The following issues were found

libavutil/wchar_filename.h
2 issues
MultiByteToWideChar - Requires maximum length in CHARACTERS, not bytes
Security

Line: 30 Column: 17 CWE codes: 120

              static inline int utf8towchar(const char *filename_utf8, wchar_t **filename_w)
{
    int num_chars;
    num_chars = MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS, filename_utf8, -1, NULL, 0);
    if (num_chars <= 0) {
        *filename_w = NULL;
        return 0;
    }
    *filename_w = (wchar_t *)av_mallocz_array(num_chars, sizeof(wchar_t));

            

Reported by FlawFinder.

MultiByteToWideChar - Requires maximum length in CHARACTERS, not bytes
Security

Line: 40 Column: 5 CWE codes: 120

                      errno = ENOMEM;
        return -1;
    }
    MultiByteToWideChar(CP_UTF8, 0, filename_utf8, -1, *filename_w, num_chars);
    return 0;
}
#endif

#endif /* AVUTIL_WCHAR_FILENAME_H */

            

Reported by FlawFinder.

libavcodec/qtrle.c
2 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 176 Column: 21 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                              }
                CHECK_PIXEL_PTR(rle_code * num_pixels);
                while (rle_code--) {
                    memcpy(&rgb[pixel_ptr], &pi, num_pixels);
                    pixel_ptr += num_pixels;
                }
            } else {
                /* copy the same pixel directly to output 4 times */
                rle_code *= 4;

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 546 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                      s->frame->palette_has_changed = ff_copy_palette(s->pal, avpkt, avctx);

        /* make the palette available on the way out */
        memcpy(s->frame->data[1], s->pal, AVPALETTE_SIZE);
    }

done:
    if (!s->frame->data[0])
        return AVERROR_INVALIDDATA;

            

Reported by FlawFinder.

libpostproc/postprocess_internal.h
2 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 179 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
static inline void linecpy(void *dest, const void *src, int lines, int stride) {
    if (stride > 0) {
        memcpy(dest, src, lines*stride);
    } else {
        memcpy((uint8_t*)dest+(lines-1)*stride, (const uint8_t*)src+(lines-1)*stride, -lines*stride);
    }
}


            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 181 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                  if (stride > 0) {
        memcpy(dest, src, lines*stride);
    } else {
        memcpy((uint8_t*)dest+(lines-1)*stride, (const uint8_t*)src+(lines-1)*stride, -lines*stride);
    }
}

#endif /* POSTPROC_POSTPROCESS_INTERNAL_H */

            

Reported by FlawFinder.

libswresample/x86/rematrix_init.c
2 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 85 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                      s->native_simd_one = av_mallocz(sizeof(float));
        if (!s->native_simd_matrix || !s->native_simd_one)
            return AVERROR(ENOMEM);
        memcpy(s->native_simd_matrix, s->native_matrix, num * sizeof(float));
        memcpy(s->native_simd_one, s->native_one, sizeof(float));
    }
#endif

    return 0;

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 86 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                      if (!s->native_simd_matrix || !s->native_simd_one)
            return AVERROR(ENOMEM);
        memcpy(s->native_simd_matrix, s->native_matrix, num * sizeof(float));
        memcpy(s->native_simd_one, s->native_one, sizeof(float));
    }
#endif

    return 0;
}

            

Reported by FlawFinder.

libavcodec/dstdec.c
2 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 271 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                      skip_bits1(gb);
        if (get_bits(gb, 6))
            return AVERROR_INVALIDDATA;
        memcpy(frame->data[0], avpkt->data + 1, FFMIN(avpkt->size - 1, frame->nb_samples * channels));
        goto dsd;
    }

    /* Segmentation (10.4, 10.5, 10.6) */


            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 301 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
    if (same_map) {
        s->probs.elements = s->fsets.elements;
        memcpy(map_ch_to_pelem, map_ch_to_felem, sizeof(map_ch_to_felem));
    } else {
        avpriv_request_sample(avctx, "Not Same Mapping");
        if ((ret = read_map(gb, &s->probs, map_ch_to_pelem, channels)) < 0)
            return ret;
    }

            

