CWE: 78 OS Command Injection BadSource: listen_socket Read data using a listen socket (server side) GoodSource: Fixed string Sink: w32_execvp BadSink : execute command with wexecvp Flow Variant: 42 Data flow: data returned from one function to another in the same source file

CWE: 476 NULL Pointer Dereference BadSource: Set data to NULL GoodSource: Initialize data Sinks: GoodSink: Check for NULL before attempting to print data BadSink : Print data Flow Variant: 44 Data/control flow: data passed as an argument from one function to a function in the same source f...

CWE: 122 Heap Based Buffer Overflow BadSource: Allocate using malloc() and set data pointer to a small buffer GoodSource: Allocate using malloc() and set data pointer to a large buffer Sink: loop BadSink : Copy string to data using a loop Flow Variant: 05 Control flow: if(staticTrue) and if...

CWE: 690 Unchecked Return Value To NULL Pointer BadSource: calloc Allocate data using calloc() Sinks: GoodSink: Check to see if the data allocation failed and if not, use data BadSink : Dont check for NULL and use data Flow Variant: 08 Control flow: if(staticReturnsTrue()) and if(staticRetur...

CWE: 590 Free Memory Not on Heap BadSource: alloca Data buffer is allocated on the stack with alloca() GoodSource: Allocate memory on the heap Sinks: BadSink : Print then free data Flow Variant: 67 Data flow: data passed in a struct from one function to another in different source files

CWE: 478 Missing Default Case in Switch Sinks: GoodSink: Use default case in switch statement BadSink : No default case in a switch statement Flow Variant: 08 Control flow: if(staticReturnsTrue()) and if(staticReturnsFalse())

CWE: 457 Use of Uninitialized Variable BadSource: no_init Dont initialize data GoodSource: Initialize data Sinks: use GoodSink: Initialize then use data BadSink : Use data Flow Variant: 08 Control flow: if(staticReturnsTrue()) and if(staticReturnsFalse())

CWE: 426 Untrusted Search Path BadSource: Dont specify the full path in the OS command GoodSource: Specify the full path in the OS command Sinks: system BadSink : Execute the system function Flow Variant: 63 Data flow: pointer to data passed from one function to another in different source ...

CWE: 400 Resource Exhaustion BadSource: fscanf Read data from the console using fscanf() GoodSource: Assign count to be a relatively small number Sinks: sleep GoodSink: Validate count before using it as a parameter in sleep function BadSink : Use count as the parameter for sleep withhout che...

CWE: 369 Divide by Zero BadSource: zero Fixed value of zero GoodSource: Non-zero Sinks: divide GoodSink: Check for zero before dividing BadSink : Divide a constant by data Flow Variant: 11 Control flow: if(globalReturnsTrue()) and if(globalReturnsFalse())

CWE: 197 Numeric Truncation Error BadSource: large Set data to a number larger than CHAR_MAX GoodSource: Less than CHAR_MAX Sink: BadSink : Convert data to a char Flow Variant: 32 Data flow using two pointers to the same value within the same function

CWE: 195 Signed to Unsigned Conversion Error BadSource: negative Set data to a fixed negative number GoodSource: Positive integer Sinks: malloc BadSink : Allocate memory using malloc() with the size of data Flow Variant: 61 Data flow: data returned from one function to another in different s...

CWE: 195 Signed to Unsigned Conversion Error BadSource: fscanf Read data from the console using fscanf() GoodSource: Positive integer Sink: malloc BadSink : Allocate memory using malloc() with the size of data Flow Variant: 22 Control flow: Flow controlled by value of a global variable. Sink...

CWE: 191 Integer Underflow BadSource: min Set data to the min value for unsigned int GoodSource: Set data to a small, non-zero number (negative two) Sinks: sub GoodSink: Ensure there will not be an underflow before subtracting 1 from data BadSink : Subtract 1 from data, which can cause an Un...

CWE: 190 Integer Overflow BadSource: rand Set data to result of rand(), which may be zero GoodSource: Set data to a small, non-zero number (two) Sinks: add GoodSink: Ensure there will not be an overflow before adding 1 to data BadSink : Add 1 to data, which can cause an overflow Flow Varian...

CWE: 134 Uncontrolled Format String BadSource: environment Read input from an environment variable GoodSource: Copy a fixed string into data Sinks: printf GoodSink: printf with %s as the first argument and data as the second BadSink : printf with only data as an argument Flow Variant: 03 Co...

CWE: 127 Buffer Under-read BadSource: Set data pointer to before the allocated memory buffer GoodSource: Set data pointer to the allocated memory buffer Sinks: memmove BadSink : Copy data to string using memmove Flow Variant: 31 Data flow using a copy of data within the same function

CWE: 124 Buffer Underwrite BadSource: Set data pointer to before the allocated memory buffer GoodSource: Set data pointer to the allocated memory buffer Sinks: memmove BadSink : Copy string to data using memmove Flow Variant: 31 Data flow using a copy of data within the same function

CWE: 124 Buffer Underwrite BadSource: Set data pointer to before the allocated memory buffer GoodSource: Set data pointer to the allocated memory buffer Sink: memcpy BadSink : Copy string to data using memcpy Flow Variant: 54 Data flow: data passed as an argument from one function through t...

CWE: 121 Stack Based Buffer Overflow BadSource: Initialize data as a large string GoodSource: Initialize data as a small string Sinks: cpy BadSink : Copy data to string using wcscpy Flow Variant: 66 Data flow: data passed in an array from one function to another in different source files

CWE: 121 Stack Based Buffer Overflow BadSource: Initialize data as a large string GoodSource: Initialize data as a small string Sink: ncpy BadSink : Copy data to string using wcsncpy Flow Variant: 52 Data flow: data passed as an argument from one function to another to another in three diff...

CWE: 121 Stack Based Buffer Overflow BadSource: Set data pointer to the bad buffer GoodSource: Set data pointer to the good buffer Sink: memcpy BadSink : Copy string to data using memcpy Flow Variant: 08 Control flow: if(staticReturnsTrue()) and if(staticReturnsFalse())

CWE: 121 Stack Based Buffer Overflow BadSource: fscanf Read data from the console using fscanf() GoodSource: Larger than zero but less than 10 Sinks: GoodSink: Ensure the array index is valid BadSink : Improperly check the array index by not checking the upper bound Flow Variant: 12 Control...

Buffer Overflow. This code has been donated by MIT. This test case has the following characteristics : write/read = Write, Which bound = Upper, Data type = character, Memory location = stack, Scope = inter-file/inter-procedural, Container = no, Pointer = no, Index complexity = N/A, Addres...

Buffer Overflow. This code has been donated by MIT. This test case has the following characteristics : write/read = Write, Which bound = Upper, Data type = character, Memory location = stack, Scope = same, Container = no, Pointer = no, Index complexity = variable, Address complexity = con...