The SAMATE Project Department of Homeland Security
Downloads:  Selected

Back to the previous page...Back to the previous page

Test Case IDCandidate5
Bad / GoodBadBad test case
AuthorN/A
Associated test caseN/A
ContributorSecureSoftware
LanguageC
Type of test caseSource Code
Input stringN/A
Expected OutputStrlen() output: 0
InstructionsN/A
Submission date2005-10-21
DescriptioniconImproper string length checking takes place when wide or multi-byte character strings are mistaken for standard character strings. (from TCCLASP-5_2_15_10)
Filename
Flaw
  • (?) CWE-133: String Errors at line 11

There is 1 comment :: Submit a comment :: RSS

>./Improper_string_length_checking.c
  1. #include <stdio.h>
  2. #include <strings.h>
  3. #include <wchar.h>
  4. int main() {
  5. wchar_t wideString[] = L"The spazzy orange tiger jumped ” \
  6. “over the tawny jaguar.";
  7. wchar_t *newString;
  8. newString = (wchar_t *) malloc(strlen(wideString));
  9.  
  10. printf("Strlen() output: %d\nWcslen() output: %d\n",
  11. strlen(wideString), wcslen(wideString));
  12.  
  13.  
  14.  
  15. /* The above code gives the following output:
  16. Strlen() output: 0
  17. Wcslen() output: 53
  19. */
  20. }
  21.  
  22.  
  23.  
  24.  
  25.  
  26.  
  27.  
  28.