The following issues were found

libavutil/timestamp.h
1 issues
snprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 46 Column: 31 CWE codes: 134
Suggestion: Use a constant for the format specification 

              static inline char *av_ts_make_string(char *buf, int64_t ts)
{
    if (ts == AV_NOPTS_VALUE) snprintf(buf, AV_TS_MAX_STRING_SIZE, "NOPTS");
    else                      snprintf(buf, AV_TS_MAX_STRING_SIZE, "%" PRId64, ts);
    return buf;
}

/**
 * Convenience macro, the return value should be used only directly in

Reported by FlawFinder.

libavutil/tx.c
1 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 84 Column: 13 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                  if (n == 15) {
        for (int k = 0; k < m; k++) {
            int tmp[15];
            memcpy(tmp, &in_map[k*15], 15*sizeof(*tmp));
            for (int i = 0; i < 5; i++) {
                for (int j = 0; j < 3; j++)
                    in_map[k*15 + i*3 + j] = tmp[(i*3 + j*5) % 15];
            }
        }

Reported by FlawFinder.

libavutil/utils.c
1 issues
snprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 133 Column: 25 CWE codes: 134
Suggestion: Use a constant for the format specification 

                                            (c >= 'a' && c <= 'z') ||
                              (c >= 'A' && c <= 'Z') ||
                              (c && strchr(". -_", c));
        const int len = snprintf(buf, buf_size, print_chr ? "%c" : "[%d]", c);
        if (len < 0)
            break;
        buf += len;
        buf_size = buf_size > len ? buf_size - len : 0;
        fourcc >>= 8;

Reported by FlawFinder.

libavutil/x86/cpu.c
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 99 Column: 23 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

                  int eax, ebx, ecx, edx;
    int max_std_level, max_ext_level, std_caps = 0, ext_caps = 0;
    int family = 0, model = 0;
    union { int i[3]; char c[12]; } vendor;
    int xcr0_lo = 0, xcr0_hi = 0;

    if (!cpuid_test())
        return 0; /* CPUID not supported */

Reported by FlawFinder.

libswscale/swscale.c
1 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 943 Column: 13 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                      base = srcStride[0] < 0 ? c->rgb0_scratch - srcStride[0] * (srcSliceH-1) :
                                  c->rgb0_scratch;
        for (y=0; y<srcSliceH; y++){
            memcpy(base + srcStride[0]*y, src2[0] + srcStride[0]*y, 4*c->srcW);
            for (x=c->src0Alpha-1; x<4*c->srcW; x+=4) {
                base[ srcStride[0]*y + x] = 0xFF;
            }
        }
        src2[0] = base;

Reported by FlawFinder.

libswscale/tests/floatimg_cmp.c
1 issues
fopen - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 94 Column: 18 CWE codes: 362 

                      if (argv[i][0] != '-' || i + 1 == argc)
            goto bad_option;
        if (!strcmp(argv[i], "-ref")) {
            fp = fopen(argv[i + 1], "rb");
            if (!fp) {
                fprintf(stderr, "could not open '%s'\n", argv[i + 1]);
                goto end;
            }
        } else if (!strcmp(argv[i], "-size")) {

Reported by FlawFinder.

libswscale/x86/hscale_fast_bilinear_simd.c
1 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 158 Column: 17 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                              filter[i + 3]    = (((xpos + xInc * 3) & 0xFFFF) ^ 0xFFFF) >> 9;
                filterPos[i / 2] = xx;

                memcpy(filterCode + fragmentPos, fragment, fragmentLength);

                filterCode[fragmentPos + imm8OfPShufW1] =  (a + inc)       |
                                                          ((b + inc) << 2) |
                                                          ((c + inc) << 4) |
                                                          ((d + inc) << 6);

Reported by FlawFinder.

tests/api/api-seek-test.c
1 issues
strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 172 Column: 10 CWE codes: 126 

                  long int number;
    char *end_of_string = NULL;
    number = strtol(string_with_number, &end_of_string, 10);
    if ((strlen(string_with_number) != end_of_string - string_with_number)  || (number < 0)) {
        av_log(NULL, AV_LOG_ERROR, "Incorrect input ranges of seeking\n");
        return -1;
    }
    else if ((number == LONG_MAX) || (number == LONG_MIN)) {
        if (errno == ERANGE) {

Reported by FlawFinder.

tests/base64.c
1 issues
getchar - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 41 Column: 18 CWE codes: 120 20 

                      i_shift -= 6;                                   \
    } while (0)

    while ((in = getchar()) != EOF) {
        i_bits   = (i_bits << 8) + in;
        i_shift += 8;
        while (i_shift > 6)
            putb64();
    }

Reported by FlawFinder.

tests/checkasm/alacdsp.c
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 94 Column: 18 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

                  int32_t *ref_ebb[2] = { &ref_buf[BUF_SIZE*2], &ref_buf[BUF_SIZE*3] };
    int32_t *new_ebb[2] = { &new_buf[BUF_SIZE*2], &new_buf[BUF_SIZE*3] };
    ALACDSPContext c;
    static const char * const channels[2] = { "mono", "stereo" };
    int ch;

    ff_alacdsp_init(&c);
    for (ch = 1; ch <= 2; ch++) {
        if (check_func(c.append_extra_bits[ch-1], "alac_append_extra_bits_%s", channels[ch-1])) {

Reported by FlawFinder.