The following issues were found

Userland/Libraries/LibC/syslog.cpp
2 issues
syslog - If syslog's format strings can be influenced by an attacker, they can be exploited
Security

Line: 103 Column: 6 CWE codes: 134
Suggestion: Use a constant format string for syslog 

                  va_end(ap);
}

void syslog(int priority, const char* message, ...)
{
    va_list ap;
    va_start(ap, message);
    vsyslog_r(priority, &global_log_data, message, ap);
    va_end(ap);

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 34 Column: 8 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length 

              
// Used when ident is null, since syslog traditionally prints the program's
// own name; the process name will always be the same unless we exec.
static char program_name_buffer[256];
static bool program_name_set = false;

// Convenience function for initialization and checking what string to use
// for the program name.
static const char* get_syslog_ident(struct syslog_data* data)

Reported by FlawFinder.

Userland/Applications/SystemMonitor/ProcessModel.cpp
2 issues
Uninitialized struct member: state.cpu_percent_kernel
Error

Line: 380 CWE codes: 908 

                              auto pit = m_threads.find(thread.tid);
                VERIFY(pit != m_threads.end());
                (*pit).value->previous_state = (*pit).value->current_state;
                (*pit).value->current_state = state;

                live_tids.set(thread.tid);
            }
        }
    }

Reported by Cppcheck.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 28 Column: 15 CWE codes: 362 

                  s_the = this;

    auto file = Core::File::construct("/proc/cpuinfo");
    if (file->open(Core::OpenMode::ReadOnly)) {
        auto json = JsonValue::from_string({ file->read_all() });
        auto cpuinfo_array = json.value().as_array();
        cpuinfo_array.for_each([&](auto& value) {
            auto& cpu_object = value.as_object();
            auto cpu_id = cpu_object.get("processor").as_u32();

Reported by FlawFinder.

Kernel/FileSystem/FIFO.cpp
2 issues
read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 118 Column: 25 CWE codes: 120 20 

                  return m_buffer->space_for_writing() || !m_readers;
}

KResultOr<size_t> FIFO::read(FileDescription& fd, u64, UserOrKernelBuffer& buffer, size_t size)
{
    if (m_buffer->is_empty()) {
        if (!m_writers)
            return 0;
        if (m_writers && !fd.is_blocking())

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 126 Column: 22 CWE codes: 120 20 

                      if (m_writers && !fd.is_blocking())
            return EAGAIN;
    }
    return m_buffer->read(buffer, size);
}

KResultOr<size_t> FIFO::write(FileDescription& fd, u64, const UserOrKernelBuffer& buffer, size_t size)
{
    if (!m_readers) {

Reported by FlawFinder.

Userland/Libraries/LibC/sys/stat.h
2 issues
chmod - This accepts filename arguments; if an attacker can move those files, a race condition results.
Security

Line: 17 Column: 5 CWE codes: 362
Suggestion: Use fchmod( ) instead 

              __BEGIN_DECLS

mode_t umask(mode_t);
int chmod(const char* pathname, mode_t);
int fchmod(int fd, mode_t);
int mkdir(const char* pathname, mode_t);
int mkfifo(const char* pathname, mode_t);
int fstat(int fd, struct stat* statbuf);
int lstat(const char* path, struct stat* statbuf);

Reported by FlawFinder.

umask - Ensure that umask is given most restrictive possible setting (e.g., 066 or 077)
Security

Line: 16 Column: 8 CWE codes: 732 

              
__BEGIN_DECLS

mode_t umask(mode_t);
int chmod(const char* pathname, mode_t);
int fchmod(int fd, mode_t);
int mkdir(const char* pathname, mode_t);
int mkfifo(const char* pathname, mode_t);
int fstat(int fd, struct stat* statbuf);

Reported by FlawFinder.

Kernel/FileSystem/Ext2FileSystem.h
2 issues
chmod - This accepts filename arguments; if an attacker can move those files, a race condition results.
Security

Line: 55 Column: 21 CWE codes: 362
Suggestion: Use fchmod( ) instead 

                  virtual KResult set_mtime(time_t) override;
    virtual KResult increment_link_count() override;
    virtual KResult decrement_link_count() override;
    virtual KResult chmod(mode_t) override;
    virtual KResult chown(uid_t, gid_t) override;
    virtual KResult truncate(u64) override;
    virtual KResultOr<int> get_block_address(int) override;

    KResult write_directory(Vector<Ext2FSDirectoryEntry>&);

Reported by FlawFinder.

chown - This accepts filename arguments; if an attacker can move those files, a race condition results.
Security

Line: 56 Column: 21 CWE codes: 362
Suggestion: Use fchown( ) instead 

                  virtual KResult increment_link_count() override;
    virtual KResult decrement_link_count() override;
    virtual KResult chmod(mode_t) override;
    virtual KResult chown(uid_t, gid_t) override;
    virtual KResult truncate(u64) override;
    virtual KResultOr<int> get_block_address(int) override;

    KResult write_directory(Vector<Ext2FSDirectoryEntry>&);
    KResult populate_lookup_cache() const;

Reported by FlawFinder.

