 | # .byte 9,0,0,0 | COMMENT |
| LOW | crypto/perlasm/x86_64-xlate.pl | 1681 | # In case you wonder why references are 32-bit .rvas and not 64-bit | COMMENT |
| LOW | crypto/perlasm/x86_64-xlate.pl | 1701 | # are too subtle to discuss here. For now it's sufficient to say that | COMMENT |
| LOW | crypto/perlasm/cbc.pl | 1 | #! /usr/bin/env perl | COMMENT |
| LOW | crypto/perlasm/cbc.pl | 21 | COMMENT | |
| LOW | crypto/perlasm/riscv.pm | 1 | #! /usr/bin/env perl | COMMENT |
| LOW | crypto/perlasm/riscv.pm | 21 | # are met: | COMMENT |
| LOW | crypto/perlasm/x86asm.pl | 1 | #! /usr/bin/env perl | COMMENT |
| 1656 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crypto/md5/asm/md5-sparcv9.pl | 10 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/md5/asm/md5-sparcv9.pl | 17 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/rc4/asm/rc4-586.pl | 10 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/rc4/asm/rc4-586.pl | 15 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/rc4/asm/rc4-parisc.pl | 10 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/rc4/asm/rc4-parisc.pl | 15 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/rc4/asm/rc4-s390x.pl | 10 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/rc4/asm/rc4-s390x.pl | 15 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/rc4/asm/rc4-c64xplus.pl | 10 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/rc4/asm/rc4-c64xplus.pl | 15 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/rc4/asm/rc4-x86_64.pl | 10 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/rc4/asm/rc4-x86_64.pl | 15 | # ==================================================================== | COMMENT |
| MEDIUM⚡ | crypto/rc4/asm/rc4-md5-x86_64.pl | 10 | # ==================================================================== | COMMENT |
| MEDIUM⚡ | crypto/rc4/asm/rc4-md5-x86_64.pl | 15 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/des/asm/dest4-sparcv9.pl | 10 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/des/asm/dest4-sparcv9.pl | 14 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 313 | # ============================================================== | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 333 | # ============================================================== | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 356 | # ============================================================== | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 439 | # ============================================================== | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 478 | # ============================================================== | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 524 | # ============================================================== | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 591 | # ============================================================== | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 655 | # ============================================================== | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 879 | # ============================================================== | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 1002 | # ============================================================== | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 1101 | # ============================================================== | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 1177 | # ============================================================== | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 1239 | # ============================================================== | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 1338 | # ============================================================== | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 1372 | # ============================================================== | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 1398 | # ============================================================== | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 1421 | # ============================================================== | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 1717 | # ============================================================== | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 1731 | # ============================================================== | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 1828 | # ============================================================== | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 1855 | # ============================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/ghash-alpha.pl | 10 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/ghash-alpha.pl | 15 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/ghash-ia64.pl | 10 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/ghash-ia64.pl | 15 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/ghash-parisc.pl | 10 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/ghash-parisc.pl | 15 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/ghashp8-ppc.pl | 10 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/ghashp8-ppc.pl | 15 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/ghashv8-armx.pl | 10 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/ghashv8-armx.pl | 15 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/ghash-c64xplus.pl | 10 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/ghash-c64xplus.pl | 15 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/aes-gcm-armv8-unroll8_64.pl | 10 | #======================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/aes-gcm-armv8-unroll8_64.pl | 16 | #======================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/aes-gcm-ppc.pl | 10 | #=================================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/aes-gcm-ppc.pl | 43 | # =================================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/ghash-sparcv9.pl | 10 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/ghash-sparcv9.pl | 15 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/ghash-x86.pl | 10 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/ghash-x86.pl | 15 | # ==================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/aes-gcm-avx512.pl | 33 | #====================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/aes-gcm-avx512.pl | 86 | #====================================================================== | COMMENT |
| MEDIUM | crypto/modes/asm/aes-gcm-armv8_64.pl | 10 | #======================================================================== | COMMENT |
| 296 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crypto/perlasm/riscv.pm | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/md5/asm/md5-riscv64-zbb.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl | 15 | # This file provides optimized x86_64 assembly implementations of the Number | COMMENT |
| MEDIUM | crypto/modes/asm/ghash-riscv64-zvkg.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/modes/asm/ghash-riscv64-zvkb-zvbc.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/modes/asm/ghash-riscv64.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/modes/asm/aes-gcm-riscv64-zvkb-zvkg-zvkned.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/chacha/asm/chacha-riscv64-v-zbb.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM⚡ | crypto/ec/asm/x25519-x86_64.pl | 20 | # This module implements radix 2^51 multiplication and squaring, and | COMMENT |
| MEDIUM | crypto/poly1305/asm/poly1305-armv9-sve2.pl | 12 | # This file is an SVE2 port-and-merge of POLY1305 hash algorithm, derived from | COMMENT |
| MEDIUM⚡ | crypto/poly1305/asm/poly1305-ppc.pl | 17 | # This module implements Poly1305 hash for PowerPC. | COMMENT |
| MEDIUM⚡ | crypto/poly1305/asm/poly1305-armv8.pl | 17 | # This module implements Poly1305 hash for ARMv8. | COMMENT |
| MEDIUM⚡ | crypto/poly1305/asm/poly1305-sparcv9.pl | 17 | # This module implements Poly1305 hash for SPARCv9, vanilla, as well | COMMENT |
| MEDIUM⚡ | crypto/poly1305/asm/poly1305-ppcfp.pl | 17 | # This module implements Poly1305 hash for PowerPC FPU. | COMMENT |
| MEDIUM⚡ | crypto/poly1305/asm/poly1305-x86_64.pl | 17 | # This module implements Poly1305 hash for x86_64. | COMMENT |
| MEDIUM⚡ | crypto/poly1305/asm/poly1305-s390x.pl | 17 | # This module implements Poly1305 hash for s390x. | COMMENT |
| MEDIUM⚡ | crypto/poly1305/asm/poly1305-x86.pl | 17 | # This module implements Poly1305 hash for x86. | COMMENT |
