From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 583D44B574 for ; Sat, 8 Jun 2024 16:01:53 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id B471A68D686; Sat, 8 Jun 2024 19:01:51 +0300 (EEST) Received: from relay2-d.mail.gandi.net (relay2-d.mail.gandi.net [217.70.183.194]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 564FE68D686 for ; Sat, 8 Jun 2024 19:01:45 +0300 (EEST) Received: by mail.gandi.net (Postfix) with ESMTPSA id 7178D40003 for ; Sat, 8 Jun 2024 16:01:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1717862504; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=m4CYP2w5vtkULx8FsGplM7v/vJ6FiblYiK3wlNuDn28=; b=SVFhQhDjCjEaRvDIwsXFlSH+Oz5teQBXY/RnT+QmkwH3yQ/sEbN8az9N+iOpIRIL61MF3X LRgGwsR1cEQQxs6wWFDv2QLYb/L+yqDhG/ebpmeR+T6WtWKh5ON206mfg3NUA3vKJb9Bag AH8f79m3E16rBi4FEzFE2c9vQgGfXHgOc4q4bm0egbXLH7xKdqBDrF6An+XOIf9mLscA6l BYThLkybhE8l+LHakftuKD9KUfzsvAtBPj2CIpAcNbJBcOWhpFV1HXs6Bhbph5NWnZuVr5 nXoNklbMCn5MrgYiGeKh1ZbRjW4nOtK519a41h1qE1ZyhsapD/zDiEmW00wveg== Date: Sat, 8 Jun 2024 18:01:43 +0200 From: Michael Niedermayer To: FFmpeg development discussions and patches Message-ID: <20240608160143.GW2821752@pb2> References: <20240513233816.GL6420@pb2> MIME-Version: 1.0 In-Reply-To: <20240513233816.GL6420@pb2> X-GND-Sasl: michael@niedermayer.cc Subject: Re: [FFmpeg-devel] [WIP] False positives on Coverity X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: multipart/mixed; boundary="===============4145908698662052642==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============4145908698662052642== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="/yruk2jJK3ChhVTO" Content-Disposition: inline --/yruk2jJK3ChhVTO Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, May 14, 2024 at 01:38:16AM +0200, Michael Niedermayer wrote: > Hi all >=20 > To keep people updated (and as this is not vissible on the ML) > heres my current list of issues marked as false positives / intentional i= n Mai & April 2024 > (in case anyone wants to review, i presume noone wants but just in case) updated list as of today: 1409917 Unintentional integer overflow No overflow happens as dimensions = and sprite accuracy are too limited 1409920 Unintentional integer overflow The involved variables are too res= tricted for overflow 1416963 Unintentional integer overflow No overflow happens as bytes of an= image are addressible by int 1417663 Uninitialized scalar variable par_m_source is 0..3 and mid is in= itialized 1419522 Unintentional integer overflow No overflow can happen, the values= are too restricted 1419833 Untrusted loop bound The loop bound is limited to 65535 I also submit a patch to check the 2nd case better 1500345 Uninitialized scalar variable Not a bugf strictly but bad practi= ce and fix submitted 1503083 Uninitialized pointer read nb_channels is non negative, coverity = assumes it could be negative 1452594 Free of array-typed value passed flags are 0 but assumed by cove= rity to be non 0 1452451 Use after free coverity assumes FLAGS has values it d= oes not 1452474 Use after free coverity assumes FLAGS has values it d= oes not 1452532 Use after free coverity assumes FLAGS has values it d= oes not 1524728 Free of array-typed value coverity assumes 0 (flags) is not 0 1591440 Free of array-typed value coverity assumes 0 (flags) is not 0 1452617 Free of array-typed value coverity assumes AV_DICT_DONT_STRDUP_= KEY but that is not set 1520670 Dereference after null check either frame or pkt is NULL 1524701 Free of array-typed value coverity assumes flags to be non 0 wh= ile it is 0 1538859 Dereference after null check frame is always non-NULL for audio an= d video 1596536 Dereference null return value There should be a descriptor for eve= ry type that is used 1518989 Missing break in switch no break is intentional 1559177 Resource leak av_fifo_write() either succeeds or the= frame is freed 1559181 Resource leak av_fifo_write() either succeeds or the= frame is freed 1596530 Free of array-typed value coverity assumes flags to be non 0 whi= le it is 0 1516444 Free of array-typed value coverity assumes flags to be non 0 whi= le it is 0 1524729 Free of array-typed value coverity assumes flags to be non 0 whi= le it is 0 1596628 Free of array-typed value coverity assumes flags to be