The following issues were found

libavfilter/vf_shufflepixels.c
1 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 253 Column: 13 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                          const type *src = (const type *)(in->data[p] +                   \
                                             map[y] * in->linesize[p]);      \
                                                                             \
            memcpy(dst, src, s->linesize[p]);                                \
            dst += out->linesize[p] / sizeof(type);                          \
        }                                                                    \
    }                                                                        \
                                                                             \
    return 0;                                                                \

            

Reported by FlawFinder.

libavfilter/vf_subtitles.c
1 issues
strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 468 Column: 61 CWE codes: 126

                                  char *ass_line = sub.rects[i]->ass;
                    if (!ass_line)
                        break;
                    ass_process_chunk(ass->track, ass_line, strlen(ass_line),
                                      start_time, duration);
                }
            }
        }
        av_packet_unref(&pkt);

            

Reported by FlawFinder.

libavfilter/vf_telecine.c
1 issues
strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 77 Column: 10 CWE codes: 126

                  const char *p;
    int max = 0;

    if (!strlen(s->pattern)) {
        av_log(ctx, AV_LOG_ERROR, "No pattern provided.\n");
        return AVERROR_INVALIDDATA;
    }

    for (p = s->pattern; *p; p++) {

            

Reported by FlawFinder.

libavfilter/vf_tonemap_vaapi.c
1 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 165 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                      return AVERROR(EIO);
    }

    memcpy(hdrtm_param->data.metadata, &ctx->in_metadata, sizeof(VAHdrMetaDataHDR10));

    vas = vaUnmapBuffer(vpp_ctx->hwctx->display, vpp_ctx->filter_buffers[0]);
    if (vas != VA_STATUS_SUCCESS) {
        av_log(avctx, AV_LOG_ERROR, "Failed to unmap output buffers: "
               "%d (%s).\n", vas, vaErrorStr(vas));

            

Reported by FlawFinder.

libavfilter/vf_vidstabdetect.c
1 issues
fopen - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 143 Column: 12 CWE codes: 362

                  av_log(ctx, AV_LOG_INFO, "          show = %d\n", s->conf.show);
    av_log(ctx, AV_LOG_INFO, "        result = %s\n", s->result);

    s->f = fopen(s->result, "w");
    if (s->f == NULL) {
        av_log(ctx, AV_LOG_ERROR, "cannot open transform file %s\n", s->result);
        return AVERROR(EINVAL);
    } else {
        if (vsPrepareFile(md, s->f) != VS_OK) {

            

Reported by FlawFinder.

libavfilter/vf_vidstabtransform.c
1 issues
fopen - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 209 Column: 9 CWE codes: 362

                      av_log(ctx, AV_LOG_INFO, "    zoomspeed = %g\n", tc->conf.zoomSpeed);
    av_log(ctx, AV_LOG_INFO, "    interpol  = %s\n", getInterpolationTypeName(tc->conf.interpolType));

    f = fopen(tc->input, "r");
    if (!f) {
        int ret = AVERROR(errno);
        av_log(ctx, AV_LOG_ERROR, "cannot open input file %s\n", tc->input);
        return ret;
    } else {

            

Reported by FlawFinder.

libavfilter/vf_vif.c
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 434 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              
static void set_meta(AVDictionary **metadata, const char *key, float d)
{
    char value[257];
    snprintf(value, sizeof(value), "%f", d);
    av_dict_set(metadata, key, value, 0);
}

static AVFrame *do_vif(AVFilterContext *ctx, AVFrame *main, const AVFrame *ref)

            

Reported by FlawFinder.

libavfilter/vf_w3fdif.c
1 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 394 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                  out_line = dst_data + (y_out * dst_line_stride);

    while (y_out < end) {
        memcpy(out_line, in_line, linesize);
        y_out += 2;
        in_line  += cur_line_stride * 2;
        out_line += dst_line_stride * 2;
    }


            

Reported by FlawFinder.

libavfilter/vf_yadif.c
1 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 224 Column: 13 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                                          y ? -refs : refs,
                            td->parity ^ td->tff, mode);
        } else {
            memcpy(&td->frame->data[td->plane][y * td->frame->linesize[td->plane]],
                   &s->cur->data[td->plane][y * refs], td->w * df);
        }
    }
    return 0;
}

            

Reported by FlawFinder.

libavfilter/vulkan.c
1 issues
strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 927 Column: 25 CWE codes: 126

                  AVBPrint buf;
    av_bprint_init(&buf, 0, AV_BPRINT_SIZE_UNLIMITED);

    for (int i = 0; i < strlen(p); i++) {
        if (p[i] == '\n') {
            av_bprintf(&buf, "%i\t", ++line);
            av_bprint_append_data(&buf, start, &p[i] - start + 1);
            start = &p[i + 1];
        }

            

Reported by FlawFinder.