| MEDIUM | crypto/sm3/asm/sm3-riscv64-zbb.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/sm3/asm/sm3-armv8.pl | 9 | # This module implements support for Armv8 SM3 instructions | COMMENT |
| MEDIUM | crypto/sm3/asm/sm3-x86_64.pl | 11 | # This module implements support for Intel(R) SM3 instructions | COMMENT |
| MEDIUM | crypto/sm3/asm/sm3-riscv64-zvksh.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/sm4/asm/vpsm4-armv8.pl | 10 | # This module implements SM4 with ASIMD on aarch64 | COMMENT |
| MEDIUM | crypto/sm4/asm/sm4-riscv64-zvksed.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/sm4/asm/vpsm4_ex-armv8.pl | 10 | # This module implements SM4 with ASIMD and AESE on AARCH64 | COMMENT |
| MEDIUM | crypto/sm4/asm/sm4-x86_64.pl | 11 | # This module implements support for Intel(R) SM4 instructions | COMMENT |
| MEDIUM | crypto/sm4/asm/sm4-armv8.pl | 10 | # This module implements support for SM4 hw support on aarch64 | COMMENT |
| MEDIUM | crypto/sha/asm/sha512-loongarch64.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/sha/asm/sha256-loongarch64.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/sha/asm/sha256-riscv64-zvkb-zvknha_or_zvknhb.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/sha/asm/sha512-riscv64-zvkb-zvknhb.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/sha/asm/sha512-riscv64-zbb.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/sha/asm/sha256-riscv64-zbb.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/aes/asm/aes-riscv32-zkn.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM⚡ | crypto/aes/asm/aesv8-armx.pl | 17 | # This module implements support for ARMv8 AES instructions. The | COMMENT |
| MEDIUM | crypto/aes/asm/aes-riscv64-zvbb-zvkg-zvkned.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM⚡ | crypto/aes/asm/aesni-x86_64.pl | 17 | # This module implements support for Intel AES-NI extension. In | COMMENT |
| MEDIUM | crypto/aes/asm/aes-riscv64-zvkb-zvkned.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/aes/asm/aes-riscv64-zvkned.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/aes/asm/aes-riscv64-zkn.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM⚡ | crypto/aes/asm/aesni-x86.pl | 17 | # This module implements support for Intel AES-NI extension. In | COMMENT |
| MEDIUM⚡ | crypto/aes/asm/aesp8-ppc.pl | 17 | # This module implements support for AES instructions as per PowerISA | COMMENT |
| MEDIUM | test/certs/mkcert.sh | 12 | # This file is dual-licensed and is also available under other terms. | COMMENT |
| MEDIUM | test/recipes/95-test_external_pyca_data/cryptography.sh | 45 | # Create a python virtual env | COMMENT |
| MEDIUM | test/recipes/25-test_eai_data/kdc.sh | 3 | # Create a root CA, signing a leaf cert with a KDC principal otherName SAN, and | COMMENT |
| MEDIUM | util/reformat-patches.sh | 328 | # Create the worktree | COMMENT |
| MEDIUM | util/ctags.sh | 74 | # This file is automatically generated by $0. | COMMENT |
| MEDIUM | util/perl/TLSProxy/Proxy.pm | 246 | # Create the Proxy socket | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crypto/perlasm/riscv.pm | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| LOW | crypto/md5/asm/md5-586.pl | 115 | # make sure to do 'D' first, not 'B', else we clash with | COMMENT |
| LOW | crypto/md5/asm/md5-586.pl | 133 | # make sure to do 'D' first, not 'B', else we clash with | COMMENT |
| MEDIUM | crypto/md5/asm/md5-riscv64-zbb.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/modes/asm/ghash-riscv64-zvkg.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/modes/asm/ghash-riscv64-zvkb-zvbc.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/modes/asm/ghash-riscv64.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/modes/asm/aes-gcm-riscv64-zvkb-zvkg-zvkned.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/chacha/asm/chacha-riscv64-v-zbb.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/sm3/asm/sm3-riscv64-zbb.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/sm3/asm/sm3-riscv64-zvksh.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/sm4/asm/sm4-riscv64-zvksed.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/sha/asm/sha512-loongarch64.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/sha/asm/sha256-loongarch64.