The following issues were found

libavcodec/truemotion2.c
16 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 841 Column: 13 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              
        /* vertical edge extension */
        if (j == 0) {
            memcpy(Y - 4 - 1 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 - 2 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 - 3 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 - 4 * ctx->y_stride, Y - 4, ctx->y_stride);
        } else if (j == h - 1) {
            memcpy(Y - 4 + 1 * ctx->y_stride, Y - 4, ctx->y_stride);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 842 Column: 13 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                      /* vertical edge extension */
        if (j == 0) {
            memcpy(Y - 4 - 1 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 - 2 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 - 3 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 - 4 * ctx->y_stride, Y - 4, ctx->y_stride);
        } else if (j == h - 1) {
            memcpy(Y - 4 + 1 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 + 2 * ctx->y_stride, Y - 4, ctx->y_stride);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 843 Column: 13 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                      if (j == 0) {
            memcpy(Y - 4 - 1 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 - 2 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 - 3 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 - 4 * ctx->y_stride, Y - 4, ctx->y_stride);
        } else if (j == h - 1) {
            memcpy(Y - 4 + 1 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 + 2 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 + 3 * ctx->y_stride, Y - 4, ctx->y_stride);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 844 Column: 13 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                          memcpy(Y - 4 - 1 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 - 2 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 - 3 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 - 4 * ctx->y_stride, Y - 4, ctx->y_stride);
        } else if (j == h - 1) {
            memcpy(Y - 4 + 1 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 + 2 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 + 3 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 + 4 * ctx->y_stride, Y - 4, ctx->y_stride);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 846 Column: 13 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                          memcpy(Y - 4 - 3 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 - 4 * ctx->y_stride, Y - 4, ctx->y_stride);
        } else if (j == h - 1) {
            memcpy(Y - 4 + 1 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 + 2 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 + 3 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 + 4 * ctx->y_stride, Y - 4, ctx->y_stride);
        }

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 847 Column: 13 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                          memcpy(Y - 4 - 4 * ctx->y_stride, Y - 4, ctx->y_stride);
        } else if (j == h - 1) {
            memcpy(Y - 4 + 1 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 + 2 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 + 3 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 + 4 * ctx->y_stride, Y - 4, ctx->y_stride);
        }

        Y += ctx->y_stride;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 848 Column: 13 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                      } else if (j == h - 1) {
            memcpy(Y - 4 + 1 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 + 2 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 + 3 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 + 4 * ctx->y_stride, Y - 4, ctx->y_stride);
        }

        Y += ctx->y_stride;
        if (j & 1) {

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 849 Column: 13 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                          memcpy(Y - 4 + 1 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 + 2 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 + 3 * ctx->y_stride, Y - 4, ctx->y_stride);
            memcpy(Y - 4 + 4 * ctx->y_stride, Y - 4, ctx->y_stride);
        }

        Y += ctx->y_stride;
        if (j & 1) {
            /* horizontal edge extension */

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 862 Column: 17 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              
            /* vertical edge extension */
            if (j == 1) {
                memcpy(U - 2 - 1 * ctx->uv_stride, U - 2, ctx->uv_stride);
                memcpy(V - 2 - 1 * ctx->uv_stride, V - 2, ctx->uv_stride);
                memcpy(U - 2 - 2 * ctx->uv_stride, U - 2, ctx->uv_stride);
                memcpy(V - 2 - 2 * ctx->uv_stride, V - 2, ctx->uv_stride);
            } else if (j == h - 1) {
                memcpy(U - 2 + 1 * ctx->uv_stride, U - 2, ctx->uv_stride);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 863 Column: 17 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                          /* vertical edge extension */
            if (j == 1) {
                memcpy(U - 2 - 1 * ctx->uv_stride, U - 2, ctx->uv_stride);
                memcpy(V - 2 - 1 * ctx->uv_stride, V - 2, ctx->uv_stride);
                memcpy(U - 2 - 2 * ctx->uv_stride, U - 2, ctx->uv_stride);
                memcpy(V - 2 - 2 * ctx->uv_stride, V - 2, ctx->uv_stride);
            } else if (j == h - 1) {
                memcpy(U - 2 + 1 * ctx->uv_stride, U - 2, ctx->uv_stride);
                memcpy(V - 2 + 1 * ctx->uv_stride, V - 2, ctx->uv_stride);

Reported by FlawFinder.

libavformat/mpegts.c
16 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 423 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                  int len, offset;

    if (is_start) {
        memcpy(tss->section_buf, buf, buf_size);
        tss->section_index = buf_size;
        tss->section_h_size = -1;
        tss->end_of_section_reached = 0;
    } else {
        if (tss->end_of_section_reached)

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 433 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                      len = MAX_SECTION_SIZE - tss->section_index;
        if (buf_size < len)
            len = buf_size;
        memcpy(tss->section_buf + tss->section_index, buf, len);
        tss->section_index += len;
    }

    offset = 0;
    cur_section_buf = tss->section_buf;

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 713 Column: 13 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

                      char *in, *out;
        size_t inlen = len, outlen = inlen * 6 + 1;
        if (len >= 3 && p[0] == 0x10 && !p[1] && p[2] && p[2] <= 0xf && p[2] != 0xc) {
            char iso8859[12];
            snprintf(iso8859, sizeof(iso8859), "ISO-8859-%d", p[2]);
            inlen -= 3;
            in = (char *)p + 3;
            cd = iconv_open("UTF-8", iso8859);
        } else if (p[0] < 0x20) {

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 748 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                  str = av_malloc(len + 1);
    if (!str)
        return NULL;
    memcpy(str, p, len);
    str[len] = '\0';
    p  += len;
    *pp = p;
    return str;
}

