The following issues were found

src/third_party/boost/boost/random/extreme_value_distribution.hpp
1 issues
random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 25 Column: 11 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

              #include <boost/random/uniform_01.hpp>

namespace boost {
namespace random {

/**
 * The extreme value distribution is a real valued distribution with two
 * parameters a and b.
 *

            

Reported by FlawFinder.

src/third_party/boost/boost/random/discrete_distribution.hpp
1 issues
random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 38 Column: 11 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

              #include <boost/random/detail/disable_warnings.hpp>

namespace boost {
namespace random {
namespace detail {

template<class IntType, class WeightType>
struct integer_alias_table {
    WeightType get_weight(IntType bin) const {

            

Reported by FlawFinder.

src/third_party/icu4c-57.1/source/common/umutex.cpp
1 issues
InitializeCriticalSection - Exceptions can be thrown in low-memory situations
Security

Line: 107 Column: 5 CWE codes:
Suggestion: Use InitializeCriticalSectionAndSpinCount instead

              U_NAMESPACE_END

static void winMutexInit(CRITICAL_SECTION *cs) {
    InitializeCriticalSection(cs);
    return;
}

U_CAPI void  U_EXPORT2
umtx_lock(UMutex *mutex) {

            

Reported by FlawFinder.

src/third_party/boost/boost/random/discard_block.hpp
1 issues
random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 31 Column: 11 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

              

namespace boost {
namespace random {

/**
 * The class template \discard_block_engine is a model of
 * \pseudo_random_number_generator.  It modifies
 * another generator by discarding parts of its output.

            

Reported by FlawFinder.

src/third_party/icu4c-57.1/source/common/unicode/simpleformatter.h
1 issues
syntax error
Error

Line: 69

                   *                  Set to U_ILLEGAL_ARGUMENT_ERROR for bad argument syntax.
     * @draft ICU 57
     */
    SimpleFormatter(const UnicodeString& pattern, UErrorCode &errorCode) {
        applyPattern(pattern, errorCode);
    }

    /**
     * Constructs a formatter from the pattern string.

            

Reported by Cppcheck.

src/third_party/icu4c-57.1/source/common/unicode/strenum.h
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 219 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                   * char * default buffer for use with default implementations and subclasses.
     * @stable ICU 2.8
     */
    char charsBuffer[32];
    /**
     * char * buffer for use with default implementations and subclasses.
     * Allocated in constructor and in ensureCharsCapacity().
     * @stable ICU 2.8
     */

            

Reported by FlawFinder.

src/third_party/icu4c-57.1/source/common/unicode/udata.h
1 issues
access - This usually indicates a security flaw. If an attacker can change anything along the path between the call to access() and the file's actual use (e.g., by moving files), the attacker can exploit the race condition
Security

Line: 426 Column: 37 CWE codes: 362/367!
Suggestion: Set up the correct permissions (e.g., using setuid()) and try to open the file directly

               * @stable ICU 3.4 
 */
U_STABLE void U_EXPORT2
udata_setFileAccess(UDataFileAccess access, UErrorCode *status);

U_CDECL_END

#endif

            

Reported by FlawFinder.

src/third_party/icu4c-57.1/source/common/unicode/utext.h
1 issues
access - This usually indicates a security flaw. If an attacker can change anything along the path between the call to access() and the file's actual use (e.g., by moving files), the attacker can exploit the race condition
Security

Line: 1257 Column: 18 CWE codes: 362/367!
Suggestion: Set up the correct permissions (e.g., using setuid()) and try to open the file directly

                   * @see UTextAccess
     * @stable ICU 3.6
     */
    UTextAccess *access;

    /**
     * (public) Function pointer for UTextExtract.
     *
     * @see UTextExtract

            

Reported by FlawFinder.

src/third_party/icu4c-57.1/source/common/unifiedcache.cpp
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 186 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              void UnifiedCache::_dumpContents() const {
    int32_t pos = UHASH_FIRST;
    const UHashElement *element = uhash_nextElement(fHashtable, &pos);
    char buffer[256];
    int32_t cnt = 0;
    for (; element != NULL; element = uhash_nextElement(fHashtable, &pos)) {
        const SharedObject *sharedObject =
                (const SharedObject *) element->value.pointer;
        const CacheKeyBase *key =

            

Reported by FlawFinder.

src/third_party/icu4c-57.1/source/common/unistr.cpp
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 946 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              UnicodeString::toUTF8(ByteSink &sink) const {
  int32_t length16 = length();
  if(length16 != 0) {
    char stackBuffer[1024];
    int32_t capacity = (int32_t)sizeof(stackBuffer);
    UBool utf8IsOwned = FALSE;
    char *utf8 = sink.GetAppendBuffer(length16 < capacity ? length16 : capacity,
                                      3*length16,
                                      stackBuffer, capacity,

            

Reported by FlawFinder.