This test takes in a value from a taint source, and creates a string array based on the value. Math is performed on the value such that, if the value is greater than 500, the resultant value 'wraps around', and becomes negative. This results in an exception being thrown, due to the invalid a...

This test takes in a value passed in as an argument and uses it to compute a divisor which is later used in a modulus operation. Metadata - Base program: Apache Lenya - Source Taint: FILE_CONTENTS - Data Type: SIMPLE - Data Flow: JAVA_GENERICS - Control Flow: INTERPROCEDURAL_1

This test takes in a value from a taint source, and creates a string array based on the value. Math is performed on the value such that, if the value is 32749 or greater, the resultant value underflows and becomes positive. This results in an infinite loop. Metadata - Base program: Apache Je...

This test takes in a value from a taint source, which is then used to allocate an array. This value is positive when stored in a byte, but if the value is between 128 and 255, becomes negative if stored in a byte. When this negative value is stored in a larger container (an int) it becomes a ...

This test takes in a value from an argument and uses it as a array accessor resulting in an ArrayIndexOutOfBounds exception. Metadata - Base program: Apache Jena - Source Taint: FILE_CONTENTS - Data Type: ARRAY - Data Flow: ADDRESS_AS_FUNCTION_RETURN_VALUE - Control Flow: INFINITE_LOOP

This test takes in a value from a taint source, which is then used to allocate an array. This value is positive when stored in a byte, but if the value is between 128 and 255, becomes negative if stored in a byte. When this negative value is stored in a larger container (an int) it becomes a ...

This test takes in a value from a taint source. Math is performed on the value such that, if the value is 32767 or 32766, the resultant value 'wraps around', and becomes negative. This results in an infinite loop. Metadata - Base program: Elastic Search - Source Taint: ENVIRONMENT_VARIABLE ...

This test takes in a value from a taint source. The value is truncated to an integer, and then used to generate a random number within a range. If the converted integer value is negative, SecureRandom.nextInt(value) will throw a RuntimeException. Metadata - Base program: Coffee MUD - Source...

This test takes in a value from a taint source, which is then used to allocate an array. This value is positive when stored in a byte, but if the value is between 128 and 255, becomes negative if stored in a byte. When this negative value is stored in a larger container (an int) it becomes a ...

This test takes in a value from a taint source, and creates a string array based on the value. Math is performed on the value such that, if the value is 32749 or greater, the resultant value underflows and becomes positive. This results in an infinite loop. Metadata - Base program: Apache Lu...

This test takes in a value from a taint source, and creates a string array based on the value. Math is performed on the value such that, if the value is 32749 or greater, the resultant value underflows and becomes positive. This results in an infinite loop. Metadata - Base program: Apache Le...

This test takes in a value from a taint source. Math is performed on the value such that, if the value is 32767 or 32766, the resultant value 'wraps around', and becomes negative. This results in an infinite loop. Metadata - Base program: Apache Lenya - Source Taint: SOCKET - Data Type: VOI...

This test takes in a value from a taint source, and creates a string array based on the value. Math is performed on the value such that, if the value is greater than 500, the resultant value 'wraps around', and becomes negative. This results in an exception being thrown, due to the invalid a...

This test takes in a value from a taint source. Math is performed on the value such that, if the value is 32767 or 32766, the resultant value 'wraps around', and becomes negative. This results in an infinite loop. Metadata - Base program: Elastic Search - Source Taint: SOCKET - Data Type: A...

This test takes in a value from an argument and uses it as a array accessor resulting in an ArrayIndexOutOfBounds exception. Metadata -Base program: Apache Lucene - Source Taint: FILE_CONTENTS - Data Type: array - Data Flow: basic - Control Flow: interprocedural_1

This test takes in a char value from a taint source. The value is cast to a byte causing an unsigned to signed conversion. This value is then used to allocate an array. If the original char is >127 this will lead to a negative index for the array causing a NegativeArraySizeException. Metadata - ...

This test takes in a value from a taint source. Math is performed on the value such that, if the value is 32767 or 32766, the resultant value 'wraps around', and becomes negative. This results in an infinite loop. Metadata - Base program: Apache Lenya - Source Taint: SOCKET - Data Type: SIM...

This test takes in a value passed in as an argument and uses it to compute a divisor which is later used in a modulus operation. Metadata - Base program: Apache Lucene - Source Taint: FILE_CONTENTS - Data Type: ARRAY - Data Flow: VAR_ARG_LIST - Control Flow: FUNCTION_INVOCATION_OVERLOAD

This test takes in a value from a taint source, and creates a string array based on the value. Math is performed on the value such that, if the value is 32749 or greater, the resultant value underflows and becomes positive. This results in an infinite loop. Metadata - Base program: Coffee MU...

This test takes in a value from a taint source, which is then used to allocate an array. This value is positive when stored in a byte, but if the value is between 128 and 255, becomes negative if stored in a byte. When this negative value is stored in a larger container (an int) it becomes a ...

This test takes in a value passed in as an argument and uses it to compute a divisor which is later used in a modulus operation. Metadata - Base program: Apache Lucene - Source Taint: SOCKET - Data Type: VOID_POINTER - Data Flow: ADDRESS_AS_CONSTANT - Control Flow: RECURSIVE

This test takes in a value passed in as an argument and uses it to compute a divisor which is later used in a modulus operation. Metadata - Base program: Apache POI - Source Taint: SOCKET - Data Type: VOID_POINTER - Data Flow: JAVA_GENERICS - Control Flow: BREAK_WITH_LABEL

This test takes in a value passed in as an argument and uses it to compute a divisor which is later used in a modulus operation. Metadata - Base program: Elastic Search - Source Taint: ENVIRONMENT_VARIABLE - Data Type: SIMPLE - Data Flow: JAVA_GENERICS - Control Flow: FUNCTION_INVOCATION_O...

This test takes in a value from a taint source. Math is performed on the value such that, if the value is 32767 or 32766, the resultant value 'wraps around', and becomes negative. This results in an infinite loop. Metadata - Base program: Apache Jena - Source Taint: SOCKET - Data Type: ARRA...

This test takes in a value from a taint source. The value is truncated to an integer, and then used to generate a random number within a range. If the converted integer value is negative, SecureRandom.nextInt(value) will throw a RuntimeException. Metadata - Base program: Apache POI - Source...