diff --git a/Makefile b/Makefile
index 71bb4dcf26cfe0fc6dd4325be361dc575a8df138..2126cf709c1e03c3e9eea34ffbac66474d75e095 100644
--- a/Makefile
+++ b/Makefile
@@ -52,6 +52,7 @@ frama-c/build/bin/frama-c:
 TARGETS=\
   2048 \
   basic-cwe-examples \
+  bench-moerman2018 \
   cerberus \
   chrony \
   debie1 \
diff --git a/README.md b/README.md
index beac7489731faf0da72cc2970437c53ea26791be..2c47a2c842f4dd7281b0a26177256baaf1ff859f 100644
--- a/README.md
+++ b/README.md
@@ -120,6 +120,7 @@ when available. We also summarize the license of each directory below.
 
 - `2048`: MIT
 - `basic-cwe-examples`: see `LICENSE`
+- `bench-moerman2018`: MIT
 - `chrony`: GPL
 - `debie1`: distribution and use authorized by Patria Aviation Oy,
             Space Systems Finland Ltd. and Tidorum Ltd, see `README.txt`
diff --git a/bench-moerman2018/.frama-c/.gitignore b/bench-moerman2018/.frama-c/.gitignore
new file mode 100644
index 0000000000000000000000000000000000000000..b5c027fb0a5326c540dec44823094661ecb3a5ec
--- /dev/null
+++ b/bench-moerman2018/.frama-c/.gitignore
@@ -0,0 +1,7 @@
+# extra .gitignore rules specific to this benchmark
+
+# we do not version the .parse and .eva directories due to their large size
+
+eval.txt
+*.eva
+*.parse
diff --git a/bench-moerman2018/.frama-c/GNUmakefile b/bench-moerman2018/.frama-c/GNUmakefile
new file mode 100644
index 0000000000000000000000000000000000000000..9ae99e2d63ffac53938bc3cf21abcdb586778056
--- /dev/null
+++ b/bench-moerman2018/.frama-c/GNUmakefile
@@ -0,0 +1,76 @@
+# Makefile template for Frama-C/Eva case studies.
+# For details and usage information, see the Frama-C User Manual.
+
+### Prologue. Do not modify this block. #######################################
+-include path.mk
+FRAMAC ?= frama-c
+include $(shell $(FRAMAC)-config -scripts)/prologue.mk
+###############################################################################
+
+# Edit below as needed. MACHDEP is mandatory. Suggested flags are optional.
+
+MACHDEP = x86_32
+
+## Preprocessing flags (for -cpp-extra-args)
+CPPFLAGS    += \
+  -I../common \
+
+## General flags
+FCFLAGS     += \
+  -add-symbolic-path=.:.. \
+  -kernel-warn-key annot:missing-spec=abort \
+  -kernel-warn-key typing:implicit-function-declaration=abort \
+
+## Eva-specific flags
+EVAFLAGS    += \
+  -eva-warn-key builtins:missing-spec=abort \
+  -eva-precision 3 \
+
+## GUI-only flags
+FCGUIFLAGS += \
+  -add-symbolic-path=.:.. \
+
+# This bench has several targets, so we use Makefile functions to generate
+# them. A few test cases are not run.
+
+# exclude files with recursive functions, and those testing memory leaks
+filter-out-substring = $(foreach v,$(2),$(if $(findstring $(1),$(v)),,$(v)))
+SRCS:=$(sort $(call filter-out-substring,leak,\
+               $(call filter-out-substring,recursion,\
+                 $(wildcard ../base/*.c ../*/*/*.c))))
+
+# [target] converts a file name into a suitable target name,
+# removing the initial '../', the final '.c', and converting '/' into '_'.
+target = $(subst /,_,$(patsubst %.c,%,$(1:../%=%)))
+
+GOOD_TARGETS:=$(foreach s,$(SRCS),$(call target,$(s))_good.eva)
+BAD_TARGETS:=$(foreach s,$(SRCS),$(call target,$(s))_bad.eva)
+TARGETS:=$(GOOD_TARGETS) $(BAD_TARGETS)
+
+define generate-parse-rules =
+  $(call target,$(1))_good.parse: $(if $(findstring cross_file,$(1)),../common/common.c,) $(1)
+  $(call target,$(1))_good.parse: CPPFLAGS+="-DNO_BUG"
+  $(call target,$(1))_bad.parse: $(if $(findstring cross_file,$(1)),../common/common.c,) $(1)
+
+  $(call target,$(1))_good.eva/eval.txt: $(call target,$(1))_good.eva evaluate_case.sh
+	./evaluate_case.sh good $$</alarms.csv > $$</eval.txt
+  $(call target,$(1))_bad.eva/eval.txt: $(call target,$(1))_bad.eva evaluate_case.sh
+	./evaluate_case.sh bad $$</alarms.csv > $$</eval.txt
+endef
+$(foreach s,$(SRCS),$(eval $(call generate-parse-rules,$(s))))
+
+eval_summary.txt: $(addsuffix /eval.txt, $(TARGETS))
+	@echo "Updating summary: $(abspath $@)"
+	@cat $^ > eval_summary.txt
+
+evaluate: eval_summary.txt
+.PHONY: eval_summary.txt
+
+all: evaluate
+
+### Epilogue. Do not modify this block. #######################################
+include $(shell $(FRAMAC)-config -scripts)/epilogue.mk
+###############################################################################
+
+# optional, for OSCS
+-include ../../Makefile.common
diff --git a/bench-moerman2018/.frama-c/eval_summary.txt b/bench-moerman2018/.frama-c/eval_summary.txt
new file mode 100644
index 0000000000000000000000000000000000000000..c9c1cc56f7514c05b9829f71174162047d5543b8
--- /dev/null
+++ b/bench-moerman2018/.frama-c/eval_summary.txt
@@ -0,0 +1,400 @@
+base_files_access_closed_good.eva/alarms.csv (good): ok
+base_files_double_close_good.eva/alarms.csv (good): ok
+base_general_divide_by_0_good.eva/alarms.csv (good): ok
+base_general_nullpointer_good.eva/alarms.csv (good): ok
+base_general_uninitialized_pointer_good.eva/alarms.csv (good): ok
+base_general_uninitialized_value_good.eva/alarms.csv (good): ok
+base_integers_overflow_good.eva/alarms.csv (good): ok
+base_memory_double_free_good.eva/alarms.csv (good): ok
+base_memory_read_uninitialized_malloced_mem_good.eva/alarms.csv (good): ok
+base_memory_refer_freed_good.eva/alarms.csv (good): ok
+base_memory_zero_alloc_good.eva/alarms.csv (good): ok
+base_strings_overflow_good.eva/alarms.csv (good): ok
+base_strings_unbounded_copy_good.eva/alarms.csv (good): imprecise
+file_operations_access_closed_01_simple_if_good.eva/alarms.csv (good): ok
+file_operations_access_closed_02_simple_if_int1_good.eva/alarms.csv (good): ok
+file_operations_access_closed_02_simple_if_int2_good.eva/alarms.csv (good): ok
+file_operations_access_closed_03_simple_if_multi_func_good.eva/alarms.csv (good): ok
+file_operations_access_closed_04_simple_switch_good.eva/alarms.csv (good): ok
+file_operations_access_closed_05_simple_goto_good.eva/alarms.csv (good): ok
+file_operations_access_closed_06_simple_pass_by_reference_good.eva/alarms.csv (good): ok
+file_operations_access_closed_07_cross_file_good.eva/alarms.csv (good): ok
+file_operations_access_closed_08_loop_for_good.eva/alarms.csv (good): ok
+file_operations_access_closed_09_loop_for_complex_good.eva/alarms.csv (good): ok
+file_operations_access_closed_10_loop_while_continue_good.eva/alarms.csv (good): ok
+file_operations_access_closed_11_loop_while_do_continue_good.eva/alarms.csv (good): ok
+file_operations_access_closed_12_loop_for_array_branching_good.eva/alarms.csv (good): ok
+file_operations_access_closed_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): ok
+file_operations_access_closed_17_complex_function_pointers_good.eva/alarms.csv (good): ok
+file_operations_access_closed_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): ok
+file_operations_access_closed_19_complex_refcount_good.eva/alarms.csv (good): ok
+file_operations_double_close_01_simple_if_good.eva/alarms.csv (good): ok
+file_operations_double_close_02_simple_if_int1_good.eva/alarms.csv (good): ok
+file_operations_double_close_02_simple_if_int2_good.eva/alarms.csv (good): ok
+file_operations_double_close_03_simple_if_multi_func_good.eva/alarms.csv (good): ok
+file_operations_double_close_04_simple_switch_good.eva/alarms.csv (good): ok
+file_operations_double_close_05_simple_goto_good.eva/alarms.csv (good): ok
+file_operations_double_close_06_simple_pass_by_reference_good.eva/alarms.csv (good): ok
+file_operations_double_close_07_cross_file_good.eva/alarms.csv (good): ok
+file_operations_double_close_08_loop_for_good.eva/alarms.csv (good): ok
+file_operations_double_close_09_loop_for_complex_good.eva/alarms.csv (good): ok
+file_operations_double_close_10_loop_while_continue_good.eva/alarms.csv (good): ok
+file_operations_double_close_11_loop_while_do_continue_good.eva/alarms.csv (good): ok
+file_operations_double_close_12_loop_for_array_branching_good.eva/alarms.csv (good): ok
+file_operations_double_close_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): ok
+file_operations_double_close_17_complex_function_pointers_good.eva/alarms.csv (good): ok
+file_operations_double_close_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): ok
+file_operations_double_close_19_complex_refcount_good.eva/alarms.csv (good): ok
+general_divide_by_zero_01_simple_if_good.eva/alarms.csv (good): ok
+general_divide_by_zero_02_simple_if_int1_good.eva/alarms.csv (good): ok
+general_divide_by_zero_02_simple_if_int2_good.eva/alarms.csv (good): ok
+general_divide_by_zero_03_simple_if_multi_func_good.eva/alarms.csv (good): ok
+general_divide_by_zero_04_simple_switch_good.eva/alarms.csv (good): ok
+general_divide_by_zero_05_simple_goto_good.eva/alarms.csv (good): ok
+general_divide_by_zero_06_simple_pass_by_reference_good.eva/alarms.csv (good): ok
+general_divide_by_zero_07_simple_cross_file_good.eva/alarms.csv (good): ok
