Creating test case using base program. Added an environment variable read to the function definition. Completed injection. UNSPECIFIED UNSPECIFIED $SS_TC_ROOT/$SS_TC_INSTALL/bin/tree make install CC="$SS_CC" LD="$SS_LNK" CFLAGS="$CFLAGS" CPPFLAGS="$CPPFLAGS" LDFLAGS="$LDFLAGS" prefix="$SS_TC_ROOT/$SS_TC_INSTALL" LIBS="$LIBS" Has a fixed heap buffer of size 64, allocated within a struct (char [64]) NONE AAA $SS_TC_ROOT/logs/execute/lttng $SS_TC_DEPS/lib64/liblttng-stonesoup-c.so:$SS_TC_DEPS/lib64/liblttng-ust-fork.so 0 --charset ASCII --sort=name -n -q input/good-01 STDOUT-REPORT-01 AND STDOUT-CONTENT-LENGTH-01 AND NOT TIMEOUT AND NOT CONTROLLED_EXIT 5 directories, 10 files SIMILAR DOES_NOT_RETURN CONTROLLED_EXIT Has a fixed heap buffer of size 64, allocated within a struct (char [64]) NONE Hellow world! $SS_TC_ROOT/logs/execute/lttng $SS_TC_DEPS/lib64/liblttng-stonesoup-c.so:$SS_TC_DEPS/lib64/liblttng-ust-fork.so 0 --charset ASCII --sort=name -n -q -L 2 input/good-02 STDOUT-REPORT-02 AND STDOUT-CONTENT-LENGTH-02 AND NOT TIMEOUT AND NOT CONTROLLED_EXIT 5 directories, 4 files SIMILAR DOES_NOT_RETURN CONTROLLED_EXIT Has a fixed heap buffer of size 64, allocated within a struct (char [64]) NONE Good-bye cruel world! $SS_TC_ROOT/logs/execute/lttng $SS_TC_DEPS/lib64/liblttng-stonesoup-c.so:$SS_TC_DEPS/lib64/liblttng-ust-fork.so 0 --charset ASCII --sort=name -n -q -J input/good-03 STDOUT-REPORT-03 AND STDOUT-CONTENT-LENGTH-03 AND NOT TIMEOUT AND NOT CONTROLLED_EXIT {"type":"report","directories":7,"files":367} SIMILAR DOES_NOT_RETURN CONTROLLED_EXIT Has a fixed heap buffer of size 64, allocated within a struct (char [64]) NONE AAA $SS_TC_ROOT/logs/execute/lttng $SS_TC_DEPS/lib64/liblttng-stonesoup-c.so:$SS_TC_DEPS/lib64/liblttng-ust-fork.so 0 --charset ASCII --sort=name -n -q -P "test*" -F input/good-03 STDOUT-REPORT-04 AND STDOUT-CONTENT-LENGTH-04 AND NOT TIMEOUT AND NOT CONTROLLED_EXIT 7 directories, 62 files SIMILAR DOES_NOT_RETURN CONTROLLED_EXIT Has a fixed heap buffer of size 64, allocated within a struct (char [64]) NONE Hellow world! $SS_TC_ROOT/logs/execute/lttng $SS_TC_DEPS/lib64/liblttng-stonesoup-c.so:$SS_TC_DEPS/lib64/liblttng-ust-fork.so 0 --charset ASCII --sort=name -n -q -H "" input/good-01 STDOUT-REPORT-05 AND STDOUT-CONTENT-LENGTH-05 AND NOT TIMEOUT AND NOT CONTROLLED_EXIT 5 directories, 10 files SIMILAR DOES_NOT_RETURN CONTROLLED_EXIT Has a fixed heap buffer of size 64, allocated within a struct (char [64]) DOS_UNCONTROLLED_EXIT AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA $SS_TC_ROOT/logs/execute/lttng $SS_TC_DEPS/lib64/liblttng-stonesoup-c.so:$SS_TC_DEPS/lib64/liblttng-ust-fork.so 0 --charset ASCII --sort=name -n -q -P "test*" -F input/good-03 weakness_started_AncsnrhhexyjnQWKJqZI AND ((NOT PERFORMER AND (segfault_code_gbdNlKwqib OR segfault_code_prJjIr1M7v OR segfault_code_YL9rqsA3Ul OR segfault_code_eQ8FFVjGeL OR segfault_code_KrEekbq3lR OR