ABM 1.0.1 Test suite #35

A chroot() is performed without a chdir().

A chroot() is performed with a chdir().

Tainted input allows arbitrary files to be read and written.

Tainted input allows arbitrary files to be read and written. (fixed version)

Two file operations are performed on a filename, allowing a filename race condition to occur.

Syslog is called with a user supplied format string.

Printf is called with a format from a table. This is not a defect.

The credentials for connecting to the database are hard-wired into the sourcecode.

The credentials for connecting to the database are hard-wired into the sourcecode. (fixed version)

The credentials for connecting to the database are hard-wired into the sourcecode. (fixed version 2)

An exception leaks internal path information to the user.

An exception leaks internal path information to the user. (fixed version)

integer overflow results in a short malloc and an overflow.

integer overflow results in a short malloc and an overflow. A guard is put in place to protect against the overflow but it is incorrect.

integer overflow results in a short malloc and an overflow. A guard is put in place to protect against the overflow.

integer overflow results in a short malloc and an overflow. A guard in the caller is used to protect against the overflow but it is incorrect.

integer overflow results in a short malloc and an overflow. A guard in the caller is used to protect against the overflow.

Tainted output allows log entries to be forged.

Tainted output allows log entries to be forged. (fixed version)

Tainted output allows log entries to be forged.

Tainted output allows log entries to be forged. (fixed version)

Memory resources are referenced indefinitely but never used, resulting in a memory leak.

Memory resources are referenced indefinitely but never used, resulting in a memory leak. (fixed version)

Memory resources are referenced indefinitely but never used, resulting in a memory leak. (fixed version 2)

A strncpy generates a string that may be missing a NUL termination. When it is copied with strcpy a stack buffer can be overrun.