+general_divide_by_zero_08_loop_for_good.eva/alarms.csv (good): ok
+general_divide_by_zero_09_loop_for_complex_good.eva/alarms.csv (good): ok
+general_divide_by_zero_10_loop_while_continue_good.eva/alarms.csv (good): ok
+general_divide_by_zero_11_loop_while_do_continue_good.eva/alarms.csv (good): ok
+general_divide_by_zero_12_loop_for_array_branching_good.eva/alarms.csv (good): ok
+general_divide_by_zero_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): ok
+general_divide_by_zero_17_complex_function_pointers_good.eva/alarms.csv (good): ok
+general_divide_by_zero_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): ok
+general_divide_by_zero_19_complex_refcount_good.eva/alarms.csv (good): ok
+general_nullpointer_01_simple_if_good.eva/alarms.csv (good): ok
+general_nullpointer_02_simple_if_int1_good.eva/alarms.csv (good): ok
+general_nullpointer_02_simple_if_int2_good.eva/alarms.csv (good): ok
+general_nullpointer_03_simple_if_multi_func_good.eva/alarms.csv (good): ok
+general_nullpointer_04_simple_switch_good.eva/alarms.csv (good): ok
+general_nullpointer_05_simple_goto_good.eva/alarms.csv (good): ok
+general_nullpointer_06_simple_pass_by_reference_good.eva/alarms.csv (good): ok
+general_nullpointer_07_cross_file_good.eva/alarms.csv (good): ok
+general_nullpointer_08_loop_for_good.eva/alarms.csv (good): ok
+general_nullpointer_09_loop_for_complex_good.eva/alarms.csv (good): ok
+general_nullpointer_10_loop_while_continue_good.eva/alarms.csv (good): ok
+general_nullpointer_11_loop_while_do_continue_good.eva/alarms.csv (good): ok
+general_nullpointer_12_loop_for_array_branching_good.eva/alarms.csv (good): ok
+general_nullpointer_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): ok
+general_nullpointer_17_complex_function_pointers_good.eva/alarms.csv (good): ok
+general_nullpointer_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): ok
+general_nullpointer_19_complex_refcount_good.eva/alarms.csv (good): ok
+integers_overflow_01_simple_if_good.eva/alarms.csv (good): ok
+integers_overflow_02_simple_if_int1_good.eva/alarms.csv (good): ok
+integers_overflow_02_simple_if_int2_good.eva/alarms.csv (good): ok
+integers_overflow_03_simple_if_multi_func_good.eva/alarms.csv (good): ok
+integers_overflow_04_simple_switch_good.eva/alarms.csv (good): ok
+integers_overflow_05_simple_goto_good.eva/alarms.csv (good): ok
+integers_overflow_06_simple_pass_by_reference_good.eva/alarms.csv (good): ok
+integers_overflow_07_simple_cross_file_good.eva/alarms.csv (good): ok
+integers_overflow_08_loop_for_good.eva/alarms.csv (good): ok
+integers_overflow_09_loop_for_complex_good.eva/alarms.csv (good): ok
+integers_overflow_10_loop_while_continue_good.eva/alarms.csv (good): ok
+integers_overflow_11_loop_while_do_continue_good.eva/alarms.csv (good): ok
+integers_overflow_12_loop_for_array_branching_good.eva/alarms.csv (good): ok
+integers_overflow_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): ok
+integers_overflow_17_complex_function_pointers_good.eva/alarms.csv (good): ok
+integers_overflow_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): ok
+integers_overflow_19_complex_refcount_good.eva/alarms.csv (good): ok
+memory_access_uninit_01_simple_if_good.eva/alarms.csv (good): ok
+memory_access_uninit_02_simple_if_int1_good.eva/alarms.csv (good): ok
+memory_access_uninit_02_simple_if_int2_good.eva/alarms.csv (good): ok
+memory_access_uninit_03_simple_if_multi_func_good.eva/alarms.csv (good): ok
+memory_access_uninit_04_simple_switch_good.eva/alarms.csv (good): ok
+memory_access_uninit_05_simple_goto_good.eva/alarms.csv (good): ok
+memory_access_uninit_06_simple_pass_by_reference_good.eva/alarms.csv (good): ok
+memory_access_uninit_07_simple_cross_file_good.eva/alarms.csv (good): ok
+memory_access_uninit_08_loop_for_good.eva/alarms.csv (good): ok
+memory_access_uninit_09_loop_for_complex_good.eva/alarms.csv (good): ok
+memory_access_uninit_10_loop_while_continue_good.eva/alarms.csv (good): ok
+memory_access_uninit_11_loop_while_do_continue_good.eva/alarms.csv (good): ok
+memory_access_uninit_12_loop_for_array_branching_good.eva/alarms.csv (good): ok
+memory_access_uninit_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): imprecise
+memory_access_uninit_17_complex_function_pointers_good.eva/alarms.csv (good): ok
+memory_access_uninit_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): imprecise
+memory_access_uninit_19_complex_refcount_good.eva/alarms.csv (good): imprecise
+memory_double_free_01_simple_if_good.eva/alarms.csv (good): ok
+memory_double_free_02_simple_if_int1_good.eva/alarms.csv (good): ok
+memory_double_free_02_simple_if_int2_good.eva/alarms.csv (good): ok
+memory_double_free_03_simple_if_multi_func_good.eva/alarms.csv (good): ok
+memory_double_free_04_simple_switch_good.eva/alarms.csv (good): ok
+memory_double_free_05_simple_goto_good.eva/alarms.csv (good): ok
+memory_double_free_06_simple_pass_by_reference_good.eva/alarms.csv (good): ok
+memory_double_free_07_cross_file_good.eva/alarms.csv (good): ok
+memory_double_free_08_loop_for_good.eva/alarms.csv (good): ok
+memory_double_free_09_loop_for_complex_good.eva/alarms.csv (good): ok
+memory_double_free_10_loop_while_continue_good.eva/alarms.csv (good): ok
+memory_double_free_11_loop_while_do_continue_good.eva/alarms.csv (good): ok
+memory_double_free_12_loop_for_array_branching_good.eva/alarms.csv (good): ok
+memory_double_free_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): imprecise
+memory_double_free_17_complex_function_pointers_good.eva/alarms.csv (good): ok
+memory_double_free_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): ok
+memory_double_free_19_complex_refcount_good.eva/alarms.csv (good): ok
+memory_refer_free_01_simple_if_good.eva/alarms.csv (good): ok
+memory_refer_free_02_simple_if_int1_good.eva/alarms.csv (good): ok
+memory_refer_free_02_simple_if_int2_good.eva/alarms.csv (good): ok
+memory_refer_free_03_simple_if_multi_func_good.eva/alarms.csv (good): ok
+memory_refer_free_04_simple_switch_good.eva/alarms.csv (good): ok
+memory_refer_free_05_simple_goto_good.eva/alarms.csv (good): ok
+memory_refer_free_06_simple_pass_by_reference_good.eva/alarms.csv (good): ok
+memory_refer_free_07_cross_file_good.eva/alarms.csv (good): imprecise
+memory_refer_free_08_loop_for_good.eva/alarms.csv (good): ok
+memory_refer_free_09_loop_for_complex_good.eva/alarms.csv (good): ok
+memory_refer_free_10_loop_while_continue_good.eva/alarms.csv (good): ok
+memory_refer_free_11_loop_while_do_continue_good.eva/alarms.csv (good): ok
+memory_refer_free_12_loop_for_array_branching_good.eva/alarms.csv (good): ok
+memory_refer_free_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): imprecise
+memory_refer_free_17_complex_function_pointers_good.eva/alarms.csv (good): ok
+memory_refer_free_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): ok
+memory_refer_free_19_complex_refcount_good.eva/alarms.csv (good): ok
+memory_zero_alloc_01_simple_if_good.eva/alarms.csv (good): ok
+memory_zero_alloc_02_simple_if_int1_good.eva/alarms.csv (good): ok
+memory_zero_alloc_02_simple_if_int2_good.eva/alarms.csv (good): ok
+memory_zero_alloc_03_simple_if_multi_func_good.eva/alarms.csv (good): ok
+memory_zero_alloc_04_simple_switch_good.eva/alarms.csv (good): ok
+memory_zero_alloc_05_simple_goto_good.eva/alarms.csv (good): ok
+memory_zero_alloc_06_simple_pass_by_reference_good.eva/alarms.csv (good): ok
+memory_zero_alloc_07_cross_file_good.eva/alarms.csv (good): ok
+memory_zero_alloc_08_loop_for_good.eva/alarms.csv (good): ok
+memory_zero_alloc_09_loop_for_complex_good.eva/alarms.csv (good): ok
+memory_zero_alloc_10_loop_while_continue_good.eva/alarms.csv (good): ok
+memory_zero_alloc_11_loop_while_do_continue_good.eva/alarms.csv (good): imprecise
+memory_zero_alloc_12_loop_for_array_branching_good.eva/alarms.csv (good): ok
+memory_zero_alloc_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): imprecise
+memory_zero_alloc_17_complex_function_pointers_good.eva/alarms.csv (good): ok
+memory_zero_alloc_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): ok
+memory_zero_alloc_19_complex_refcount_good.eva/alarms.csv (good): ok
+strings_overflow_01_simple_if_good.eva/alarms.csv (good): ok
+strings_overflow_02_simple_if_int1_good.eva/alarms.csv (good): ok
+strings_overflow_02_simple_if_int2_good.eva/alarms.csv (good): ok
+strings_overflow_03_simple_if_multi_func_good.eva/alarms.csv (good): ok
+strings_overflow_04_simple_switch_good.eva/alarms.csv (good): ok
+strings_overflow_05_simple_goto_good.eva/alarms.csv (good): ok
+strings_overflow_06_simple_pass_by_reference_good.eva/alarms.csv (good): ok
+strings_overflow_07_simple_cross_file_good.eva/alarms.csv (good): ok
+strings_overflow_08_loop_for_good.eva/alarms.csv (good): ok
+strings_overflow_09_loop_for_complex_good.eva/alarms.csv (good): ok
+strings_overflow_10_loop_while_continue_good.eva/alarms.csv (good): ok
