The following issues were found

src/viewer/svutil.cpp
6 issues
execvp - This causes a new program to execute and is difficult to use safely
Security

Line: 113 Column: 5 CWE codes: 78
Suggestion: try using a library call that implements the same functionality if available

                    }
    }
    argv[argc] = nullptr;
    execvp(executable, argv.get());
  }
#  endif
}

SVSemaphore::SVSemaphore() {

            

Reported by FlawFinder.

snprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 265 Column: 3 CWE codes: 134
Suggestion: Use a constant for the format specification

                std::vector<char> cmd(cmdlen);
  const char *sv_path = scrollview_path.c_str();
#  ifdef _WIN32
  snprintf(&cmd[0], cmdlen, cmd_template, sv_path, sv_path);
#  else
  snprintf(&cmd[0], cmdlen, cmd_template, sv_path);
#  endif
  std::string command(&cmd[0]);
  return command;

            

Reported by FlawFinder.

snprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 267 Column: 3 CWE codes: 134
Suggestion: Use a constant for the format specification

              #  ifdef _WIN32
  snprintf(&cmd[0], cmdlen, cmd_template, sv_path, sv_path);
#  else
  snprintf(&cmd[0], cmdlen, cmd_template, sv_path);
#  endif
  std::string command(&cmd[0]);
  return command;
}


            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 122 Column: 30 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

              #  ifdef _WIN32
  semaphore_ = CreateSemaphore(0, 0, 10, 0);
#  elif defined(__APPLE__)
  auto name = std::to_string(random());
  sem_unlink(name.c_str());
  semaphore_ = sem_open(name.c_str(), O_CREAT, S_IWUSR, 0);
  if (semaphore_ == SEM_FAILED) {
    perror("sem_open");
  }

            

Reported by FlawFinder.

getenv - Environment variables are untrustable input if they can be set by an attacker. They can have any content and length, and the same variable can be set more than once
Security

Line: 306 Column: 35 CWE codes: 807 20
Suggestion: Check environment variables carefully before using them

                } else if (connect(stream_, addr_info->ai_addr, addr_info->ai_addrlen) < 0) {
    // If server is not there, we will start a new server as local child
    // process.
    const char *scrollview_path = getenv("SCROLLVIEW_PATH");
    if (scrollview_path == nullptr) {
#  ifdef SCROLLVIEW_PATH
#    define _STR(a) #    a
#    define _XSTR(a) _STR(a)
      scrollview_path = _XSTR(SCROLLVIEW_PATH);

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 97 Column: 40 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                      ++argc;
      }
    }
    std::unique_ptr<char *[]> argv(new char *[argc + 2]);
    std::string argv0(executable);
    argv[0] = &argv0[0];
    argv[1] = &mutable_args[0];
    argc = 2;
    bool inquote = false;

            

Reported by FlawFinder.

src/ccstruct/imagedata.cpp
6 issues
random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 513 Column: 9 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

              
// Shuffles all the pages in the document.
void DocumentData::Shuffle() {
  TRand random;
  // Different documents get shuffled differently, but the same for the same
  // name.
  random.set_seed(document_name_.c_str());
  int num_pages = pages_.size();
  // Execute one random swap for each page in the document.

            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 516 Column: 3 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

                TRand random;
  // Different documents get shuffled differently, but the same for the same
  // name.
  random.set_seed(document_name_.c_str());
  int num_pages = pages_.size();
  // Execute one random swap for each page in the document.
  for (int i = 0; i < num_pages; ++i) {
    int src = random.IntRand() % num_pages;
    int dest = random.IntRand() % num_pages;

            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 520 Column: 15 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

                int num_pages = pages_.size();
  // Execute one random swap for each page in the document.
  for (int i = 0; i < num_pages; ++i) {
    int src = random.IntRand() % num_pages;
    int dest = random.IntRand() % num_pages;
    std::swap(pages_[src], pages_[dest]);
  }
}


            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 521 Column: 16 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

                // Execute one random swap for each page in the document.
  for (int i = 0; i < num_pages; ++i) {
    int src = random.IntRand() % num_pages;
    int dest = random.IntRand() % num_pages;
    std::swap(pages_[src], pages_[dest]);
  }
}