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 932 Column: 13 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                          PESContext *sub_pes = av_malloc(sizeof(*sub_pes));
            if (!sub_pes)
                return AVERROR(ENOMEM);
            memcpy(sub_pes, pes, sizeof(*sub_pes));

            sub_st = avformat_new_stream(pes->stream, NULL);
            if (!sub_st) {
                av_free(sub_pes);
                return AVERROR(ENOMEM);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1047 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                  uint8_t buf_padded[128 + AV_INPUT_BUFFER_PADDING_SIZE];
    int buf_padded_size = FFMIN(buf_size, sizeof(buf_padded) - AV_INPUT_BUFFER_PADDING_SIZE);

    memcpy(buf_padded, buf, buf_padded_size);

    init_get_bits(&gb, buf_padded, buf_padded_size * 8);

    if (sl->use_au_start)
        au_start_flag = get_bits1(&gb);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1151 Column: 13 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                          len = PES_START_SIZE - pes->data_index;
            if (len > buf_size)
                len = buf_size;
            memcpy(pes->header + pes->data_index, p, len);
            pes->data_index += len;
            p += len;
            buf_size -= len;
            if (pes->data_index == PES_START_SIZE) {
                /* we got all the PES or section header. We can now

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1231 Column: 13 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                              return AVERROR_INVALIDDATA;
            if (len > buf_size)
                len = buf_size;
            memcpy(pes->header + pes->data_index, p, len);
            pes->data_index += len;
            p += len;
            buf_size -= len;
            if (pes->data_index == PES_HEADER_SIZE) {
                pes->pes_header_size = pes->header[8] + 9;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1246 Column: 13 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                              return AVERROR_INVALIDDATA;
            if (len > buf_size)
                len = buf_size;
            memcpy(pes->header + pes->data_index, p, len);
            pes->data_index += len;
            p += len;
            buf_size -= len;
            if (pes->data_index == pes->pes_header_size) {
                const uint8_t *r;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1377 Column: 17 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                                  // not sure if this is legal in ts but see issue #2392
                    buf_size = pes->total_size;
                }
                memcpy(pes->buffer->data + pes->data_index, p, buf_size);
                pes->data_index += buf_size;
                /* emit complete packets with known packet size
                 * decreases demuxer delay for infrequent packets like subtitles from
                 * a couple of seconds to milliseconds for properly muxed files.
                 * total_size is the number of bytes following pes_packet_length

Reported by FlawFinder.

libavformat/utils.c
16 issues
Uninitialized variable: ret
Error

Line: 5113 CWE codes: 908 

              
               av_freep(&key);
            }
            return match && ret;
        } else if (*spec == 'u' && *(spec + 1) == '\0') {
            AVCodecParameters *par = st->codecpar;
            int val;
            switch (par->codec_type) {
            case AVMEDIA_TYPE_AUDIO:

Reported by Cppcheck.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 307 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              
int av_filename_number_test(const char *filename)
{
    char buf[1024];
    return filename &&
           (av_get_frame_filename(buf, sizeof(buf), filename, 1) >= 0);
}

static int set_codec_from_probe_data(AVFormatContext *s, AVStream *st,

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 670 Column: 13 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                              goto no_packet;
            }
            pd->buf = new_buf;
            memcpy(pd->buf + pd->buf_size, pkt->data, pkt->size);
            pd->buf_size += pkt->size;
            memset(pd->buf + pd->buf_size, 0, AVPROBE_PADDING_SIZE);
        } else {
no_packet:
            st->internal->probe_packets = 0;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1638 Column: 17 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                                  continue;
                }

                memcpy(dst_data, src_sd->data, src_sd->size);
            }
            st->internal->inject_global_side_data = 0;
        }
    }

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 3542 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                      dst_data = av_stream_new_side_data(st, sd_src->type, sd_src->size);
        if (!dst_data)
            return AVERROR(ENOMEM);
        memcpy(dst_data, sd_src->data, sd_src->size);
    }
    return 0;
}

int avformat_find_stream_info(AVFormatContext *ic, AVDictionary **options)

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 4054 Column: 13 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

                              goto find_stream_info_err;
        }
        if (!has_codec_parameters(st, &errmsg)) {
            char buf[256];
            avcodec_string(buf, sizeof(buf), st->internal->avctx, 0);
            av_log(ic, AV_LOG_WARNING,
                   "Could not find codec parameters for stream %d (%s): %s\n"
                   "Consider increasing the value for the 'analyzeduration' (%"PRId64") and 'probesize' (%"PRId64") options\n",
                   i, buf, errmsg, ic->max_analyze_duration, ic->probesize);

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 4594 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              int av_get_frame_filename2(char *buf, int buf_size, const char *path, int number, int flags)
{
    const char *p;
    char *q, buf1[20], c;
    int nd, len, percentd_found;

    q = buf;
    p = path;
    percentd_found = 0;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 4628 Column: 17 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                              len = strlen(buf1);
                if ((q - buf + len) > buf_size - 1)
                    goto fail;
                memcpy(q, buf1, len);
                q += len;
                break;
            default:
                goto fail;
            }

Reported by FlawFinder.

atoi - Unless checked, the resulting number can exceed the expected range
Security

Line: 4705 Column: 29 CWE codes: 190
Suggestion: If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended) 

                          av_strlcpy(hostname, p + 1,
                       FFMIN(hostname_size, brk - p));
            if (brk[1] == ':' && port_ptr)
                *port_ptr = atoi(brk + 2);
        } else if ((col = strchr(p, ':')) && col < ls) {
            av_strlcpy(hostname, p,
                       FFMIN(col + 1 - p, hostname_size));
            if (port_ptr)
                *port_ptr = atoi(col + 1);

Reported by FlawFinder.

atoi - Unless checked, the resulting number can exceed the expected range
Security

