cls: INTER

why: Security impact depends on external views::Widget::OnGestureEvent semantics and event propagation.


why: Requires external knowledge of RefreshCellularDataPlans’ lifetime and callback behavior.


why: Required invariant that all page IDs enter m_processSuppressiblePages regardless of pageIsProcessSuppressible.


why: Requires external semantics of toV8 wrapper creation when substituting the caller’s creationContext.


why: Copying versus moving is unsafe only given external path trust and work-item semantics.


why: create_kernel’s failure contract: whether it initializes item->kernel to a valid deletable pointer.


cls: INTRA

why: Unchecked reinterpret_cast of NSURL object to CFURLRef in empty-string path.


why: Safety of Quantum-to-ssize_t cast depends on Quantum’s externally defined type and range.


why: Security impact of const qualification depends on class state and caller overload resolution.


why: Whether callers safely handle the propagated MakeShape failure is external.


why: Whether failed authentication must update existing session state via user_session_update.


why: Whether CommonFinishDecode already frees decode, making cleanup a double-free.


why: Reference dtype rejection is fully visible before local Tensor construction.


why: Whether InfoHeader can be NULL depends on external object-construction invariants.


why: Requires knowing BuildTensorShape’s external dimension-product overflow behavior.


why: Safety of decrementing access mode requires external semantics of open_context and flag value 3.


why: Whether absent config_proto makes omitted allowed_devices grant unrestricted GPU access is externally defined.


why: Unbounded batch_idx increment indexes splits_values without validating split monotonicity.


why: Whether callers permit zero bias_size and require array_data processing is external.


why: Whether callers reject malformed graphs when a missing input makes this function return false.


why: Attacker-controlled DebugString is logged on invalid output index, enabling log amplification.


why: Size-validation failure exits after decoder initialization without calling png::CommonFreeDecode.


why: Security relevance depends on caller handling; the vulnerable function’s iterator dereference is guarded.


why: Forced VMLOAD/VMSAVE interception requires nested-SVM semantics defined outside this function


why: Safety of final gf_bs_align(bs) requires external semantics and caller’s expected stream position.


why: Requires external return-range and signedness guarantees for gf_bs_read_ue_log and s32.


why: Typeof default falls through and returns nullptr instead of rejecting an invalid literal kind


why: Unchecked shapes[0] access when maxRank is zero and shapes may be empty


why: Whether allocate_temp buffers safely support these asynchronous assignments depends on external allocator semantics.


why: Websocket server runs under another user and must rename sockets in sessions directory.


why: Direct float/double pointer casts dereference potentially misaligned EXIF byte addresses.


why: Unchecked X509_VERIFY_PARAM_set1_host return can silently leave hostname validation misconfigured.


why: Safety of CASES_WITH_DEFAULT requires its external macro expansion and supported-type definitions.


why: Requires knowing mrb_get_args can reenter and mutate self before array metadata capture


why: Whether callers guarantee output_port validity and context output-count consistency is external.


why: Whether cc[1] is a validated in-range offset into ucd_caseless_sets.


why: AddItem/AddNode side effects determine whether arg_index can diverge from result_.nodes.size().


why: Parsed dimensions narrow through signed long before size_t, without range validation.


why: Whether codegen(..., val=false) still changes the value stack.


why: Requires StagingMap::put’s external key-shape contract to judge the scalar restriction.


why: Whether prior parsing guarantees avc->s_info.sps is non-NULL at this branch.


why: Requires external invariant that node_map_->GetNode always returns non-null for these inputs


why: Safety of rhs.IsInitialized() depends on external Tensor state and concurrency semantics.


why: gen_values’ return/stack contract determines why n==13 must not trigger argument packing


why: Requires knowing drain() can invalidate iterator by invoking external callbacks.


why: Actual capacity of caller-provided szLine versus strcpy output up to 2048 bytes.


why: GOPHER_WWW format has five conversions but supplies only three arguments.


why: GF_SAFEALLOC’s allocation semantics and failure behavior require its external macro definition


why: Unchecked min_rank arithmetic can overflow for INT64_MIN or INT64_MAX concat_dim


why: Requires caller semantics: whether out_metadata requests optional metadata for metadata-less bundles.


