CWE: 775 Missing Release of File Descriptor or Handle After Effective Lifetime BadSource: Open a file using CreateFile() Sinks: GoodSink: Close the file using CloseHandle() BadSink : Do not close file Flow Variant: 05 Control flow: if(staticTrue) and if(staticFalse)

CWE: 773 Missing Reference to Active File Descriptor or Handle BadSource: Create a file descriptor using open() Sinks: GoodSink: Close the file before reusing the file descriptor BadSink : Reassign the file descriptor before closing the file Flow Variant: 65 Data/control flow: data passed a...

CWE: 675 Duplicate Operations on Resource BadSource: freopen Open and close a file using freopen() and flose() GoodSource: Open a file using fopen() Sinks: GoodSink: Do nothing BadSink : Close the file Flow Variant: 44 Data/control flow: data passed as an argument from one function to a fun...

CWE: 457 Use of Uninitialized Variable BadSource: partial_init Initialize part, but not all of the array GoodSource: Initialize data Sinks: use GoodSink: Initialize then use data BadSink : Use data Flow Variant: 12 Control flow: if(globalReturnsTrueOrFalse())

CWE: 400 Resource Exhaustion BadSource: fscanf Read data from the console using fscanf() GoodSource: Assign count to be a relatively small number Sinks: sleep GoodSink: Validate count before using it as a parameter in sleep function BadSink : Use count as the parameter for sleep withhout che...

CWE: 400 Resource Exhaustion BadSource: fgets Read data from the console using fgets() GoodSource: Assign count to be a relatively small number Sinks: for_loop GoodSink: Validate count before using it as the loop variant in a for loop BadSink : Use count as the loop variant in a for loop Fl...

CWE: 400 Resource Exhaustion BadSource: connect_socket Read data using a connect socket (client side) GoodSource: Assign count to be a relatively small number Sinks: fwrite GoodSink: Write to a file count number of times, but first validate count BadSink : Write to a file count number of tim...

CWE: 369 Divide by Zero BadSource: connect_socket Read data using a connect socket (client side) GoodSource: A hardcoded non-zero number (two) Sinks: GoodSink: Check value of or near zero before dividing BadSink : Divide a constant by data Flow Variant: 12 Control flow: if(globalReturnsTrue...

CWE: 272 Least Privilege Violation Sinks: CreateProcess GoodSink: Create a process using CreateProcessA() with quotes for the executable path BadSink : Create a process using CreateProcessA() without quotes for the executable path Flow Variant: 17 Control flow: for loops

CWE: 252 Unchecked Return Value Sinks: snprintf GoodSink: Check if snprintf() fails BadSink : Do not check if snprintf() fails Flow Variant: 16 Control flow: while(1)

CWE: 252 Unchecked Return Value Sinks: fwrite GoodSink: Check if fwrite() fails BadSink : Do not check if fwrite() fails Flow Variant: 03 Control flow: if(5==5) and if(5!=5)

CWE: 195 Signed to Unsigned Conversion Error BadSource: fgets Read data from the console using fgets() GoodSource: Positive integer Sink: memcpy BadSink : Copy strings using memcpy() with the length of data Flow Variant: 10 Control flow: if(globalTrue) and if(globalFalse)

CWE: 194 Unexpected Sign Extension BadSource: connect_socket Read data using a connect socket (client side) GoodSource: Positive integer Sinks: memcpy BadSink : Copy strings using memcpy() with the length of data Flow Variant: 61 Data flow: data returned from one function to another in diffe...

CWE: 191 Integer Underflow BadSource: rand Set data to result of rand() GoodSource: Set data to a small, non-zero number (negative two) Sinks: sub GoodSink: Ensure there will not be an underflow before subtracting 1 from data BadSink : Subtract 1 from data, which can cause an Underflow Flow...

CWE: 191 Integer Underflow BadSource: connect_socket Read data using a connect socket (client side) GoodSource: Set data to a small, non-zero number (negative two) Sinks: sub GoodSink: Ensure there will not be an underflow before subtracting 1 from data BadSink : Subtract 1 from data, which ...

CWE: 191 Integer Underflow BadSource: rand Set data to result of rand() GoodSource: Set data to a small, non-zero number (negative two) Sinks: multiply GoodSink: Ensure there will not be an underflow before multiplying data by 2 BadSink : If data is negative, multiply by 2, which can cause a...

CWE: 134 Uncontrolled Format String BadSource: environment Read input from an environment variable GoodSource: Copy a fixed string into data Sinks: vprintf GoodSink: vwprintf with a format string BadSink : vwprintf without a format string Flow Variant: 31 Data flow using a copy of data with...

CWE: 134 Uncontrolled Format String BadSource: file Read input from a file GoodSource: Copy a fixed string into data Sinks: vprintf GoodSink: vprintf with a format string BadSink : vprintf without a format string Flow Variant: 21 Control flow: Flow controlled by value of a static global var...

CWE: 122 Heap Based Buffer Overflow BadSource: Allocate memory for a string, but do not allocate space for NULL terminator GoodSource: Allocate enough memory for a string and the NULL terminator Sinks: memmove BadSink : Copy string to data using memmove() Flow Variant: 67 Data flow: data pa...

CWE: 121 Stack Based Buffer Overflow BadSource: Initialize data as a large string GoodSource: Initialize data as a small string Sink: cat BadSink : Copy data to string using strcat Flow Variant: 17 Control flow: for loops

CWE: 121 Stack Based Buffer Overflow BadSource: Initialize data as a large string GoodSource: Initialize data as a small string Sink: ncpy BadSink : Copy data to string using wcsncpy Flow Variant: 07 Control flow: if(staticFive==5) and if(staticFive!=5)

CWE: 121 Stack Based Buffer Overflow BadSource: Initialize data as a large string GoodSource: Initialize data as a small string Sinks: loop BadSink : Copy data to string using a loop Flow Variant: 66 Data flow: data passed in an array from one function to another in different source files

CWE: 121 Stack Based Buffer Overflow BadSource: Set data pointer to the bad buffer GoodSource: Set data pointer to the good buffer Sink: loop BadSink : Copy string to data using a loop Flow Variant: 54 Data flow: data passed as an argument from one function through three others to a fifth; ...

CWE: 114 Process Control BadSource: listen_socket Read data using a listen socket (server side) GoodSource: Hard code the full pathname to the library Sink: BadSink : Load a dynamic link library Flow Variant: 07 Control flow: if(staticFive==5) and if(staticFive!=5)

CWE: 114 Process Control BadSource: file Read input from a file GoodSource: Hard code the full pathname to the library Sink: BadSink : Load a dynamic link library Flow Variant: 32 Data flow using two pointers to the same value within the same function