I do not deem myself qualified to judge cryptography beyond the absolutely obvious stuff like typical C errors. (Or basically, programming errors, not cryptographic errors.)
But at that point just having DIY C (or other) crypto in some random project is *already* a warning sign that you're better off patching that with calls to a trusted equivalent cryptographic library instead.
No one else implements it? It's probably for a reason and unless I'm *really* invested in getting that thing running, I simply do not care to investigate further.
As for overlarge source, yeah, sometimes I just put that off for "later" (probably never) and move along.
