The following issues were found

src/third_party/boost/boost/interprocess/sync/windows/named_sync.hpp
3 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 44 Column: 17 CWE codes: 362

                 virtual const void *buffer_with_final_data_to_file() = 0;
   virtual const void *buffer_with_init_data_to_file() = 0;
   virtual void *buffer_to_store_init_data_from_file() = 0;
   virtual bool open(create_enum_t creation_type, const char *id_name) = 0;
   virtual bool open(create_enum_t creation_type, const wchar_t *id_name) = 0;
   virtual void close() = 0;
   virtual ~windows_named_sync_interface() = 0;
};


            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 45 Column: 17 CWE codes: 362

                 virtual const void *buffer_with_init_data_to_file() = 0;
   virtual void *buffer_to_store_init_data_from_file() = 0;
   virtual bool open(create_enum_t creation_type, const char *id_name) = 0;
   virtual bool open(create_enum_t creation_type, const wchar_t *id_name) = 0;
   virtual void close() = 0;
   virtual ~windows_named_sync_interface() = 0;
};

inline windows_named_sync_interface::~windows_named_sync_interface()

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 172 Column: 44 CWE codes: 362

                                CharT unique_id_name[sizeof(unique_id_val)*2+1];
                  std::size_t name_suffix_length = sizeof(unique_id_name);
                  bytes_to_str(&unique_id_val, sizeof(unique_id_val), &unique_id_name[0], name_suffix_length);
                  success = sync_interface.open(creation_type, unique_id_name);
               }
            }

            //Obtain OS error in case something has failed
            err = system_error_code();

            

Reported by FlawFinder.

src/third_party/boost/boost/iostreams/detail/streambuf/indirect_streambuf.hpp
3 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 66 Column: 10 CWE codes: 362

              public:
    indirect_streambuf();

    void open(const T& t BOOST_IOSTREAMS_PUSH_PARAMS());
    bool is_open() const;
    void close();
    bool auto_close() const;
    void set_auto_close(bool close);
    bool strict_sync();

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 152 Column: 46 CWE codes: 362

              //--------------Implementation of open, is_open and close---------------------//

template<typename T, typename Tr, typename Alloc, typename Mode>
void indirect_streambuf<T, Tr, Alloc, Mode>::open
    (const T& t, std::streamsize buffer_size, std::streamsize pback_size)
{
    using namespace std;

    // Normalize buffer sizes.

            

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 256 Column: 15 CWE codes: 120 20

              
    // Read from source.
    std::streamsize chars =
        obj().read(buf.data() + pback_size_, buf.size() - pback_size_, next_);
    if (chars == -1) {
        this->set_true_eof(true);
        chars = 0;
    }
    setg(eback(), gptr(), buf.data() + pback_size_ + chars);

            

Reported by FlawFinder.

src/third_party/boost/libs/locale/src/encoding/conv.hpp
3 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 72 Column: 34 CWE codes: 362

              
                    typedef std::string string_type;
                    
                    virtual bool open(char const *to_charset,char const *from_charset,method_type how) = 0;
                    
                    virtual std::string convert(char const *begin,char const *end) = 0;
                    
                    virtual ~converter_between()
                    {

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 88 Column: 34 CWE codes: 362

              
                    typedef std::basic_string<char_type> string_type;
                    
                    virtual bool open(char const *charset,method_type how) = 0;
                    
                    virtual std::string convert(CharType const *begin,CharType const *end) = 0;
                    
                    virtual ~converter_from_utf()
                    {

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 104 Column: 34 CWE codes: 362

              
                    typedef std::basic_string<char_type> string_type;

                    virtual bool open(char const *charset,method_type how) = 0;

                    virtual string_type convert(char const *begin,char const *end) = 0;

                    virtual ~converter_to_utf()
                    {

            

Reported by FlawFinder.