non 0 whi= le it is 0 1452412 Free of array-typed value coverity assumes flags to be non 0 whi= le it is 0 1452415 Free of array-typed value coverity assumes flags to be non 0 whi= le it is 0 1452551 Free of array-typed value coverity assumes flags to be a value i= t is not 1559186 Resource leak The value is stored by av_fifo_write(= ) and thus not lost 1452419 Free of array-typed value coverity assumes flags to be non 0 whi= le it is 0 1452457 Missing break in switch this looks intentional 1500328 Resource leak packet_queue_put_private() either stor= es pkt1 or it fails and its freed 1452606 Free of array-typed value coverity assumes AV_DICT_DONT_STRDUP_V= AL is set while it is not 1551681 Data race condition The mutex is in the caller 1475938 Uninitialized array index read all of dither seems to be intiial= ized 1465483 Unintentional integer overflow the clip limits len 1473539 Explicit null dereferenced new_rematrixing_strategy is always set = for block 0 1596532 Copy of overlapping memory num_blocks ia positive so the loop does= at least one iteration 1500322 Out-of-bounds read the mode is simply not possible 1473499 Uninitialized scalar variable the default case seems unreachable 1595709 Uninitialized scalar variable num_uv_points cannot be set when pre= dict_uv_scaling is uninitialized 1595705 Uninitialized scalar variable the parts of scaling used and initia= lized 1595706 Uninitialized scalar variable the parts of scaling used and initia= lized 1595707 Unintended sign extension the array is not gb sized, the shift is = not nearly that large 1467648 Untrusted loop bound loop bound is 16bit and thus bound by 65535, = its also bound by the data length 1504415 Untrusted value as argument av_grow_packet() will allocate a buffe= r matching the value or it will fail 1545117 Division or modulo by zero coverity assumes the loop never execut= es but thats not currently possible 1473510 Untrusted loop bound the read values are checked when they are re= ad 1507875 Untrusted array index read seq_parameter_set_id is checked when re= ad (also coverity seems to have alot of problems with the multiple layers o= f macros and functions in the CBS system) 1452623 Free of address-of expression coverity fails to keep track of data= _ref/data_buf 1458177 Free of address-of expression coverity assumes data_ref is NULL 1465491 Unintentional integer overflow 8 is smaller than 32 1465864 Out-of-bounds read coverity assumes planes can be more than 4 1543204 Logically dead code Lynne preferres to keep this code 1500292 Unintentional integer overflow the error is too small for an overf= low to happen 1443722 Unintentional integer overflow image dimensions do not overflow 32= bit 1467656 Out-of-bounds access There is enough space allocated for what is a= ccessed 1427586 Out-of-bounds read coverity assumes (x&511) >=3D 512 1465486 Unintentional integer overflow 16bit + 8bit doesnt need 64bit 1496852 Macro compares unsigned to 0 macro tests the valid range, one side= is 0 1596606 Unintentional integer overflow valid width * height must fit in int 1452461 Free of array-typed value coverity 0 !=3D 0 flags issue 1473505 Untrusted loop bound The loop is checking the upper bound 1466634 Missing break in switch fallthrough initializes [0] 1516445 Out-of-bounds read a j=3D0; j<1; j++ loops does not execute twice 1473591 Untrusted loop bound The loop checks if more data remains 1496615 Explicit null dereferenced code is not reachable with frame =3D NU= LL 1532404 Untrusted loop bound the loop tests if data is remaining 1452436 Free of array-typed value 0 is really 0 1485002 Unintentional integer overflow dc_w and dc_h (xsize * ysize) is te= sted by av_image_check_size2() 1500327 Unintentional integer overflow width *planes does not overflow 1452485 Free of array-typed value flags 0 is really 0 1500307 Unintentional integer overflow The arguments to the multiplication= are small numbers 1500324 Unintentional integer overflow The arguments to the multiplicatio= n are small numbers 1500335 Unintentional integer overflow The arguments to the multiplicatio= n are small numbers 1500337 Unintentional integer overflow The arguments to the multiplicatio= n are small numbers 1551680 Check of thread-shared field evades lock acquisition thread1 