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/sha/asm/sha256-riscv64-zvkb-zvknha_or_zvknhb.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/sha/asm/sha512-riscv64-zvkb-zvknhb.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/sha/asm/sha512-riscv64-zbb.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/sha/asm/sha256-riscv64-zbb.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/aes/asm/aes-riscv32-zkn.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/aes/asm/aes-riscv64-zvbb-zvkg-zvkned.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/aes/asm/aes-riscv64-zvkb-zvkned.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/aes/asm/aes-riscv64-zvkned.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | crypto/aes/asm/aes-riscv64-zkn.pl | 2 | # This file is dual-licensed, meaning that you can use it under your | COMMENT |
| MEDIUM | test/quic-openssl-docker/hq-interop/quic-hq-interop.c | 26 | * @note This client is intended for demonstration purposes and may require | COMMENT |
| LOW | …es/95-test_external_oqsprovider_data/oqsprovider-ca.sh | 56 | # Don't forget to use provider(s) when not activated via config file | COMMENT |
| LOW | util/perl/OpenSSL/Util.pm | 221 | # It seems to be an executable, so we make sure to prefix it | COMMENT |
| MEDIUM | demos/guide/quic-client-block.c | 115 | * is for demonstration purposes only. | COMMENT |
| MEDIUM | demos/guide/quic-client-non-block.c | 222 | * is for demonstration purposes only. | COMMENT |
| MEDIUM | demos/signature/rsa_pss_direct.c | 22 | * Here we sign an all-zeroes digest for demonstration purposes. | COMMENT |
| MEDIUM | demos/digest/EVP_MD_xof.c | 56 | /* Allow digest length to be changed for demonstration purposes. */ | COMMENT |
| MEDIUM | demos/cipher/aesgcm.c | 102 | * For demonstration purposes the IV is being set here. In a compliant | COMMENT |
| MEDIUM | demos/encode/rsa_encode.c | 17 | * output for demonstration purposes. Both public and private keys are accepted. | COMMENT |
| MEDIUM | demos/encode/ec_encode.c | 17 | * output for demonstration purposes. Both public and private keys are accepted. | COMMENT |
| MEDIUM | demos/mac/poly1305.c | 60 | * purely for demonstration purposes. Please note that Poly1305 exhibits | COMMENT |
| LOW | demos/quic/poll-server/quic-server-ssl-poll-http.c | 1537 | * adjust _want_events, don't forget to ask poll manager to rebuild | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crypto/x86cpuid.pl | 235 | # Essentially there is only one use for this function. Under DJGPP: | COMMENT |
| MEDIUM | crypto/perlasm/x86_64-xlate.pl | 1667 | # To facilitate composing of .pdata structures, auto-generated "gear" | COMMENT |
| MEDIUM⚡ | crypto/rc4/asm/rc4-md5-x86_64.pl | 22 | # below theoretical maximum, interleaving them would allow to utilize | COMMENT |
| MEDIUM | crypto/modes/asm/aes-gcm-avx512.pl | 171 | # ; helps to facilitate SEH handlers writing. | COMMENT |
| LOW | crypto/modes/asm/aes-gcm-riscv64-zvkb-zvkg-zvkned.pl | 441 | # Note: The actual vl should be `FULL_BLOCK_LEN32/4 * 2`, but we just use | COMMENT |
| MEDIUM | crypto/chacha/asm/chacha-s390x.pl | 36 | # But to harness overheads revert to transliteration of VSX code path | COMMENT |
| MEDIUM | crypto/chacha/asm/chacha-s390x.pl | 436 | # On the other hand minimum amount of data it takes to fully utilize | COMMENT |
| MEDIUM | crypto/poly1305/asm/poly1305-mips.pl | 38 | # The return value is placed in $a0. Following coding rules facilitate | COMMENT |
| MEDIUM | crypto/bn/asm/mips-mont.pl | 40 | # The return value is placed in $a0. Following coding rules facilitate | COMMENT |
| MEDIUM | crypto/sha/asm/sha512-mips.pl | 42 | # The return value is placed in $a0. Following coding rules facilitate | COMMENT |
| MEDIUM | crypto/sha/asm/keccak1600-armv8.pl | 35 | # instructions effectively facilitate parallel hashing, which we don't | COMMENT |
| MEDIUM | crypto/sha/asm/sha1-armv4-large.pl | 731 | # this fix-up provides Thumb encoding in conjunction with INST | COMMENT |
| MEDIUM⚡ | crypto/sha/asm/sha1-x86_64.pl | 25 | # capacity to fully utilize SHA-1 parallelism. Therefore this fresh | COMMENT |
| MEDIUM | crypto/sha/asm/sha1-mips.pl | 40 | # The return value is placed in $a0. Following coding rules facilitate | COMMENT |
