Test case 250863

Type: source code
State: mixed
Author: NSA/Center for Assured Software
Status: accepted
Language: Java
Submission Date: 02 Nov 2017

Description

CWE: 191 Integer Underflow
BadSource: database Read data from a database
GoodSource: A hardcoded non-zero, non-min, non-max, even number
Sinks: sub
GoodSink: Ensure there will not be an underflow before subtracting 1 from data
BadSink : Subtract 1 from data, which can cause an Underflow
Flow Variant: 71 Data flow: data passed as an Object reference argument from one method to another in different classes in the same package

Flaws

CWE-191 Integer Underflow (Wrap or Wraparound)

Test Suites

Documentation

Trace

- CWE191_Integer_Underflow__int_database_predec_71a.javaline 54
  - CWE-191 Integer Underflow (Wrap or Wraparound)

Files

src

main

java

testcases

CWE191_Integer_Underflow

s05

CWE191_Integer_Underflow__int_database_predec_71a.java

CWE191_Integer_Underflow__int_database_predec_71b.java

testcasesupport

AbstractTestCase.java

AbstractTestCaseBase.java

IO.java

manifest.sarif


xxxxxxxxxx
227
 
1
/* TEMPLATE GENERATED TESTCASE FILE
2
Filename: CWE191_Integer_Underflow__int_database_predec_71a.java
3
Label Definition File: CWE191_Integer_Underflow__int.label.xml
4
Template File: sources-sinks-71a.tmpl.java
5
*/
6
/*
7
 * @description
8
 * CWE: 191 Integer Underflow
9
 * BadSource: database Read data from a database
10
 * GoodSource: A hardcoded non-zero, non-min, non-max, even number
11
 * Sinks: decrement
12
 *    GoodSink: Ensure there will not be an underflow before decrementing data
13
 *    BadSink : Decrement data, which can cause an Underflow
14
 * Flow Variant: 71 Data flow: data passed as an Object reference argument from one method to another in different classes in the same package
15
 *
16
 * */
17
18
package testcases.CWE191_Integer_Underflow.s05;
19
import testcasesupport.*;
20
21
import javax.servlet.http.*;
22
23
import java.sql.Connection;
24
import java.sql.PreparedStatement;
25
import java.sql.ResultSet;
26
import java.sql.SQLException;
27
28
import java.util.logging.Level;
29
30
public class CWE191_Integer_Underflow__int_database_predec_71a extends AbstractTestCase
31
{
32
    public void bad() throws Throwable
33
    {
34
        int data;
35
36
        data = Integer.MIN_VALUE; /* Initialize data */
37
38
        /* Read data from a database */
39
        {
40
            Connection connection = null;
41
            PreparedStatement preparedStatement = null;
42
            ResultSet resultSet = null;
43
44
            try
45
            {
46
                /* setup the connection */
47
                connection = IO.getDBConnection();
48
49
                /* prepare and execute a (hardcoded) query */
50
                preparedStatement = connection.prepareStatement("select name from users where id=0");
51
                resultSet = preparedStatement.executeQuery();
52
53
                /* POTENTIAL FLAW: Read data from a database query resultset */
54
                String stringNumber = resultSet.getString(1);
55
                if (stringNumber != null) /* avoid NPD incidental warnings */
56
                {
57
                    try
58
                    {
59
                        data = Integer.parseInt(stringNumber.trim());
60
                    }
61
                    catch (NumberFormatException exceptNumberFormat)
62
                    {
63
                        IO.logger.log(Level.WARNING, "Number format exception parsing data from string", exceptNumberFormat);
64
                    }
65
                }
66
            }
67
            catch (SQLException exceptSql)
68
            {
69
                IO.logger.log(Level.WARNING, "Error with SQL statement", exceptSql);
70
            }
71
            finally
72
            {
73
                /* Close database objects */
74
                try
75
                {
76
                    if (resultSet != null)
77
                    {
78
                        resultSet.close();
79
                    }
80
                }
81
                catch (SQLException exceptSql)
82
                {
83
                    IO.logger.log(Level.WARNING, "Error closing ResultSet", exceptSql);
84
                }
85
86
                try
87
                {
88
                    if (preparedStatement != null)
89
                    {
90
                        preparedStatement.close();
91
                    }
92
                }
93
                catch (SQLException exceptSql)
94
                {
95
                    IO.logger.log(Level.WARNING, "Error closing PreparedStatement", exceptSql);
96
                }
97
98
                try
99
                {
100
