Test case 150935

Description

This test case takes an unsigned long value and uses it in an initialization function for a struct. Within the initialization function, the long gets converted to an unsigned short when a struct uses the unsigned long as an initialization value for an unsigned short member. If the unsigned long number is large enough, it will result in a numerical truncation. The test case then uses the short value to malloc memory for a char * buffer. It then memset's the char * member of the struct to ascii value 98 ('b') for the size of the unsigned long value. If the numerical truncation took place, then the char * buffer won't have enough memory allocated to it for this to properly work. Which will result in writing 'garbage' data into memory somewhere, potentially corrupting the program.
Metadata
- Base program: Subversion
- Source Taint: SHARED_MEMORY
- Data Type: UNION
- Data Flow: ADDRESS_ALIAS_10
- Control Flow: INDIRECTLY_RECURSIVE