A strncpy generates a string with a missing NUL termination. A NUL is explicitely added to ensure that the string is NUL terminated.

A strncpy generates a string that may be missing a NUL termination. When it is copied with strcpy a stack buffer can be overrun.

Memory resources are referenced indefinitely but never used, resulting in a memory leak. (fixed version 2)

Memory resources are referenced indefinitely but never used, resulting in a memory leak. (fixed version)

Memory resources are referenced indefinitely but never used, resulting in a memory leak.

Tainted output allows log entries to be forged. (fixed version)

Tainted output allows log entries to be forged.

Tainted output allows log entries to be forged. (fixed version)

Tainted output allows log entries to be forged.

integer overflow results in a short malloc and an overflow. A guard in the caller is used to protect against the overflow.

integer overflow results in a short malloc and an overflow. A guard in the caller is used to protect against the overflow but it is incorrect.

integer overflow results in a short malloc and an overflow. A guard is put in place to protect against the overflow.

integer overflow results in a short malloc and an overflow. A guard is put in place to protect against the overflow but it is incorrect.

integer overflow results in a short malloc and an overflow.

An exception leaks internal path information to the user. (fixed version)

An exception leaks internal path information to the user.

The credentials for connecting to the database are hard-wired into the sourcecode. (fixed version 2)

The credentials for connecting to the database are hard-wired into the sourcecode. (fixed version)

The credentials for connecting to the database are hard-wired into the sourcecode.

Printf is called with a format from a table. This is not a defect.

Syslog is called with a user supplied format string.

Two file operations are performed on a filename, allowing a filename race condition to occur.

Tainted input allows arbitrary files to be read and written. (fixed version)

Tainted input allows arbitrary files to be read and written.

A chroot() is performed with a chdir().