Test case 150786

Description

This test case allocates a stack buffer of size 16. It takes the user input and performs a check to see if it is possible to copy the user input into a 16-byte buffer. If the user input is larger than 15 bytes, then the check method returns a -1. This value is converted to an unsigned type (size_t), resulting in an enormous number if the check method returned -1. The test case then uses that unsigned value as a size for the copy from the user input into the stack buffer. Because the unsigned value is huge, this overwrites the stack, resulting in a segmentation fault upon return from the function.
Metadata
- Base program: Subversion
- Source Taint: SOCKET
- Data Type: STRUCT
- Data Flow: BUFFER_ADDRESS_POINTER
- Control Flow: INFINITE_LOOP