Infinite loop

Test of tool recognition of pointer scaling weakness.

Test if a tool can detect a heap inspection weakness.

This sample contains the format string vulnerability CVE-2000-0867 from sysklogd 1.3.30. The flaw is found when the LogLine() function of klogd.c calls the Syslog() function in the same file.

Sensitive data from getpass is output with syslog.

Sensitive data from getpass is output with printf.

Execl() is called with user-provided data but only if it matches an item in a safe list.

Execl() is called with user-provided data.

System() is called with user-provided data.

Sprintf is used to copy a string to a stack buffer. A guard in the caller prevents an overflow from occuring

Sprintf is used to copy a string to a stack buffer. A guard in the caller is used to prevent an overflow from occuring but the guard is incorrect and an overflow can still occur.

Sprintf is used to copy a string to a stack buffer. A guard is used to prevent a buffer overflow condition.

Sprintf is used to copy a string to a stack buffer. A guard is used to prevent a buffer overflow condition but the guard is incorrect and a buffer overflow can still occur.

Sprintf is used to copy a string to a stack buffer. The length is guarded with a length specifier in the format string preventing a buffer overflow from occuring.

Sprintf is used to copy a string to a stack buffer. The length is guarded with a length specifier in the format string but the wrong length is given.

sprintf allows a stack buffer to be overrun.

Snprintf is called with an improper bound. A guard in the caller prevents an overflow condition from occuring.

Snprintf is called with an improper bound. A guard in the caller attempts to prevent an overflow condition but is done incorrectly.

snprintf is used repeatedly while keeping track of the residual buffer length.

snprintf is used repeatedly while keeping track of the residual buffer length, however an accounting error allows a heap buffer to be overrun.

snprintf with correct bounds safely copies a string into a heap buffer.

snprintf with incorrect bounds allows a heap buffer to be overrun.

Snprintf is called with a bad bound but is protected with a length specifier in the format string.

Snprintf is called with a bad bound. An attempt is made to protect against buffer overflows with a lenght specifier in the format string but this is done incorrectly.

Snprintf is called with an improper bound. A guard in the caller prevents an overflow condition from occuring.