The following issues were found
libavcodec/libmp3lame.c
1 issues
Line: 270
Column: 9
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
if (len <= s->buffer_index) {
if ((ret = ff_get_encode_buffer(avctx, avpkt, len, 0)) < 0)
return ret;
memcpy(avpkt->data, s->buffer, len);
s->buffer_index -= len;
memmove(s->buffer, s->buffer + len, s->buffer_index);
/* Get the next frame pts/duration */
ff_af_queue_remove(&s->afq, avctx->frame_size, &avpkt->pts,
Reported by FlawFinder.
libavcodec/libopenjpegdec.c
1 issues
Line: 117
Column: 5
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
if (nb_bytes > remaining) {
nb_bytes = remaining;
}
memcpy(out_buffer, reader->buffer + reader->pos, nb_bytes);
reader->pos += (int)nb_bytes;
return nb_bytes;
}
static OPJ_OFF_T stream_skip(OPJ_OFF_T nb_bytes, void *user_data)
Reported by FlawFinder.
libavcodec/libopenjpegenc.c
1 issues
Line: 84
Column: 5
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
return (OPJ_SIZE_T)-1;
}
}
memcpy(packet->data + writer->pos, out_buffer, nb_bytes);
writer->pos += (int)nb_bytes;
return nb_bytes;
}
static OPJ_OFF_T stream_skip(OPJ_OFF_T nb_bytes, void *user_data)
Reported by FlawFinder.
libavcodec/libspeexenc.c
1 issues
Line: 258
Column: 5
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
}
/* copy header packet to extradata */
memcpy(avctx->extradata, header_data, header_size);
avctx->extradata_size = header_size;
speex_header_free(header_data);
/* init libspeex bitwriter */
speex_bits_init(&s->bits);
Reported by FlawFinder.
libavcodec/libvo-amrwbenc.c
1 issues
Line: 61
Column: 5
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
static const int rates[] = { 6600, 8850, 12650, 14250, 15850, 18250,
19850, 23050, 23850 };
int i, best = -1, min_diff = 0;
char log_buf[200];
for (i = 0; i < 9; i++) {
if (rates[i] == bitrate)
return i;
if (best < 0 || abs(rates[i] - bitrate) < min_diff) {
Reported by FlawFinder.
libavcodec/libvorbisdec.c
1 issues
Line: 41
Column: 14
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
OggVorbisDecContext *context = avccontext->priv_data ;
uint8_t *p= avccontext->extradata;
int i, hsizes[3], ret;
unsigned char *headers[3], *extradata = avccontext->extradata;
if(! avccontext->extradata_size || ! p) {
av_log(avccontext, AV_LOG_ERROR, "vorbis extradata absent\n");
return AVERROR(EINVAL);
}
Reported by FlawFinder.
libavcodec/libwebpenc.c
1 issues
Line: 64
Column: 5
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
ret = ff_get_encode_buffer(avctx, pkt, mw.size, 0);
if (ret < 0)
goto end;
memcpy(pkt->data, mw.mem, mw.size);
pkt->flags |= AV_PKT_FLAG_KEY;
*got_packet = 1;
end:
Reported by FlawFinder.
libavcodec/libwebpenc_animencoder.c
1 issues
Line: 74
Column: 17
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
ret = ff_get_encode_buffer(avctx, pkt, assembled_data.size, 0);
if (ret < 0)
return ret;
memcpy(pkt->data, assembled_data.bytes, assembled_data.size);
s->done = 1;
pkt->flags |= AV_PKT_FLAG_KEY;
pkt->pts = pkt->dts = s->first_frame_pts;
*got_packet = 1;
return 0;
Reported by FlawFinder.
libavcodec/libwebpenc_common.c
1 issues
Line: 229
Column: 37
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
int xs = x >> !!p;
int ys = y >> !!p;
for (y2 = ys; y2 < FFMIN(ys + bs2, h); y2++) {
memcpy(&s->ref->data[p][frame->linesize[p] * y2 + xs],
& frame->data[p][frame->linesize[p] * y2 + xs], FFMIN(bs2, w-xs));
}
}
for (y2 = y; y2 < FFMIN(y+bs, frame->height); y2++) {
memset(&frame->data[3][frame->linesize[3] * y2 + x],
Reported by FlawFinder.
libavcodec/libxavs.c
1 issues
Line: 106
Column: 9
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
/* Write the SEI as part of the first frame. */
if (x4->sei_size > 0 && nnal > 0) {
memcpy(p, x4->sei, x4->sei_size);
p += x4->sei_size;
x4->sei_size = 0;
}
for (i = 0; i < nnal; i++) {
Reported by FlawFinder.