For several months, NIST launched the public challenge to define SHA-3, the successor of SHA-1. All the 42 contenders had to submit the description of their algorithm together with C reference implementation.
Tool supplier, Fortify, decided to analyze these implementations. They used their source analysis code on these reference implementations. Guess what? They found some common mistakes, such as buffer overflows. See the the report. But, most implementations were excellent.

The fact that the implementations had weaknesses does not mean that the algorithm itself is weak. But we may learn two lessons:

• – As we all know, writing a secure implementation of an algorithm is a difficult task. And Fortify did not test the robustness against attacks, just the programming errors.
• – Using software testing tools such as static analyzers, memory manager, … is MANDATORY when developing software for security. It will not eliminate all the weakness, but at least avoid some basic ones.