+strings_overflow_11_loop_while_do_continue_good.eva/alarms.csv (good): ok
+strings_overflow_12_loop_for_array_branching_good.eva/alarms.csv (good): ok
+strings_overflow_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): imprecise
+strings_overflow_17_complex_function_pointers_good.eva/alarms.csv (good): ok
+strings_overflow_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): ok
+strings_overflow_19_complex_refcount_good.eva/alarms.csv (good): ok
+strings_unbounded_copy_01_simple_if_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_02_simple_if_int1_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_02_simple_if_int2_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_03_simple_if_multi_func_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_04_simple_switch_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_05_simple_goto_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_06_simple_pass_by_reference_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_07_simple_cross_file_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_08_loop_for_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_09_loop_for_complex_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_10_loop_while_continue_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_11_loop_while_do_continue_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_12_loop_for_array_branching_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_13_loop_for_pointer_arithmetic_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_17_complex_function_pointers_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_18_complex_struct_multiple_methods_good.eva/alarms.csv (good): imprecise
+strings_unbounded_copy_19_complex_refcount_good.eva/alarms.csv (good): imprecise
+base_files_access_closed_bad.eva/alarms.csv (bad): unsound
+base_files_double_close_bad.eva/alarms.csv (bad): unsound
+base_general_divide_by_0_bad.eva/alarms.csv (bad): ok
+base_general_nullpointer_bad.eva/alarms.csv (bad): ok
+base_general_uninitialized_pointer_bad.eva/alarms.csv (bad): ok
+base_general_uninitialized_value_bad.eva/alarms.csv (bad): ok
+base_integers_overflow_bad.eva/alarms.csv (bad): ok
+base_memory_double_free_bad.eva/alarms.csv (bad): ok
+base_memory_read_uninitialized_malloced_mem_bad.eva/alarms.csv (bad): ok
+base_memory_refer_freed_bad.eva/alarms.csv (bad): ok
+base_memory_zero_alloc_bad.eva/alarms.csv (bad): ok
+base_strings_overflow_bad.eva/alarms.csv (bad): ok
+base_strings_unbounded_copy_bad.eva/alarms.csv (bad): ok
+file_operations_access_closed_01_simple_if_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_02_simple_if_int1_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_02_simple_if_int2_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_03_simple_if_multi_func_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_04_simple_switch_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_05_simple_goto_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_07_cross_file_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_08_loop_for_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_09_loop_for_complex_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_10_loop_while_continue_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_11_loop_while_do_continue_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_12_loop_for_array_branching_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_17_complex_function_pointers_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): unsound
+file_operations_access_closed_19_complex_refcount_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_01_simple_if_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_02_simple_if_int1_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_02_simple_if_int2_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_03_simple_if_multi_func_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_04_simple_switch_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_05_simple_goto_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_07_cross_file_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_08_loop_for_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_09_loop_for_complex_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_10_loop_while_continue_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_11_loop_while_do_continue_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_12_loop_for_array_branching_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_17_complex_function_pointers_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): unsound
+file_operations_double_close_19_complex_refcount_bad.eva/alarms.csv (bad): unsound
+general_divide_by_zero_01_simple_if_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_02_simple_if_int1_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_02_simple_if_int2_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_03_simple_if_multi_func_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_04_simple_switch_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_05_simple_goto_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_07_simple_cross_file_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_08_loop_for_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_09_loop_for_complex_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_10_loop_while_continue_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_11_loop_while_do_continue_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_12_loop_for_array_branching_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_17_complex_function_pointers_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): ok
+general_divide_by_zero_19_complex_refcount_bad.eva/alarms.csv (bad): ok
+general_nullpointer_01_simple_if_bad.eva/alarms.csv (bad): ok
+general_nullpointer_02_simple_if_int1_bad.eva/alarms.csv (bad): ok
+general_nullpointer_02_simple_if_int2_bad.eva/alarms.csv (bad): ok
+general_nullpointer_03_simple_if_multi_func_bad.eva/alarms.csv (bad): ok
+general_nullpointer_04_simple_switch_bad.eva/alarms.csv (bad): ok
+general_nullpointer_05_simple_goto_bad.eva/alarms.csv (bad): ok
+general_nullpointer_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): ok
+general_nullpointer_07_cross_file_bad.eva/alarms.csv (bad): ok
+general_nullpointer_08_loop_for_bad.eva/alarms.csv (bad): ok
+general_nullpointer_09_loop_for_complex_bad.eva/alarms.csv (bad): ok
+general_nullpointer_10_loop_while_continue_bad.eva/alarms.csv (bad): ok
+general_nullpointer_11_loop_while_do_continue_bad.eva/alarms.csv (bad): ok
+general_nullpointer_12_loop_for_array_branching_bad.eva/alarms.csv (bad): ok
+general_nullpointer_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): ok
+general_nullpointer_17_complex_function_pointers_bad.eva/alarms.csv (bad): ok
+general_nullpointer_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): ok
+general_nullpointer_19_complex_refcount_bad.eva/alarms.csv (bad): ok
+integers_overflow_01_simple_if_bad.eva/alarms.csv (bad): ok
+integers_overflow_02_simple_if_int1_bad.eva/alarms.csv (bad): ok
+integers_overflow_02_simple_if_int2_bad.eva/alarms.csv (bad): ok
+integers_overflow_03_simple_if_multi_func_bad.eva/alarms.csv (bad): ok
+integers_overflow_04_simple_switch_bad.eva/alarms.csv (bad): ok
+integers_overflow_05_simple_goto_bad.eva/alarms.csv (bad): ok
+integers_overflow_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): ok
+integers_overflow_07_simple_cross_file_bad.eva/alarms.csv (bad): ok
+integers_overflow_08_loop_for_bad.eva/alarms.csv (bad): ok
+integers_overflow_09_loop_for_complex_bad.eva/alarms.csv (bad): ok
+integers_overflow_10_loop_while_continue_bad.eva/alarms.csv (bad): ok
+integers_overflow_11_loop_while_do_continue_bad.eva/alarms.csv (bad): ok
+integers_overflow_12_loop_for_array_branching_bad.eva/alarms.csv (bad): ok
+integers_overflow_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): ok
+integers_overflow_17_complex_function_pointers_bad.eva/alarms.csv (bad): ok
+integers_overflow_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): ok
+integers_overflow_19_complex_refcount_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_01_simple_if_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_02_simple_if_int1_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_02_simple_if_int2_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_03_simple_if_multi_func_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_04_simple_switch_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_05_simple_goto_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_07_simple_cross_file_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_08_loop_for_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_09_loop_for_complex_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_10_loop_while_continue_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_11_loop_while_do_continue_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_12_loop_for_array_branching_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_17_complex_function_pointers_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): ok
