The SAMATE Project Department of Homeland Security
Downloads:  Selected

Back to the previous page...Back to the previous page

Test Case IDCandidate10
Bad / GoodBadBad test case
AuthorN/A
Associated test caseN/A
ContributorSecureSoftware
LanguageC
Type of test caseSource Code
Input stringN/A
Expected OutputN/A
InstructionsN/A
Submission date2005-10-27
DescriptioniconFormat string problems occur when a user has the ability to control or write completely the format string used to format data in the printf style family of C/ C++ functions. (from TCCLASP-5_2_23_10)
Filename
Flaw
  • (?) CWE-134: Uncontrolled Format String at line 27

There is 1 comment :: Submit a comment :: RSS

>./Format_string_problem.c
  1. /* This software was developed at the National Institute of Standards and Technology by employees of the Federal Government
  2. in the course of their official duties. Pursuant to title 17 Section 105 of the United States Code
  3. this software is not subject to copyright protection and is in the public domain.
  4. NIST assumes no responsibility whatsoever for its use by other parties,
  5. and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.
  7. This test case is derived from an example found in the Secure Software Inc. CLASP v2.0 User Guide.
  9. */
  10.  
  11.  
  12. /* The following example is exploitable, due to the printf() call in the printWrapper()
  13. function. Note: The stack buffer was added to make exploitation more
  14. simple.
  15. */
  16.  
  17.  
  18. #include <stdio.h>
  19.  
  20.  
  21. int main(int argc, char **argv) {
  22.  
  23. char buf[5012];
  24.  
  25. memcpy(buf, argv[1], 5012);
  26.  
  27. printf(argv[1]);  /*  Bad */
  28.  
  29. return (0);
  30.  
  31. }
  32.  
  33.  
  34.