and t= hread2 are the same and the main thread so they dont need a mutex between e= ach other 1551686 Data race condition task index is not changed by another thread 1551692 Data race condition the return code is not changed once the task= has returned a code 1452477 Untrusted value as argument zsize is positve and its maximum is ch= ecked 1500326 Unintentional integer overflow no overflow 1500323 Unintentional integer overflow ccr_bur*cb_tbl cannot overflow here= atm 1500348 Unintentional integer overflow f*ff_g723_1_cos_tab will not overfl= ow here atm 1500352 Unintentional integer overflow 16bit * 16384 will not overflow 1515882 Unintentional integer overflow 1515883 Unintentional integer overflow 1515884 Unintentional integer overflow 1473559 Uninitialized scalar variable coverity hallucinates different sub_= mb_type values each time it looks 1465261 Free of array-typed value and 0 is still 0 1413314 Untrusted pointer read The code seems ok, just ugly 1430928 Untrusted loop bound The values are checked against size 1430929 Untrusted value as argument The values are checked against side_da= ta_size 1452417 Free of array-typed value coverity still fails to consider the fla= g value 1452423 Free of array-typed value 0 is REALLY 0 1452553 Free of array-typed value 0 AV_DICT_DONT_OVERWRITE is not AV_DICT_= DONT_STRDUP_VAL 1452575 Free of array-typed value 0 is REALLY 0 1466602 Free of array-typed value if flags 0 is passed then the flags argu= ment is 0 1473502 Untrusted loop bound seeking to a "untrusted value" is fine 1473502 Untrusted loop bound avio_seek() checks the offset 1473544 Untrusted loop bound allocate then store 1473561 Untrusted pointer write a non negative variable only needs a uppe= r bound check, i will suggest to add a assert though. This code does have a= feeling of fragility to it 1473589 Untrusted value as argument mode_blocksize is 0 or 1 1477411 Free of array-typed value another 0 is not 0 in coverity 1477412 Untrusted divisor the pcrs are checked so they are not equal 1477435 Untrusted loop bound inside the loop there are checks 1477437 Untrusted loop bound the code just skips over the chunk size with = avio_skip() 1500301 String not null terminated the profile_string const and 0 termina= ted. p is initialized to all 0, there is remaining space after the memcpy t= hus p is 0 terminated 1500302 Uninitialized scalar variable is_pipe and ts_from_file is contrad= icting 1452430 Free of array-typed value 0 !=3D 0 again 1442565 Untrusted loop bound dict_entries is checked against extradata_s= ize 1596608 Dereference after null check a new frame is allocated by ff_progre= ss_frame_get_buffer 1455684 Unintentional integer overflow w*h doesnt overflow w*h/256*100 als= o wont 1361959 Untrusted loop bound cnt is checked against bytestream2_get_bytes_= left(&dgb 1473503 Untrusted loop bound the loop checks if there is input data remain= ing 1473551 Untrusted loop bound the loop is checked by height and linesize 1473573 Untrusted loop bound the loop checks if there is input data remain= ing 1473506 Missing break in switch intentional 1466603 Uninitialized scalar variable good_thresh is given inconsistant v= alues by coverity 1528149 Unintended sign extension width * height < 4096 1547074 Missing break in switch intentional fallthrough 1547075 Missing break in switch intentional fallthrough 1477413 Missing break in switch intentional fallthrough 1512411 Dereference after null check pkt_out is NULL for alpha, the derefe= rence is under !ctx->is_alpha 1530136 Operands don't affect result LONG may be the same as uint64_t but = it doesnt have to be 1465488 Unintentional integer overflow with 1U this is now a false posit= ive 1500294 Unintentional integer overflow the shift is limited to 7+15 1465264 Free of array-typed value 0 & x =3D=3D 0 1521983 Unintentional integer overflow 1465484 Unintentional integer overflow the dc chroma vlcs dont overflow 32= bit 1465485 Unintentional integer overflow the dc luma vlcs dont overflow 32bit 1473497 Uninitialized scalar variable switch case default is impossible 1473517 Uninitialized scalar variable switch case default is impossible 1500291 Unintentional integer overflow Straight above the use its checked 1500295 Unintentional integer overflow