+memory_access_uninit_19_complex_refcount_bad.eva/alarms.csv (bad): ok
+memory_double_free_01_simple_if_bad.eva/alarms.csv (bad): ok
+memory_double_free_02_simple_if_int1_bad.eva/alarms.csv (bad): ok
+memory_double_free_02_simple_if_int2_bad.eva/alarms.csv (bad): ok
+memory_double_free_03_simple_if_multi_func_bad.eva/alarms.csv (bad): ok
+memory_double_free_04_simple_switch_bad.eva/alarms.csv (bad): ok
+memory_double_free_05_simple_goto_bad.eva/alarms.csv (bad): ok
+memory_double_free_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): ok
+memory_double_free_07_cross_file_bad.eva/alarms.csv (bad): ok
+memory_double_free_08_loop_for_bad.eva/alarms.csv (bad): ok
+memory_double_free_09_loop_for_complex_bad.eva/alarms.csv (bad): ok
+memory_double_free_10_loop_while_continue_bad.eva/alarms.csv (bad): ok
+memory_double_free_11_loop_while_do_continue_bad.eva/alarms.csv (bad): ok
+memory_double_free_12_loop_for_array_branching_bad.eva/alarms.csv (bad): ok
+memory_double_free_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): ok
+memory_double_free_17_complex_function_pointers_bad.eva/alarms.csv (bad): ok
+memory_double_free_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): ok
+memory_double_free_19_complex_refcount_bad.eva/alarms.csv (bad): ok
+memory_refer_free_01_simple_if_bad.eva/alarms.csv (bad): ok
+memory_refer_free_02_simple_if_int1_bad.eva/alarms.csv (bad): ok
+memory_refer_free_02_simple_if_int2_bad.eva/alarms.csv (bad): ok
+memory_refer_free_03_simple_if_multi_func_bad.eva/alarms.csv (bad): ok
+memory_refer_free_04_simple_switch_bad.eva/alarms.csv (bad): ok
+memory_refer_free_05_simple_goto_bad.eva/alarms.csv (bad): ok
+memory_refer_free_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): ok
+memory_refer_free_07_cross_file_bad.eva/alarms.csv (bad): ok
+memory_refer_free_08_loop_for_bad.eva/alarms.csv (bad): ok
+memory_refer_free_09_loop_for_complex_bad.eva/alarms.csv (bad): ok
+memory_refer_free_10_loop_while_continue_bad.eva/alarms.csv (bad): ok
+memory_refer_free_11_loop_while_do_continue_bad.eva/alarms.csv (bad): ok
+memory_refer_free_12_loop_for_array_branching_bad.eva/alarms.csv (bad): ok
+memory_refer_free_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): ok
+memory_refer_free_17_complex_function_pointers_bad.eva/alarms.csv (bad): ok
+memory_refer_free_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): ok
+memory_refer_free_19_complex_refcount_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_01_simple_if_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_02_simple_if_int1_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_02_simple_if_int2_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_03_simple_if_multi_func_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_04_simple_switch_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_05_simple_goto_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_07_cross_file_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_08_loop_for_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_09_loop_for_complex_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_10_loop_while_continue_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_11_loop_while_do_continue_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_12_loop_for_array_branching_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_17_complex_function_pointers_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): ok
+memory_zero_alloc_19_complex_refcount_bad.eva/alarms.csv (bad): ok
+strings_overflow_01_simple_if_bad.eva/alarms.csv (bad): ok
+strings_overflow_02_simple_if_int1_bad.eva/alarms.csv (bad): ok
+strings_overflow_02_simple_if_int2_bad.eva/alarms.csv (bad): ok
+strings_overflow_03_simple_if_multi_func_bad.eva/alarms.csv (bad): ok
+strings_overflow_04_simple_switch_bad.eva/alarms.csv (bad): ok
+strings_overflow_05_simple_goto_bad.eva/alarms.csv (bad): ok
+strings_overflow_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): ok
+strings_overflow_07_simple_cross_file_bad.eva/alarms.csv (bad): ok
+strings_overflow_08_loop_for_bad.eva/alarms.csv (bad): ok
+strings_overflow_09_loop_for_complex_bad.eva/alarms.csv (bad): ok
+strings_overflow_10_loop_while_continue_bad.eva/alarms.csv (bad): ok
+strings_overflow_11_loop_while_do_continue_bad.eva/alarms.csv (bad): ok
+strings_overflow_12_loop_for_array_branching_bad.eva/alarms.csv (bad): ok
+strings_overflow_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): ok
+strings_overflow_17_complex_function_pointers_bad.eva/alarms.csv (bad): ok
+strings_overflow_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): ok
+strings_overflow_19_complex_refcount_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_01_simple_if_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_02_simple_if_int1_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_02_simple_if_int2_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_03_simple_if_multi_func_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_04_simple_switch_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_05_simple_goto_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_06_simple_pass_by_reference_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_07_simple_cross_file_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_08_loop_for_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_09_loop_for_complex_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_10_loop_while_continue_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_11_loop_while_do_continue_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_12_loop_for_array_branching_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_13_loop_for_pointer_arithmetic_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_17_complex_function_pointers_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_18_complex_struct_multiple_methods_bad.eva/alarms.csv (bad): ok
+strings_unbounded_copy_19_complex_refcount_bad.eva/alarms.csv (bad): ok
diff --git a/bench-moerman2018/.frama-c/evaluate_case.sh b/bench-moerman2018/.frama-c/evaluate_case.sh
new file mode 100755
index 0000000000000000000000000000000000000000..80efc323491adef8fe31a906c898015ffe7cd7e8
--- /dev/null
+++ b/bench-moerman2018/.frama-c/evaluate_case.sh
@@ -0,0 +1,29 @@
+#!/bin/bash -eu
+
+if [ $# -lt 2 ]; then
+    echo "usage: $0 (good|bad) path/to/alarms.csv"
+    exit 1
+fi
+
+goodbad="$1"
+alarms=$(wc -l "$2" | cut -d' ' -f1)
+
+case $goodbad in
+    "good")
+        if [ "$alarms" -gt 1 ]; then
+            echo "$2 ($goodbad): imprecise"
+        else
+            echo "$2 ($goodbad): ok"
+        fi
+        ;;
+    "bad")
+        if [ "$alarms" -lt 2 ]; then
+            echo "$2 ($goodbad): unsound"
+        else
+            echo "$2 ($goodbad): ok"
+        fi
+        ;;
+    *)
+        echo "invalid '$goodbad': must be either 'good' or 'bad'."
+        exit 1
+esac
diff --git a/bench-moerman2018/.frama-c/path.mk b/bench-moerman2018/.frama-c/path.mk
new file mode 120000
index 0000000000000000000000000000000000000000..57620d6d4816c69648f7a48a2ab302665cd5ac66
--- /dev/null
+++ b/bench-moerman2018/.frama-c/path.mk
@@ -0,0 +1 @@
+../../path.mk
\ No newline at end of file
diff --git a/bench-moerman2018/LICENSE b/bench-moerman2018/LICENSE
new file mode 100644
index 0000000000000000000000000000000000000000..f6e9e392a618ebd70f7b5e1ee9f1021b04edfb0c
--- /dev/null
+++ b/bench-moerman2018/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2018 Jonathan Moerman
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/bench-moerman2018/README.md b/bench-moerman2018/README.md
new file mode 100644
index 0000000000000000000000000000000000000000..51785694e0f21202fa91ffd5ac0af7cbe184e194
--- /dev/null
+++ b/bench-moerman2018/README.md
@@ -0,0 +1,13 @@
+# About this test suite
+
+This test suite was designed and used for my bachelor thesis "Evaluating the performance of open source static analysis tools".
+
+This test suite was inspired by, and used in conjunction with the test suite presented in "Test-driving static analysis tools in search of c code vulnerabilities" by George Chatzieleftheriou and Panagiotis Katsaros.
+
+## How to use this test suite
+
+The .c files included in this test suite need to be preprocessed before use. The shellscript ```preprocess_files.sh``` can be used to accomplish this.
+
+- ```preprocess_files.sh``` needs a unix like environment with gpp installed to work. 
+- Usage: ```preprocess_files.sh [directory to process]```, for example ```preprocess_files.sh ./integers/overflow/```.
