CWE: 190 Integer Overflow BadSource: fscanf Read data from the console using fscanf() GoodSource: Set data to a small, non-zero number (two) Sinks: increment GoodSink: Ensure there will not be an overflow before incrementing data BadSink : Increment data, which can cause an overflow Flow Va...

CWE: 190 Integer Overflow BadSource: max Set data to the max value for int64_t GoodSource: Set data to a small, non-zero number (two) Sinks: increment GoodSink: Ensure there will not be an overflow before incrementing data BadSink : Increment data, which can cause an overflow Flow Variant: ...

CWE: 190 Integer Overflow BadSource: max Set data to the max value for int64_t GoodSource: Set data to a small, non-zero number (two) Sinks: increment GoodSink: Ensure there will not be an overflow before incrementing data BadSink : Increment data, which can cause an overflow Flow Variant: ...

This test case implements an file read of 16 characters which does not properly null terminate the copied string if the original string is 16 characters in length or greater. The test case takes the name of a file, opens the file, and reads up to the first 16 characters into an internal buffer of...

This test case implements an sprintf that uses untrusted user input without a format string. The test case takes untrusted user input and passes it to an sprintf that does not implement a format string. This allows the user to pass format strings to the test case causing it to leak sensitive data...

This test case implements an improper array index validation that can cause a function pointer to get overwritten leading to a segfault. The test case takes untrusted user input and uses it to calculate array indexes which then get modified. If the untrusted input contains certain ASCII character...

This test case implements an unchecked read from a buffer. The buffer is declared as a fixed size member of a struct that is allocated on the stack. Untrusted input is not properly sanitized or restricted before being used to determine the number of characters to read from the buffer. This allows...

This test case takes a buffer as input and copies it into another buffer. It then converts the new buffer to uppercase and prints it out. If the provided input is larger than the buffer it is being copied into, then this will result in a buffer overwrite due to access with an incorrect length. Th...

This test case implements an incorrectly checked write into a heap allocated buffer. The buffer is malloc()'d with a fixed size and pointed to by a local variable. Untrusted input is not properly sanitized or restricted before being copied into the buffer, from the last character to the first. Th...

This test case implements an unchecked read from a buffer. The buffer is declared as a fixed size buffer as part of a struct on the heap. Untrusted input is not properly sanitized or restricted before being used as an index of the buffer to read. This allows inputs containing non-ascii characters...

This test case creates a function pointer that takes 2 const char * as input and returns an int. If the length of the taint source is 0 mod 3, the test case sets the function pointer to be strcmp. If the length of the taint source is 1 mod 3, the test case sets the function pointer to strcoll. Ot...

This test case implements an improper array index validation that can cause a function pointer to get overwritten leading to a segfault. The test case takes untrusted user input and uses it to calculate array indexes which then get modified. If the untrusted input contains certain ASCII character...

Metadata - Base program: Wireshark - Source Taint: FILE_CONTENTS - Data Type: STRUCT - Data Flow: BASIC - Control Flow: SEQUENCE

Metadata - Base program: Wireshark - Source Taint: FILE_CONTENTS - Data Type: VOID_POINTER - Data Flow: BUFFER_ADDRESS_ARRAY_INDEX - Control Flow: UNCONDITIONAL_JUMP

Metadata - Base program: Gimp - Source Taint: ENVIRONMENT_VARIABLE - Data Type: VOID_POINTER - Data Flow: BUFFER_ADDRESS_POINTER - Control Flow: RECURSIVE

Metadata - Base program: Subversion - Source Taint: FILE_CONTENTS - Data Type: ARRAY - Data Flow: BUFFER_ADDRESS_ARRAY_INDEX - Control Flow: CALLBACK

This test case takes an integer and checks for an upper limit. If the number is less than the upper limit, then, a buffer the size of the upper limit will be created and filled with 'a's. The buffer will then be filled with 'b's using the input integer. If the input is negative, this will result ...

This test case takes a filename. It determines the size of the file, and attempts to check whether the size of the file is smaller than 128 characters. The arithmetic used in the if-check may cause an integer underflow, which will result in the if-check succeeding when it should fail. If the if-c...

This test case takes the name of an externally accessible file as input, and treats the file as a global mutex lock. The test case will attempt to 'grab' the mutex lock by checking for the files existence, and creating it if it doesn't exist. The creation of the file is treated as grabbing the lo...

This test case implements a time of check time of use vulnerability that allows a DOS due to the input file being deleted before opening. The test case takes in a control file and an input file. The input file is checked to see if it is in the current working directory and exists. If both of thes...

This test case implements a non-reentrant function that is called by a signal handler. The test case takes a control file and input string as input. The control file is used for timing and the input string is used as data for the test case to manipulate. The test case assigns a signal handler tha...

This test case implements two threads that do not use synchronization while accessing a shared resource. The test case takes a control integer, the names of two control files, and an input string. The control integer and the two control files are used for timing within the test case to ensure tha...

This test case reads the taint source. If the length of the taint source is 63 bytes or less, it allocates a buffer to copy the taint source into. It then copies the taint source into the buffer, regardless of whether it actually allocated any memory or not. If it did not allocate memory, the buf...

This test case reads the taint source. If it contains a non-alphanumeric value, the source taint buffer is set to NULL. Subsequently, strcpy is called with the source taint buffer as this source. This causes a null pointer dereference. Metadata - Base program: Subversion - Source Taint: FILE_CO...

This test case reads the taint source. If it contains a non-alphanumeric value, the source taint buffer is set to NULL. Subsequently, strcpy is called with the source taint buffer as this source. This causes a null pointer dereference. Metadata - Base program: OpenSSL - Source Taint: SHARED_MEM...