// Locks the pages_mutex_ and Loads as many pages can fit in max_memory_

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 67 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                // Save the imagedata.
  // TODO: optimize resize (no init).
  image_data->image_data_.resize(imagedatasize);
  memcpy(&image_data->image_data_[0], imagedata, imagedatasize);
  if (!image_data->AddBoxes(box_text)) {
    if (truth_text == nullptr || truth_text[0] == '\0') {
      tprintf("Error: No text corresponding to page %d from image %s!\n", page_number, name);
      delete image_data;
      return nullptr;

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 340 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                pix.destroy();
  // TODO: optimize resize (no init).
  image_data->resize(size);
  memcpy(&(*image_data)[0], data, size);
  lept_free(data);
}

// Returns the Pix image for the image_data. Must be pixDestroyed after use.
Image ImageData::GetPixInternal(const std::vector<char> &image_data) {

            

Reported by FlawFinder.

unittest/normstrngs_test.cc
6 issues
syntax error
Error

Line: 31

              }
#endif

TEST(NormstrngsTest, BasicText) {
  const char *kBasicText = "AbCd Ef";
  std::string result;
  EXPECT_TRUE(NormalizeUTF8String(UnicodeNormMode::kNFKC, OCRNorm::kNormalize,
                                  GraphemeNorm::kNormalize, kBasicText, &result));
  EXPECT_STREQ(kBasicText, result.c_str());

            

Reported by Cppcheck.

syntax error
Error

Line: 39

                EXPECT_STREQ(kBasicText, result.c_str());
}

TEST(NormstrngsTest, LigatureText) {
  const char *kTwoByteLigText = "ij"; // U+0133 (ij) -> ij
  std::string result;
  EXPECT_TRUE(NormalizeUTF8String(UnicodeNormMode::kNFKC, OCRNorm::kNormalize,
                                  GraphemeNorm::kNormalize, kTwoByteLigText, &result));
  EXPECT_STREQ("ij", result.c_str());

            

Reported by Cppcheck.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 317 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                EXPECT_TRUE(IsWhitespace('\n'));
  // U+2000 through U+200A
  for (char32 ch = 0x2000; ch <= 0x200A; ++ch) {
    char text[80];
    snprintf(text, sizeof(text), "Failed at U+%x", ch);
    SCOPED_TRACE(text);
    EXPECT_TRUE(IsWhitespace(ch));
  }
  // U+3000 is whitespace

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 358 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                const int32_t kMinUnicodeValue = 33;
  const int32_t kMaxUnicodeValue = 0x10FFFF;
  for (int32_t ch = kMinUnicodeValue; ch <= kMaxUnicodeValue; ++ch) {
    char text[80];
    snprintf(text, sizeof(text), "Failed at U+%x", ch);
    SCOPED_TRACE(text);
    EXPECT_EQ(UniLib::IsInterchangeValid(ch), IsInterchangeValid(ch));
  }
#else

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 375 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                const int32_t kMinUnicodeValue = 33;
  const int32_t kMaxUnicodeValue = 0x10FFFF;
  for (int32_t ch = kMinUnicodeValue; ch <= kMaxUnicodeValue; ++ch) {
    char text[80];
    snprintf(text, sizeof(text), "Failed at U+%x", ch);
    SCOPED_TRACE(text);
    std::string str = EncodeAsUTF8(ch);
    EXPECT_EQ(UniLib::IsInterchangeValid7BitAscii(str), IsInterchangeValid7BitAscii(ch));
  }

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 404 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                for (int32_t ch = kMinUnicodeValue; ch <= kMaxUnicodeValue; ++ch) {
    if (!IsValidCodepoint(ch))
      continue;
    char text[80];
    snprintf(text, sizeof(text), "Failed at U+%x", ch);
    SCOPED_TRACE(text);
    std::string str = EncodeAsUTF8(ch);
    const std::string expected_half_str =
        UniLib::FullwidthToHalfwidth(str.c_str(), str.length(), true);

            

Reported by FlawFinder.

java/com/google/scrollview/ui/SVMenuItem.java
6 issues
Avoid using redundant field initializer for 'value'
Performance

Line: 32

               * wants to change it, but can just call the client with the new value.
 */
class SVMenuItem extends SVAbstractMenuItem {
  public String value = null;
  public String desc = null;

  SVMenuItem(int id, String name, String v, String d) {
    super(id, name, new JMenuItem(name));
    value = v;

            

Reported by PMD.

