This test case implements an incorrectly checked write into a buffer that is contained within a heap allocated struct. The buffer is declared as a struct member with a fixed size. Untrusted input is not properly sanitized or restricted before being copied into the buffer, from the last character ...

Metadata - Base program: FFmpeg - Source Taint: ENVIRONMENT_VARIABLE - Data Type: TYPEDEF - Data Flow: ADDRESS_AS_CONSTANT - Control Flow: SEQUENCE

Metadata - Base program: Subversion - Source Taint: SOCKET - Data Type: UNION - Data Flow: VAR_ARG_LIST - Control Flow: MACROS

Metadata - Base program: Subversion - Source Taint: SHARED_MEMORY - Data Type: TYPEDEF - Data Flow: INDEX_ALIAS_1 - Control Flow: RECURSIVE

Metadata - Base program: OpenSSL - Source Taint: FILE_CONTENTS - Data Type: HEAP_POINTER - Data Flow: INDEX_ALIAS_1 - Control Flow: SET_JUMP_LONG_JUMP

Metadata - Base program: OpenSSL - Source Taint: FILE_CONTENTS - Data Type: VOID_POINTER - Data Flow: ADDRESS_ALIAS_50 - Control Flow: CALLBACK

Metadata - Base program: Subversion - Source Taint: SOCKET - Data Type: STRUCT - Data Flow: ADDRESS_AS_FUNCTION_RETURN_VALUE - Control Flow: UNCONDITIONAL_JUMP

Metadata - Base program: Tree - Source Taint: SOCKET - Data Type: SIMPLE - Data Flow: BASIC - Control Flow: SEQUENCE

This test case takes an unsigned long value and uses it in an initialization function for a struct. Within the initialization function, the long gets converted to an unsigned short when a struct uses the unsigned long as an initialization value for an unsigned short member. If the unsigned long n...

This weakness reads a number to be used as a loop counter. The loop counter is initially read as an unsigned long, then converted to an int. If the number read in is larger than MAX_UINT, it is silently converted to a negative number. This breaks the loop counter logic, resulting in an infinite l...

This test case allocates a stack buffer of size 16. It takes the user input and performs a check to see if it is possible to copy the user input into a 16-byte buffer. If the user input is larger than 15 bytes, then the check method returns a -1. This value is converted to an unsigned type (size_...

This weakness reads a number and attempts to modify the two high bytes of it, if it is greater than 65535. If the calculation to modify the two high bytes is performed, it will happen incorrectly due to the placement of the pointer modification and it instead changes the bytes on function pointer...

This test case implements a time of check time of use vulnerability that allows a DOS due to the input file being deleted before opening. The test case takes in a control file and an input file. The input file is checked to see if it is in the current working directory and exists. If both of thes...

This test case implements two threads that lock a counting semaphore multiple times, causing a deadlock if the lock is locked more times that it is unlocked. The test case takes a string as input and if the input string contains spaces spawns two threads, the first of which locks a semaphore twic...

This test case implements a non-reentrant function that uses a static integer to iterate through a string setting each character to null. The test case takes a control integer and an input string. The control integer is used for timing within the test case to ensure that we hit either a good or b...

This test case implements a singleton struct without synchronization that can lead to two threads receiving separate instances of the singleton struct resulting in a deadlocked state. It takes a control integer, the names of two control files, and another integer as input. The control integer and...

This test case implements a single signal handler that is associated with two signals. The test case takes the names of two control files and an input string. The control files are used for timing within the test case to ensure that the test case follows an exploiting or benign execution path, an...

This test case implements a non-reentrant function that is called by a signal handler. The test case takes a control file and input string as input. The control file is used for timing and the input string is used as data for the test case to manipulate. The test case assigns a signal handler tha...

This test case implements a non-reentrant function that uses a static integer to iterate through a string setting each character to null. The test case takes a control integer and an input string. The control integer is used for timing within the test case to ensure that we hit either a good or b...

This test case reads the taint source, and converts it to an integer, then an unsigned int. It uses a wrapped malloc to allocate a buffer of the size specified by the taint source. If the size is greater than 512, the wrapped malloc returns NULL. The program attempts to use the buffer, and if the...

This test case looks for the substring 'aba' within the taint source. If it finds the substring, it sets a pointer called stonesoup_second_buff to the beginning of the 'aba' substring, and the weakness continues without incident. If it does not find the substring, stonesoup_second_buff retains it...

This test case reads entries from a comma-separated-value file. It expects to read 3 strings from a file in the format: double quote, up to 79 characters, double quote, comma; double quote, up to 79 characters, double quote, comma; and double quote, up to 79 characters, double quote. The test cas...

This test case reads the taint source. If the length of the taint source is 63 bytes or less, it allocates a buffer to copy the taint source into. It then copies the taint source into the buffer, regardless of whether it actually allocated any memory or not. If it did not allocate memory, the buf...

This test case reads the taint source, and converts it to an integer, then an unsigned int. It uses a wrapped malloc to allocate a buffer of the size specified by the taint source. If the size is greater than 512, the wrapped malloc returns NULL. The program attempts to use the buffer, and if the...

A malloc-ed data is freed only once.