segfault_msg_XjwpTm5KUR OR illegal_inst_msg_pr4Y3eourS) AND NOT timeout_RDHB1P1zzo) or (PERFORMER AND NOT ((segfault_code_gbdNlKwqib OR segfault_code_prJjIr1M7v OR segfault_code_YL9rqsA3Ul OR segfault_code_eQ8FFVjGeL OR segfault_code_KrEekbq3lR OR segfault_msg_XjwpTm5KUR OR illegal_inst_msg_pr4Y3eourS) OR timeout_RDHB1P1zzo))) (NOT PERFORMER AND (segfault_code_gbdNlKwqib OR segfault_code_prJjIr1M7v OR segfault_code_YL9rqsA3Ul OR segfault_code_eQ8FFVjGeL OR segfault_code_KrEekbq3lR OR segfault_msg_XjwpTm5KUR OR illegal_inst_msg_pr4Y3eourS) AND NOT timeout_RDHB1P1zzo) or (PERFORMER AND NOT ((segfault_code_gbdNlKwqib OR segfault_code_prJjIr1M7v OR segfault_code_YL9rqsA3Ul OR segfault_code_eQ8FFVjGeL OR segfault_code_KrEekbq3lR OR segfault_msg_XjwpTm5KUR OR illegal_inst_msg_pr4Y3eourS) OR timeout_RDHB1P1zzo)) DOES_NOT_RETURN CONTROLLED_EXIT CONTINUED_EXECUTION None 132 None 134 None 135 None 136 None 139 None Segmentation fault None Illegal instruction None stonesoup_trace:weakness_start Has a fixed heap buffer of size 64, allocated within a struct (char [64]) DOS_UNCONTROLLED_EXIT This is probably going to overflow a buffer of some sort. Let's run it anyway and see what happens. I hope that everything turns out ok, because I would love to see what this looks like in all CAPS. Converting ASCII characters to upper case is easy, you can either call a system function, or just add the standard difference between the start of the two character sets. But, I am sure there is a reason that system functions exist for this sort of functionality. $SS_TC_ROOT/logs/execute/lttng $SS_TC_DEPS/lib64/liblttng-stonesoup-c.so:$SS_TC_DEPS/lib64/liblttng-ust-fork.so 0 --charset ASCII --sort=name -n -q -P "test*" -F input/good-03 weakness_started_l1PAbXEopTatnlYLrfjk AND ((NOT PERFORMER AND (segfault_code_JQy4QYtNvQ OR segfault_code_0gdxn6Q7Mb OR segfault_code_TrMJmEW91M OR segfault_code_3rJVvXm1XU OR segfault_code_tqLgDoxbqT OR segfault_msg_HCMSpwbxD6 OR illegal_inst_msg_rBb9usjHcB) AND NOT timeout_cvHilp48x2) or (PERFORMER AND NOT ((segfault_code_JQy4QYtNvQ OR segfault_code_0gdxn6Q7Mb OR segfault_code_TrMJmEW91M OR segfault_code_3rJVvXm1XU OR segfault_code_tqLgDoxbqT OR segfault_msg_HCMSpwbxD6 OR illegal_inst_msg_rBb9usjHcB) OR timeout_cvHilp48x2))) (NOT PERFORMER AND (segfault_code_JQy4QYtNvQ OR segfault_code_0gdxn6Q7Mb OR segfault_code_TrMJmEW91M OR segfault_code_3rJVvXm1XU OR segfault_code_tqLgDoxbqT OR segfault_msg_HCMSpwbxD6 OR illegal_inst_msg_rBb9usjHcB) AND NOT timeout_cvHilp48x2) or (PERFORMER AND NOT ((segfault_code_JQy4QYtNvQ OR segfault_code_0gdxn6Q7Mb OR segfault_code_TrMJmEW91M OR segfault_code_3rJVvXm1XU OR segfault_code_tqLgDoxbqT OR segfault_msg_HCMSpwbxD6 OR illegal_inst_msg_rBb9usjHcB) OR timeout_cvHilp48x2)) DOES_NOT_RETURN CONTROLLED_EXIT CONTINUED_EXECUTION None 132 None 134 None 135 None 136 None 139 None Segmentation fault None Illegal instruction None stonesoup_trace:weakness_start