The field initializer for 'value' is never used (overwritten on line 37)
Design

Line: 32

               * wants to change it, but can just call the client with the new value.
 */
class SVMenuItem extends SVAbstractMenuItem {
  public String value = null;
  public String desc = null;

  SVMenuItem(int id, String name, String v, String d) {
    super(id, name, new JMenuItem(name));
    value = v;

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 32

               * wants to change it, but can just call the client with the new value.
 */
class SVMenuItem extends SVAbstractMenuItem {
  public String value = null;
  public String desc = null;

  SVMenuItem(int id, String name, String v, String d) {
    super(id, name, new JMenuItem(name));
    value = v;

            

Reported by PMD.

The field initializer for 'desc' is never used (overwritten on line 38)
Design

Line: 33

               */
class SVMenuItem extends SVAbstractMenuItem {
  public String value = null;
  public String desc = null;

  SVMenuItem(int id, String name, String v, String d) {
    super(id, name, new JMenuItem(name));
    value = v;
    desc = d;

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 33

               */
class SVMenuItem extends SVAbstractMenuItem {
  public String value = null;
  public String desc = null;

  SVMenuItem(int id, String name, String v, String d) {
    super(id, name, new JMenuItem(name));
    value = v;
    desc = d;

            

Reported by PMD.

Avoid using redundant field initializer for 'desc'
Performance

Line: 33

               */
class SVMenuItem extends SVAbstractMenuItem {
  public String value = null;
  public String desc = null;

  SVMenuItem(int id, String name, String v, String d) {
    super(id, name, new JMenuItem(name));
    value = v;
    desc = d;

            

Reported by PMD.

src/training/pango/stringrenderer.cpp
6 issues
snprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 862 Column: 7 CWE codes: 134
Suggestion: Use a constant for the format specification

                    ClearBoxes(); // Get rid of them as they are garbage.
      const int kMaxTitleLength = 1024;
      char title[kMaxTitleLength];
      snprintf(title, kMaxTitleLength, kTitleTemplate, all_fonts[i].c_str(), ok_chars,
               100.0 * ok_chars / total_chars_, raw_score, 100.0 * raw_score / char_map_.size());
      tprintf("%s\n", title);
      // This is a good font! Store the offset to return once we've tried all
      // the fonts.
      if (offset) {

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 88 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                int byte_stride = cairo_image_surface_get_stride(surface);

  for (int i = 0; i < height; ++i) {
    memcpy(reinterpret_cast<unsigned char *>(pix->data + i * pix->wpl) + 1,
           cairo_image_surface_get_data(surface) + i * byte_stride,
           byte_stride - ((i == height - 1) ? 1 : 0));
  }
  return pix;
}

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 861 Column: 7 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                    int offset = RenderToBinaryImage(text, text_length, 128, image);
      ClearBoxes(); // Get rid of them as they are garbage.
      const int kMaxTitleLength = 1024;
      char title[kMaxTitleLength];
      snprintf(title, kMaxTitleLength, kTitleTemplate, all_fonts[i].c_str(), ok_chars,
               100.0 * ok_chars / total_chars_, raw_score, 100.0 * raw_score / char_map_.size());
      tprintf("%s\n", title);
      // This is a good font! Store the offset to return once we've tried all
      // the fonts.

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 472 Column: 35 CWE codes: 126

                  tlog(3, "Added %d\n", cluster_start_indices.back());
  } while (pango_layout_iter_next_cluster(cluster_iter));
  pango_layout_iter_free(cluster_iter);
  cluster_start_indices.push_back(strlen(text));
  tlog(3, "Added last index %d\n", cluster_start_indices.back());
  // Sort the indices and create a map from start to end indices.
  std::sort(cluster_start_indices.begin(), cluster_start_indices.end());
  std::map<int, int> cluster_start_to_end_index;
  for (size_t i = 0; i + 1 < cluster_start_indices.size(); ++i) {

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 829 Column: 46 CWE codes: 126