Kernel/Syscalls/futex.cpp
2 issues
Uninitialized variable: is_empty
Error

Line: 166 CWE codes: 908 

                                  return target_futex_queue.ptr();
                },
                params.val2, is_empty, is_target_empty);
            if (is_empty)
                remove_futex_queue(user_address);
            if (is_target_empty && target_futex_queue)
                remove_futex_queue(user_address2);
        }
        return woken_or_requeued;

Reported by Cppcheck.

Uninitialized variable: is_target_empty
Error

Line: 168 CWE codes: 908 

                              params.val2, is_empty, is_target_empty);
            if (is_empty)
                remove_futex_queue(user_address);
            if (is_target_empty && target_futex_queue)
                remove_futex_queue(user_address2);
        }
        return woken_or_requeued;
    };

Reported by Cppcheck.

Userland/Applications/SystemMonitor/GraphWidget.h
2 issues
There is an unknown macro here somewhere. Configuration is required. If C_OBJECT is a macro then please configure it.
Error

Line: 14 

              #include <LibGfx/SystemTheme.h>

class GraphWidget final : public GUI::Frame {
    C_OBJECT(GraphWidget)
public:
    virtual ~GraphWidget() override;

    void set_max(int max) { m_max = max; }
    int max() const { return m_max; }

Reported by Cppcheck.

There is an unknown macro here somewhere. Configuration is required. If C_OBJECT is a macro then please configure it.
Error

Line: 14 

              #include <LibGfx/SystemTheme.h>

class GraphWidget final : public GUI::Frame {
    C_OBJECT(GraphWidget)
public:
    virtual ~GraphWidget() override;

    void set_max(int max) { m_max = max; }
    int max() const { return m_max; }

Reported by Cppcheck.

Userland/Applications/Spreadsheet/Workbook.cpp
2 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 48 Column: 38 CWE codes: 362 

              
Result<bool, String> Workbook::load(const StringView& filename)
{
    auto file_or_error = Core::File::open(filename, Core::OpenMode::ReadOnly);
    if (file_or_error.is_error()) {
        StringBuilder sb;
        sb.append("Failed to open ");
        sb.append(filename);
        sb.append(" for reading. Error: ");

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 77 Column: 11 CWE codes: 362 

              {
    auto mime = Core::guess_mime_type_based_on_filename(filename);
    auto file = Core::File::construct(filename);
    file->open(Core::OpenMode::WriteOnly);
    if (!file->is_open()) {
        StringBuilder sb;
        sb.append("Failed to open ");
        sb.append(filename);
        sb.append(" for write. Error: ");

Reported by FlawFinder.

Userland/Libraries/LibC/sys/mman.cpp
2 issues
strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 18 Column: 112 CWE codes: 126 

              
void* serenity_mmap(void* addr, size_t size, int prot, int flags, int fd, off_t offset, size_t alignment, const char* name)
{
    Syscall::SC_mmap_params params { (uintptr_t)addr, size, alignment, prot, flags, fd, offset, { name, name ? strlen(name) : 0 } };
    ptrdiff_t rc = syscall(SC_mmap, &params);
    if (rc < 0 && rc > -EMAXERRNO) {
        errno = -rc;
        return MAP_FAILED;
    }

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 66 Column: 67 CWE codes: 126 

                      errno = EFAULT;
        return -1;
    }
    Syscall::SC_set_mmap_name_params params { addr, size, { name, strlen(name) } };
    int rc = syscall(SC_set_mmap_name, &params);
    __RETURN_WITH_ERRNO(rc, rc, -1);
}

int madvise(void* address, size_t size, int advice)

Reported by FlawFinder.

Kernel/FileSystem/DevPtsFS.h
2 issues
chmod - This accepts filename arguments; if an attacker can move those files, a race condition results.
Security

Line: 59 Column: 21 CWE codes: 362
Suggestion: Use fchmod( ) instead 

                  virtual KResultOr<NonnullRefPtr<Inode>> create_child(StringView name, mode_t, dev_t, uid_t, gid_t) override;
    virtual KResult add_child(Inode&, const StringView& name, mode_t) override;
    virtual KResult remove_child(const StringView& name) override;
    virtual KResult chmod(mode_t) override;
    virtual KResult chown(uid_t, gid_t) override;

    WeakPtr<SlavePTY> m_pty;
    InodeMetadata m_metadata;
};

Reported by FlawFinder.

chown - This accepts filename arguments; if an attacker can move those files, a race condition results.
Security

Line: 60 Column: 21 CWE codes: 362
Suggestion: Use fchown( ) instead 

                  virtual KResult add_child(Inode&, const StringView& name, mode_t) override;
    virtual KResult remove_child(const StringView& name) override;
    virtual KResult chmod(mode_t) override;
    virtual KResult chown(uid_t, gid_t) override;

    WeakPtr<SlavePTY> m_pty;
    InodeMetadata m_metadata;
};

Reported by FlawFinder.