Line: 4710 Column: 29 CWE codes: 190
Suggestion: If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended) 

                          av_strlcpy(hostname, p,
                       FFMIN(col + 1 - p, hostname_size));
            if (port_ptr)
                *port_ptr = atoi(col + 1);
        } else
            av_strlcpy(hostname, p,
                       FFMIN(ls + 1 - p, hostname_size));
    }
}

Reported by FlawFinder.

libavcodec/mpeg12dec.c
15 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1091 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                      return err;

    if (!ctx->mpeg_enc_ctx_allocated)
        memcpy(s + 1, s1 + 1, sizeof(Mpeg1Context) - sizeof(MpegEncContext));

    if (!(s->pict_type == AV_PICTURE_TYPE_B || s->low_delay))
        s->picture_number++;

    return 0;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1106 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                  uint16_t temp_matrix[64];
    int i;

    memcpy(temp_matrix, matrix, 64 * sizeof(uint16_t));

    for (i = 0; i < 64; i++)
        matrix[new_perm[i]] = temp_matrix[old_perm[i]];
}

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1322 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              
        /* Quantization matrices may need reordering
         * if DCT permutation is changed. */
        memcpy(old_permutation, s->idsp.idct_permutation, 64 * sizeof(uint8_t));

        ff_mpv_idct_init(s);
        if ((ret = ff_mpv_common_init(s)) < 0)
            return ret;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1633 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                                                        sizeof(s1->pan_scan));
        if (!pan_scan)
            return AVERROR(ENOMEM);
        memcpy(pan_scan->data, &s1->pan_scan, sizeof(s1->pan_scan));

        if (s1->a53_buf_ref) {
            AVFrameSideData *sd = av_frame_new_side_data_from_buf(
                s->current_picture_ptr->f, AV_FRAME_DATA_A53_CC,
                s1->a53_buf_ref);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 2252 Column: 17 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              
            ret = av_buffer_realloc(&s1->a53_buf_ref, new_size);
            if (ret >= 0)
                memcpy(s1->a53_buf_ref->data + old_size, p + 7, cc_count * UINT64_C(3));

            avctx->properties |= FF_CODEC_PROPERTY_CLOSED_CAPTIONS;
        }
        return 1;
    } else if (buf_size >= 2 &&

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 2455 Column: 9 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

                  broken_link = get_bits1(&s->gb);

    if (s->avctx->debug & FF_DEBUG_PICT_INFO) {
        char tcbuf[AV_TIMECODE_STR_SIZE];
        av_timecode_make_mpeg_tc_string(tcbuf, tc);
        av_log(s->avctx, AV_LOG_DEBUG,
               "GOP (%s) closed_gop=%d broken_link=%d\n",
               tcbuf, s->closed_gop, broken_link);
    }

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 2852 Column: 13 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

                      s2->current_picture_ptr = NULL;

        if (s2->timecode_frame_start != -1 && *got_output) {
            char tcbuf[AV_TIMECODE_STR_SIZE];
            AVFrameSideData *tcside = av_frame_new_side_data(picture,
                                                             AV_FRAME_DATA_GOP_TIMECODE,
                                                             sizeof(int64_t));
            if (!tcside)
                return AVERROR(ENOMEM);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 2858 Column: 13 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                                                                           sizeof(int64_t));
            if (!tcside)
                return AVERROR(ENOMEM);
            memcpy(tcside->data, &s2->timecode_frame_start, sizeof(int64_t));

            av_timecode_make_mpeg_tc_string(tcbuf, s2->timecode_frame_start);
            av_dict_set(&picture->metadata, "timecode", tcbuf, 0);

            s2->timecode_frame_start = -1;

Reported by FlawFinder.

mismatch - Function does not check the second iterator for over-read conditions
Security

Line: 322 Column: 9 CWE codes: 126
Suggestion: This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it 

                  uint8_t *const scantable = s->intra_scantable.permutated;
    const uint16_t *quant_matrix;
    const int qscale = s->qscale;
    int mismatch;

    mismatch = 1;

    {
        OPEN_READER(re, &s->gb);

Reported by FlawFinder.

mismatch - Function does not check the second iterator for over-read conditions
Security

Line: 341 Column: 13 CWE codes: 126
Suggestion: This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it 

                          if (GET_CACHE(re, &s->gb) & 0x40000000)
                level = -level;
            block[0]  = level;
            mismatch ^= level;
            i++;
            SKIP_BITS(re, &s->gb, 2);
            if (((int32_t) GET_CACHE(re, &s->gb)) <= (int32_t) 0xBFFFFFFF)
                goto end;
        }

Reported by FlawFinder.

tools/python/convert.py
15 issues
Unused import struct from wildcard import
Error

Line: 23 Column: 1 

              # verified with Python 3.5.2 on Ubuntu 16.04
import argparse
import os
from convert_from_tensorflow import *

def get_arguments():
    parser = argparse.ArgumentParser(description='generate native mode model with weights from deep learning model')
    parser.add_argument('--outdir', type=str, default='./', help='where to put generated files')
    parser.add_argument('--infmt', type=str, default='tensorflow', help='format of the deep learning model')

Reported by Pylint.

Unused import sys from wildcard import
Error

Line: 23 Column: 1 

              # verified with Python 3.5.2 on Ubuntu 16.04
import argparse
import os
from convert_from_tensorflow import *

def get_arguments():
    parser = argparse.ArgumentParser(description='generate native mode model with weights from deep learning model')
    parser.add_argument('--outdir', type=str, default='./', help='where to put generated files')
    parser.add_argument('--infmt', type=str, default='tensorflow', help='format of the deep learning model')

Reported by Pylint.

