The following issues were found

UI/qt-wrappers.cpp
2 issues
vsnprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 43 Column: 2 CWE codes: 134
Suggestion: Use a constant for the format specification

              static inline void OBSErrorBoxva(QWidget *parent, const char *msg, va_list args)
{
	char full_message[4096];
	vsnprintf(full_message, 4095, msg, args);

	QMessageBox::critical(parent, "Error", full_message);
}

void OBSErrorBox(QWidget *parent, const char *msg, ...)

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 42 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              
static inline void OBSErrorBoxva(QWidget *parent, const char *msg, va_list args)
{
	char full_message[4096];
	vsnprintf(full_message, 4095, msg, args);

	QMessageBox::critical(parent, "Error", full_message);
}


            

Reported by FlawFinder.

libobs/util/bmem.h
2 issues
strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 83 Column: 24 CWE codes: 126

              	if (!str)
		return NULL;

	return bstrdup_n(str, strlen(str));
}

static inline wchar_t *bwstrdup(const wchar_t *str)
{
	if (!str)

            

Reported by FlawFinder.

wcslen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 91 Column: 25 CWE codes: 126

              	if (!str)
		return NULL;

	return bwstrdup_n(str, wcslen(str));
}

#ifdef __cplusplus
}
#endif

            

Reported by FlawFinder.

UI/win-update/win-update-helpers.cpp
2 issues
vsnprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 24 Column: 18 CWE codes: 134
Suggestion: Use a constant for the format specification

              		return std::string();

	std::string str;
	int size = (int)vsnprintf(nullptr, 0, format, args) + 1;
	str.resize(size);
	vsnprintf(&str[0], size, format, args);
	return str;
}


            

Reported by FlawFinder.

vsnprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 26 Column: 2 CWE codes: 134
Suggestion: Use a constant for the format specification

              	std::string str;
	int size = (int)vsnprintf(nullptr, 0, format, args) + 1;
	str.resize(size);
	vsnprintf(&str[0], size, format, args);
	return str;
}

std::string strprintf(const char *format, ...)
{

            

Reported by FlawFinder.

plugins/linux-capture/linux-capture.c
1 issues
There is an unknown macro here somewhere. Configuration is required. If OBS_DECLARE_MODULE is a macro then please configure it.
Error

Line: 24

              #include "pipewire-capture.h"
#endif

OBS_DECLARE_MODULE()
OBS_MODULE_USE_DEFAULT_LOCALE("linux-xshm", "en-US")
MODULE_EXPORT const char *obs_module_description(void)
{
#ifdef ENABLE_PIPEWIRE
	if (obs_get_nix_platform() != OBS_NIX_PLATFORM_X11_GLX)

            

Reported by Cppcheck.

UI/auth-youtube.cpp
1 issues
Returning pointer to local variable 'result' that will be invalid when returning.
Error

Line: 121 CWE codes: 562

              				return static_cast<char>(
					allowedChars[distr(randomSeed)]);
			});
	return result.c_str();
}

// Static.
std::shared_ptr<Auth> YoutubeAuth::Login(QWidget *owner,
					 const std::string &service)

            

Reported by Cppcheck.

UI/frontend-plugins/frontend-tools/captions-handler.hpp
1 issues
failed to expand 'CAPTIONS_ERROR_GENERIC_FAIL', Invalid ## usage when expanding 'captions_error'.
Error

Line: 28

              
typedef std::function<void(const std::string &)> captions_cb;

#define captions_error(s) std::string(obs_module_text("Captions.Error."##s))
#define CAPTIONS_ERROR_GENERIC_FAIL captions_error("GenericFail")

/* ------------------------------------------------------------------------- */

class captions_handler {

            

Reported by Cppcheck.

UI/frontend-plugins/frontend-tools/frontend-tools.c
1 issues
There is an unknown macro here somewhere. Configuration is required. If OBS_DECLARE_MODULE is a macro then please configure it.
Error

Line: 4

              #include <obs-module.h>
#include "frontend-tools-config.h"

OBS_DECLARE_MODULE()
OBS_MODULE_USE_DEFAULT_LOCALE("frontend-tools", "en-US")

void InitSceneSwitcher();
void FreeSceneSwitcher();


            

Reported by Cppcheck.

UI/importers/sl.cpp
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 472 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              {
	OBSImporterFiles res;
#ifdef _WIN32
	char dst[512];

	int found = os_get_config_path(dst, 512,
				       "slobs-client\\SceneCollections\\");
	if (found == -1)
		return res;

            

Reported by FlawFinder.

UI/importers/xsplit.cpp
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 513 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              {
	OBSImporterFiles res;
#ifdef _WIN32
	char dst[512];
	int found = os_get_program_data_path(
		dst, 512, "SplitMediaLabs\\XSplit\\Presentation2.0\\");

	if (found == -1)
		return res;

            

Reported by FlawFinder.

UI/obs-frontend-api/obs-frontend-api.cpp
1 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 48 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
	for (auto &str : strings) {
		*ptr_list = string_data;
		memcpy(string_data, str.c_str(), str.size() + 1);

		ptr_list++;
		string_data += str.size() + 1;
	}


            

Reported by FlawFinder.