                    if (connection != null)
101
                    {
102
                        connection.close();
103
                    }
104
                }
105
                catch (SQLException exceptSql)
106
                {
107
                    IO.logger.log(Level.WARNING, "Error closing Connection", exceptSql);
108
                }
109
            }
110
        }
111
112
        (new CWE191_Integer_Underflow__int_database_predec_71b()).badSink((Object)data  );
113
    }
114
115
    public void good() throws Throwable
116
    {
117
        goodG2B();
118
        goodB2G();
119
    }
120
121
    /* goodG2B() - use goodsource and badsink */
122
    private void goodG2B() throws Throwable
123
    {
124
        int data;
125
126
        /* FIX: Use a hardcoded number that won't cause underflow, overflow, divide by zero, or loss-of-precision issues */
127
        data = 2;
128
129
        (new CWE191_Integer_Underflow__int_database_predec_71b()).goodG2BSink((Object)data  );
130
    }
131
132
    /* goodB2G() - use badsource and goodsink */
133
    private void goodB2G() throws Throwable
134
    {
135
        int data;
136
137
        data = Integer.MIN_VALUE; /* Initialize data */
138
139
        /* Read data from a database */
140
        {
141
            Connection connection = null;
142
            PreparedStatement preparedStatement = null;
143
            ResultSet resultSet = null;
144
145
            try
146
            {
147
                /* setup the connection */
148
                connection = IO.getDBConnection();
149
150
                /* prepare and execute a (hardcoded) query */
151
                preparedStatement = connection.prepareStatement("select name from users where id=0");
152
                resultSet = preparedStatement.executeQuery();
153
154
                /* POTENTIAL FLAW: Read data from a database query resultset */
155
                String stringNumber = resultSet.getString(1);
156
                if (stringNumber != null) /* avoid NPD incidental warnings */
157
                {
158
                    try
159
                    {
160
                        data = Integer.parseInt(stringNumber.trim());
161
                    }
162
                    catch (NumberFormatException exceptNumberFormat)
163
                    {
164
                        IO.logger.log(Level.WARNING, "Number format exception parsing data from string", exceptNumberFormat);
165
                    }
166
                }
167
            }
168
            catch (SQLException exceptSql)
169
            {
170
                IO.logger.log(Level.WARNING, "Error with SQL statement", exceptSql);
171
            }
172
            finally
173
            {
174
                /* Close database objects */
175
                try
176
                {
177
                    if (resultSet != null)
178
                    {
179
                        resultSet.close();
180
                    }
181
                }
182
                catch (SQLException exceptSql)
183
                {
184
                    IO.logger.log(Level.WARNING, "Error closing ResultSet", exceptSql);
185
                }
186
187
                try
188
                {
189
                    if (preparedStatement != null)
190
                    {
191
                        preparedStatement.close();
192
                    }
193
                }
194
                catch (SQLException exceptSql)
195
                {
196
                    IO.logger.log(Level.WARNING, "Error closing PreparedStatement", exceptSql);
197
                }
198
199
                try
200
                {
201
                    if (connection != null)
202
                    {
203
                        connection.close();
204
                    }
205
                }
206
                catch (SQLException exceptSql)
207
                {
208
                    IO.logger.log(Level.WARNING, "Error closing Connection", exceptSql);
209
                }
210
            }
211
        }
212
213
        (new CWE191_Integer_Underflow__int_database_predec_71b()).goodB2GSink((Object)data  );
214
    }
215
216
    /* Below is the main(). It is only used when building this testcase on
217
     * its own for testing or for building a binary to use in testing binary
218
     * analysis tools. It is not used when compiling all the testcases as one
219
     * application, which is how source code analysis tools are tested.
220
     */
221
    public static void main(String[] args) throws ClassNotFoundException,
222
           InstantiationException, IllegalAccessException
223
    {
224
        mainFromParent(args);
225
    }
226
}
227

Have any comments on this test case? Please, send us an email.