The following issues were found

Userland/Services/WindowServer/AppletManager.cpp
1 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 23 Column: 40 CWE codes: 362 

              {
    s_the = this;

    auto wm_config = Core::ConfigFile::open("/etc/WindowServer.ini");
    auto order = wm_config->read_entry("Applet", "Order");
    order_vector = order.split(',');
}

AppletManager::~AppletManager()

Reported by FlawFinder.

Kernel/Devices/ZeroDevice.cpp
1 issues
read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 32 Column: 31 CWE codes: 120 20 

                  return true;
}

KResultOr<size_t> ZeroDevice::read(FileDescription&, u64, UserOrKernelBuffer& buffer, size_t size)
{
    if (!buffer.memset(0, size))
        return EFAULT;
    return size;
}

Reported by FlawFinder.

Userland/Utilities/test-fuzz.cpp
1 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 144 Column: 29 CWE codes: 362 

              
    auto fn = parse_target_name(type);

    auto file = Core::File::open(filename, Core::OpenMode::ReadOnly);
    if (file.is_error()) {
        warnln("Cannot read from file: {}", file.error());
        exit(1);
    }

Reported by FlawFinder.

Userland/Services/WindowServer/Compositor.cpp
1 issues
usleep - This C routine is considered obsolete (as opposed to the shell command by the same name). The interaction of this function with SIGALRM and other timer functions such as sleep(), alarm(), setitimer(), and nanosleep() is unspecified
Security

Line: 633 Column: 13 CWE codes: 676
Suggestion: Use nanosleep(2) or setitimer(2) instead 

                              bounding_flash.translate_by(-screen_rect.location());
                screen.flush_display_front_buffer((!screen_data.m_screen_can_set_buffer || !screen_data.m_buffers_are_flipped) ? 0 : 1, bounding_flash);
            }
            usleep(10000);
        }
    }

    if (device_can_flush_buffers && screen_data.m_screen_can_set_buffer) {
        if (!screen_data.m_has_flipped) {

Reported by FlawFinder.

Kernel/Devices/SerialDevice.h
1 issues
read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 23 Column: 31 CWE codes: 120 20 

              
    // ^CharacterDevice
    virtual bool can_read(const FileDescription&, size_t) const override;
    virtual KResultOr<size_t> read(FileDescription&, u64, UserOrKernelBuffer&, size_t) override;
    virtual bool can_write(const FileDescription&, size_t) const override;
    virtual KResultOr<size_t> write(FileDescription&, u64, const UserOrKernelBuffer&, size_t) override;

    void put_char(char);

Reported by FlawFinder.

Kernel/Devices/SerialDevice.cpp
1 issues
read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 57 Column: 33 CWE codes: 120 20 

                  return (get_line_status() & DataReady) != 0;
}

KResultOr<size_t> SerialDevice::read(FileDescription&, u64, UserOrKernelBuffer& buffer, size_t size)
{
    if (!size)
        return 0;

    ScopedSpinLock lock(m_serial_lock);

Reported by FlawFinder.

Userland/Services/WindowServer/Screen.cpp
1 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 227 Column: 24 CWE codes: 362 

              {
    close_device();
    auto& info = screen_layout_info();
    m_framebuffer_fd = open(info.device.characters(), O_RDWR | O_CLOEXEC);
    if (m_framebuffer_fd < 0) {
        perror(String::formatted("failed to open {}", info.device).characters());
        return false;
    }

Reported by FlawFinder.

Userland/Services/WindowServer/WindowManager.cpp
1 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 69 Column: 34 CWE codes: 362 

              
void WindowManager::reload_config()
{
    m_config = Core::ConfigFile::open("/etc/WindowServer.ini");

    unsigned virtual_desktop_rows = (unsigned)m_config->read_num_entry("VirtualDesktop", "Rows", default_window_stack_rows);
    unsigned virtual_desktop_columns = (unsigned)m_config->read_num_entry("VirtualDesktop", "Columns", default_window_stack_columns);
    if (virtual_desktop_rows == 0 || virtual_desktop_columns == 0 || virtual_desktop_rows > max_window_stack_rows || virtual_desktop_columns > max_window_stack_columns) {
        virtual_desktop_rows = default_window_stack_rows;

Reported by FlawFinder.

Kernel/Devices/SB16.h
1 issues
read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 31 Column: 31 CWE codes: 120 20 

              
    // ^CharacterDevice
    virtual bool can_read(const FileDescription&, size_t) const override;
    virtual KResultOr<size_t> read(FileDescription&, u64, UserOrKernelBuffer&, size_t) override;
    virtual KResultOr<size_t> write(FileDescription&, u64, const UserOrKernelBuffer&, size_t) override;
    virtual bool can_write(const FileDescription&, size_t) const override { return true; }

    virtual StringView purpose() const override { return class_name(); }

Reported by FlawFinder.

Userland/Services/WindowServer/main.cpp
1 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 59 Column: 40 CWE codes: 362 

                      return 1;
    }

    auto wm_config = Core::ConfigFile::open("/etc/WindowServer.ini");
    auto theme_name = wm_config->read_entry("Theme", "Name", "Default");

    auto theme = Gfx::load_system_theme(String::formatted("/res/themes/{}.ini", theme_name));
    VERIFY(theme.is_valid());
    Gfx::set_system_theme(theme);

Reported by FlawFinder.