diff --git a/.gitattributes b/.gitattributes index ef5d21335084bd37497aeddde4d6a6a95ee364e6..48830da6d0e6b53d5eda7883c83d964077ab324c 100644 --- a/.gitattributes +++ b/.gitattributes @@ -171,6 +171,8 @@ examples/integerbugs/C1_Number_Handling/CWE_190/bad.dat -text examples/integerbugs/C1_Number_Handling/CWE_190/data.txt -text examples/integerbugs/C1_Number_Handling/CWE_190/modular_bug_finding_example_1.c -text examples/integerbugs/C1_Number_Handling/CWE_190/modular_bug_finding_example_2.c -text +examples/integerbugs/C1_Number_Handling/CWE_191/CWE_191_Example_1_bad.c -text +examples/integerbugs/C1_Number_Handling/CWE_191/CWE_191_Example_2_bad.c -text examples/integerbugs/C1_Number_Handling/CWE_194/CVE-2007-4988_CWE_194_ImageMagick/CVE-2007-4988_CWE_194_ImageMagick.docx -text examples/integerbugs/C1_Number_Handling/CWE_194/CVE-2007-4988_CWE_194_ImageMagick/ImageMagick-6.3.4-10.tar.gz -text examples/integerbugs/C1_Number_Handling/CWE_194/CWE_194_Example_1_bad.c -text diff --git a/examples/integerbugs/C1_Number_Handling/CWE_191/CWE_191_Example_1_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_191/CWE_191_Example_1_bad.c new file mode 100644 index 0000000000000000000000000000000000000000..9d3108a3a9bb8d8cad3cab637aa2bbbefb0feaf1 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_191/CWE_191_Example_1_bad.c @@ -0,0 +1,43 @@ +/* +Integer Underflow (Wrap or Wraparound) + +Description Summary +The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. + +Extended Description +This can happen in signed and unsigned cases. + +Example 1 +The following example has an integer underflow. The value of i is already at the lowest negative value possible. The new value of i is 2147483647. +(Bad Code)Example Language: C + +@GOOD_ARGS 50 +@BAD_ARGS -2147483648 +@NORMAL_OUTPUT_CONTAINS N = 49 +@ATTACK_SUCCEEDED_OUTPUT_CONTAINS N = 214 + +// bjm remove exit TTACK_SUCCEEDED_CODE 1 + +*/ + +#include <stdio.h> +#include <stdbool.h> +#include <stdlib.h> +#include <limits.h> +#ifdef ASSERT + #include <assert.h> +#endif + +main (int argc, char ** argv) +{ + if (argc < 2) exit(2); + int i = atoi(argv[1]); + + i = i - 1; +#ifdef ASSERT +assert(atoi(argv[1])>INT_MIN); +#endif + printf("N = %d\n", i); + exit(0); +} + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_191/CWE_191_Example_2_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_191/CWE_191_Example_2_bad.c new file mode 100644 index 0000000000000000000000000000000000000000..21c6be8f52b2249d83471f28a52e49291a3c75f0 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_191/CWE_191_Example_2_bad.c @@ -0,0 +1,43 @@ +/* +Integer Underflow (Wrap or Wraparound) + +Description Summary +The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. + +Extended Description +This can happen in signed and unsigned cases. + +Example 1 +The following example has an integer underflow. The value of i is already at the lowest negative value possible. The new value of i is 2147483647. +(Bad Code)Example Language: C + +@GOOD_ARGS 50 +@BAD_ARGS 0 +@NORMAL_OUTPUT_CONTAINS N = 49 +@ATTACK_SUCCEEDED_OUTPUT_CONTAINS N = 429 +// bjm removed for grace TTACK_SUCCEEDED_CODE 1 + +*/ + +#include <stdio.h> +#include <stdbool.h> +#include <stdlib.h> +#ifdef ASSERT + #include <assert.h> +#endif + +main (int argc, char **argv) +{ + if (argc < 2) exit(2); + unsigned int j = atoi(argv[1]); + j = j - 1; + +#ifdef ASSERT + assert(isdigit(argv[1][0])); + assert(atoi(argv[1])>0); +#endif + + printf("N = %u\n", j); + exit(0); +} +