CWE: 190 Integer Overflow BadSource: fscanf Read data from the console using fscanf() GoodSource: Set data to a small, non-zero number (two) Sinks: multiply GoodSink: Ensure there will not be an overflow before multiplying data by 2 BadSink : If data is positive, multiply by 2, which can cau...

CWE: 127 Buffer Under-read BadSource: Set data pointer to before the allocated memory buffer GoodSource: Set data pointer to the allocated memory buffer BadSink : Copy data to string using a loop Flow Variant: 82 Data flow: data passed in a parameter to an virtual method called via a pointer

CWE: 122 Heap Based Buffer Overflow BadSource: Allocate using malloc() and set data pointer to a small buffer GoodSource: Allocate using malloc() and set data pointer to a large buffer Sink: memmove BadSink : Copy int array to data using memmove Flow Variant: 05 Control flow: if(staticTrue)...

CWE: 121 Stack Based Buffer Overflow BadSource: Initialize data as a large string GoodSource: Initialize data as a small string Sink: snprintf BadSink : Copy data to string using snprintf Flow Variant: 05 Control flow: if(staticTrue) and if(staticFalse)

CWE: 511 Logic Time Bomb Sinks: GoodSink: no debugging bypass BadSink : after a certain date, launch an executable Flow Variant: 13 Control flow: if(IO.static_final_five==5) and if(IO.static_final_five!=5)

CWE: 379 File Creation in Insecure Directory Sinks: perm GoodSink: securely create dir BadSink : permissions never set on dir Flow Variant: 17 Control flow: for loops

CWE: 369 Divide by zero BadSource: console_readLine Read data from the console using readLine GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: modulo GoodSink: Check for zero before modulo BadSink : Modulo by a value that may be zero Flow Variant: 66 Data flow: data pa...

CWE: 191 Integer Underflow BadSource: PropertiesFile Read a value from a .properties file GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: multiply GoodSink: Ensure there will not be an overflow before performing the multiplication BadSink : Unchecked multiplication, wh...

CWE: 134 Uncontrolled Format String BadSource: console_readLine Read data from the console using readLine GoodSource: A hardcoded string Sinks: format GoodSink: dynamic formatted stdout with string defined BadSink : dynamic formatted stdout without validation Flow Variant: 45 Data flow: dat...

CWE: 78 OS Command Injection BadSource: Environment Read input from an environment variable GoodSource: Benign input Sink: execvp BadSink : execute command with execvp Flow Variant: 52 Data flow: data passed as an argument from one function to another to another in three different source files

CWE: 762 Mismatched Memory Management Routines BadSource: Allocate data using new GoodSource: Allocate data using new [] Sinks: GoodSink: Deallocate data using delete BadSink : Deallocate data using delete [] Flow Variant: 51 Data flow: data passed as an argument from one function to anoth...

CWE: 590 Free of Invalid Pointer Not on the Heap BadSource: static Data buffer is declared static on the stack GoodSource: Allocate memory on the heap Sinks: BadSink : Print then free data Flow Variant: 67 Data flow: data passed in a struct from one function to another in different source files

CWE: 590 Free of Invalid Pointer Not on the Heap BadSource: static Data buffer is declared static on the stack GoodSource: Allocate memory on the heap Sink: BadSink : Print then free data Flow Variant: 03 Control flow: if(5==5) and if(5!=5)

CWE: 563 Unused Variable BadSource: Initialize data Sinks: GoodSink: Use data BadSink : do nothing Flow Variant: 13 Control flow: if(global_const_five==5) and if(global_const_five!=5)

CWE: 400 Resource Exhaustion BadSource: fgets Read data from the console using fgets() GoodSource: Assign count to be a relatively small number Sinks: fwrite GoodSink: Write to a file count number of times, but first validate count BadSink : Write to a file count number of times Flow Varian...

CWE: 390 Detection of Error Condition Without Action Sinks: w32CreateMutex GoodSink: Check the return value of CreateMutexW() and handle it properly BadSink : Check to see if CreateMutexW() failed, but do nothing about it Flow Variant: 12 Control flow: if(global_returns_t_or_f())

CWE: 36 Absolute Path Traversal BadSource: fromConsole Read input from the console GoodSource: Full path and file name Sink: open BadSink : Flow Variant: 32 Data flow using two pointers to the same value within the same function

CWE: 195 Signed to Unsigned Conversion BadSource: fscanf Read data from the console using fscanf() GoodSource: Positive integer Sinks: memcpy BadSink : Copy strings using memcpy() with the length of data Flow Variant: 65 Data/control flow: data passed as an argument from one function to a fu...

CWE: 188 Reliance on Data Memory Layout Sinks: modify_local GoodSink: Modify the second field of the struct using the field name BadSink : Attempt to modify second field in struct, assuming the first field is an int Flow Variant: 15 Control flow: switch(6)

CWE: 187 Partial Comparison BadSource: substring Provide a password that is a shortened version of the actual password GoodSource: Provide a matching password Sinks: ncmp_user_pw GoodSink: Compare the 2 passwords correctly BadSink : use strncmp() to do password match, but use the length of t...

CWE: 134 Uncontrolled Format String BadSource: connect_socket Read data using a connect socket (client side) GoodSource: Copy a fixed string into data Sinks: snprintf GoodSink: snwprintf with "%s" as the third argument and data as the fourth BadSink : snwprintf with data as the third argumen...

CWE: 129 Improper Validation of Array Index BadSource: fscanf Read data from the console using fscanf() GoodSource: Larger than zero but less than 10 Sinks: int GoodSink: Ensure the array index is valid BadSink : Improperly check the array index by not checking the upper bound Flow Variant:...

CWE: 127 Buffer Under-read BadSource: Set data pointer to before the allocated memory buffer GoodSource: Set data pointer to the allocated memory buffer Sink: memcpy BadSink : Copy data to string using memcpy Flow Variant: 10 Control flow: if(global_t) and if(global_f)

CWE: 127 Buffer Under-read BadSource: Set data pointer to before the allocated memory buffer GoodSource: Set data pointer to the allocated memory buffer Sink: memcpy BadSink : Copy data to string using memcpy Flow Variant: 05 Control flow: if(static_t) and if(static_f)

CWE: 121 Stack Based Buffer Overflow BadSource: Initialize data as a large string GoodSource: Initialize data as a small string Sink: ncpy BadSink : Copy data to string using wcsncpy Flow Variant: 03 Control flow: if(5==5) and if(5!=5)