Unused import np from wildcard import
Error

Line: 23 Column: 1 

              # verified with Python 3.5.2 on Ubuntu 16.04
import argparse
import os
from convert_from_tensorflow import *

def get_arguments():
    parser = argparse.ArgumentParser(description='generate native mode model with weights from deep learning model')
    parser.add_argument('--outdir', type=str, default='./', help='where to put generated files')
    parser.add_argument('--infmt', type=str, default='tensorflow', help='format of the deep learning model')

Reported by Pylint.

Unused import tf from wildcard import
Error

Line: 23 Column: 1 

              # verified with Python 3.5.2 on Ubuntu 16.04
import argparse
import os
from convert_from_tensorflow import *

def get_arguments():
    parser = argparse.ArgumentParser(description='generate native mode model with weights from deep learning model')
    parser.add_argument('--outdir', type=str, default='./', help='where to put generated files')
    parser.add_argument('--infmt', type=str, default='tensorflow', help='format of the deep learning model')

Reported by Pylint.

Wildcard import convert_from_tensorflow
Error

Line: 23 Column: 1 

              # verified with Python 3.5.2 on Ubuntu 16.04
import argparse
import os
from convert_from_tensorflow import *

def get_arguments():
    parser = argparse.ArgumentParser(description='generate native mode model with weights from deep learning model')
    parser.add_argument('--outdir', type=str, default='./', help='where to put generated files')
    parser.add_argument('--infmt', type=str, default='tensorflow', help='format of the deep learning model')

Reported by Pylint.

Unused import TFConverter from wildcard import
Error

Line: 23 Column: 1 

              # verified with Python 3.5.2 on Ubuntu 16.04
import argparse
import os
from convert_from_tensorflow import *

def get_arguments():
    parser = argparse.ArgumentParser(description='generate native mode model with weights from deep learning model')
    parser.add_argument('--outdir', type=str, default='./', help='where to put generated files')
    parser.add_argument('--infmt', type=str, default='tensorflow', help='format of the deep learning model')

Reported by Pylint.

Unused import Operand from wildcard import
Error

Line: 23 Column: 1 

              # verified with Python 3.5.2 on Ubuntu 16.04
import argparse
import os
from convert_from_tensorflow import *

def get_arguments():
    parser = argparse.ArgumentParser(description='generate native mode model with weights from deep learning model')
    parser.add_argument('--outdir', type=str, default='./', help='where to put generated files')
    parser.add_argument('--infmt', type=str, default='tensorflow', help='format of the deep learning model')

Reported by Pylint.

Unused import header from wildcard import
Error

Line: 23 Column: 1 

              # verified with Python 3.5.2 on Ubuntu 16.04
import argparse
import os
from convert_from_tensorflow import *

def get_arguments():
    parser = argparse.ArgumentParser(description='generate native mode model with weights from deep learning model')
    parser.add_argument('--outdir', type=str, default='./', help='where to put generated files')
    parser.add_argument('--infmt', type=str, default='tensorflow', help='format of the deep learning model')

Reported by Pylint.

Missing module docstring
Error

Line: 1 Column: 1 

              # Copyright (c) 2019 Guo Yejun
#
# This file is part of FFmpeg.
#
# FFmpeg is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#

Reported by Pylint.

Missing function or method docstring
Error

Line: 25 Column: 1 

              import os
from convert_from_tensorflow import *

def get_arguments():
    parser = argparse.ArgumentParser(description='generate native mode model with weights from deep learning model')
    parser.add_argument('--outdir', type=str, default='./', help='where to put generated files')
    parser.add_argument('--infmt', type=str, default='tensorflow', help='format of the deep learning model')
    parser.add_argument('infile', help='path to the deep learning model with weights')
    parser.add_argument('--dump4tb', type=str, default='no', help='dump file for visualization in tensorboard')

Reported by Pylint.

libavfilter/avf_showspectrum.c
15 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 452 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                          g[n].im = b;
        }

        memcpy(f, h, s->buf_size * sizeof(*f));
        s->tx_fn(s->fft[ch], h, f, sizeof(float));

        memcpy(f, g, s->buf_size * sizeof(*f));
        s->tx_fn(s->fft[ch], g, f, sizeof(float));

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 455 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                      memcpy(f, h, s->buf_size * sizeof(*f));
        s->tx_fn(s->fft[ch], h, f, sizeof(float));

        memcpy(f, g, s->buf_size * sizeof(*f));
        s->tx_fn(s->fft[ch], g, f, sizeof(float));

        for (int n = 0; n < L; n++) {
            c = g[n].re;
            S = g[n].im;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 468 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                          g[n].im = b / L;
        }

        memcpy(f, g, s->buf_size * sizeof(*f));
        s->itx_fn(s->ifft[ch], g, f, sizeof(float));

        for (int k = 0; k < M; k++) {
            psi = k * k / 2.f * phi;
            c =  cosf(psi);

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 777 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

                  float spp = samples / (float)sz;
    char *text;
    uint8_t *dst;
    char chlayout_str[128];

    av_get_channel_layout_string(chlayout_str, sizeof(chlayout_str), inlink->channels,
                                 inlink->channel_layout);

    text = av_asprintf("%d Hz | %s", inlink->sample_rate, chlayout_str);

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 787 Column: 45 CWE codes: 126 

                      return AVERROR(ENOMEM);

    drawtext(s->outpicref, 2, outlink->h - 10, "CREATED BY LIBAVFILTER", 0);
    drawtext(s->outpicref, outlink->w - 2 - strlen(text) * 10, outlink->h - 10, text, 0);
    av_freep(&text);
    if (s->stop) {
        text = av_asprintf("Zoom: %d Hz - %d Hz", s->start, s->stop);
        if (!text)
            return AVERROR(ENOMEM);