Straight above the use its checked 1465480 Unintentional integer overflow mb num doesnt overflow 1465490 Unintentional integer overflow ESC3 should not overflow 1473567 Result is not floating-point yes thats how the mp3 dequant works 1503079 Division or modulo by zero coverity assumes frames =3D 0 but this= is impossible 1465482 Unintentional integer overflow the number of bits written is max = 10 so no overflow is possible 1596736 Untrusted loop bound the flags are 0, coverity assumes they are n= ot and taking an impossible branch / The 2 of 3 case is unrelated, and simp= ly checks strcasecmps the given filename 1596737 Free of array-typed value the flags are 0, coverity assumes they a= re not and taking an impossible branch 1441937 Unintentional integer overflow MB num doesnt overflow 1500279 Unintentional integer overflow libopus uses 16bit so 32 will suffi= ce 1452479 Out-of-bounds access coverity disregards thath the nlsf[] access = is after a i !=3D order check 1452618 Out-of-bounds access coverity assumes impossible subframes, this = begins with the assumtation of duration_ms=3D60 and nb_frames =3D 1, which = is already not possible at the same time 1447467 Free of address-of expression the flags are 0, coverity assumes th= ey are not and taking an impossible branch 1521984 Free of array-typed value the flags are 0, coverity assumes they a= re not and taking an impossible branch 1465489 Unintentional integer overflow put_bits() already asserts a limit = in k of 30 indirectly 1500333 Uninitialized scalar variable lpc should be initialzed in all cas= es in subframe 0, other subframes follow and thus have it initialized from = subframe 0 1505357 Unintentional integer overflow w*h*4 doesnt overflow 1495853 Missing break in switch Looks like intended fallthrough 1465487 Unintentional integer overflow Check is above 1548380 Uninitialized scalar variable This is possible if size is 0 but it= is never 0 1429858 Unintended sign extension 8bit * 1 is not overflowing 1473496 Unchecked return value With a fixed size, a failure is not expected 1473581 Missing break in switch 1515890 Out-of-bounds access width is not a negative value 1500282 Uninitialized scalar variable Either vlc table is set or value is,= coverity assumes a invalid state 1473508 Untrusted array index read The indexes are limited to the array s= izes 1500353 Unintentional integer overflow The line above checks for this 1500293 Unintentional integer overflow the product of 2 8 bit numbers doe= s not overflow 32bit 1469450 Unintentional integer overflow dc vlc should fit in 32bit 1469451 Unintentional integer overflow dc vlc should fit in 32bit 1473582 Uninitialized scalar variable frame and block need to be intra OR = inter they cannot be neither 1500311 Uninitialized scalar variable frame and block need to be intra OR = inter they cannot be neither 1452495 Uninitialized scalar variable 3bits are within 0..7 1452628 Uninitialized scalar variable 3bits are within 0..7 1518967 Unchecked return value buf cant be NULL and 157 isnt 0 nor is it o= verflowing 1518968 Unchecked return value buf cant be NULL and 157 isnt 0 nor is it o= verflowing 1429859 Unintentional integer overflow The range of hscale and delta_size = is too l imited and w h are checked 1465479 Unintentional integer overflow unary is 31 or lower here 1427156 Uninitialized pointer read the implied pix fmts and pack are incom= patible, thus the execution path is impossible 1591438 Division or modulo by zero I dont think widest_tile_sb can be 0 he= re DUP 1441935 Unchecked return value The buffer used is a fixed size buffer = =66rom the context, it cannot be too large nor can it be NULL 1544628 Unintentional integer overflow no len is all checked 1544629 Unintentional integer overflow no len is all checked 1473569 Untrusted array index read mode_blocksize is 0 or 1, header_len is= checked < 7 and not negative 1452622 Logically dead code coverity treats a unisgned check as if it was = signed 1516089 Negative array index write unsigned values are not negative 1560038 Negative array index read The invalid case implies CHROMA_FORMAT_= 444 while the array index is under CHROMA_FORMAT_422 1560043 Uninitialized scalar variable pred_flag should not magically change 1560045 Unintended