Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A function return value is compared directly against an expected value without first verifying for negative error codes. This may lead to unexpected execution of error-handling cleanup paths, potentially triggering double-frees when unhandled error codes mimic unexpected data bytes.
`slice::from_raw_parts_mut` is called inside `Iterator::next()` with a struct field length (`self.$STALE_LEN`) that may no longer reflect the number of currently initialized elements. Once any element has been moved out of the backing buffer during iteration, the field value becomes stale — the resulting slice falsely asserts that every slot holds a valid, i
A teardown or cleanup function polls an atomic pointer with `load()` without swapping it with null. If this pointer's memory is deallocated and the teardown process unwinds (e.g. from a panic) or re-executes, the parent structure will retain a dangling pointer leading to a double-free. Use `.swap(std::ptr::null_mut(), Ordering::AcqRel)` instead to safely tak
Potential double-free (CWE-415): $F->buf[0] was previously assigned via av_buffer_create(...) with a custom release callback that owns resources such as the MppFrame / AVDRMFrameDescriptor / decoder ref. The subsequent assignment $F->hw_frames_ctx = av_buffer_ref(...) checks for NULL and on failure jumps to a manual cleanup label via 'goto'. The manual clean