| MEDIUM | crypto/sha/asm/keccak1600-avx2.pl | 26 | # It makes other steps more intricate, but overall, is it a win? To be | COMMENT |
| MEDIUM | crypto/aes/asm/aesv8-armx.pl | 4104 | // After specially processing, utilize the five blocks processing again. | COMMENT |
| MEDIUM⚡ | crypto/aes/asm/aesni-sha1-x86_64.pl | 23 | # utilize processor resources better and achieve better performance. | COMMENT |
| MEDIUM | crypto/aes/asm/aesni-sha1-x86_64.pl | 65 | # fully utilize parallelism, so stitching would not give any gain | COMMENT |
| MEDIUM⚡ | crypto/aes/asm/aesni-sha256-x86_64.pl | 23 | # utilize processor resources better and achieve better performance. | COMMENT |
| MEDIUM | crypto/aes/asm/aes-mips.pl | 53 | # The return value is placed in $a0. Following coding rules facilitate | COMMENT |
| MEDIUM | test/run_tests.pl | 50 | # compatibility with the /proc paradigm. | COMMENT |
| MEDIUM | test/run_tests.pl | 420 | # If this isn't a TAP::Parser::Aggregator, it's the pre-TAP test harness, | COMMENT |
| MEDIUM | …cipes/95-test_external_oqsprovider_data/oqsprovider.sh | 81 | # Be verbose if harness is verbose: | COMMENT |
| MEDIUM | util/perl/OpenSSL/Util.pm | 197 | # Prefix to be applied as needed. Essentially, we need to determine | COMMENT |
| LOW | util/perl/TLSProxy/NextProto.pm | 49 | # For now though since we don't support parsing we just create an empty NextProto | COMMENT |
| MEDIUM | .github/workflows/cross-compiles.yml | 200 | # Perl test harness sees the non-zero exit code and marks every | COMMENT |
| MEDIUM | .github/workflows/ct-validation-daily.yml | 24 | # harness and fails the job. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/verify_extra_test.c | 687 | const char *test_email = "user@example.com"; | CODE |
| LOW | test/quic_fifd_test.c | 97 | static const unsigned char placeholder_data[] = "placeholder"; | CODE |
| LOW⚡ | test/v3nametest.c | 446 | || !TEST_true(set_email1(crt, "user@example.com")) | CODE |
| LOW⚡ | test/v3nametest.c | 447 | || !TEST_int_eq(X509_check_email(crt, "user@example.com", 0, 0), 0) | CODE |
| LOW⚡ | test/v3nametest.c | 448 | || !TEST_int_eq(X509_check_email(crt, "user@example.com", 0, | CODE |
| LOW⚡ | test/v3nametest.c | 451 | || !TEST_int_eq(X509_check_email(crt, "user@example.com", 0, | CODE |
| LOW⚡ | test/v3nametest.c | 460 | || !TEST_true(set_email1(crt, "user@example.com")) | CODE |
| LOW⚡ | test/v3nametest.c | 463 | || !TEST_int_eq(X509_check_email(crt, "user@example.com", 0, 0), 0) | CODE |
| LOW⚡ | test/v3nametest.c | 464 | || !TEST_int_eq(X509_check_email(crt, "user@example.com", 0, | CODE |
| LOW⚡ | test/v3nametest.c | 467 | || !TEST_int_eq(X509_check_email(crt, "user@example.com", 0, | CODE |
| LOW | test/certs/setup.sh | 466 | NC="excluded;otherName:SRVName;UTF8STRING:foo@example.org" ./mkcert.sh genca \ | CODE |
| LOW | test/certs/setup.sh | 473 | "otherName.1 = SRVName;UTF8STRING:foo@example.org" | CODE |
| LOW | test/recipes/30-test_evp_data/evppkey_rsa_common.txt | 430 | Output = "lorem ipsum dolor sit amet" | CODE |
| LOW | test/recipes/30-test_evp_data/evppkey_rsa_common.txt | 430 | Output = "lorem ipsum dolor sit amet" | CODE |
| LOW⚡ | test/recipes/30-test_evp_data/evppkey_rsa_common.txt | 463 | Output = "lorem ipsum" | CODE |
| LOW⚡ | test/recipes/30-test_evp_data/evppkey_rsa_common.txt | 468 | Output = "lorem ipsum" | CODE |
| LOW⚡ | test/recipes/30-test_evp_data/evppkey_rsa_common.txt | 473 | Output = "lorem ipsum" | CODE |
| LOW⚡ | test/recipes/30-test_evp_data/evppkey_rsa_common.txt | 478 | Output = "lorem ipsum" | CODE |
| LOW⚡ | test/recipes/30-test_evp_data/evppkey_rsa_common.txt | 483 | Output = "lorem ipsum" | CODE |
| LOW⚡ | test/recipes/30-test_evp_data/evppkey_rsa_common.txt | 488 | Output = "lorem ipsum" | CODE |
| LOW⚡ | test/recipes/30-test_evp_data/evppkey_rsa_common.txt | 493 | Output = "lorem ipsum" | CODE |
| LOW⚡ | test/recipes/30-test_evp_data/evppkey_rsa_common.txt | 643 | Output = "lorem ipsum" | CODE |
| LOW⚡ | test/recipes/30-test_evp_data/evppkey_rsa_common.txt | 648 | Output = "lorem ipsum" | CODE |
| LOW⚡ | test/recipes/30-test_evp_data/evppkey_rsa_common.txt | 653 | Output = "lorem ipsum" | CODE |
| LOW⚡ | test/recipes/30-test_evp_data/evppkey_rsa_common.txt | 658 | Output = "lorem ipsum" | CODE |
