/* TEMPLATE GENERATED TESTCASE FILE Filename: CWE191_Integer_Underflow__short_min_predec_15.java Label Definition File: CWE191_Integer_Underflow.label.xml Template File: sources-sinks-15.tmpl.java */ /* * @description * CWE: 191 Integer Underflow * BadSource: min Set data to the max value for short * GoodSource: A hardcoded non-zero, non-min, non-max, even number * Sinks: decrement * GoodSink: Ensure there will not be an underflow before decrementing data * BadSink : Decrement data, which can cause an Underflow * Flow Variant: 15 Control flow: switch(6) and switch(7) * * */ package testcases.CWE191_Integer_Underflow.s05; import testcasesupport.*; public class CWE191_Integer_Underflow__short_min_predec_15 extends AbstractTestCase { public void bad() throws Throwable { short data; switch (6) { case 6: /* POTENTIAL FLAW: Use the maximum size of the data type */ data = Short.MIN_VALUE; break; default: /* INCIDENTAL: CWE 561 Dead Code, the code below will never run * but ensure data is inititialized before the Sink to avoid compiler errors */ data = 0; break; } switch (7) { case 7: /* POTENTIAL FLAW: if data == Short.MIN_VALUE, this will overflow */ short result = (short)(--data); IO.writeLine("result: " + result); break; default: /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */ IO.writeLine("Benign, fixed string"); break; } } /* goodG2B1() - use goodsource and badsink by changing the first switch to switch(5) */ private void goodG2B1() throws Throwable { short data; switch (5) { case 6: /* INCIDENTAL: CWE 561 Dead Code, the code below will never run * but ensure data is inititialized before the Sink to avoid compiler errors */ data = 0; break; default: /* FIX: Use a hardcoded number that won't cause underflow, overflow, divide by zero, or loss-of-precision issues */ data = 2; break; } switch (7) { case 7: /* POTENTIAL FLAW: if data == Short.MIN_VALUE, this will overflow */ short result = (short)(--data); IO.writeLine("result: " + result); break; default: /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */ IO.writeLine("Benign, fixed string"); break; } } /* goodG2B2() - use goodsource and badsink by reversing the blocks in the first switch */ private void goodG2B2() throws Throwable { short data; switch (6) { case 6: /* FIX: Use a hardcoded number that won't cause underflow, overflow, divide by zero, or loss-of-precision issues */ data = 2; break; default: /* INCIDENTAL: CWE 561 Dead Code, the code below will never run * but ensure data is inititialized before the Sink to avoid compiler errors */ data = 0; break; } switch (7) { case 7: /* POTENTIAL FLAW: if data == Short.MIN_VALUE, this will overflow */ short result = (short)(--data); IO.writeLine("result: " + result); break; default: /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */ IO.writeLine("Benign, fixed string"); break; } } /* goodB2G1() - use badsource and goodsink by changing the second switch to switch(8) */ private void goodB2G1() throws Throwable { short data; switch (6) { case 6: /* POTENTIAL FLAW: Use the maximum size of the data type */ data = Short.MIN_VALUE; break; default: /* INCIDENTAL: CWE 561 Dead Code, the code below will never run * but ensure data is inititialized before the Sink to avoid compiler errors */ data = 0; break; } switch (8) { case 7: /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */ IO.writeLine("Benign, fixed string"); break; default: /* FIX: Add a check to prevent an underflow from occurring */ if (data > Short.MIN_VALUE) { short result = (short)(--data); IO.writeLine("result: " + result); } else { IO.writeLine("data value is too small to decrement."); } break; } } /* goodB2G2() - use badsource and goodsink by reversing the blocks in the second switch */ private void goodB2G2() throws Throwable { short data; switch (6) { case 6: /* POTENTIAL FLAW: Use the maximum size of the data type */ data = Short.MIN_VALUE; break; default: /* INCIDENTAL: CWE 561 Dead Code, the code below will never run * but ensure data is inititialized before the Sink to avoid compiler errors */ data = 0; break; } switch (7) { case 7: /* FIX: Add a check to prevent an underflow from occurring */ if (data > Short.MIN_VALUE) { short result = (short)(--data); IO.writeLine("result: " + result); } else { IO.writeLine("data value is too small to decrement."); } break; default: /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */ IO.writeLine("Benign, fixed string"); break; } } public void good() throws Throwable { goodG2B1(); goodG2B2(); goodB2G1(); goodB2G2(); } /* Below is the main(). It is only used when building this testcase on * its own for testing or for building a binary to use in testing binary * analysis tools. It is not used when compiling all the testcases as one * application, which is how source code analysis tools are tested. */ public static void main(String[] args) throws ClassNotFoundException, InstantiationException, IllegalAccessException { mainFromParent(args); } }