SAMATE Logo NIST Logo The SAMATE Project Department of Homeland Security
Downloads:  Download this Test Case #153759

Back to the previous page... Back to the previous page

Test Case IDCandidate153759
Bad / Good / MixedBadBad test case
AuthorIARPA STONESOUP Test and Evaluation team
Associations
Test suite: 102  
Application: 5  
Added byCharles Oliveira
LanguageC
Type of test caseSource Code
Input string
Expected Output
Instructions
See src/INSTALL file for instructions on how to install.
Submission date2015-10-06
DescriptionThis test case creates a function pointer that takes 2 const char * as input and returns an int. If the length of the taint source is 0 mod 3, the test case sets the function pointer to be strcmp. If the length of the taint source is 1 mod 3, the test case sets the function pointer to strcoll. Otherwise the test case sets the function pointer to be the address passed in by the taint source. When the test case calls the function pointer, if the function pointer is strcmp or strcoll, the weakness proceeds without error. However, if the function pointer is the value passed in from the taint source, the function call results in a segmentation fault or illegal instruction fault.
Metadata
- Base program: PostgreSQL
- Source Taint: ENVIRONMENT_VARIABLE
- Data Type: ARRAY
- Data Flow: ADDRESS_AS_VARIABLE
- Control Flow: INTERPROCEDURAL_1
File(s)
Flaw

There are no comments
Have any comments on this test case? Please, .

File Contains:
CWE-822: Untrusted Pointer Dereference on line(s): 182, 183, 184