The SAMATE Project Department of Homeland Security
Downloads:  Selected

Back to the previous page...Back to the previous page

Test Case IDCandidate2082
Bad / GoodBadBad test case
AuthorN/A
Associated test caseN/A
ContributorPaul E. Black
LanguageC
Type of test caseSource Code
Input string./a.out a234567890 b234567890
Expected Outputresults: a234567890b234567890>
InstructionsN/A
Submission date2009-04-03
DescriptioniconOff-by-one error on bounds checking for strcat(). PLOVER: NUM.OBO, BUFF.OVER This replaces case 1320
Filename
Flaw
  • (?) CWE-121: Stack-based Buffer Overflow at line 25

There is no comments :: Submit a comment :: RSS

>./strcat-bad2.c
  1. /*
  2.   PLOVER: NUM.OBO, BUFF.OVER
  3. */
  4.  
  5. /*
  6.         Off-by-one error in bounds checking of strcat()
  8.     input: ./a.out a234567890 b234567890
  9. */
  10.  
  11.  
  12. #include <stdio.h>
  13. #include <string.h>
  14.  
  15. #define MAXSIZE 20
  16.  
  17. void test(char *str, char *str2){
  18.     char pre[2] = "<";
  19.     char buf[MAXSIZE] = "";
  20.     char post[2] = ">";
  21.     if(strlen(str) < MAXSIZE)
  22.         strcpy(buf, str);
  23.     printf(" strcpy: %s%s%s\n", pre, buf, post);
  24.     if(strlen(buf) + strlen(str2) <= MAXSIZE) // theoretical integer overflow
  25.         strcat(buf, str2); // CWE-121
  26.     printf("results: %s%s%s\n", pre, buf, post);
  27. }
  28.  
  29. int main(int argc, char **argv){
  30.     char *userstr;
  31.     char *userstr2;
  32.     if(argc > 2){
  33.         userstr = argv[1];
  34.         userstr2 = argv[2];
  35.         test(userstr,userstr2);
  36.     }
  37.     printf("done\n");
  38.     return 0;
  39. }
  40.