+This should generate the sub directories ```test_correct``` (safe calls to unsafe functions), ```test_incorrect``` (unsafe calls to unsafe functions), ```test_lib_correct``` (safe functions, no entry point), ```test_lib_incorrect``` (unsafe functions, no entry point) and ```test_correct_catch_bad``` (safe calls to safe functions).
diff --git a/bench-moerman2018/base/files_access_closed.c b/bench-moerman2018/base/files_access_closed.c
new file mode 100644
index 0000000000000000000000000000000000000000..e717051f79f4fe437ed54c417101dceef011f7aa
--- /dev/null
+++ b/bench-moerman2018/base/files_access_closed.c
@@ -0,0 +1,22 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+    FILE* file;
+
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return 0;
+    }
+
+#ifdef NO_BUG
+    printf("%i\n", (int) fgetc(file));
+    fclose(file);
+#else
+    fclose(file);
+    printf("%i\n", (int) fgetc(file));
+#endif
+
+    return 1;
+}
diff --git a/bench-moerman2018/base/files_double_close.c b/bench-moerman2018/base/files_double_close.c
new file mode 100644
index 0000000000000000000000000000000000000000..b268cc3d7dada45451c2b341546c8e4078c88535
--- /dev/null
+++ b/bench-moerman2018/base/files_double_close.c
@@ -0,0 +1,23 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+    FILE* file;
+
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return 1;
+    }
+
+    printf("%i\n", (int) fgetc(file));
+
+#ifdef NO_BUG
+    fclose(file);
+#else
+    fclose(file);
+    fclose(file);
+#endif
+
+    return 1;
+}
diff --git a/bench-moerman2018/base/files_resource_leak.c b/bench-moerman2018/base/files_resource_leak.c
new file mode 100644
index 0000000000000000000000000000000000000000..305e8d8860c8dde09c0ab1482d4b034915f41a08
--- /dev/null
+++ b/bench-moerman2018/base/files_resource_leak.c
@@ -0,0 +1,20 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+    FILE* file;
+
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return 1;
+    }
+
+    printf("%i\n", (int) fgetc(file));
+
+#ifdef NO_BUG
+    fclose(file);
+#endif
+
+    return 1;
+}
diff --git a/bench-moerman2018/base/general_divide_by_0.c b/bench-moerman2018/base/general_divide_by_0.c
new file mode 100644
index 0000000000000000000000000000000000000000..e7dfd8a241d632cd5ced6f938e1fd7a36d3dc685
--- /dev/null
+++ b/bench-moerman2018/base/general_divide_by_0.c
@@ -0,0 +1,16 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+    int x;
+
+#ifdef NO_BUG
+    x = 1;
+#else
+    x = 0;
+#endif
+
+    printf("%i\n", 5 / x);
+
+    return 1;
+}
diff --git a/bench-moerman2018/base/general_nullpointer.c b/bench-moerman2018/base/general_nullpointer.c
new file mode 100644
index 0000000000000000000000000000000000000000..d68bd3fabd6d04ea8a4e5b8feacf304cd05c3f6f
--- /dev/null
+++ b/bench-moerman2018/base/general_nullpointer.c
@@ -0,0 +1,17 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+    int arr[3] = {1, 2, 3};
+    int* ptr;
+
+#ifdef NO_BUG
+    ptr = arr;
+#else
+    ptr = 0;
+#endif
+
+    printf("%i\n", *ptr + arr[2]);
+
+    return 1;
+}
diff --git a/bench-moerman2018/base/general_uninitialized_pointer.c b/bench-moerman2018/base/general_uninitialized_pointer.c
new file mode 100644
index 0000000000000000000000000000000000000000..c52e9a2fb68eac0da481e32a5d24c9184d12fa94
--- /dev/null
+++ b/bench-moerman2018/base/general_uninitialized_pointer.c
@@ -0,0 +1,15 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+    int arr[3] = {1, 2, 3};
+    int* ptr;
+
+#ifdef NO_BUG
+    ptr = arr;
+#endif
+
+    printf("%i\n", *ptr + arr[2]);
+
+    return 1;
+}
diff --git a/bench-moerman2018/base/general_uninitialized_value.c b/bench-moerman2018/base/general_uninitialized_value.c
new file mode 100644
index 0000000000000000000000000000000000000000..3b40ae2f7f5ed6e153e66bc8d2f7e36c8a40b51a
--- /dev/null
+++ b/bench-moerman2018/base/general_uninitialized_value.c
@@ -0,0 +1,14 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+    int x;
+
+#ifdef NO_BUG
+    x = 5;
+#endif
+
+    printf("%i\n", x + 1);
+
+    return 1;
+}
diff --git a/bench-moerman2018/base/integers_overflow.c b/bench-moerman2018/base/integers_overflow.c
new file mode 100644
index 0000000000000000000000000000000000000000..852a7c0ff0a895fef0b88a2132996ed054e146eb
--- /dev/null
+++ b/bench-moerman2018/base/integers_overflow.c
@@ -0,0 +1,17 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <limits.h>
+
+int main() {
+    int x;
+
+#ifdef NO_BUG
+    x = INT_MAX - 1;
+#else
+    x = INT_MAX;
+#endif
+
+    printf("%i\n", x + 1);
+
+    return 1;
+}
diff --git a/bench-moerman2018/base/memory_double_free.c b/bench-moerman2018/base/memory_double_free.c
new file mode 100644
index 0000000000000000000000000000000000000000..99356bac4b998adfe99f9380225da2aae418609d
--- /dev/null
+++ b/bench-moerman2018/base/memory_double_free.c
@@ -0,0 +1,24 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+    int* data;
+    int x = 33;
+
+    data = malloc(5 * sizeof(int));
+
+    if(!data) {
+        return -1;
+    }
+
+    *data = x;
+
+    printf("%i\n", *data);
+
+    free(data);
+#ifndef NO_BUG
+    free(data);
+#endif
+
+    return 1;
+}
diff --git a/bench-moerman2018/base/memory_leak.c b/bench-moerman2018/base/memory_leak.c
new file mode 100644
index 0000000000000000000000000000000000000000..9ca1fa60aa9c0f255d0a3f1ef9e1074e857ab025
--- /dev/null
+++ b/bench-moerman2018/base/memory_leak.c
@@ -0,0 +1,23 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+    int* data;
+    int x = 33;
+
+    data = malloc(5 * sizeof(int));
+
+    if(!data) {
+        return -1;
+    }
+
+    *data = x;
+
+    printf("%i\n", *data);
+
+#ifdef NO_BUG
+    free(data);
+#endif
+
+    return 1;
+}
diff --git a/bench-moerman2018/base/memory_read_uninitialized_malloced_mem.c b/bench-moerman2018/base/memory_read_uninitialized_malloced_mem.c
new file mode 100644
index 0000000000000000000000000000000000000000..3019d7de14ba63873bc51761dc304b63ec1ad96d
--- /dev/null
+++ b/bench-moerman2018/base/memory_read_uninitialized_malloced_mem.c
@@ -0,0 +1,23 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+    int* data;
+
+    data = malloc(sizeof(int));
+
+
+    if(!data) {
+        return -1;
+    }
+
+#ifdef NO_BUG
+    *data = 37;
+#endif
+
+    printf("%i\n", *data);
+
+    free(data);
+
+    return 1;
+}
diff --git a/bench-moerman2018/base/memory_refer_freed.c b/bench-moerman2018/base/memory_refer_freed.c
new file mode 100644
index 0000000000000000000000000000000000000000..a3386c212177617d26655de5b64b8f15180e0bb3
--- /dev/null
+++ b/bench-moerman2018/base/memory_refer_freed.c
@@ -0,0 +1,25 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+    int* data;
+    int x = 33;
+
+    data = malloc(5 * sizeof(int));
+
+    if(!data) {
+        return -1;
+    }
+
+    *data = x;
+
+#ifdef NO_BUG
+    printf("%i\n", *data);
+    free(data);
+#else
+    free(data);
+    printf("%i\n", *data);
+#endif
+
+    return 1;
+}
diff --git a/bench-moerman2018/base/memory_zero_alloc.c b/bench-moerman2018/base/memory_zero_alloc.c
new file mode 100644
index 0000000000000000000000000000000000000000..a3d224535caa2e259b2043de63cb05730d15455a
--- /dev/null
+++ b/bench-moerman2018/base/memory_zero_alloc.c
@@ -0,0 +1,27 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+    int* data;
+    int x;
+
+#ifdef NO_BUG
+    x = 1;
+#else
+    x = 0;
+#endif
+
+    data = malloc(x * sizeof(int));
+
+    if(!data) {
+        return -1;
+    }
+
+    *data = x;
+
+    printf("%i\n", *data);
+
+    free(data);
+
+    return 1;
+}
diff --git a/bench-moerman2018/base/strings_overflow.c b/bench-moerman2018/base/strings_overflow.c
new file mode 100644
index 0000000000000000000000000000000000000000..55e8d7c616d450031a7608cce37b1d408b320a83
--- /dev/null
+++ b/bench-moerman2018/base/strings_overflow.c
@@ -0,0 +1,16 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+#ifdef NO_BUG
+    char test_string[] = "this is a long string";
+#else
+    char test_string[] = "short string";
+#endif
+
+    test_string[13] = '?';
+
+    printf("%s\n", test_string);
+
+    return 1;
+}
diff --git a/bench-moerman2018/base/strings_unbounded_copy.c b/bench-moerman2018/base/strings_unbounded_copy.c
new file mode 100644
index 0000000000000000000000000000000000000000..ad1b7b0da3f61f2214e5713fc49773271ffbdb88
--- /dev/null
+++ b/bench-moerman2018/base/strings_unbounded_copy.c
@@ -0,0 +1,17 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+int main() {
+#ifdef NO_BUG
+    char test_string[22];
+#else
+    char test_string[13];
+#endif
+
+    strcpy(test_string, "this is a long string");
+
+    printf("%s\n", test_string);
+
+    return 1;
+}
diff --git a/bench-moerman2018/common/common.c b/bench-moerman2018/common/common.c
new file mode 100644
index 0000000000000000000000000000000000000000..f7e71fa7074def8996e9619a8b04189b37c9361b
--- /dev/null
+++ b/bench-moerman2018/common/common.c
@@ -0,0 +1,52 @@
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+void assign_pointer(void** dest, void* source1, void* source2, bool condition) {
+    if(condition) {
+        *dest = source1;
+    } else {
+        *dest = source2;
+    }
+}
+
+void* choose_pointer(void* source1, void* source2, bool condition) {
+    if(condition) {
+        return source1;
+    } else {
