CWE: 122 Heap Based Buffer Overflow BadSource: Allocate using malloc() and set data pointer to a small buffer GoodSource: Allocate using malloc() and set data pointer to a large buffer Sink: memcpy BadSink : Copy string to data using memcpy Flow Variant: 16 Control flow: while(1)

CWE: 89 SQL Injection BadSource: connect_tcp Read data using an outbound tcp connection GoodSource: A hardcoded string Sinks: executeBatch GoodSink: prepared sqlstatement, batch BadSink : untrusted input to raw update batch Flow Variant: 66 Data flow: data passed in an array from one method...

CWE: 643 Unsafe Treatment of XPath Input BadSource: PropertiesFile Read a value from a .properties file (in property named data) GoodSource: A hardcoded string Sinks: unvalidatedXPath GoodSink: validate input through StringEscapeUtils BadSink : user input is used without validate Flow Varia...

CWE: 369 Divide by zero BadSource: PropertiesFile Read a value from a .properties file GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: modulo GoodSink: Check for zero before modulo BadSink : Modulo by a value that may be zero Flow Variant: 68 Data flow: data passed as...

CWE: 369 Divide by zero BadSource: PropertiesFile Read a value from a .properties file GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: divide GoodSink: Check for zero before dividing BadSink : Dividing by a value that may be zero Flow Variant: 68 Data flow: data passe...

CWE: 191 Integer Underflow BadSource: listen_tcp Read data using a listening tcp connection GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: subtract GoodSink: Ensure there will not be an underflow before performing the subtraction BadSink : Unchecked subtraction can le...

CWE: 78 OS Command Injection BadSource: listen_socket Read data using a listen socket (server side) GoodSource: Benign input Sink: w32spawnlp BadSink : execute command with spawnlp Flow Variant: 12 Control flow: if(global_returns_t_or_f())

CWE: 78 OS Command Injection BadSource: fromConsole Read input from the console GoodSource: Benign input Sink: popen BadSink : Execute command using popen() Flow Variant: 05 Control flow: if(static_t) and if(static_f)

CWE: 78 OS Command Injection BadSource: connect_socket Read data using a connect socket (client side) GoodSource: Benign input Sink: w32spawnvp BadSink : execute command with spawnvp Flow Variant: 06 Control flow: if(static_const_five==5) and if(static_const_five!=5)

CWE: 78 OS Command Injection BadSource: Environment Read input from an environment variable GoodSource: Benign input Sink: execl BadSink : execute command with execl Flow Variant: 12 Control flow: if(global_returns_t_or_f())

CWE: 762 Mismatched Memory Management Routines BadSource: Allocate data using new [] GoodSource: Allocate data using new Sinks: GoodSink: Deallocate data using delete [] BadSink : Deallocate data using delete Flow Variant: 63 Data flow: pointer to data passed from one function to another i...

CWE: 606 Unchecked Input For Loop Condition BadSource: connect_socket Read data using a connect socket (client side) GoodSource: Input a number less than MAX_LOOP Sinks: GoodSink: Use data as the for loop variant after checking to see if it is less than MAX_LOOP BadSink : Use data as the for...

CWE: 534 Information Leak Through Debug Log Files Sinks: GoodSink: Write to the log, but do not write the password BadSink : Write to the log and include the password Flow Variant: 03 Control flow: if(5==5) and if(5!=5)

CWE: 415 Double Free BadSource: Allocate data using new and Deallocae data using delete GoodSource: Allocate data using new Sinks: GoodSink: do nothing BadSink : Deallocate data using delete Flow Variant: 11 Control flow: if(global_returns_t()) and if(global_returns_f())

CWE: 415 Double Free BadSource: Allocate data using malloc() and Deallocate data using free() GoodSource: Allocate data using malloc() Sinks: GoodSink: do nothing BadSink : Deallocate data using free() Flow Variant: 16 Control flow: while(1) and while(0)

CWE: 369 Divide By Zero BadSource: fscanf Read data from the console using fscanf() GoodSource: Non-zero Sink: BadSink : Divide a constant by data Flow Variant: 11 Control flow: if(global_returns_t()) and if(global_returns_f())

CWE: 195 Signed to Unsigned Conversion BadSource: listen_socket Read data using a listen socket (server side) GoodSource: Positive integer Sink: malloc BadSink : Allocate memory using malloc() with the size of data Flow Variant: 01 Baseline

CWE: 194 Unexpected Sign Extension BadSource: rand Set data to result of rand(), which could be negative GoodSource: Positive integer Sink: memmove BadSink : Copy strings using memmove() with the length of data Flow Variant: 10 Control flow: if(global_t) and if(global_f)

CWE: 191 Integer Underflow BadSource: rand Set data to result of rand() GoodSource: Small, non-zero Sinks: GoodSink: Ensure there is no underflow before performing the subtraction BadSink : Subtract 1 from data Flow Variant: 02 Control flow: if(1) and if(0)

CWE: 134 Uncontrolled Format String BadSource: listen_socket Read data using a listen socket (server side) GoodSource: Copy a fixed string into data Sinks: fprintf GoodSink: fwprintf with "%s" as the second argument and data as the third BadSink : fwprintf with data as the second argument F...

CWE: 134 Uncontrolled Format String BadSource: connect_socket Read data using a connect socket (client side) GoodSource: Copy a fixed string into data Sinks: vprintf GoodSink: vwprintf with a format string BadSink : vwprintf without a format string Flow Variant: 68 Data flow: data passed as...

CWE: 134 Uncontrolled Format String BadSource: fromFile Read input from a file GoodSource: Copy a fixed string into data Sinks: snprintf GoodSink: snprintf with "%s" as the third argument and data as the fourth BadSink : snprintf with data as the third argument Flow Variant: 61 Data flow: d...

CWE: 134 Uncontrolled Format String BadSource: fromFile Read input from a file GoodSource: Copy a fixed string into data Sinks: printf GoodSink: printf with "%s" as the first argument and data as the second BadSink : printf with only data as an argument Flow Variant: 15 Control flow: switch...

CWE: 122 Heap Based Buffer Overflow BadSource: Initialize data as a large string GoodSource: Initialize data as a small string Sinks: memmove BadSink : Copy data to string using memmove Flow Variant: 44 Data/control flow: data passed as an argument from one function to a function in the sam...

Unprotected string copy, unlocked shared resource. PLOVER: BUFF.OVER, RACE