Test case 150833

Description

This test case allocates a stack buffer of size 16. It takes the user input and performs a check to see if it is possible to copy the user input into a 16-byte buffer. If the user input is larger than 15 bytes, then the check method returns a -1. This value is converted to an unsigned type (size_t), resulting in an enormous number if the check method returned -1. The test case then uses that unsigned value as a size for the copy from the user input into the stack buffer. Because the unsigned value is huge, this overwrites the stack, resulting in a segmentation fault upon return from the function.
Metadata
- Base program: Subversion
- Source Taint: SHARED_MEMORY
- Data Type: VOID_POINTER
- Data Flow: VAR_ARG_LIST
- Control Flow: SET_JUMP_LONG_JUMP