                // Select a suitable font to render the title with.
  const char kTitleTemplate[] = "%s : %d hits = %.2f%%, raw = %d = %.2f%%";
  std::string title_font;
  if (!FontUtils::SelectFont(kTitleTemplate, strlen(kTitleTemplate), &title_font, nullptr)) {
    tprintf("WARNING: Could not find a font to render image title with!\n");
    title_font = "Arial";
  }
  title_font += " 8";
  tlog(1, "Selected title font: %s\n", title_font.c_str());

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 877 Column: 34 CWE codes: 126

                    set_font(title_font);
      v_margin_ /= 8;
      Image title_image = nullptr;
      RenderToBinaryImage(title, strlen(title), 128, &title_image);
      *image |= title_image;
      title_image.destroy();

      v_margin_ *= 8;
      set_font(orig_font);

            

Reported by FlawFinder.

src/ccutil/genericvector.h
5 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 203 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                // operator=() for each element like double_the_size() does.
  static T *double_the_size_memcpy(int current_size, T *data) {
    T *data_new = new T[current_size * 2];
    memcpy(data_new, data, sizeof(T) * current_size);
    delete[] data;
    return data_new;
  }

  // Reverses the elements of the vector.

            

Reported by FlawFinder.

fopen - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 287 Column: 14 CWE codes: 362

              // returning false on error.
inline bool LoadDataFromFile(const char *filename, GenericVector<char> *data) {
  bool result = false;
  FILE *fp = fopen(filename, "rb");
  if (fp != nullptr) {
    fseek(fp, 0, SEEK_END);
    auto size = std::ftell(fp);
    fseek(fp, 0, SEEK_SET);
    // Trying to open a directory on Linux sets size to LONG_MAX. Catch it here.

            

Reported by FlawFinder.

fopen - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 307 Column: 14 CWE codes: 362

              // The default FileWriter writes the vector of char to the filename file,
// returning false on error.
inline bool SaveDataToFile(const GenericVector<char> &data, const char *filename) {
  FILE *fp = fopen(filename, "wb");
  if (fp == nullptr) {
    return false;
  }
  bool result = static_cast<int>(fwrite(&data[0], 1, data.size(), fp)) == data.size();
  fclose(fp);

            

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 170 Column: 8 CWE codes: 120 20

                // Returns false on error or if the callback returns false.
  // DEPRECATED. Use [De]Serialize[Classes] instead.
  bool write(FILE *f, std::function<bool(FILE *, const T &)> cb) const;
  bool read(TFile *f, std::function<bool(TFile *, T *)> cb);
  // Writes a vector of simple types to the given file. Assumes that bitwise
  // read/write of T will work. Returns false in case of error.
  // TODO(rays) Change all callers to use TFile and remove deprecated methods.
  bool Serialize(FILE *fp) const;
  bool Serialize(TFile *fp) const;

            

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 744 Column: 24 CWE codes: 120 20

              }

template <typename T>
bool GenericVector<T>::read(TFile *f, std::function<bool(TFile *, T *)> cb) {
  int32_t reserved;
  if (f->FReadEndian(&reserved, sizeof(reserved), 1) != 1) {
    return false;
  }
  reserve(reserved);

            

Reported by FlawFinder.

src/training/pango/pango_font_info.cpp
5 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 130 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                  File::DeleteMatchingFiles(File::JoinPath(cache_dir_.c_str(), "*cache-?").c_str());
  }
  const int MAX_FONTCONF_FILESIZE = 1024;
  char fonts_conf_template[MAX_FONTCONF_FILESIZE];
  cache_dir_ = cache_dir;
  fonts_dir_ = fonts_dir;
  snprintf(fonts_conf_template, MAX_FONTCONF_FILESIZE,
           "<?xml version=\"1.0\"?>\n"
           "<!DOCTYPE fontconfig SYSTEM \"fonts.dtd\">\n"

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 229 Column: 7 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                    continue;
    }
    if (pango_coverage_get(coverage, *it) != PANGO_COVERAGE_EXACT) {
      char tmp[5];
      int len = it.get_utf8(tmp);
      tmp[len] = '\0';
      tlog(2, "'%s' (U+%x) not covered by font\n", tmp, *it);
      pango_coverage_unref(coverage);
      g_object_unref(font);

            

Reported by FlawFinder.

equal - Function does not check the second iterator for over-read conditions
Security

