The SAMATE Project Department of Homeland Security
Downloads:  Selected

Back to the previous page...Back to the previous page

Test Case IDCandidate2082
Bad / GoodBadBad test case
AuthorN/A
Associated test caseN/A
ContributorPaul E. Black
LanguageC
Type of test caseSource Code
Input string./a.out a234567890 b234567890
Expected Outputresults: a234567890b234567890>
InstructionsN/A
Submission date2009-04-03
DescriptioniconOff-by-one error on bounds checking for strcat(). PLOVER: NUM.OBO, BUFF.OVER This replaces case 1320
Filename
Flaw
  • (?) CWE-121: Stack-based Buffer Overflow at line 25

There is no comments :: Submit a comment :: RSS

>./strcat-bad2.c
  1. /*
  2.   PLOVER: NUM.OBO, BUFF.OVER
  3. */
  4.  
  5. /*
  6.         Off-by-one error in bounds checking of strcat()
  7.     input: ./a.out a234567890 b234567890
  8. */
  9.  
  10.  
  11. #include <stdio.h>
  12. #include <string.h>
  13.  
  14. #define MAXSIZE 20
  15.  
  16. void test(char *str, char *str2){
  17.     char pre[2] = "<";
  18.     char buf[MAXSIZE] = "";
  19.     char post[2] = ">";
  20.     if(strlen(str) < MAXSIZE)
  21.         strcpy(buf, str);
  22.     printf(" strcpy: %s%s%s\n", pre, buf, post);
  23.     if(strlen(buf) + strlen(str2) <= MAXSIZE) // theoretical integer overflow
  24.         strcat(buf, str2); // CWE-121
  25.     printf("results: %s%s%s\n", pre, buf, post);
  26. }
  27.  
  28. int main(int argc, char **argv){
  29.     char *userstr;
  30.     char *userstr2;
  31.     if(argc > 2){
  32.         userstr = argv[1];
  33.         userstr2 = argv[2];
  34.         test(userstr,userstr2);
  35.     }
  36.     printf("done\n");
  37.     return 0;
  38. }
  39.