The following issues were found
app/tests/test_device_msg_deserialize.c
2 issues
Line: 29
Column: 14
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
}
static void test_deserialize_clipboard_big(void) {
unsigned char input[DEVICE_MSG_MAX_SIZE];
input[0] = DEVICE_MSG_TYPE_CLIPBOARD;
input[1] = (DEVICE_MSG_TEXT_MAX_LENGTH & 0xff000000u) >> 24;
input[2] = (DEVICE_MSG_TEXT_MAX_LENGTH & 0x00ff0000u) >> 16;
input[3] = (DEVICE_MSG_TEXT_MAX_LENGTH & 0x0000ff00u) >> 8;
input[4] = DEVICE_MSG_TEXT_MAX_LENGTH & 0x000000ffu;
Reported by FlawFinder.
Line: 44
Column: 12
CWE codes:
126
assert(msg.type == DEVICE_MSG_TYPE_CLIPBOARD);
assert(msg.clipboard.text);
assert(strlen(msg.clipboard.text) == DEVICE_MSG_TEXT_MAX_LENGTH);
assert(msg.clipboard.text[0] == 'a');
device_msg_destroy(&msg);
}
Reported by FlawFinder.
app/src/stream.c
2 issues
Line: 131
Column: 9
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
}
}
memcpy(stream->pending->data + offset, packet->data, packet->size);
if (!is_config) {
// prepare the concat packet to send to the decoder
stream->pending->pts = packet->pts;
stream->pending->dts = packet->dts;
Reported by FlawFinder.
Line: 182
Column: 25
CWE codes:
362
stream_open_sinks(struct stream *stream, const AVCodec *codec) {
for (unsigned i = 0; i < stream->sink_count; ++i) {
struct sc_packet_sink *sink = stream->sinks[i];
if (!sink->ops->open(sink, codec)) {
LOGE("Could not open packet sink %d", i);
stream_close_first_sinks(stream, i);
return false;
}
}
Reported by FlawFinder.
app/src/controller.c
2 issues
Line: 97
CWE codes:
908
(void) non_empty;
sc_mutex_unlock(&controller->mutex);
bool ok = process_msg(controller, &msg);
control_msg_destroy(&msg);
if (!ok) {
LOGD("Could not write msg to socket");
break;
}
Reported by Cppcheck.
Line: 68
Column: 21
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
static bool
process_msg(struct controller *controller,
const struct control_msg *msg) {
static unsigned char serialized_msg[CONTROL_MSG_MAX_SIZE];
size_t length = control_msg_serialize(msg, serialized_msg);
if (!length) {
return false;
}
int w = net_send_all(controller->control_socket, serialized_msg, length);
Reported by FlawFinder.
app/src/v4l2_sink.c
2 issues
Line: 39
Column: 5
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
}
// copy the first packet to the extra data
memcpy(extradata, packet->data, packet->size);
ostream->codecpar->extradata = extradata;
ostream->codecpar->extradata_size = packet->size;
int ret = avformat_write_header(vs->format_ctx, NULL);
Reported by FlawFinder.
Line: 191
Column: 5
CWE codes:
120
return false;
}
#else
strncpy(vs->format_ctx->filename, vs->device_name,
sizeof(vs->format_ctx->filename));
#endif
AVStream *ostream = avformat_new_stream(vs->format_ctx, encoder);
if (!ostream) {
Reported by FlawFinder.
app/src/device_msg.c
1 issues
Line: 30
Column: 17
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
return -1;
}
if (clipboard_len) {
memcpy(text, &buf[5], clipboard_len);
}
text[clipboard_len] = '\0';
msg->clipboard.text = text;
return 5 + clipboard_len;
Reported by FlawFinder.
app/src/decoder.c
1 issues
Line: 30
Column: 25
CWE codes:
362
decoder_open_sinks(struct decoder *decoder) {
for (unsigned i = 0; i < decoder->sink_count; ++i) {
struct sc_frame_sink *sink = decoder->sinks[i];
if (!sink->ops->open(sink)) {
LOGE("Could not open frame sink %d", i);
decoder_close_first_sinks(decoder, i);
return false;
}
}
Reported by FlawFinder.
app/src/receiver.c
1 issues
Line: 71
Column: 21
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
run_receiver(void *data) {
struct receiver *receiver = data;
static unsigned char buf[DEVICE_MSG_MAX_SIZE];
size_t head = 0;
for (;;) {
assert(head < DEVICE_MSG_MAX_SIZE);
ssize_t r = net_recv(receiver->control_socket, buf + head,
Reported by FlawFinder.
app/src/recorder.c
1 issues
Line: 88
Column: 5
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
}
// copy the first packet to the extra data
memcpy(extradata, packet->data, packet->size);
ostream->codecpar->extradata = extradata;
ostream->codecpar->extradata_size = packet->size;
int ret = avformat_write_header(recorder->ctx, NULL);
Reported by FlawFinder.
app/src/screen.c
1 issues
Line: 485
Column: 21
CWE codes:
362
void
screen_destroy(struct screen *screen) {
#ifndef NDEBUG
assert(!screen->open);
#endif
av_frame_free(&screen->frame);
SDL_DestroyTexture(screen->texture);
SDL_DestroyRenderer(screen->renderer);
SDL_DestroyWindow(screen->window);
Reported by FlawFinder.
app/src/screen.h
1 issues
Line: 19
Column: 10
CWE codes:
362
struct sc_frame_sink frame_sink; // frame sink trait
#ifndef NDEBUG
bool open; // track the open/close state to assert correct behavior
#endif
struct video_buffer vb;
struct fps_counter fps_counter;
Reported by FlawFinder.