+        return source2;
+    }
+}
+
+void conditional_free(void* ptr, bool condition, void** set_null) {
+    if(condition) {
+        free(ptr);
+        if(set_null) {
+            *set_null = 0;
+        }
+    }
+}
+
+int int_dereference_choice(int* source1, int* source2, bool condition) {
+    if(condition) {
+        return *source1;
+    }
+    return *source2;
+}
+
+int choose_int(int int1, int int2, bool condition) {
+    if(condition) {
+        return int1;
+    } else {
+        return int2;
+    }
+}
+
+void conditional_close(FILE* file, bool do_close, FILE** set_null) {
+    if(do_close) {
+        fclose(file);
+        if(set_null) {
+            *set_null = 0;
+        }
+    }
+}
diff --git a/bench-moerman2018/common/common.h b/bench-moerman2018/common/common.h
new file mode 100644
index 0000000000000000000000000000000000000000..d1f23fcc0528bb981bae7097a03e1109d8a8c11c
--- /dev/null
+++ b/bench-moerman2018/common/common.h
@@ -0,0 +1,9 @@
+#include <stdbool.h>
+#include <stdio.h>
+
+int int_dereference_choice(int* source1, int* source2, bool condition);
+void* choose_pointer(void* source1, void* source2, bool condition);
+void conditional_free(void* ptr, bool condition, void** set_null);
+int choose_int(int int1, int int2, bool condition);
+void conditional_close(FILE* file, bool do_close, FILE** set_null);
+void assign_pointer(void** dest, void* source1, void* source2, bool condition);
diff --git a/bench-moerman2018/common/pointers.c b/bench-moerman2018/common/pointers.c
new file mode 100644
index 0000000000000000000000000000000000000000..b2b1d3e8f6297358b1c7921fe0a438f40bdcb244
--- /dev/null
+++ b/bench-moerman2018/common/pointers.c
@@ -0,0 +1,24 @@
+#include <stdbool.h>
+
+void assign_pointer(void** dest, void* source1, void* source2, bool condition) {
+    if(condition) {
+        *dest = source1;
+    } else {
+        *dest = source2;
+    }
+}
+
+void* choose_pointer(void* source1, void* source2, bool condition) {
+    if(condition) {
+        return source1;
+    } else {
+        return source2;
+    }
+}
+
+int int_dereference_choice(int* source1, int* source2, bool condition) {
+    if(condition) {
+        return *source1;
+    }
+    return *source2;
+}
diff --git a/bench-moerman2018/file_operations/access_closed/01_simple_if.c b/bench-moerman2018/file_operations/access_closed/01_simple_if.c
new file mode 100644
index 0000000000000000000000000000000000000000..ca40a50c8f5ecfc06c6b838440d969b92112c313
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/01_simple_if.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "access_closed.h"
+
+void access_closed_if_else(bool a, bool b) {
+    FILE* file;
+    int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    if(a) {
+        val = ((int) fgetc(file)) * 2;
+    } else {
+        val = (int) fgetc(file);
+        fclose(file);
+    }
+
+    if(b) {
+        val += 37;
+    } else {
+        val += (int) fgetc(file);
+    }
+
+    if(a) {
+        fclose(file);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    access_closed_if_else(true, true);
+    access_closed_if_else(true, false);
+    access_closed_if_else(false, true);
+#else
+    access_closed_if_else(true, true); /* OK */
+    access_closed_if_else(false, false); /* DANGER */
+    access_closed_if_else(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/02_simple_if_int1.c b/bench-moerman2018/file_operations/access_closed/02_simple_if_int1.c
new file mode 100644
index 0000000000000000000000000000000000000000..bd2d976fb0fe58ab2176e86a88a3fea3bba352a6
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/02_simple_if_int1.c
@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+void access_closed_if_else_int1(int x, int y) {
+    int val = 0;
+    FILE* file;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && x < y) {
+        return;
+    }
+#endif
+
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    if(x <= 10) {
+        val = ((int) fgetc(file)) * 2;
+    } else {
+        val = (int) fgetc(file);
+        fclose(file);
+    }
+
+    if(x >= y) {
+        val += 10;
+    } else {
+        val = ((int) fgetc(file)) * 2;
+    }
+
+    if(x <= 10) {
+        fclose(file);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    access_closed_if_else_int1(10, 10);
+    access_closed_if_else_int1(10, 11);
+    access_closed_if_else_int1(11, 11);
+#else
+    access_closed_if_else_int1(10, 10); /* OK */
+    access_closed_if_else_int1(11, 12); /* DANGER */
+    access_closed_if_else_int1(11, 11); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/02_simple_if_int2.c b/bench-moerman2018/file_operations/access_closed/02_simple_if_int2.c
new file mode 100644
index 0000000000000000000000000000000000000000..7473afcb4f59249203bc6f910faf2681407ea96c
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/02_simple_if_int2.c
@@ -0,0 +1,61 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+void access_closed_if_else_int2(int x, int y) {
+    FILE* file;
+    int val = 0;
+    int m, n;
+
+    m = -1;
+    n = 5;
+
+    x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && x < y) {
+        return;
+    }
+#endif
+
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    if(x <= 10) {
+        val = ((int) fgetc(file)) * 2;
+    } else {
+        val = (int) fgetc(file);
+        fclose(file);
+    }
+
+    if(x >= y) {
+        val += 10;
+    } else {
+        val = ((int) fgetc(file)) * 2;
+    }
+
+    if(x <= 10) {
+        fclose(file);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    access_closed_if_else_int2(-5, 10);
+    access_closed_if_else_int2(-5, 11);
+    access_closed_if_else_int2(-6, 11);
+#else
+    access_closed_if_else_int2(-5, 10); /* OK */
+    access_closed_if_else_int2(-6, 12); /* DANGER */
+    access_closed_if_else_int2(-6, 11); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/03_simple_if_multi_func.c b/bench-moerman2018/file_operations/access_closed/03_simple_if_multi_func.c
new file mode 100644
index 0000000000000000000000000000000000000000..60ca39f7481411454c344d1ab7f20b81bc37761c
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/03_simple_if_multi_func.c
@@ -0,0 +1,55 @@
+#include "access_closed.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void conditional_close(FILE** ptr, bool condition) {
+    if(condition) {
+        fclose(*ptr);
+    }
+}
+
+static int conditional_fgetc(FILE** ptr, int def, bool condition) {
+    if(condition) {
+        return fgetc(*ptr);
+    }
+    return def;
+}
+
+void access_closed_if_else_multi(bool a, bool b) {
+    int val;
+    FILE* file;
+    FILE** file_ptr = &file;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    conditional_close(file_ptr, !a);
+    val = conditional_fgetc(file_ptr, 897, !b);
+    conditional_close(file_ptr, a);
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    access_closed_if_else_multi(true, true);
+    access_closed_if_else_multi(true, false);
+    access_closed_if_else_multi(false, true);
+#else
+    access_closed_if_else_multi(true, true); /* OK */
+    access_closed_if_else_multi(false, false); /* DANGER */
+    access_closed_if_else_multi(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/04_simple_switch.c b/bench-moerman2018/file_operations/access_closed/04_simple_switch.c
new file mode 100644
index 0000000000000000000000000000000000000000..5307d5301d91f80ae3f6de0929d2e63237963adb
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/04_simple_switch.c
@@ -0,0 +1,80 @@
+#include "access_closed.h"
+#include <stdbool.h>
+#include <stdlib.h>
+
+int access_closed_switch(int x, int y) {
+    FILE* file;
+    bool closed = false;
+    int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if((x == 10 || x == 5) && x <= y) {
+        return -1;
+    }
+#endif
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return -1;
+    }
+
+    if(x > y) {
+        fclose(file);
+        closed = true;
+    }
+
+    switch (x) {
+        case 5: {
+            val = ((int) fgetc(file)); /* DANGER: x >= y */
+            break;
+        }
+        case 7: {
+            if(!closed) {
+                val  = ((int) fgetc(file)) + 289;
+            } else {
+                val = 5687;
+            }
+            break;
+        }
+        case 10: {
+            val = ((int) fgetc(file)) + 36; /* DANGER: x >= y */
+            break;
+        }
+        case 12: {
+            if(!closed) {
+                val  = ((int) fgetc(file)) + 49807;
+            } else {
+                val = 576;
+            }
+            break;
+        }
+        default: {
+            val  = 7987;
+            break;
+        }
+    }
+
+    if(!closed) {
+        fclose(file);
+    }
+
+    return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    access_closed_switch(5, 11);
+    access_closed_switch(10, 11);
+    access_closed_switch(11, 10);
+    access_closed_switch(7, 5);
+#else
+    access_closed_switch(5, 10); /* OK */
+    access_closed_switch(10, 9); /* DANGER */
+    access_closed_switch(11, 10); /* OK */
+    access_closed_switch(7, 5); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/05_simple_goto.c b/bench-moerman2018/file_operations/access_closed/05_simple_goto.c
new file mode 100644
