Creating test case using base program. Added an environment variable read to the function definition. Completed injection. UNSPECIFIED UNSPECIFIED $SS_TC_ROOT/$SS_TC_INSTALL/bin/tree make install CC="$SS_CC" LD="$SS_LNK" CFLAGS="$CFLAGS" CPPFLAGS="$CPPFLAGS" LDFLAGS="$LDFLAGS" prefix="$SS_TC_ROOT/$SS_TC_INSTALL" LIBS="$LIBS" Malloc a buffer. Copy the input string to the buffer. If the first character is 'a' or higher, free the buffer. Use the buffer. This will cause a seg fault if the buffer was previously freed. NONE AAA $SS_TC_ROOT/logs/execute/lttng $SS_TC_DEPS/lib64/liblttng-stonesoup-c.so:$SS_TC_DEPS/lib64/liblttng-ust-fork.so 0 --charset ASCII --sort=name -n -q input/good-01 STDOUT-REPORT-01 AND STDOUT-CONTENT-LENGTH-01 AND NOT TIMEOUT AND NOT CONTROLLED_EXIT 5 directories, 10 files SIMILAR DOES_NOT_RETURN CONTROLLED_EXIT Malloc a buffer. Copy the input string to the buffer. If the first character is 'a' or higher, free the buffer. Use the buffer. This will cause a seg fault if the buffer was previously freed. NONE 12345 Hello world! $SS_TC_ROOT/logs/execute/lttng $SS_TC_DEPS/lib64/liblttng-stonesoup-c.so:$SS_TC_DEPS/lib64/liblttng-ust-fork.so 0 --charset ASCII --sort=name -n -q -L 2 input/good-02 STDOUT-REPORT-02 AND STDOUT-CONTENT-LENGTH-02 AND NOT TIMEOUT AND NOT CONTROLLED_EXIT 5 directories, 4 files SIMILAR DOES_NOT_RETURN CONTROLLED_EXIT Malloc a buffer. Copy the input string to the buffer. If the first character is 'a' or higher, free the buffer. Use the buffer. This will cause a seg fault if the buffer was previously freed. NONE [Good-bye cruel world!] $SS_TC_ROOT/logs/execute/lttng $SS_TC_DEPS/lib64/liblttng-stonesoup-c.so:$SS_TC_DEPS/lib64/liblttng-ust-fork.so 0 --charset ASCII --sort=name -n -q -J input/good-03 STDOUT-REPORT-03 AND STDOUT-CONTENT-LENGTH-03 AND NOT TIMEOUT AND NOT CONTROLLED_EXIT {"type":"report","directories":7,"files":367} SIMILAR DOES_NOT_RETURN CONTROLLED_EXIT Malloc a buffer. Copy the input string to the buffer. If the first character is 'a' or higher, free the buffer. Use the buffer. This will cause a seg fault if the buffer was previously freed. NONE AAA $SS_TC_ROOT/logs/execute/lttng $SS_TC_DEPS/lib64/liblttng-stonesoup-c.so:$SS_TC_DEPS/lib64/liblttng-ust-fork.so 0 --charset ASCII --sort=name -n -q -P "test*" -F input/good-03 STDOUT-REPORT-04 AND STDOUT-CONTENT-LENGTH-04 AND NOT TIMEOUT AND NOT CONTROLLED_EXIT 7 directories, 62 files SIMILAR DOES_NOT_RETURN CONTROLLED_EXIT Malloc a buffer. Copy the input string to the buffer. If the first character is 'a' or higher, free the buffer. Use the buffer. This will cause a seg fault if the buffer was previously freed. NONE 12345 Hello world! $SS_TC_ROOT/logs/execute/lttng $SS_TC_DEPS/lib64/liblttng-stonesoup-c.so:$SS_TC_DEPS/lib64/liblttng-ust-fork.so 0 --charset ASCII --sort=name -n -q -H "" input/good-01 STDOUT-REPORT-05 AND STDOUT-CONTENT-LENGTH-05 AND NOT TIMEOUT AND NOT CONTROLLED_EXIT 5 directories, 10 files SIMILAR DOES_NOT_RETURN CONTROLLED_EXIT Malloc a buffer. Copy the input string to the buffer. If the first character is 'a' or higher, free the buffer. Use