comparison to logical negation looks intentional to me 1593172 Unintended sign extension 16bit shifted by v/hshift will not overf= low 1593173 Unintended sign extension 16bit shifted by v/hshift will not overf= low 1593174 Unintended sign extension 16bit shifted by v/hshift will not overf= low 1593175 Unintended sign extension 16bit shifted by v/hshift will not overf= low 1507877 Unintentional integer overflow w*h doesnt overflow 1560039 Logically dead code ; Work in progress, see review on ML 1458126 Result is not floating-point The exact value doesnt matter as it b= ecomes infinite anyway 1441930 Unintentional integer overflow w*h doesnt overflow 1473557 Uninitialized scalar variable coverity doesnt understand the inlin= e asm 1473585 Uninitialized scalar variable coverity doesnt understand the inlin= e asm 1591975 Explicit null dereferenced u.map is set by av_channel_layout_custo= m_init() 1458153 Structurally dead code coverity seems to not test CONFIG_VULKAN 1583741 Resource leak the leak is inconsistant with the checks on fd 1593009 Dereference after null check if its NULL, then len is 0 1593010 Out-of-bounds read out_len may be large but that doesnt imply out = still points to buf 1583742 Unchecked return value "We're not checking for errors here because = the kernel may not support the ioctl, in which case its okay to carry on"" 1516764 Dereference null return value the value that has just been stored= will not fail to be found 1500313 Out-of-bounds read the sample formats input are valid 1509371 Use of 32-bit time_t the exact value of time doesnt matter 1473549 Untrusted divisor Its a float and it is checked "Value inf for pa= rameter 'flags' is not a valid set of 32bit integer flags" 1500289 Unintentional integer overflow squaring 8bit will not overflow 32b= it 1500296 Unintentional integer overflow w*h will not overflow 32bit 1592142 Unintentional integer overflow squaring 8bit (9bit signed) will no= t overflow 32bit 1497114 Missing break in switch 1473525 Untrusted loop bound we check the user provided name against a list 1506707 Uninitialized scalar variable FFmpeg does not ship a avisynth_c.h = anymore 1529991 Arguments in wrong order num/den are xchanged as framerate vs tim= ebase have them exchanged 1482088 Missing break in switch 1507242 Untrusted pointer read The data is checked, the code is ugly though 1473538 Untrusted loop bound reading till EOF if there is nothing better 1497470 Operands don't affect result 1500278 Uninitialized scalar variable uninitialized implies len =3D 0 1512404 Use after free 0 flags is 0 1464083 Use after free 0 flags are still 0 in the function 1500310 Uninitialized scalar variable data_end would be 0 if data_start ha= d not been initialized 1532406 Untrusted loop bound this simply iterates over NALs 1538299 Untrusted loop bound this simply iterates over NALs 1500346 Uninitialized scalar variable uninitialized implies len =3D 0 1485969 Result is not floating-point its just a limit 1452541 Use after free 0 flags are 0 even inside av_dict_set() 1598551 Unintentional integer overflow the vertical coordinate fits in int 1598560 Unintentional integer overflow the vertical coordinate fits in int 1591879 Explicit null dereferenced inconsistant avctx->pix_fmt 1591921 Unchecked return value A check is not needed here as its not in a = loop 1591895 Unintentional integer overflow mb width *4 doesnt overflow 1591893 Unintentional integer overflow height * linesize should not overf= low 1591900 Unintentional integer overflow height * linesize should not overf= low 1591904 Unintentional integer overflow height * linesize should not overf= low 1591907 Unintentional integer overflow height * linesize should not overf= low 1591920 Unintentional integer overflow height * linesize should not overf= low 1591934 Unintentional integer overflow height * linesize should not overf= low 1591940 Unintentional integer overflow height * linesize should not overf= low 1591945 Unintentional integer overflow height * linesize should not overf= low 1591950 Unintentional integer overflow height * linesize should not overf= low 1591922 Unintentional integer overflow pixel shift wont exceed 32bit 1591943 Unintentional integer overflow pixel shift wont exceed 32bit 1591873 Unintentional