CWE: 563 Unused Variable BadSource: Initialize data Sinks: GoodSink: Use data BadSink : do nothing Flow Variant: 21 Control flow: Flow controlled by value of a static global variable. All functions contained in one file.

CWE: 506 Embedded Malicious Code Sinks: file_attrib_accessed GoodSink: Do not modify the files last accessed time attribute BadSink : Modify the files last accessed time attribute Flow Variant: 17 Control flow: for loops

CWE: 457 Use of Uninitialized Variable BadSource: no_init Dont initialize data GoodSource: Initialize data Sinks: use GoodSink: Initialize then use data BadSink : Use data Flow Variant: 06 Control flow: if(STATIC_CONST_FIVE==5) and if(STATIC_CONST_FIVE!=5)

CWE: 426 Untrusted Search Path BadSource: Dont specify the full path in the OS command GoodSource: Specify the full path in the OS command Sink: system BadSink : Execute the system function Flow Variant: 42 Data flow: data returned from one function to another in the same source file

CWE: 401 Memory Leak BadSource: calloc Allocate data using calloc() GoodSource: Allocate data on the stack Sinks: GoodSink: call free() on data BadSink : no deallocation of data Flow Variant: 68 Data flow: data passed as a global variable from one function to another in different source files

CWE: 400 Resource Exhaustion BadSource: rand Set data to result of rand(), which may be zero GoodSource: Assign count to be a relatively small number Sinks: fwrite GoodSink: Write to a file count number of times, but first validate count BadSink : Write to a file count number of times Flow ...

CWE: 400 Resource Exhaustion BadSource: fgets Read data from the console using fgets() GoodSource: Assign count to be a relatively small number Sinks: sleep GoodSink: Validate count before using it as a parameter in sleep function BadSink : Use count as the parameter for sleep withhout check...

CWE: 319 Cleartext Transmission of Sensitive Information BadSource: listen_socket Read the password using a listen socket (server side) GoodSource: Use a hardcoded password (one that was not sent over the network) Sinks: GoodSink: Decrypt the password before using it in an authentication API ...

CWE: 284 Improper Access Control Sinks: CreateWindowStation GoodSink: Create a windows station using CreateWindowStationA() without excessive privileges BadSink : Create a windows station using CreateWindowStationA() with excessive privileges Flow Variant: 17 Control flow: for loops

CWE: 253 Incorrect Check of Return Value Sinks: w32CreateMutex GoodSink: Correctly check if CreateMutexA() failed BadSink : Incorrectly check if CreateMutexA() failed Flow Variant: 03 Control flow: if(5==5) and if(5!=5)

CWE: 252 Unchecked Return Value Sinks: fscanf GoodSink: Check if fscanf() fails BadSink : Do not check if fscanf() fails Flow Variant: 16 Control flow: while(1)

CWE: 252 Unchecked Return Value Sinks: fputc GoodSink: Check if fputc() fails BadSink : Do not check if fputc() fails Flow Variant: 11 Control flow: if(globalReturnsTrue()) and if(globalReturnsFalse())

CWE: 226 Sensitive Information Uncleared Before Release Sinks: alloca GoodSink: Clear the password buffer before releasing the memory from the stack BadSink : Release password from the stack without first clearing the buffer Flow Variant: 10 Control flow: if(globalTrue) and if(globalFalse)

CWE: 191 Integer Underflow BadSource: rand Set data to result of rand() GoodSource: Set data to a small, non-zero number (negative two) Sinks: sub GoodSink: Ensure there will not be an underflow before subtracting 1 from data BadSink : Subtract 1 from data, which can cause an Underflow Flow...

CWE: 190 Integer Overflow BadSource: rand Set data to result of rand() GoodSource: Set data to a small, non-zero number (two) Sinks: multiply GoodSink: Ensure there will not be an overflow before multiplying data by 2 BadSink : If data is positive, multiply by 2, which can cause an overflow ...

CWE: 134 Uncontrolled Format String BadSource: file Read input from a file GoodSource: Copy a fixed string into data Sinks: snprintf GoodSink: snprintf with %s as the third argument and data as the fourth BadSink : snprintf with data as the third argument Flow Variant: 06 Control flow: if(S...

CWE: 134 Uncontrolled Format String BadSource: file Read input from a file GoodSource: Copy a fixed string into data Sinks: fprintf GoodSink: fprintf with %s as the second argument and data as the third BadSink : fprintf with data as the second argument Flow Variant: 21 Control flow: Flow c...

CWE: 134 Uncontrolled Format String BadSource: environment Read input from an environment variable GoodSource: Copy a fixed string into data Sinks: vfprintf GoodSink: vfprintf with a format string BadSink : vfprintf without a format string Flow Variant: 15 Control flow: switch(6) and switch(7)

CWE: 122 Heap Based Buffer Overflow BadSource: Initialize data as a large string GoodSource: Initialize data as a small string Sinks: cat BadSink : Copy data to string using wcscat Flow Variant: 64 Data flow: void pointer to data passed from one function to another in different source files

CWE: 121 Stack Based Buffer Overflow BadSource: Initialize data as a large string GoodSource: Initialize data as a small string Sink: cat BadSink : Copy data to string using wcscat Flow Variant: 51 Data flow: data passed as an argument from one function to another in different source files

CWE: 121 Stack Based Buffer Overflow BadSource: Initialize data as a large string GoodSource: Initialize data as a small string Sinks: snprintf BadSink : Copy data to string using snprintf Flow Variant: 65 Data/control flow: data passed as an argument from one function to a function in a di...

CWE: 121 Stack Based Buffer Overflow BadSource: Set data pointer to the bad buffer GoodSource: Set data pointer to the good buffer Sink: memmove BadSink : Copy string to data using memmove Flow Variant: 12 Control flow: if(globalReturnsTrueOrFalse())

CWE: 121 Stack Based Buffer Overflow BadSource: Set data pointer to the bad buffer GoodSource: Set data pointer to the good buffer Sinks: ncat BadSink : Copy string to data using strncat Flow Variant: 45 Data flow: data passed as a static global variable from one function to another in the ...

CWE: 121 Stack Based Buffer Overflow BadSource: Point data to a buffer that does not have space for a NULL terminator GoodSource: Point data to a buffer that includes space for a NULL terminator Sink: ncpy BadSink : Copy string to data using strncpy() Flow Variant: 05 Control flow: if(stati...

CWE: 114 Process Control BadSource: listen_socket Read data using a listen socket (server side) GoodSource: Hard code the full pathname to the library Sinks: BadSink : Load a dynamic link library Flow Variant: 63 Data flow: pointer to data passed from one function to another in different sou...