Metadata - Base program: FFmpeg - Source Taint: FILE_CONTENTS - Data Type: HEAP_POINTER - Data Flow: INDEX_ALIAS_10 - Control Flow: SEQUENCE

Metadata - Base program: FFmpeg - Source Taint: FILE_CONTENTS - Data Type: UNION - Data Flow: ADDRESS_AS_FUNCTION_RETURN_VALUE - Control Flow: SEQUENCE

Metadata - Base program: FFmpeg - Source Taint: SHARED_MEMORY - Data Type: ARRAY - Data Flow: ADDRESS_AS_CONSTANT - Control Flow: INFINITE_LOOP

Metadata - Base program: FFmpeg - Source Taint: FILE_CONTENTS - Data Type: ARRAY - Data Flow: BUFFER_ADDRESS_ARRAY_INDEX - Control Flow: INTERPROCEDURAL_2

Metadata - Base program: FFmpeg - Source Taint: FILE_CONTENTS - Data Type: UNION - Data Flow: ADDRESS_AS_NONLINEAR_EXPRESSION - Control Flow: SET_JUMP_LONG_JUMP

Metadata - Base program: FFmpeg - Source Taint: SOCKET - Data Type: SIMPLE - Data Flow: ADDRESS_AS_VARIABLE - Control Flow: RECURSIVE

Metadata - Base program: FFmpeg - Source Taint: SOCKET - Data Type: HEAP_POINTER - Data Flow: VAR_ARG_LIST - Control Flow: RECURSIVE

Metadata - Base program: FFmpeg - Source Taint: SHARED_MEMORY - Data Type: TYPEDEF - Data Flow: BUFFER_ADDRESS_POINTER - Control Flow: INTERPROCEDURAL_10

Metadata - Base program: FFmpeg - Source Taint: SOCKET - Data Type: TYPEDEF - Data Flow: ADDRESS_AS_NONLINEAR_EXPRESSION - Control Flow: SEQUENCE

Metadata - Base program: FFmpeg - Source Taint: FILE_CONTENTS - Data Type: VOID_POINTER - Data Flow: ADDRESS_AS_NONLINEAR_EXPRESSION - Control Flow: SEQUENCE

Metadata - Base program: FFmpeg - Source Taint: SOCKET - Data Type: HEAP_POINTER - Data Flow: ADDRESS_AS_NONLINEAR_EXPRESSION - Control Flow: RECURSIVE

Metadata - Base program: FFmpeg - Source Taint: SOCKET - Data Type: ARRAY - Data Flow: ADDRESS_AS_LINEAR_EXPRESSION - Control Flow: RECURSIVE

Metadata - Base program: FFmpeg - Source Taint: FILE_CONTENTS - Data Type: SIMPLE - Data Flow: ADDRESS_AS_NONLINEAR_EXPRESSION - Control Flow: MACROS

Metadata - Base program: FFmpeg - Source Taint: ENVIRONMENT_VARIABLE - Data Type: STRUCT - Data Flow: VAR_ARG_LIST - Control Flow: INTERPROCEDURAL_50

Metadata - Base program: FFmpeg - Source Taint: SHARED_MEMORY - Data Type: VOID_POINTER - Data Flow: ADDRESS_AS_NONLINEAR_EXPRESSION - Control Flow: INTERPROCEDURAL_50

Metadata - Base program: FFmpeg - Source Taint: SOCKET - Data Type: UNION - Data Flow: BUFFER_ADDRESS_ARRAY_INDEX - Control Flow: RECURSIVE

Metadata - Base program: FFmpeg - Source Taint: ENVIRONMENT_VARIABLE - Data Type: TYPEDEF - Data Flow: ADDRESS_AS_VARIABLE - Control Flow: INFINITE_LOOP

Metadata - Base program: FFmpeg - Source Taint: FILE_CONTENTS - Data Type: VOID_POINTER - Data Flow: ADDRESS_AS_LINEAR_EXPRESSION - Control Flow: UNCONDITIONAL_JUMP

This test case takes an unsigned long value and uses it in an initialization function for a struct. Within the initialization function, the long gets converted to an unsigned short when a struct uses the unsigned long as an initialization value for an unsigned short member. If the unsigned long n...

This test case squares a positive number. If the number is large enough, the square will wrap around and become a negative number. The test case then uses the number as a decrementing counter in a while loop. If the number is negative when entering the loop, the loop will never terminate. Metadat...

This test case takes a filename. It determines the size of the file, and attempts to check whether the size of the file is smaller than 128 characters. The arithmetic used in the if-check may cause an integer underflow, which will result in the if-check succeeding when it should fail. If the if-c...

This test case takes a filename. It determines the size of the file, and attempts to check whether the size of the file is smaller than 128 characters. The arithmetic used in the if-check may cause an integer underflow, which will result in the if-check succeeding when it should fail. If the if-c...

This weakness reads a number and attempts to modify the two high bytes of it, if it is greater than 65535. If the calculation to modify the two high bytes is performed, it will happen incorrectly due to the placement of the pointer modification and it instead changes the bytes on function pointer...

This test case squares a positive number. If the number is large enough, the square will wrap around and become a negative number. The test case then uses the number as a decrementing counter in a while loop. If the number is negative when entering the loop, the loop will never terminate. Metadat...

This test case allocates a stack buffer of size 16. It takes the user input and performs a check to see if it is possible to copy the user input into a 16-byte buffer. If the user input is larger than 15 bytes, then the check method returns a -1. This value is converted to an unsigned type (size_...