Line: 508 Column: 8 CWE codes: 126
Suggestion: This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it

              
  char *selected_desc_str = pango_font_description_to_string(selected_desc);
  tlog(2, "query_desc: '%s' Selected: '%s'\n", query_desc.c_str(), selected_desc_str);
  if (!equal && best_match != nullptr) {
    *best_match = selected_desc_str;
    // Clip the ending ' 0' if there is one. It seems that, if there is no
    // point size on the end of the fontname, then Pango always appends ' 0'.
    int len = best_match->size();
    if (len > 2 && best_match->at(len - 1) == '0' && best_match->at(len - 2) == ' ') {

            

Reported by FlawFinder.

equal - Function does not check the second iterator for over-read conditions
Security

Line: 521 Column: 8 CWE codes: 126
Suggestion: This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it

                pango_font_description_free(selected_desc);
  g_object_unref(selected_font);
  pango_font_description_free(desc);
  if (!equal)
    tlog(4, "** Font '%s' failed pango_font_description_equal!\n", input_query_desc);
  return equal;
}

static bool ShouldIgnoreFontFamilyName(const char *query) {

            

Reported by FlawFinder.

equal - Function does not check the second iterator for over-read conditions
Security

Line: 523 Column: 10 CWE codes: 126
Suggestion: This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it

                pango_font_description_free(desc);
  if (!equal)
    tlog(4, "** Font '%s' failed pango_font_description_equal!\n", input_query_desc);
  return equal;
}

static bool ShouldIgnoreFontFamilyName(const char *query) {
  static const char *kIgnoredFamilyNames[] = {"Sans", "Serif", "Monospace", nullptr};
  const char **list = kIgnoredFamilyNames;

            

Reported by FlawFinder.

src/wordrec/language_model.cpp
5 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 971 Column: 9 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                    if (modified_context == nullptr) {
        size_t context_len = strlen(context);
        modified_context = new char[context_len + strlen(unichar_ptr) + step + 1];
        memcpy(modified_context, context, context_len);
        modified_context_end = modified_context + context_len;
        context_ptr = modified_context;
      }
      strncpy(modified_context_end, unichar_ptr - step, step);
      modified_context_end += step;

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 950 Column: 43 CWE codes: 126

                char *modified_context = nullptr;
  char *modified_context_end = nullptr;
  const char *unichar_ptr = unichar;
  const char *unichar_end = unichar_ptr + strlen(unichar_ptr);
  float prob = 0.0f;
  int step = 0;
  while (unichar_ptr < unichar_end && (step = UNICHAR::utf8_step(unichar_ptr)) > 0) {
    if (language_model_debug_level > 1) {
      tprintf("prob(%s | %s)=%g\n", unichar_ptr, context_ptr,

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 969 Column: 30 CWE codes: 126

                  // unless use_only_first_uft8_step is true.
    if (unichar_ptr < unichar_end) {
      if (modified_context == nullptr) {
        size_t context_len = strlen(context);
        modified_context = new char[context_len + strlen(unichar_ptr) + step + 1];
        memcpy(modified_context, context, context_len);
        modified_context_end = modified_context + context_len;
        context_ptr = modified_context;
      }

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 970 Column: 51 CWE codes: 126

                  if (unichar_ptr < unichar_end) {
      if (modified_context == nullptr) {
        size_t context_len = strlen(context);
        modified_context = new char[context_len + strlen(unichar_ptr) + step + 1];
        memcpy(modified_context, context, context_len);
        modified_context_end = modified_context + context_len;
        context_ptr = modified_context;
      }
      strncpy(modified_context_end, unichar_ptr - step, step);

            

Reported by FlawFinder.

strncpy - Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned]
Security

Line: 975 Column: 7 CWE codes: 120

                      modified_context_end = modified_context + context_len;
        context_ptr = modified_context;
      }
      strncpy(modified_context_end, unichar_ptr - step, step);
      modified_context_end += step;
      *modified_context_end = '\0';
    }
  }
  prob /= static_cast<float>(*unichar_step_len); // normalize

            

Reported by FlawFinder.

src/ccstruct/ratngs.h
5 issues
There is an unknown macro here somewhere. Configuration is required. If ELISTIZEH is a macro then please configure it.
Error

Line: 224

              };

// Make BLOB_CHOICE listable.
ELISTIZEH(BLOB_CHOICE)

// Return the BLOB_CHOICE in bc_list matching a given unichar_id,
// or nullptr if there is no match.
BLOB_CHOICE *FindMatchingChoice(UNICHAR_ID char_id, BLOB_CHOICE_LIST *bc_list);


            

Reported by Cppcheck.