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 793 Column: 49 CWE codes: 126 

                      text = av_asprintf("Zoom: %d Hz - %d Hz", s->start, s->stop);
        if (!text)
            return AVERROR(ENOMEM);
        drawtext(s->outpicref, outlink->w - 2 - strlen(text) * 10, 3, text, 0);
        av_freep(&text);
    }

    dst = s->outpicref->data[0] + (s->start_y - 1) * s->outpicref->linesize[0] + s->start_x - 1;
    for (x = 0; x < s->w + 1; x++)

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 849 Column: 57 CWE codes: 126 

                              if (!units)
                    return AVERROR(ENOMEM);

                drawtext(s->outpicref, s->start_x - 8 * strlen(units) - 4, h * (ch + 1) + s->start_y - y - 4 - hh, units, 0);
                av_free(units);
            }
        }

        for (x = 0; x < s->w && s->single_pic; x+=80) {

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 860 Column: 57 CWE codes: 126 

                          if (!units)
                return AVERROR(ENOMEM);

            drawtext(s->outpicref, s->start_x + x - 4 * strlen(units), s->h + s->start_y + 6, units, 0);
            drawtext(s->outpicref, s->start_x + x - 4 * strlen(units), s->start_y - 12, units, 0);
            av_free(units);
        }

        drawtext(s->outpicref, outlink->w / 2 - 4 * 4, outlink->h - s->start_y / 2, "TIME", 0);

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 861 Column: 57 CWE codes: 126 

                              return AVERROR(ENOMEM);

            drawtext(s->outpicref, s->start_x + x - 4 * strlen(units), s->h + s->start_y + 6, units, 0);
            drawtext(s->outpicref, s->start_x + x - 4 * strlen(units), s->start_y - 12, units, 0);
            av_free(units);
        }

        drawtext(s->outpicref, outlink->w / 2 - 4 * 4, outlink->h - s->start_y / 2, "TIME", 0);
        drawtext(s->outpicref, s->start_x / 7, outlink->h / 2 - 14 * 4, "FREQUENCY (Hz)", 1);

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 907 Column: 57 CWE codes: 126 

                              if (!units)
                    return AVERROR(ENOMEM);

                drawtext(s->outpicref, s->start_x - 4 * strlen(units) + x + w * ch, s->start_y - 12, units, 0);
                drawtext(s->outpicref, s->start_x - 4 * strlen(units) + x + w * ch, s->h + s->start_y + 6, units, 0);
                av_free(units);
            }
        }
        for (y = 0; y < s->h && s->single_pic; y+=40) {

Reported by FlawFinder.

libavcodec/libvpxenc.c
14 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 367 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                      return AVERROR(ENOMEM);
    }

    memcpy(data, frame_hdr10_plus.hdr10_plus->data, frame_hdr10_plus.hdr10_plus->size);
    av_buffer_unref(&frame_hdr10_plus.hdr10_plus);
    return 0;
}

static av_cold int codecctl_int(AVCodecContext *avctx,

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 376 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

                                              enum vp8e_enc_control_id id, int val)
{
    VPxContext *ctx = avctx->priv_data;
    char buf[80];
    int width = -30;
    int res;

    snprintf(buf, sizeof(buf), "%s:", ctlidstr[id]);
    av_log(avctx, AV_LOG_DEBUG, "  %*s%d\n", width, buf, val);

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 398 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

                                               enum vp8e_enc_control_id id, int *val)
{
    VPxContext *ctx = avctx->priv_data;
    char buf[80];
    int width = -30;
    int res;

    snprintf(buf, sizeof(buf), "%s:", ctlidstr[id]);
    av_log(avctx, AV_LOG_DEBUG, "  %*s%d\n", width, buf, *val);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 485 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                      cfg->ts_number_layers = 2;
        cfg->ts_rate_decimator[0] = 2;
        cfg->ts_rate_decimator[1] = 1;
        memcpy(cfg->ts_layer_id, ids, sizeof(ids));

        layer_flags[0] =
             VP8_EFLAG_NO_REF_GF | VP8_EFLAG_NO_REF_ARF |
             VP8_EFLAG_NO_UPD_GF | VP8_EFLAG_NO_UPD_ARF;
        layer_flags[1] =

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 510 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                      cfg->ts_rate_decimator[0] = 4;
        cfg->ts_rate_decimator[1] = 2;
        cfg->ts_rate_decimator[2] = 1;
        memcpy(cfg->ts_layer_id, ids, sizeof(ids));

        /**
         * 0=L, 1=GF, 2=ARF,
         * Intra-layer prediction disabled.
         */

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 545 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                      cfg->ts_rate_decimator[0] = 4;
        cfg->ts_rate_decimator[1] = 2;
        cfg->ts_rate_decimator[2] = 1;
        memcpy(cfg->ts_layer_id, ids, sizeof(ids));

        /**
         * 0=L, 1=GF, 2=ARF, Intra-layer prediction disabled.
         */
        layer_flags[0] =

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1250 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                  if (ret < 0)
        return ret;

    memcpy(pkt->data, cx_frame->buf, pkt->size);
    pkt->pts = pkt->dts = cx_frame->pts;

    if (!!(cx_frame->flags & VPX_FRAME_IS_KEY)) {
        pict_type = AV_PICTURE_TYPE_I;
        pkt->flags |= AV_PKT_FLAG_KEY;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1278 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                          return AVERROR(ENOMEM);
        }
        AV_WB64(side_data, 1);
        memcpy(side_data + 8, cx_frame->buf_alpha, cx_frame->sz_alpha);
    }
    if (cx_frame->frame_number != -1) {
        VPxContext *ctx = avctx->priv_data;
        if (!ctx->discard_hdr10_plus) {
            int err = copy_hdr10_plus_to_pkt(ctx->hdr10_plus_fifo, pkt);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1354 Column: 17 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                                  av_freep(&cx_frame);
                    return AVERROR(ENOMEM);
                }
                memcpy(cx_frame->buf, pkt->data.frame.buf, pkt->data.frame.sz);
                if (ctx->is_alpha) {
                    cx_frame->buf_alpha = av_malloc(cx_frame->sz_alpha);
                    if (!cx_frame->buf_alpha) {
                        av_log(avctx, AV_LOG_ERROR,
                               "Data buffer alloc (%"SIZE_SPECIFIER" bytes) failed\n",

