The following issues were found

libavformat/format.c
1 issues
fopen - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 293 Column: 23 CWE codes: 362

                                     "Format %s probed with size=%d and score=%d\n",
                       (*fmt)->name, probe_size, score);
#if 0
            FILE *f = fopen("probestat.tmp", "ab");
            fprintf(f, "probe_size:%d format:%s score:%d filename:%s\n", probe_size, (*fmt)->name, score, filename);
            fclose(f);
#endif
        }
    }

            

Reported by FlawFinder.

libavformat/framehash.c
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 33 Column: 9 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                  for (i = 0; i < s->nb_streams; i++) {
        AVStream *st = s->streams[i];
        AVCodecParameters *avctx = st->codecpar;
        char buf[256] = { 0 };
        avio_printf(s->pb, "#tb %d: %d/%d\n", i, st->time_base.num, st->time_base.den);
        avio_printf(s->pb, "#media_type %d: %s\n", i, av_get_media_type_string(avctx->codec_type));
        avio_printf(s->pb, "#codec_id %d: %s\n", i, avcodec_get_name(avctx->codec_id));
        switch (avctx->codec_type) {
        case AVMEDIA_TYPE_AUDIO:

            

Reported by FlawFinder.

libavformat/fsb.c
1 issues
Uninitialized variable: offset
Error

Line: 158 CWE codes: 908

                      av_assert0(0);
    }

    avio_skip(pb, offset - avio_tell(pb));
    s->internal->data_offset = avio_tell(pb);

    avpriv_set_pts_info(st, 64, 1, par->sample_rate);

    return 0;

            

Reported by Cppcheck.

libavformat/gdv.c
1 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 187 Column: 13 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                          if (!pal) {
                return AVERROR(ENOMEM);
            }
            memcpy(pal, gdv->pal, AVPALETTE_SIZE);
            pkt->flags |= AV_PKT_FLAG_KEY;
            gdv->is_first_video = 0;
        }
    }


            

Reported by FlawFinder.

libavformat/gxf.c
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 44 Column: 4 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

               */
static int add_timecode_metadata(AVDictionary **pm, const char *key, uint32_t timecode, int fields_per_frame)
{
   char tmp[128];
   int field  = timecode & 0xff;
   int frame  = fields_per_frame ? field / fields_per_frame : field;
   int second = (timecode >>  8) & 0xff;
   int minute = (timecode >> 16) & 0xff;
   int hour   = (timecode >> 24) & 0x1f;

            

Reported by FlawFinder.

libavformat/hlsplaylist.c
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 159 Column: 9 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                      time_t tt, wrongsecs;
        int milli;
        struct tm *tm, tmpbuf;
        char buf0[128], buf1[128];
        tt = (int64_t)*prog_date_time;
        milli = av_clip(lrint(1000*(*prog_date_time - tt)), 0, 999);
        tm = localtime_r(&tt, &tmpbuf);
        if (!strftime(buf0, sizeof(buf0), "%Y-%m-%dT%H:%M:%S", tm)) {
            av_log(NULL, AV_LOG_DEBUG, "strftime error in ff_hls_write_file_entry\n");

            

Reported by FlawFinder.

libavformat/icecast.c
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 92 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                  AVDictionary *opt_dict = NULL;

    // URI part variables
    char h_url[1024], host[1024], auth[1024], path[1024];
    char *headers, *user = NULL;
    int port, ret;
    AVBPrint bp;

    if (flags & AVIO_FLAG_READ)

            

Reported by FlawFinder.

libavformat/id3v1.h
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 34 Column: 14 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              /**
 * ID3v1 genres
 */
extern const char * const ff_id3v1_genre_str[ID3v1_GENRE_MAX + 1];

/**
 * Read an ID3v1 tag
 */
void ff_id3v1_read(AVFormatContext *s);

            

Reported by FlawFinder.

libavformat/id3v2.h
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 212 Column: 14 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              
extern const CodecMime ff_id3v2_mime_tags[];

extern const char * const ff_id3v2_picture_types[21];

#endif /* AVFORMAT_ID3V2_H */

            

Reported by FlawFinder.

libavformat/img2.h
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 50 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                  int img_count;
    int is_pipe;
    int split_planes;       /**< use independent file for each Y, U, V plane */
    char path[1024];
    char *pixel_format;     /**< Set by a private option. */
    int width, height;      /**< Set by a private option. */
    AVRational framerate;   /**< Set by a private option. */
    int loop;
    int pattern_type; /**< PatternType */

            

Reported by FlawFinder.