There is an unknown macro here somewhere. Configuration is required. If ELISTIZEH is a macro then please configure it.
Error

Line: 224

              };

// Make BLOB_CHOICE listable.
ELISTIZEH(BLOB_CHOICE)

// Return the BLOB_CHOICE in bc_list matching a given unichar_id,
// or nullptr if there is no match.
BLOB_CHOICE *FindMatchingChoice(UNICHAR_ID char_id, BLOB_CHOICE_LIST *bc_list);


            

Reported by Cppcheck.

There is an unknown macro here somewhere. Configuration is required. If ELISTIZEH is a macro then please configure it.
Error

Line: 224

              };

// Make BLOB_CHOICE listable.
ELISTIZEH(BLOB_CHOICE)

// Return the BLOB_CHOICE in bc_list matching a given unichar_id,
// or nullptr if there is no match.
BLOB_CHOICE *FindMatchingChoice(UNICHAR_ID char_id, BLOB_CHOICE_LIST *bc_list);


            

Reported by Cppcheck.

There is an unknown macro here somewhere. Configuration is required. If ELISTIZEH is a macro then please configure it.
Error

Line: 224

              };

// Make BLOB_CHOICE listable.
ELISTIZEH(BLOB_CHOICE)

// Return the BLOB_CHOICE in bc_list matching a given unichar_id,
// or nullptr if there is no match.
BLOB_CHOICE *FindMatchingChoice(UNICHAR_ID char_id, BLOB_CHOICE_LIST *bc_list);


            

Reported by Cppcheck.

There is an unknown macro here somewhere. Configuration is required. If ELISTIZEH is a macro then please configure it.
Error

Line: 224

              };

// Make BLOB_CHOICE listable.
ELISTIZEH(BLOB_CHOICE)

// Return the BLOB_CHOICE in bc_list matching a given unichar_id,
// or nullptr if there is no match.
BLOB_CHOICE *FindMatchingChoice(UNICHAR_ID char_id, BLOB_CHOICE_LIST *bc_list);


            

Reported by Cppcheck.

src/ccutil/unichar.cpp
5 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 57 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                    break; // Illegal surrogate
    }
  }
  memcpy(chars, utf8_str, total_len);
  if (total_len < UNICHAR_LEN) {
    chars[UNICHAR_LEN - 1] = total_len;
    while (total_len < UNICHAR_LEN - 1) {
      chars[total_len++] = 0;
    }

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 137 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              char *UNICHAR::utf8_str() const {
  int len = utf8_len();
  char *str = new char[len + 1];
  memcpy(str, chars, len);
  str[len] = 0;
  return str;
}

// Get the number of bytes in the first character of the given utf8 string.

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 144 Column: 16 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              
// Get the number of bytes in the first character of the given utf8 string.
int UNICHAR::utf8_step(const char *utf8_str) {
  static const char utf8_bytes[256] = {
      1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
      1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
      1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
      1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
      1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,

            

Reported by FlawFinder.

strncpy - Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned]
Security

Line: 191 Column: 3 CWE codes: 120

                  utf8_output[0] = ' ';
    return 1;
  }
  strncpy(utf8_output, it_, len);
  return len;
}

int UNICHAR::const_iterator::utf8_len() const {
  ASSERT_HOST(it_ != nullptr);

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 221 Column: 27 CWE codes: 126

              // Returns an empty vector if the input contains invalid UTF-8.
/* static */
std::vector<char32> UNICHAR::UTF8ToUTF32(const char *utf8_str) {
  const int utf8_length = strlen(utf8_str);
  std::vector<char32> unicodes;
  unicodes.reserve(utf8_length);
  const_iterator end_it(end(utf8_str, utf8_length));
  for (const_iterator it(begin(utf8_str, utf8_length)); it != end_it; ++it) {
    if (it.is_legal()) {

            

Reported by FlawFinder.