On macOS, release builds log to /tmp/Moonlight-<epoch>.log. /tmp is
shared by all users and the file name is predictable, so another local
user could plant symlinks at upcoming log names and have Moonlight
truncate and overwrite any file the victim can write to. The log was
also created world-readable.
Open the log with QIODevice::NewOnly (O_CREAT|O_EXCL) so an existing
file or symlink is never opened, and create it readable only by the
owner on Qt 6.3+. If the open fails we keep logging to stderr, as we
already did for any other open failure.
bs_read_ue() can return values above INT32_MAX. bs_read_se() stored the
result in an int32_t and computed (r+1)/2, which is undefined behavior
when the code is 0x7FFFFFFF and gives wrong values for codes above
INT32_MAX. The SPS being parsed comes from the host during the H.264
SPS fixup.
Do the conversion in unsigned arithmetic. bs_read_ue() returns at most
0xFFFFFFFE, so both branches produce in-range int32_t values, and every
code that was previously well-defined decodes to the same value.
Chris