The following issues were found

Userland/Libraries/LibAudio/WavLoader.cpp
1 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 23 Column: 18 CWE codes: 362

              WavLoaderPlugin::WavLoaderPlugin(const StringView& path)
    : m_file(Core::File::construct(path))
{
    if (!m_file->open(Core::OpenMode::ReadOnly)) {
        m_error_string = String::formatted("Can't open file: {}", m_file->error_string());
        return;
    }
    m_stream = make<Core::InputFileStream>(*m_file);


            

Reported by FlawFinder.

Userland/Libraries/LibAudio/WavWriter.cpp
1 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 35 Column: 18 CWE codes: 362

              void WavWriter::set_file(const StringView& path)
{
    m_file = Core::File::construct(path);
    if (!m_file->open(Core::OpenMode::ReadWrite)) {
        m_error_string = String::formatted("Can't open file: {}", m_file->error_string());
        return;
    }
    m_file->seek(44);
    m_finalized = false;

            

Reported by FlawFinder.

Userland/Libraries/LibC/arpa/inet.cpp
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 72 Column: 12 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              
char* inet_ntoa(struct in_addr in)
{
    static char buffer[32];
    inet_ntop(AF_INET, &in.s_addr, buffer, sizeof(buffer));
    return buffer;
}
}

            

Reported by FlawFinder.

Kernel/ConsoleDevice.cpp
1 issues
read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 49 Column: 42 CWE codes: 120 20

                  return false;
}

Kernel::KResultOr<size_t> ConsoleDevice::read(FileDescription&, u64, Kernel::UserOrKernelBuffer&, size_t)
{
    // FIXME: Implement reading from the console.
    //        Maybe we could use a ring buffer for this device?
    return 0;
}

            

Reported by FlawFinder.

Userland/Libraries/LibC/ctype.cpp
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 11 Column: 7 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              
extern "C" {

const char _ctype_[256] = {
    _C, _C, _C, _C, _C, _C, _C, _C,
    _C, _C | _S, _C | _S, _C | _S, _C | _S, _C | _S, _C, _C,
    _C, _C, _C, _C, _C, _C, _C, _C,
    _C, _C, _C, _C, _C, _C, _C, _C,
    (char)(_S | _B), _P, _P, _P, _P, _P, _P, _P,

            

Reported by FlawFinder.

Userland/Libraries/LibC/ctype.h
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 23 Column: 14 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              #define _X 0100
#define _B 0200

extern const char _ctype_[256];

static inline int __inline_isalnum(int c)
{
    return _ctype_[(unsigned char)(c)] & (_U | _L | _N);
}

            

Reported by FlawFinder.

Userland/Applications/KeyboardMapper/KeyboardMapperWidget.cpp
1 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 194 Column: 11 CWE codes: 362

                  String file_content = map_json.to_string();

    auto file = Core::File::construct(filename);
    file->open(Core::OpenMode::WriteOnly);
    if (!file->is_open()) {
        StringBuilder sb;
        sb.append("Failed to open ");
        sb.append(filename);
        sb.append(" for write. Error: ");

            

Reported by FlawFinder.

Userland/Libraries/LibC/dirent.h
1 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 18 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                  off_t d_off;
    unsigned short d_reclen;
    unsigned char d_type;
    char d_name[256];
};

struct __DIR {
    int fd;
    struct dirent cur_ent;

            

Reported by FlawFinder.

Userland/Utilities/ifconfig.cpp
1 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 42 Column: 20 CWE codes: 362

                  if (!value_ipv4 && !value_adapter && !value_gateway && !value_mask) {

        auto file = Core::File::construct("/proc/net/adapters");
        if (!file->open(Core::OpenMode::ReadOnly)) {
            outln("Failed to open {}: {}", file->name(), file->error_string());
            return 1;
        }

        auto file_contents = file->read_all();

            

Reported by FlawFinder.

Userland/Applications/HexEditor/HexEditorWidget.cpp
1 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 343 Column: 16 CWE codes: 362

              void HexEditorWidget::open_file(const String& path)
{
    auto file = Core::File::construct(path);
    if (!file->open(Core::OpenMode::ReadOnly)) {
        GUI::MessageBox::show(window(), String::formatted("Opening \"{}\" failed: {}", path, strerror(errno)), "Error", GUI::MessageBox::Type::Error);
        return;
    }

    m_document_dirty = false;

            

Reported by FlawFinder.