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1364 Column: 21 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                                      av_free(cx_frame);
                        return AVERROR(ENOMEM);
                    }
                    memcpy(cx_frame->buf_alpha, pkt_alpha->data.frame.buf, pkt_alpha->data.frame.sz);
                }
                coded_frame_add(&ctx->coded_frame_list, cx_frame);
            }
            break;
        case VPX_CODEC_STATS_PKT: {

Reported by FlawFinder.

tests/checkasm/checkasm.c
14 issues
vfprintf - If format strings can be influenced by an attacker, they can be exploited
Security

Line: 418 Column: 5 CWE codes: 134
Suggestion: Use a constant for the format specification 

              #endif

    va_start(arg, fmt);
    vfprintf(stderr, fmt, arg);
    va_end(arg);

    if (use_color) {
#if HAVE_SETCONSOLETEXTATTRIBUTE && HAVE_GETSTDHANDLE
        SetConsoleTextAttribute(con, org_attributes);

Reported by FlawFinder.

vsnprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 755 Column: 19 CWE codes: 134
Suggestion: Use a constant for the format specification 

                  va_list arg;

    va_start(arg, name);
    name_length = vsnprintf(name_buf, sizeof(name_buf), name, arg);
    va_end(arg);

    if (!func || name_length <= 0 || name_length >= sizeof(name_buf))
        return NULL;

Reported by FlawFinder.

vfprintf - If format strings can be influenced by an attacker, they can be exploited
Security

Line: 808 Column: 9 CWE codes: 134
Suggestion: Use a constant for the format specification 

                      print_cpu_name();
        fprintf(stderr, "   %s_%s (", state.current_func->name, cpu_suffix(state.current_func_ver->cpu));
        va_start(arg, msg);
        vfprintf(stderr, msg, arg);
        va_end(arg);
        fprintf(stderr, ")\n");

        state.current_func_ver->ok = 0;
        state.num_failed++;

Reported by FlawFinder.

vfprintf - If format strings can be influenced by an attacker, they can be exploited
Security

Line: 838 Column: 23 CWE codes: 134
Suggestion: Use a constant for the format specification 

                      print_cpu_name();
        pad_length -= fprintf(stderr, " - %s.", state.current_test_name);
        va_start(arg, name);
        pad_length -= vfprintf(stderr, name, arg);
        va_end(arg);
        fprintf(stderr, "%*c", FFMAX(pad_length, 0) + 2, '[');

        if (state.num_failed == prev_failed)
            color_printf(COLOR_GREEN, "OK");

Reported by FlawFinder.

vsnprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 856 Column: 19 CWE codes: 134
Suggestion: Use a constant for the format specification 

                      va_list arg;

        va_start(arg, name);
        length += vsnprintf(NULL, 0, name, arg);
        va_end(arg);

        if (length > max_length)
            max_length = length;
    }

Reported by FlawFinder.

fprintf - If format strings can be influenced by an attacker, they can be exploited
Security

Line: 884 Column: 13 CWE codes: 134
Suggestion: Use a constant for the format specification 

                  fprintf(stderr, "%s:\n", name); \
    while (h--) { \
        for (int x = 0; x < w; x++) \
            fprintf(stderr, " " fmt, buf1[x]); \
        fprintf(stderr, "    "); \
        for (int x = 0; x < w; x++) \
            fprintf(stderr, " " fmt, buf2[x]); \
        fprintf(stderr, "    "); \
        for (int x = 0; x < w; x++) \

Reported by FlawFinder.

fprintf - If format strings can be influenced by an attacker, they can be exploited
Security

Line: 887 Column: 13 CWE codes: 134
Suggestion: Use a constant for the format specification 

                          fprintf(stderr, " " fmt, buf1[x]); \
        fprintf(stderr, "    "); \
        for (int x = 0; x < w; x++) \
            fprintf(stderr, " " fmt, buf2[x]); \
        fprintf(stderr, "    "); \
        for (int x = 0; x < w; x++) \
            fprintf(stderr, "%c", buf1[x] != buf2[x] ? 'x' : '.'); \
        buf1 += stride1; \
        buf2 += stride2; \

Reported by FlawFinder.

getenv - Environment variables are untrustable input if they can be set by an attacker. They can have any content and length, and the same variable can be set more than once
Security

Line: 410 Column: 28 CWE codes: 807 20
Suggestion: Check environment variables carefully before using them 

                      SetConsoleTextAttribute(con, (org_attributes & 0xfff0) | (color & 0x0f));
#else
    if (use_color < 0) {
        const char *term = getenv("TERM");
        use_color = term && strcmp(term, "dumb") && isatty(2);
    }
    if (use_color)
        fprintf(stderr, "\x1b[%d;3%dm", (color & 0x08) >> 3, color & 0x07);
#endif

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 265 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

                  struct CheckasmFunc *child[2];
    CheckasmFuncVersion versions;
    uint8_t color; /* 0 = red, 1 = black */
    char name[1];
} CheckasmFunc;

/* Internal state */
static struct {
    CheckasmFunc *funcs;

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 582 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                      /* Allocate and insert a new node into the tree */
        int name_length = strlen(name);
        f = *root = checkasm_malloc(sizeof(CheckasmFunc) + name_length);
        memcpy(f->name, name, name_length + 1);
    }

    return f;
}

Reported by FlawFinder.