the buffer. This will cause a seg fault if the buffer was previously freed. DOS_UNCONTROLLED_EXIT abc $SS_TC_ROOT/logs/execute/lttng $SS_TC_DEPS/lib64/liblttng-stonesoup-c.so:$SS_TC_DEPS/lib64/liblttng-ust-fork.so 0 --charset ASCII --sort=name -n -q -L 2 input/good-02 weakness_started_bHzwvjSWnLqld9jGn8Ld AND ((NOT PERFORMER AND (segfault_code_3Qz4eGbBiF OR segfault_code_aXcTFkTFlM OR segfault_code_0sUaCYYgR5 OR segfault_code_G1UXqWCuDj OR segfault_code_WnuQwfSfd3 OR segfault_msg_ynPaA6Elbx OR illegal_inst_msg_2OwwqufjPn) AND NOT timeout_KipEmRutMC) or (PERFORMER AND NOT ((segfault_code_3Qz4eGbBiF OR segfault_code_aXcTFkTFlM OR segfault_code_0sUaCYYgR5 OR segfault_code_G1UXqWCuDj OR segfault_code_WnuQwfSfd3 OR segfault_msg_ynPaA6Elbx OR illegal_inst_msg_2OwwqufjPn) OR timeout_KipEmRutMC))) (NOT PERFORMER AND (segfault_code_3Qz4eGbBiF OR segfault_code_aXcTFkTFlM OR segfault_code_0sUaCYYgR5 OR segfault_code_G1UXqWCuDj OR segfault_code_WnuQwfSfd3 OR segfault_msg_ynPaA6Elbx OR illegal_inst_msg_2OwwqufjPn) AND NOT timeout_KipEmRutMC) or (PERFORMER AND NOT ((segfault_code_3Qz4eGbBiF OR segfault_code_aXcTFkTFlM OR segfault_code_0sUaCYYgR5 OR segfault_code_G1UXqWCuDj OR segfault_code_WnuQwfSfd3 OR segfault_msg_ynPaA6Elbx OR illegal_inst_msg_2OwwqufjPn) OR timeout_KipEmRutMC)) DOES_NOT_RETURN CONTROLLED_EXIT CONTINUED_EXECUTION None 132 None 134 None 135 None 136 None 139 None Segmentation fault None Illegal instruction None stonesoup_trace:weakness_start Malloc a buffer. Copy the input string to the buffer. If the first character is 'a' or higher, free the buffer. Use the buffer. This will cause a seg fault if the buffer was previously freed. DOS_UNCONTROLLED_EXIT this string begins with a lower-case letter $SS_TC_ROOT/logs/execute/lttng $SS_TC_DEPS/lib64/liblttng-stonesoup-c.so:$SS_TC_DEPS/lib64/liblttng-ust-fork.so 0 --charset ASCII --sort=name -n -q -P "test*" -F input/good-03 weakness_started_LqFwIgM4YcqGU5KkSW1k AND ((NOT PERFORMER AND (segfault_code_AGdIBISo8W OR segfault_code_r2EMR762Y0 OR segfault_code_ACZQBEIz8m OR segfault_code_Gunra1aTGJ OR segfault_code_5hZwXAgaal OR segfault_msg_3bOtJV0PtR OR illegal_inst_msg_JXhUAh1igo) AND NOT timeout_mx57LAlIjG) or (PERFORMER AND NOT ((segfault_code_AGdIBISo8W OR segfault_code_r2EMR762Y0 OR segfault_code_ACZQBEIz8m OR segfault_code_Gunra1aTGJ OR segfault_code_5hZwXAgaal OR segfault_msg_3bOtJV0PtR OR illegal_inst_msg_JXhUAh1igo) OR timeout_mx57LAlIjG))) (NOT PERFORMER AND (segfault_code_AGdIBISo8W OR segfault_code_r2EMR762Y0 OR segfault_code_ACZQBEIz8m OR segfault_code_Gunra1aTGJ OR segfault_code_5hZwXAgaal OR segfault_msg_3bOtJV0PtR OR illegal_inst_msg_JXhUAh1igo) AND NOT timeout_mx57LAlIjG) or (PERFORMER AND NOT ((segfault_code_AGdIBISo8W OR segfault_code_r2EMR762Y0 OR segfault_code_ACZQBEIz8m OR segfault_code_Gunra1aTGJ OR segfault_code_5hZwXAgaal OR segfault_msg_3bOtJV0PtR OR illegal_inst_msg_JXhUAh1igo) OR timeout_mx57LAlIjG)) DOES_NOT_RETURN CONTROLLED_EXIT CONTINUED_EXECUTION None 132 None 134 None 135 None 136 None 139 None Segmentation fault None Illegal instruction None stonesoup_trace:weakness_start