A chroot() is performed without a chdir().

Use of negative index when accessing an array or negative size when creating it. These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for an executable suite of all the DRDC test cases.

A string function is passed a value without format string. This can lead to a format string vulnerability if the value can be in control of a malicious user. These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case I...

The size passed to malloc is not big enough to represent the type. These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for an executable suite of all the DRDC test cases.

A pointer to a local variable will go out of scope after the return. These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for an executable suite of all the DRDC test cases.

A reference to an allocated resource is lost because of pointer reuse. These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for an executable suite of all the DRDC test cases.

Reading of an uninitialized variable. These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for an executable suite of all the DRDC test cases.

A pointer to allocated memory is used, even if the memory block was freed before (the pointer was passed to free()). These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for an executable suite of ...

Use of gets(), strcpy() and similar functions, where there is no way to limit the size of the read string (no destination size parameter). These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for a...

A non null-terminated string is read. These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for an executable suite of all the DRDC test cases.

An array is overrun. These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for an executable suite of all the DRDC test cases.

A non-virtual destructor is never called. These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for an executable suite of all the DRDC test cases.

A signed integer looses its sign when implicitly casted to an unsigned integer. These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for an executable suite of all the DRDC test cases.

A value is casted into a type that can't represent it, because it's too small. These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for an executable suite of all the DRDC test cases.

The value exceeds the representation capacity of the type. These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for an executable suite of all the DRDC test cases.

A buffer function is called with a destination size too big. These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for an executable suite of all the DRDC test cases.

Incorrect pointer arithmetic to access a data structure. These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for an executable suite of all the DRDC test cases.

A C++ array is not deleted correctly, which could lead to memory leaks. These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for an executable suite of all the DRDC test cases.

The condition to exit the loop is never satisfied. These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for an executable suite of all the DRDC test cases.

A division by zero occurs. These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for an executable suite of all the DRDC test cases.

An erased c++ iterator is dereferenced. These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for an executable suite of all the DRDC test cases.

A past-the-end c++ iterator is dereferenced. These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for an executable suite of all the DRDC test cases.

A null pointer is dereferenced. These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for an executable suite of all the DRDC test cases.

memcopy() is used to copy memory from one region to another, but the two regions overlap, which is not supported by memcopy(). NOTE: the implementation in vstudio seems to handle overlapping regions correctly, even if the doc says otherwise. These test cases were graciously provided by Frederic M...

free() is given a pointer to something else than an allocated memory block. These test cases were graciously provided by Frederic Michaud of Defense Research & Development Canada - Valcartier. Please see test case ID 000-001-518 for an executable suite of all the DRDC test cases.