| LOW⚡ | test/recipes/30-test_evp_data/evppkey_rsa_common.txt | 663 | Output = "lorem ipsum" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crypto/modes/asm/ghash-riscv64.pl | 562 | # Check if 4-block aggregation is possible (>= 64 bytes = 4 blocks) | COMMENT |
| LOW | crypto/modes/asm/ghash-riscv64.pl | 922 | # Check if 4-block aggregation is possible (>= 64 bytes) | COMMENT |
| LOW | crypto/sm3/asm/sm3-riscv64-zbb.pl | 341 | # Decrement length by 1 | COMMENT |
| LOW | crypto/sm3/asm/sm3-riscv64-zvksh.pl | 386 | bnez $NUM, L_sm3_loop # Check if there are any more block to process | CODE |
| LOW | crypto/bn/asm/riscv64-mont.pl | 1040 | # Check if we have processed all elements of a: | COMMENT |
| LOW | crypto/sha/asm/sha512-loongarch64.pl | 289 | # Decrement length by 1 | COMMENT |
| LOW | crypto/sha/asm/sha256-loongarch64.pl | 295 | # Decrement length by 1 | COMMENT |
| LOW | crypto/sha/asm/sha256-riscv64-zvkb-zvknha_or_zvknhb.pl | 149 | # Decrement length by 1 | COMMENT |
| LOW | crypto/sha/asm/sha512-riscv64-zvkb-zvknhb.pl | 158 | # Decrement length by 1 | COMMENT |
| LOW | crypto/sha/asm/sha512-riscv64-zvkb-zvknhb.pl | 330 | # Decrement length by 1 | COMMENT |
| LOW | crypto/sha/asm/sha512-riscv64-zbb.pl | 252 | # Decrement length by 1 | COMMENT |
| LOW | crypto/sha/asm/sha256-riscv64-zbb.pl | 339 | # Decrement length by 1 | COMMENT |
| LOW | test/slhdsa_parse.py | 60 | # Check if there is a similar test already and skip if so | COMMENT |
| LOW | test/recipes/80-test_cmp_http_data/Mock/setup-mock.sh | 22 | # Check if first parameter is PQC, then set USE_PQC accordingly | COMMENT |
| LOW | external/perl/Text-Template-1.56/lib/Text/Template.pm | 655 | # Print result text instead of returning it | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crypto/bn/asm/ppc.pl | 268 | # NOTE: The following label name should be changed to | COMMENT |
| LOW | crypto/bn/asm/ppc.pl | 406 | # NOTE: The following label name should be changed to | COMMENT |
| LOW | crypto/bn/asm/ppc.pl | 834 | # NOTE: The following label name should be changed to | COMMENT |
| LOW | crypto/bn/asm/ppc.pl | 988 | # NOTE: The following label name should be changed to | COMMENT |
| LOW | crypto/bn/asm/ppc.pl | 1527 | # NOTE: The following label name should be changed to | COMMENT |
| LOW | crypto/bn/asm/ppc.pl | 1578 | # NOTE: The following label name should be changed to | COMMENT |
| LOW | crypto/bn/asm/ppc.pl | 1624 | # NOTE: The following label name should be changed to | COMMENT |
| LOW | crypto/bn/asm/ppc.pl | 1740 | # NOTE: The following label name should be changed to | COMMENT |
| LOW | crypto/bn/asm/ppc.pl | 1782 | # NOTE: The following label name should be changed to | COMMENT |
| LOW | crypto/bn/asm/ppc.pl | 1888 | # NOTE: The following label name should be changed to | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/ascon_aead128_parse.py | 184 | print(f"Error writing to file '{output_file}': {e}", file=sys.stderr) | CODE |
| MEDIUM⚡ | test/ascon_aead128_parse.py | 206 | print(f"Error: File '{input_file}' not found", file=sys.stderr) | CODE |
| LOW⚡ | test/ascon_aead128_parse.py | 208 | except Exception as e: | CODE |
| MEDIUM⚡ | test/ascon_aead128_parse.py | 209 | print(f"Error: {e}", file=sys.stderr) | CODE |
| LOW | util/acvp-test.py | 1108 | except Exception as exc: | CODE |
| LOW⚡ | util/acvp-test.py | 1168 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | util/acvp-test.py | 331 | except (subprocess.CalledProcessError, FileNotFoundError): | CODE |
| HIGH | util/acvp-test.py | 342 | except (subprocess.CalledProcessError, FileNotFoundError): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/ascon_aead128_parse.py | 62 | CODE | |
| LOW | test/mlkem_parse.py | 45 | CODE | |
| LOW | test/mldsa_wycheproof_parse.py | 34 | CODE | |
| LOW | test/mldsa_wycheproof_parse.py | 71 | CODE | |
| LOW | util/curve25519-fe51-tables.py | 155 | CODE | |
| LOW | util/acvp-test.py | 312 | CODE | |
| LOW | util/acvp-test.py | 586 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/slhdsa_parse.py | 26 | CODE | |
| LOW | test/mldsa_wycheproof_parse.py | 26 | CODE | |
| LOW | test/cms-msg/make_missing_kdf_der.py | 16 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crypto/LPdir_unix.c | 68 | * small value (HP-UX offers 14), so we need to check if we got a result, and | COMMENT |