Reported by FlawFinder.

libavcodec/ralf.c
2 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 452 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
        src      = ctx->pkt;
        src_size = RALF_MAX_PKT_SIZE + avpkt->size;
        memcpy(ctx->pkt + RALF_MAX_PKT_SIZE, avpkt->data + 2 + table_bytes,
               avpkt->size - 2 - table_bytes);
    } else {
        if (avpkt->size == RALF_MAX_PKT_SIZE) {
            memcpy(ctx->pkt, avpkt->data, avpkt->size);
            ctx->has_pkt   = 1;

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 456 Column: 13 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                             avpkt->size - 2 - table_bytes);
    } else {
        if (avpkt->size == RALF_MAX_PKT_SIZE) {
            memcpy(ctx->pkt, avpkt->data, avpkt->size);
            ctx->has_pkt   = 1;
            *got_frame_ptr = 0;

            return avpkt->size;
        }

            

Reported by FlawFinder.

tests/api/api-h264-slice-test.c
2 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 62 Column: 9 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              
    while (ret >= 0) {
        const AVPixFmtDescriptor *desc;
        char sum[AV_HASH_MAX_SIZE * 2 + 1];
        struct AVHashContext *hash;

        ret = avcodec_receive_frame(dec_ctx, frame);
        if (ret == AVERROR(EAGAIN) || ret == AVERROR_EOF) {
            return 0;

            

Reported by FlawFinder.

fopen - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 184 Column: 18 CWE codes: 362

                      goto err;
    }

    if (!(file = fopen(argv[2], "rb"))) {
        fprintf(stderr, "Couldn't open NALU file: %s\n", argv[2]);
        ret = -1;
        goto err;
    }


            

Reported by FlawFinder.

tests/audiomatch.c
2 issues
fopen - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 53 Column: 12 CWE codes: 362

                      return 1;
    }

    f[0] = fopen(argv[1], "rb");
    f[1] = fopen(argv[2], "rb");
    if (!f[0] || !f[1]) {
        fprintf(stderr, "Could not open input files.\n");
        return 1;
    }

            

Reported by FlawFinder.

fopen - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 54 Column: 12 CWE codes: 362

                  }

    f[0] = fopen(argv[1], "rb");
    f[1] = fopen(argv[2], "rb");
    if (!f[0] || !f[1]) {
        fprintf(stderr, "Could not open input files.\n");
        return 1;
    }


            

Reported by FlawFinder.

libavcodec/rawdec.c
2 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 341 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
        buf = dst;
    } else if (need_copy) {
        memcpy(frame->buf[0]->data, buf, buf_size);
        buf = frame->buf[0]->data;
    }

    if (avctx->codec_tag == MKTAG('A', 'V', '1', 'x') ||
        avctx->codec_tag == MKTAG('A', 'V', 'u', 'p'))

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 386 Column: 17 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
            if (avpkt->size > vid_size && pal_size <= AVPALETTE_SIZE) {
                const uint8_t *pal = avpkt->data + vid_size;
                memcpy(context->palette->data, pal, pal_size);
                frame->palette_has_changed = 1;
            }
        }
    }


            

Reported by FlawFinder.

tests/checkasm/exrdsp.c
2 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 68 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
    memset(src,     0, PADDED_BUF_SIZE);
    randomize_buffers();
    memcpy(dst_ref, src, PADDED_BUF_SIZE);
    memcpy(dst_new, src, PADDED_BUF_SIZE);
    call_ref(dst_ref, BUF_SIZE);
    call_new(dst_new, BUF_SIZE);
    if (memcmp(dst_ref, dst_new, BUF_SIZE))
        fail();

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 69 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                  memset(src,     0, PADDED_BUF_SIZE);
    randomize_buffers();
    memcpy(dst_ref, src, PADDED_BUF_SIZE);
    memcpy(dst_new, src, PADDED_BUF_SIZE);
    call_ref(dst_ref, BUF_SIZE);
    call_new(dst_new, BUF_SIZE);
    if (memcmp(dst_ref, dst_new, BUF_SIZE))
        fail();
    bench_new(dst_new, BUF_SIZE);

            

Reported by FlawFinder.