tests/checkasm/vp9dsp.c
14 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 60 Column: 18 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

                  int tx, mode, bit_depth;
    declare_func_emms(AV_CPU_FLAG_MMX | AV_CPU_FLAG_MMXEXT, void, uint8_t *dst, ptrdiff_t stride,
                      const uint8_t *left, const uint8_t *top);
    static const char *const mode_names[N_INTRA_PRED_MODES] = {
        [VERT_PRED] = "vert",
        [HOR_PRED] = "hor",
        [DC_PRED] = "dc",
        [DIAG_DOWN_LEFT_PRED] = "diag_downleft",
        [DIAG_DOWN_RIGHT_PRED] = "diag_downright",

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 322 Column: 18 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

                  declare_func_emms(AV_CPU_FLAG_MMX | AV_CPU_FLAG_MMXEXT, void, uint8_t *dst, ptrdiff_t stride, int16_t *block, int eob);
    VP9DSPContext dsp;
    int y, x, tx, txtp, bit_depth, sub;
    static const char *const txtp_types[N_TXFM_TYPES] = {
        [DCT_DCT] = "dct_dct", [DCT_ADST] = "adst_dct",
        [ADST_DCT] = "dct_adst", [ADST_ADST] = "adst_adst"
    };

    for (bit_depth = 8; bit_depth <= 12; bit_depth += 2) {

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 356 Column: 29 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                                                              sz, sub, bit_depth);
                        } else {
                            eob = sz * sz;
                            memcpy(subcoef0, coef, sz * sz * SIZEOF_COEF);
                        }

                        memcpy(dst0, dst, sz * sz * SIZEOF_PIXEL);
                        memcpy(dst1, dst, sz * sz * SIZEOF_PIXEL);
                        memcpy(subcoef1, subcoef0, sz * sz * SIZEOF_COEF);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 359 Column: 25 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                                          memcpy(subcoef0, coef, sz * sz * SIZEOF_COEF);
                        }

                        memcpy(dst0, dst, sz * sz * SIZEOF_PIXEL);
                        memcpy(dst1, dst, sz * sz * SIZEOF_PIXEL);
                        memcpy(subcoef1, subcoef0, sz * sz * SIZEOF_COEF);
                        call_ref(dst0, sz * SIZEOF_PIXEL, subcoef0, eob);
                        call_new(dst1, sz * SIZEOF_PIXEL, subcoef1, eob);
                        if (memcmp(dst0, dst1, sz * sz * SIZEOF_PIXEL) ||

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 360 Column: 25 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                                      }

                        memcpy(dst0, dst, sz * sz * SIZEOF_PIXEL);
                        memcpy(dst1, dst, sz * sz * SIZEOF_PIXEL);
                        memcpy(subcoef1, subcoef0, sz * sz * SIZEOF_COEF);
                        call_ref(dst0, sz * SIZEOF_PIXEL, subcoef0, eob);
                        call_new(dst1, sz * SIZEOF_PIXEL, subcoef1, eob);
                        if (memcmp(dst0, dst1, sz * sz * SIZEOF_PIXEL) ||
                            !is_zero(subcoef0, sz * sz * SIZEOF_COEF) ||

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 361 Column: 25 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              
                        memcpy(dst0, dst, sz * sz * SIZEOF_PIXEL);
                        memcpy(dst1, dst, sz * sz * SIZEOF_PIXEL);
                        memcpy(subcoef1, subcoef0, sz * sz * SIZEOF_COEF);
                        call_ref(dst0, sz * SIZEOF_PIXEL, subcoef0, eob);
                        call_new(dst1, sz * SIZEOF_PIXEL, subcoef1, eob);
                        if (memcmp(dst0, dst1, sz * sz * SIZEOF_PIXEL) ||
                            !is_zero(subcoef0, sz * sz * SIZEOF_COEF) ||
                            !is_zero(subcoef1, sz * sz * SIZEOF_COEF))

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 457 Column: 18 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

                  LOCAL_ALIGNED_32(uint8_t, base1, [32 + 16 * 16 * 2]);
    VP9DSPContext dsp;
    int dir, wd, wd2, bit_depth;
    static const char *const dir_name[2] = { "h", "v" };
    static const int E[2] = { 20, 28 }, I[2] = { 10, 16 };
    static const int H[2] = { 7, 11 }, F[2] = { 1, 1 };
    declare_func_emms(AV_CPU_FLAG_MMX | AV_CPU_FLAG_MMXEXT, void, uint8_t *dst, ptrdiff_t stride, int E, int I, int H);

    for (bit_depth = 8; bit_depth <= 12; bit_depth += 2) {

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 477 Column: 21 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                                             "vp9_loop_filter_%s_%d_8_%dbpp",
                               dir_name[dir], 4 << wd, bit_depth)) {
                    randomize_buffers(0, 0, 8);
                    memcpy(buf1 - midoff, buf0 - midoff,
                           16 * 8 * SIZEOF_PIXEL);
                    call_ref(buf0, 16 * SIZEOF_PIXEL >> dir, E[0], I[0], H[0]);
                    call_new(buf1, 16 * SIZEOF_PIXEL >> dir, E[0], I[0], H[0]);
                    if (memcmp(buf0 - midoff, buf1 - midoff, 16 * 8 * SIZEOF_PIXEL))
                        fail();

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 499 Column: 17 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                                         dir_name[dir], bit_depth)) {
                randomize_buffers(0, 0, 16);
                randomize_buffers(0, 8, 16);
                memcpy(buf1 - midoff, buf0 - midoff, 16 * 16 * SIZEOF_PIXEL);
                call_ref(buf0, 16 * SIZEOF_PIXEL, E[0], I[0], H[0]);
                call_new(buf1, 16 * SIZEOF_PIXEL, E[0], I[0], H[0]);
                if (memcmp(buf0 - midoff, buf1 - midoff, 16 * 16 * SIZEOF_PIXEL))
                    fail();
                bench_new(buf1, 16 * SIZEOF_PIXEL, E[0], I[0], H[0]);