index 0000000000000000000000000000000000000000..3c37b1b67c2fc3023bc4037048c750d9606986ea
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/05_simple_goto.c
@@ -0,0 +1,46 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+void access_closed_goto(int x) {
+    FILE* file = 0;
+    int val = 0;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 0) {
+        return;
+    }
+#endif
+
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+GOTO_LABEL:
+    if(i <= x) {
+        val += ((int) fgetc(file));
+    } else {
+        printf("%i\n", val);
+    }
+
+    if(i == 0) {
+        i++;
+        fclose(file);
+        goto GOTO_LABEL;
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    access_closed_goto(0);
+#else
+    access_closed_goto(1);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/06_simple_pass_by_reference.c b/bench-moerman2018/file_operations/access_closed/06_simple_pass_by_reference.c
new file mode 100644
index 0000000000000000000000000000000000000000..ac7d59ee77353fef6edf13593d96a43c56f08874
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/06_simple_pass_by_reference.c
@@ -0,0 +1,59 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "access_closed.h"
+
+static int assign_possibly_closed(FILE** dest, bool close_file) {
+    int val;
+    FILE* file = fopen("file.txt","r");
+    *dest = file;
+    if(!file) {
+        return -1;
+    }
+    val = (int) fgetc(file);
+    if(close_file) {
+        fclose(file);
+    }
+    return val;
+}
+
+void access_closed_pass_by_reference(bool a, bool b) {
+    FILE* file;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    val = assign_possibly_closed(&file, !a);
+
+    if(!b && file) {
+        val += (int) fgetc(file);
+    } else {
+        val += 687;
+    }
+
+    if(a && file) {
+        fclose(file);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    access_closed_pass_by_reference(true, true);
+    access_closed_pass_by_reference(true, false);
+    access_closed_pass_by_reference(false, true);
+#else
+    access_closed_pass_by_reference(true, true); /* OK */
+    access_closed_pass_by_reference(false, false); /* DANGER */
+    access_closed_pass_by_reference(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/07_cross_file.c b/bench-moerman2018/file_operations/access_closed/07_cross_file.c
new file mode 100644
index 0000000000000000000000000000000000000000..97c3d38da75e2764d705be0cd5f6a72aff0a11b8
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/07_cross_file.c
@@ -0,0 +1,50 @@
+#include "access_closed.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+void access_closed_cross_file(bool a, bool b) {
+    int val;
+    FILE* file;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    conditional_close(file, !a, 0);
+
+    if(b) {
+        val = 678;
+    } else {
+        val = (int) fgetc(file);
+    }
+
+    if(a) {
+        fclose(file);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    access_closed_cross_file(true, true);
+    access_closed_cross_file(true, false);
+    access_closed_cross_file(false, true);
+#else
+    access_closed_cross_file(true, true); /* OK */
+    access_closed_cross_file(false, false); /* DANGER */
+    access_closed_cross_file(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/08_loop_for.c b/bench-moerman2018/file_operations/access_closed/08_loop_for.c
new file mode 100644
index 0000000000000000000000000000000000000000..60408ce78943918f3d2b9877e46deab119253f52
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/08_loop_for.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+void access_closed_for(int x) {
+    FILE* file;
+    int val = 0;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    file = fopen("file1.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    val = (int) fgetc(file);
+
+    fclose(file);
+
+    for(i = 0; i < 20; i++) {
+        if(i > x) {
+            val += (int) fgetc(file);
+        } else {
+            val += 24;
+        }
+        if(i == 10) {
+            file = fopen("file2.txt","r");
+            if(!file) {
+                return;
+            }
+        }
+    }
+
+    fclose(file);
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    access_closed_for(10);
+#else
+    access_closed_for(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/09_loop_for_complex.c b/bench-moerman2018/file_operations/access_closed/09_loop_for_complex.c
new file mode 100644
index 0000000000000000000000000000000000000000..d4c2ba096a6f8c36ecb3cba8d67b46947a4dab1f
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/09_loop_for_complex.c
@@ -0,0 +1,59 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+void access_closed_for_complex(int x) {
+    FILE* file;
+    int val = 0;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    file = fopen("file1.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    val = (int) fgetc(file);
+
+    fclose(file);
+
+    for(;;) {
+        if(i > x) {
+            val += (int) fgetc(file);
+        } else {
+            val += 24;
+        }
+        if(i == 10) {
+            file = fopen("file2.txt","r");
+            if(!file) {
+                return;
+            }
+        }
+        i++;
+        if(i >= 20) {
+            break;
+        }
+    }
+
+    fclose(file);
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    access_closed_for_complex(10);
+#else
+    access_closed_for_complex(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/10_loop_while_continue.c b/bench-moerman2018/file_operations/access_closed/10_loop_while_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..c711e56c76a4d083dfc3a0f7db81fc162b9ec8bd
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/10_loop_while_continue.c
@@ -0,0 +1,63 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+void access_closed_while_continue(int x) {
+    FILE* file;
+    int val = 0;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    file = fopen("file1.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    val = (int) fgetc(file);
+
+    fclose(file);
+
+    while(i < 30) {
+        if(i == 9) {
+            i++;
+            continue;
+        }
+        if(i > x) {
+            val += (int) fgetc(file);
+        } else {
+            val += 24;
+        }
+        if(i == 10) {
+            file = fopen("file2.txt","r");
+            if(!file) {
+                return;
+            }
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    }
+
+    fclose(file);
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    access_closed_while_continue(10);
+#else
+    access_closed_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/11_loop_while_do_continue.c b/bench-moerman2018/file_operations/access_closed/11_loop_while_do_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..2cf898ca632f24a363164587e25c0f621ec02a8c
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/11_loop_while_do_continue.c
@@ -0,0 +1,63 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+void access_closed_do_while_continue(int x) {
+    FILE* file;
+    int val = 0;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    file = fopen("file1.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    val = (int) fgetc(file);
+
+    fclose(file);
+
+    do {
+        if(i == 8) {
+            i++;
+            continue;
+        }
+        if(i > x) {
+            val += (int) fgetc(file);
+        } else {
+            val += 24;
+        }
+        if(i == 10) {
+            file = fopen("file2.txt","r");
+            if(!file) {
+                return;
+            }
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    } while(i < 30);
+
+    fclose(file);
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    access_closed_do_while_continue(10);
+#else
+    access_closed_do_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/12_loop_for_array_branching.c b/bench-moerman2018/file_operations/access_closed/12_loop_for_array_branching.c
new file mode 100644
index 0000000000000000000000000000000000000000..f9ac04c8c011730ccc3106dfa23bd0426aa84123
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/12_loop_for_array_branching.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "access_closed.h"
+
+void access_closed_for_array(int x) {
+    FILE* file = 0;
+    int p[20];
+    int val = 0;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 19) {
+        return;
+    }
+#endif
+
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    for(i = 0; i < 20; i++) {
+        p[i] = 0;
+    }
+    p[x] = 1;
+
+    for(i = 0; i < 20; i++) {
+        if(p[i] == 1) {
+            fclose(file);
+        } else {
+            val += ((int) fgetc(file)) + i;
+        }
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    access_closed_for_array(19);
+#else
+    access_closed_for_array(10);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/file_operations/access_closed/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 0000000000000000000000000000000000000000..ffbbe95b59144eb972c83dcb0bf35b250c953adb
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,71 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "access_closed.h"
+
+static void initialize_array(FILE* ptr_arr[], int length) {
+    int i;
+    FILE** ptr = ptr_arr;
+