src/third_party/mozjs-60/extract/js/src/irregexp/RegExpEngine.cpp
3 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 3282 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                      MOZ_ASSERT((ranges[i] & ~kMask) == base);
    MOZ_ASSERT(start_index == 0 || (ranges[start_index - 1] & ~kMask) <= base);

    char templ[kSize];
    jit::Label* on_bit_set;
    jit::Label* on_bit_clear;
    int bit;
    if (even_label == fall_through) {
        on_bit_set = odd_label;

            

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 543 Column: 69 CWE codes: 120 20

                  do {
        num_canonical = InsertRangeInCanonicalList(character_ranges,
                                                   num_canonical,
                                                   character_ranges[read]);
        read++;
    } while (read < n);

    while (character_ranges.length() > num_canonical)
        character_ranges.popBack();

            

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 545 Column: 14 CWE codes: 120 20

                                                                 num_canonical,
                                                   character_ranges[read]);
        read++;
    } while (read < n);

    while (character_ranges.length() > num_canonical)
        character_ranges.popBack();

    MOZ_ASSERT(CharacterRange::IsCanonical(character_ranges));

            

Reported by FlawFinder.

src/third_party/gperftools/dist/src/stacktrace_powerpc-linux-inl.h
3 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 185 Column: 11 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              #ifdef __PPC64__
      if (sigtramp64_vdso && (sigtramp64_vdso == current->return_addr)) {
        struct signal_frame_64 {
          char dummy[128];
          ucontext_t uc;
        // We don't care about the rest, since the IP value is at 'uc' field.
        } *sigframe = reinterpret_cast<signal_frame_64*>(current);
        result[n] = (void*) sigframe->uc.uc_mcontext.gp_regs[PT_NIP];
      }

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 194 Column: 11 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              #else
      if (sigtramp32_vdso && (sigtramp32_vdso == current->return_addr)) {
        struct signal_frame_32 {
          char dummy[64];
          struct sigcontext sctx;
          mcontext_t mctx;
          // We don't care about the rest, since IP value is at 'mctx' field.
        } *sigframe = reinterpret_cast<signal_frame_32*>(current);
        result[n] = (void*) sigframe->mctx.gregs[PT_NIP];

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 202 Column: 11 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                      result[n] = (void*) sigframe->mctx.gregs[PT_NIP];
      } else if (sigtramp32_rt_vdso && (sigtramp32_rt_vdso == current->return_addr)) {
        struct rt_signal_frame_32 {
          char dummy[64 + 16];
          siginfo_t info;
          ucontext_t uc;
          // We don't care about the rest, since IP value is at 'uc' field.A
        } *sigframe = reinterpret_cast<rt_signal_frame_32*>(current);
        result[n] = (void*) sigframe->uc.uc_mcontext.uc_regs->gregs[PT_NIP];

            

Reported by FlawFinder.

src/third_party/mozjs-60/extract/js/src/jit/shared/CodeGenerator-shared.cpp
3 issues
Shifting 32-bit value by 32 bits is undefined behaviour
Error

Line: 1835 CWE codes: 758

              
    // We now compute the least p >= 32 with the property above...
    int32_t p = 32;
    while ((uint64_t(1) << (p-maxLog)) + (UINT64_MAX >> (64-p)) % d + 1 < d)
        p++;

    // ...and the corresponding M. For either the signed (L=31) or the
    // unsigned (L=32) case, this value can be too large (cf. item a).
    // Codegen can still multiply by M by multiplying by (M - 2^L) and

            

Reported by Cppcheck.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 770 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                      return false;
    }

    memcpy(data, writer.buffer(), writer.length());
    nativeToBytecodeMap_ = data;
    nativeToBytecodeMapSize_ = writer.length();
    nativeToBytecodeTableOffset_ = tableOffset;
    nativeToBytecodeNumRegions_ = numRegions;