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 515 Column: 25 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                                                 dir_name[dir], 4 << wd, 4 << wd2, bit_depth)) {
                        randomize_buffers(0, 0, 16);
                        randomize_buffers(1, 8, 16);
                        memcpy(buf1 - midoff, buf0 - midoff, 16 * 16 * SIZEOF_PIXEL);
#define M(a) (((a)[1] << 8) | (a)[0])
                        call_ref(buf0, 16 * SIZEOF_PIXEL, M(E), M(I), M(H));
                        call_new(buf1, 16 * SIZEOF_PIXEL, M(E), M(I), M(H));
                        if (memcmp(buf0 - midoff, buf1 - midoff, 16 * 16 * SIZEOF_PIXEL))
                            fail();

Reported by FlawFinder.

libavutil/file_open.c
14 issues
access - This usually indicates a security flaw. If an attacker can change anything along the path between the call to access() and the file's actual use (e.g., by moving files), the attacker can exploit the race condition
Security

Line: 161 Column: 9 CWE codes: 362/367!
Suggestion: Set up the correct permissions (e.g., using setuid()) and try to open the file directly 

              FILE *av_fopen_utf8(const char *path, const char *mode)
{
    int fd;
    int access;
    const char *m = mode;

    switch (*m++) {
    case 'r': access = O_RDONLY; break;
    case 'w': access = O_CREAT|O_WRONLY|O_TRUNC; break;

Reported by FlawFinder.

access - This usually indicates a security flaw. If an attacker can change anything along the path between the call to access() and the file's actual use (e.g., by moving files), the attacker can exploit the race condition
Security

Line: 174 Column: 13 CWE codes: 362/367!
Suggestion: Set up the correct permissions (e.g., using setuid()) and try to open the file directly 

                  }
    while (*m) {
        if (*m == '+') {
            access &= ~(O_RDONLY | O_WRONLY);
            access |= O_RDWR;
        } else if (*m == 'b') {
#ifdef O_BINARY
            access |= O_BINARY;
#endif

Reported by FlawFinder.

access - This usually indicates a security flaw. If an attacker can change anything along the path between the call to access() and the file's actual use (e.g., by moving files), the attacker can exploit the race condition
Security

Line: 175 Column: 13 CWE codes: 362/367!
Suggestion: Set up the correct permissions (e.g., using setuid()) and try to open the file directly 

                  while (*m) {
        if (*m == '+') {
            access &= ~(O_RDONLY | O_WRONLY);
            access |= O_RDWR;
        } else if (*m == 'b') {
#ifdef O_BINARY
            access |= O_BINARY;
#endif
        } else if (*m) {

Reported by FlawFinder.

access - This usually indicates a security flaw. If an attacker can change anything along the path between the call to access() and the file's actual use (e.g., by moving files), the attacker can exploit the race condition
Security

Line: 178 Column: 13 CWE codes: 362/367!
Suggestion: Set up the correct permissions (e.g., using setuid()) and try to open the file directly 

                          access |= O_RDWR;
        } else if (*m == 'b') {
#ifdef O_BINARY
            access |= O_BINARY;
#endif
        } else if (*m) {
            errno = EINVAL;
            return NULL;
        }

Reported by FlawFinder.

access - This usually indicates a security flaw. If an attacker can change anything along the path between the call to access() and the file's actual use (e.g., by moving files), the attacker can exploit the race condition
Security

Line: 186 Column: 28 CWE codes: 362/367!
Suggestion: Set up the correct permissions (e.g., using setuid()) and try to open the file directly 

                      }
        m++;
    }
    fd = avpriv_open(path, access, 0666);
    if (fd == -1)
        return NULL;
    return fdopen(fd, mode);
}

Reported by FlawFinder.

tempnam - Temporary file race condition
Security

Line: 115 Column: 16 CWE codes: 377 

                  FileLogContext file_log_ctx = { &file_log_ctx_class, log_offset, log_ctx };
    int fd = -1;
#if !HAVE_MKSTEMP
    void *ptr= tempnam(NULL, prefix);
    if(!ptr)
        ptr= tempnam(".", prefix);
    *filename = av_strdup(ptr);
#undef free
    free(ptr);

Reported by FlawFinder.

tempnam - Temporary file race condition
Security

Line: 117 Column: 14 CWE codes: 377 

              #if !HAVE_MKSTEMP
    void *ptr= tempnam(NULL, prefix);
    if(!ptr)
        ptr= tempnam(".", prefix);
    *filename = av_strdup(ptr);
#undef free
    free(ptr);
#else
    size_t len = strlen(prefix) + 12; /* room for "/tmp/" and "XXXXXX\0" */

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 33 Column: 8 CWE codes: 362 

              #endif

#ifdef _WIN32
#undef open
#undef lseek
#undef stat
#undef fstat
#include <windows.h>
#include <share.h>

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 63 Column: 9 CWE codes: 362 

                  /* filename may be in CP_ACP */
    return _sopen(filename_utf8, oflag, SH_DENYNO, pmode);
}
#define open win32_open
#endif

int avpriv_open(const char *filename, int flags, ...)
{
    int fd;

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 84 Column: 10 CWE codes: 362 

                  flags |= O_NOINHERIT;
#endif

    fd = open(filename, flags, mode);
#if HAVE_FCNTL
    if (fd != -1) {
        if (fcntl(fd, F_SETFD, FD_CLOEXEC) == -1)
            av_log(NULL, AV_LOG_DEBUG, "Failed to set close on exec\n");
    }

Reported by FlawFinder.