why: Duplicate names only log; subsequent map assignment overwrites the existing entry.


why: Whether callers prevalidate each report block’s full size before this function parses it.


why: Need conn->raddr.addr’s externally defined size to judge the ai_addrlen-sized memcpy.


why: Negative pooling indices can reach Eigen coeffRef without bounds checks.


why: Requires external knowledge whether silently accepting a missing graph node enables a security bypass.


why: gf_realloc may invalidate aliased data, then memcpy reads through that stale pointer


why: Unchecked signed size converts to size_t, allowing negative values to wrap during size computation.


why: Whether TfLiteIntArrayGetSizeInBytes can return negative before conversion to size_t.


why: Requires external BuildTensorShape semantics for malformed or overflowing attacker-controlled dimensions


why: Socket filtering uses non-exact seccomp_rule_add, visibly weakening the local sandbox policy


why: Requires external guarantees about dev->card_label contents and termination.


why: Whether entries may be NULL while nb_entries is nonzero is established outside this function.


why: Requires the external pooling_ratio_ contract; its removed comparison has no intrinsic unsafe effect.


why: Empty indices/values element counts are not cross-checked before sparse tensor construction.


why: Untrusted box dimensions narrow through signed long to size_t without range validation.


why: Non-digit snprintf output bypasses validation when tmplen≥64 before unsafe pointer arithmetic.


why: Requires external callback contract for make_fragmented_temporary_buffer’s returned byte count.


why: Unbounded base64url decoding writes attacker-controlled signature into fixed 128-byte sig buffer.


why: Requires external semantics explaining why rejecting empty resource tensors is unsafe.


why: Unconditional CDATA advance skips input without an EOF guard.


why: The iov_from_buf short-copy result is ignored before virtqueue_push reports the full len.


why: Whether chroma storage width is governed by high_bit_depth(0), defined by de265_image allocation.


why: Whether njs_array_alloc makes deleted->start[i] writable depends on its external allocation semantics.


why: Whether bytecode operands were externally validated against register, pool, and symbol table bounds.


why: IRC 352 grammar determines whether argv[8] asterisk must advance arg_start.


why: Whether pad_width_ is prevalidated during construction is not visible in Compute.


why: Whether configASSERT aborts on overflow depends on its external macro definition.


why: Security impact depends on external handling of the duplicate-cipher exception.


why: Whether callers invoke ParseMCU with zero remaining lines is external.


why: Negative num_streams semantics in QuantileStreamResource are defined outside this function.


why: Requires gf_isom_parse_root_box’s contract for initializing a on nonnegative returns


why: IS_UNDEF top-level branch returns without freeing ent1, unlike the sibling branch.


why: Whether m_ulRemaining[0] can be nonpositive depends on externally maintained scan state.


why: Requires external knowledge that writer-stack depth is enforced by new_unencoding_writer.


why: Security impact depends on external implementations of logStartingSubPipeline and logShardedViewFound.


why: Requires prior bi->pdwidth initialization and downstream use when pixelsize is zero.


why: ND option-header and SLLAO buffer reads lack sufficient local bounds checks.


why: Security impact depends on the externally defined test_bad_write callback.


why: Bucket/name-count invariant is only warned about, allowing malformed table processing to continue.


why: Whether device_path is guaranteed non-NULL when the ENOENT branch executes.


why: Security impact depends on external getcwd_system semantics for one-byte buffers.


why: Unchecked s->size+1 can wrap, undersizing allocation before read and terminator write.


why: Requires lsqpack_enc_init semantics for sub-minimum dyn_table_size versus forced zero.


why: Bounds checks and subsequent output_t(loc) writes are fully visible locally.


why: Whether crypto_memneq safely handles digest_length(d) requires its external implementation and length contract.


why: Requires bitbuffer_add_row semantics to know whether num_rows-1 indexing is in bounds


why: Recursive container traversal lacks cycle detection for self-referential arrays or objects.


why: Whether get_name_len guarantees four bytes remain after the parsed name.


why: Requires external SparseTensor contract: zero-rank indices may be empty with nonempty values.