integer overflow pixel 80 << pixel shift will not e= xceed 32bit 1591917 Unintentional integer overflow w and h are checked to be within 1= 6bit 1591883 Unintentional integer overflow height * linesize should not over= flow 1591860 Unintentional integer overflow multiplying linesize by 1 or 2 doe= snt overflow 1591865 Unintentional integer overflow multiplying linesize by 1 or 2 do= esnt overflow 1591871 Unintentional integer overflow linesize *2 does not overflow 1591869 Unintentional integer overflow linesize *2 does not overflow 1591936 Unintentional integer overflow linesize *2 does not overflow 1505358 Untrusted loop bound w,h,channels are checked 1591890 Unintentional integer overflow linesize will fit in int 1598554 Unchecked return value the return does not need to be checked here 1591863 Unintentional integer overflow should not be able to overflow 1591908 Unintentional integer overflow should not be able to overflow 1591949 Unintentional integer overflow 8 * sb_cols should not overflow 1591872 Unintentional integer overflow offset_v << ps should not overflow 1591905 Unintentional integer overflow w << ps should not overflow 1591910 Unintentional integer overflow the pixel size will not overflow 32b= it 1591912 Unintentional integer overflow border << pixel_shift should not ove= rflow 1591927 Unintentional integer overflow w << ps should not overflow 1591947 Unintentional integer overflow 1<< ps, w << ps should not overflow 1591882 Unintentional integer overflow the edge buffer stride doesnt overfl= ow 1591919 Unintentional integer overflow the edge buffer stride doesnt overfl= ow 1591941 Unintentional integer overflow the edge buffer stride doesnt overfl= ow 1530245 Out-of-bounds read If the list has 1 element then this element is N= ULL 1598565 Uninitialized pointer write (see ML) 1598561 Uninitialized pointer write (see ML) 1551690 Check of thread-shared field evades lock acquisition ; async_seek()= is not called from 2 threads at the same time 1457610 Use after free ; 0 =3D 0 1473574 Untrusted loop bound ; i is in a permissible range if its within th= e buffer, the loop checks this 1591946 Structurally dead code ; It is only dead on some platforms 1492156 Unintentional integer overflow ; nb_index_entries is 16bit here 1452604 Use after free ; 0 flags is 0 1473558 Untrusted loop bound ; header_len is bound by the extradata size 1515516 Use after free ; another form of the eternal 0 becomes non 0 coveri= ty bug 1596702 Explicit null dereferenced ; coverity ignores av_channel_layout_cus= tom_init() 1595708 Explicit null dereferenced ; 1595708 Explicit null dereferenced 1591902 Operands don't affect result ; platform dependant 1477409 Use after free ; The eternal 0 flags bug from coverity, 0 has no fl= ags set the codepath is impossible 1594483 Explicit null dereferenced ; coverity ignores av_channel_layout_cus= tom_init() 1490845 Use after free ; AV_DICT_APPEND is also not the right flag to free = the argument 1473547 Untrusted pointer read ; The values are tested a few lines before u= se 1591794 Out-of-bounds read ; The end check resets the index 1530185 Missing break in switch ; intentional 1530298 Missing break in switch ; intentional 1530313 Untrusted loop bound ; The loop is bounded by bytestream2_get_byte= s_left() 1530166 Free of array-typed value ; a flags of 1 also doesnt trigger teh fr= ee() code 1530258 Copy of overlapping memory ; username and auth_params are separate = fields they do not overlap 1530312 Untrusted loop bound ; we read size, we allocate and process the da= ta, coverity points to no issue 1494441 Untrusted value as argument ; length is checked one line above the = coverity warning --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Complexity theory is the science of finding the exact solution to an approximation. Benchmarking OTOH is finding an approximation of the exact --/yruk2jJK3ChhVTO Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEKAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCZmSAYwAKCRBhHseHBAsP q8BVAJ9vE4kzEMXsmJRN/XV5eFyIk78+CACdFrOsVFiaAMpCeeNVhLccfDowhcI= =y85a -----END PGP SIGNATURE----- --/yruk2jJK3ChhVTO-- --===============4145908698662052642== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============4145908698662052642==--