            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 924 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                  if (!data)
        return false;

    memcpy(data, writer.buffer(), writer.length());
    trackedOptimizationsMap_ = data;
    trackedOptimizationsMapSize_ = writer.length();
    trackedOptimizationsRegionTableOffset_ = regionTableOffset;
    trackedOptimizationsTypesTableOffset_ = typesTableOffset;
    trackedOptimizationsAttemptsTableOffset_ = attemptsTableOffset;

            

Reported by FlawFinder.

src/third_party/s2/s2testing.cc
2 issues
srandom - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 28 Column: 3 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

              #include "strings/strutil.h"

S2Testing::Random::Random() {
  srandom(4);
}

uint64 S2Testing::Random::Rand64() {
  int bits_of_rand = log2(1ULL + RAND_MAX);
  uint64 result = 0;

            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 37 Column: 15 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

                for (size_t num_bits = 0; num_bits < 8 * sizeof(uint64);
       num_bits += bits_of_rand) {
    result <<= bits_of_rand;
    result += random();
  }
  return result;
}

uint32 S2Testing::Random::Rand32() {

            

Reported by FlawFinder.

src/third_party/s2/strings/ascii_ctype.cc
2 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 50 Column: 7 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                0x05, 0x05, 0x05, 0x10, 0x10, 0x10, 0x10, 0x40,
};

const char kAsciiToLower[256] = {
   0,   1,   2,   3,   4,   5,   6,   7,   8,   9,  10,  11,  12,  13,  14,  15,
  16,  17,  18,  19,  20,  21,  22,  23,  24,  25,  26,  27,  28,  29,  30,  31,
  32,  33,  34,  35,  36,  37,  38,  39,  40,  41,  42,  43,  44,  45,  46,  47,
  48,  49,  50,  51,  52,  53,  54,  55,  56,  57,  58,  59,  60,  61,  62,  63,
  64, 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o',

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 69 Column: 7 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

               240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255
};

const char kAsciiToUpper[256] = {
   0,   1,   2,   3,   4,   5,   6,   7,   8,   9,  10,  11,  12,  13,  14,  15,
  16,  17,  18,  19,  20,  21,  22,  23,  24,  25,  26,  27,  28,  29,  30,  31,
  32,  33,  34,  35,  36,  37,  38,  39,  40,  41,  42,  43,  44,  45,  46,  47,
  48,  49,  50,  51,  52,  53,  54,  55,  56,  57,  58,  59,  60,  61,  62,  63,
  64,  65,  66,  67,  68,  69,  70,  71,  72,  73,  74,  75,  76,  77,  78,  79,

            

Reported by FlawFinder.

src/third_party/s2/strings/ascii_ctype.h
2 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 90 Column: 14 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              }
#undef kApb

extern const char kAsciiToLower[256];
static inline char ascii_tolower(unsigned char c) { return kAsciiToLower[c]; }
extern const char kAsciiToUpper[256];
static inline char ascii_toupper(unsigned char c) { return kAsciiToUpper[c]; }

#endif  // STRINGS_ASCII_CTYPE_H__

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 92 Column: 14 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              
extern const char kAsciiToLower[256];
static inline char ascii_tolower(unsigned char c) { return kAsciiToLower[c]; }
extern const char kAsciiToUpper[256];
static inline char ascii_toupper(unsigned char c) { return kAsciiToUpper[c]; }

#endif  // STRINGS_ASCII_CTYPE_H__

            

Reported by FlawFinder.

src/third_party/boost/boost/random/inversive_congruential.hpp
2 issues
random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 33 Column: 11 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

              #include <boost/random/detail/disable_warnings.hpp>

namespace boost {
namespace random {

// Eichenauer and Lehn 1986
/**
 * Instantiations of class template @c inversive_congruential_engine model a
 * \pseudo_random_number_generator. It uses the inversive congruential

            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 260 Column: 7 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

              
} // namespace random

using random::hellekalek1995;

} // namespace boost

#include <boost/random/detail/enable_warnings.hpp>


            

Reported by FlawFinder.