Test case 153201

Description

This test case creates a function pointer that takes 2 const char * as input and returns an int. If the length of the taint source is 0 mod 3, the test case sets the function pointer to be strcmp. If the length of the taint source is 1 mod 3, the test case sets the function pointer to strcoll. Otherwise the test case sets the function pointer to be the address passed in by the taint source. When the test case calls the function pointer, if the function pointer is strcmp or strcoll, the weakness proceeds without error. However, if the function pointer is the value passed in from the taint source, the function call results in a segmentation fault or illegal instruction fault.
Metadata
- Base program: Gimp
- Source Taint: SHARED_MEMORY
- Data Type: ARRAY
- Data Flow: BUFFER_ADDRESS_POINTER
- Control Flow: MACROS