+    for(i = 0; i < length; i++, ptr++) {
+        *ptr = fopen("file.txt","r");
+    }
+}
+
+static void close_backwards(FILE** ptr, int to_close) {
+    int i;
+
+    for(i = 0; i < to_close; i++, ptr--) {
+        if(*ptr) fclose(*ptr);
+    }
+}
+
+static void close_forwards(FILE** ptr, int to_close) {
+    int i;
+
+    for(i = 0; i < to_close; i++, ptr++) {
+        if(*ptr) fclose(*ptr);
+    }
+}
+
+void access_closed_for_pointer(int x) {
+    FILE* pointers[10];
+    FILE** ptr;
+    int val = 0, i;
+
+    if(x > 10 || x < 0) {
+        return;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 5) {
+        return;
+    }
+#endif
+
+    initialize_array(pointers, 10);
+    close_backwards(pointers + 9, x);
+
+    ptr = pointers;
+    for(int i = 0; i < 5; i++, ptr++) {
+        if(*ptr) {
+            val += (int) fgetc(*ptr);
+        } else {
+            val--;
+        }
+    }
+
+    close_forwards(pointers, 10 - x);
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    access_closed_for_pointer(4);
+#else
+    access_closed_for_pointer(6);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/14_loop_recursion.c b/bench-moerman2018/file_operations/access_closed/14_loop_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..b9b2bb608e909adfcfcfa535d5cd97b9de27cc1e
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/14_loop_recursion.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+int access_closed_rec(int x, int i, FILE** file_ptr) {
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10) {
+        return -1;
+    }
+#endif
+
+    if(i <= 1) {
+        if(*file_ptr) fclose(*file_ptr);
+        *file_ptr = 0;
+        return 0;
+    }
+
+    if(i > 19 && !*file_ptr) {
+        *file_ptr = fopen("file.txt", "r");
+        return access_closed_rec(x, i-1, file_ptr);
+    }
+    if(i == 19) {
+        if(*file_ptr) {
+            fclose(*file_ptr);
+        }
+        return access_closed_rec(x, i-1, file_ptr);
+    }
+
+    if(i < x && *file_ptr) {
+        val = (int) fgetc(*file_ptr);
+    } else {
+        val = 8;
+    }
+    if(i == 10 && !*file_ptr) {
+        *file_ptr = fopen("file.txt","r");
+        if(!*file_ptr) return -1;
+    }
+
+    return val + access_closed_rec(x, i-1, file_ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+    FILE* file = 0;
+#ifdef NO_BUG
+    printf("%i\n", access_closed_rec(10, 20, &file));
+    file = fopen("file.txt", "r");
+    printf("%i\n", access_closed_rec(11, 18, &file));
+#else
+    printf("%i\n", access_closed_rec(11, 20, &file));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/15_loop_recursion_multi.c b/bench-moerman2018/file_operations/access_closed/15_loop_recursion_multi.c
new file mode 100644
index 0000000000000000000000000000000000000000..58717a813f2113323ca04ef11e848678dd9a8055
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/15_loop_recursion_multi.c
@@ -0,0 +1,61 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+int access_closed_rec_decr(int x, int i, FILE** file_ptr) {
+    if(i <= 1) {
+        if(*file_ptr) fclose(*file_ptr);
+        *file_ptr = 0;
+        return 0;
+    }
+
+    return access_closed_rec_multi(x, i-1, file_ptr);
+}
+
+int access_closed_rec_multi(int x, int i, FILE** file_ptr) {
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && i > 18) {
+        return -1;
+    }
+#endif
+    if(i > 19 && !*file_ptr) {
+        *file_ptr = fopen("file.txt", "r");
+        access_closed_rec_decr(x, i, file_ptr);
+    }
+    if(i == 19) {
+        if(*file_ptr) {
+            fclose(*file_ptr);
+        }
+        access_closed_rec_decr(x, i, file_ptr);
+    }
+
+    if(i < x && *file_ptr) {
+        val = (int) fgetc(*file_ptr);
+    } else {
+        val = 8;
+    }
+    if(i == 10 && !*file_ptr) {
+        *file_ptr = fopen("file.txt","r");
+        if(!*file_ptr) return -1;
+    }
+
+    return val + access_closed_rec_decr(x, i, file_ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+    FILE* file = 0;
+#ifdef NO_BUG
+    printf("%i\n", access_closed_rec_multi(10, 20, &file));
+    file = fopen("file.txt", "r");
+    printf("%i\n", access_closed_rec_multi(11, 18, &file));
+#else
+    printf("%i\n", access_closed_rec_multi(11, 20, &file));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/16_misc_pseudo_recursion.c b/bench-moerman2018/file_operations/access_closed/16_misc_pseudo_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..a4a0f6f12b23bd2fd7bd4388e2889db658109809
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/16_misc_pseudo_recursion.c
@@ -0,0 +1,65 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+int access_closed_pseudo_rec1(int x, int y, int i, FILE** file_ptr) {
+    int val;
+#ifdef CATCH_BAD_PARAM
+    if(x >= y && x < 10) {
+        return -1;
+    }
+#endif
+
+    if(!*file_ptr) {
+        return -1;
+    }
+
+    val = ((int) fgetc(*file_ptr));
+
+    if(i > 0) {
+        fclose(*file_ptr);
+        return 37;
+    }
+
+    if(x < y) {
+        fclose(*file_ptr);
+    } else {
+        fgetc(*file_ptr);
+    }
+
+    return val + access_closed_pseudo_rec2(x, y, 1, file_ptr);
+}
+
+int access_closed_pseudo_rec2(int x, int y, int i, FILE** file_ptr) {
+    int val = 78;
+    if(i > 0) {
+        if(x < 10) {
+            val -= ((int) fgetc(*file_ptr));
+        } else {
+            val += 2;
+        }
+
+        if(x >= y) {
+            fclose(*file_ptr);
+            *file_ptr = 0;
+        }
+        return val;
+    }
+
+    return 5 + access_closed_pseudo_rec1(x, y, 1, file_ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+    FILE* file = fopen("file.txt", "r");
+#ifdef NO_BUG
+    printf("%i\n", access_closed_pseudo_rec1(9, 10, 0, &file));
+    file = fopen("file.txt", "r");
+    printf("%i\n", access_closed_pseudo_rec1(11, 10, 0, &file));
+#else
+    printf("%i\n", access_closed_pseudo_rec1(9, 8, 0, &file));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/17_complex_function_pointers.c b/bench-moerman2018/file_operations/access_closed/17_complex_function_pointers.c
new file mode 100644
index 0000000000000000000000000000000000000000..f69f8dd0a125d6901692431c5589b3a1428e039e
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/17_complex_function_pointers.c
@@ -0,0 +1,59 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+static int assign_possibly_closed(FILE** dest, bool close_file) {
+    int val;
+    FILE* file = fopen("file.txt","r");
+    *dest = file;
+    if(!file) {
+        return -1;
+    }
+    val = (int) fgetc(file);
+    if(close_file) {
+        fclose(file);
+    }
+    return val;
+}
+
+void access_closed_function_pointer(bool a, bool b, int (*f)(FILE** dest, bool close_file)) {
+    FILE* file;
+    int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(!f || (!a & !b)) {
+        return;
+    }
+#endif
+
+    val = (*f)(&file, a);
+
+    if(!b && file) {
+        val += (int) fgetc(file);
+    } else {
+        val += 687;
+    }
+
+    if(a && file) {
+        fclose(file);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    access_closed_function_pointer(true, true, &assign_possibly_closed);
+    access_closed_function_pointer(true, false, &assign_possibly_closed);
+    access_closed_function_pointer(false, true, &assign_possibly_closed);
+#else
+    access_closed_function_pointer(true, true, &assign_possibly_closed); /* OK */
+    access_closed_function_pointer(false, false, &assign_possibly_closed); /* DANGER */
+    access_closed_function_pointer(false, true, &assign_possibly_closed); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/18_complex_struct_multiple_methods.c b/bench-moerman2018/file_operations/access_closed/18_complex_struct_multiple_methods.c
new file mode 100644
index 0000000000000000000000000000000000000000..796c8c89ef7239f589e7a4a9605eedffc17f49bb
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/18_complex_struct_multiple_methods.c
@@ -0,0 +1,93 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "access_closed.h"
+
+#ifndef s_FILES_AC_REFCOUNT
+#define s_FILES_AC_REFCOUNT
+void access_closed_cont_init(FileCont* cont) {
+    cont->refc = 1;
+    cont->file = 0;
+}
+
+FileCont* access_closed_cont_new() {
+    FileCont* new_cont;
+
+    new_cont = malloc(sizeof(FileCont));
+
+    if(new_cont) {
+        access_closed_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void access_closed_cont_ref(FileCont* cont) {
+    if(cont) {
+        cont->refc++;
+    }
+}
+void access_closed_cont_unref(FileCont* cont) {
+    if(cont->refc <= 1) {
+        fclose(cont->file);
+    } else {
+        cont->refc--;
+    }
+}
+
+FILE* access_closed_cont_get_file(FileCont* cont) {
+    return cont->file;
+}
+void access_closed_cont_set_file(FileCont* cont, FILE* file) {
+    cont->file = file;
+}
+#endif //s_FILES_AC_REFCOUNT
+
+void access_closed_struct(int x, int y) {
+    FileCont cont;
+    FILE* file;
+    int val = 78;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && x <= y) {
+        return;
+    }
+#endif
+
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    access_closed_cont_init(&cont);
+    access_closed_cont_set_file(&cont, file);
+
+    if(x <= y) {
+        fclose(access_closed_cont_get_file(&cont));
+    }
+
+    if(x > 10) {
+        val = (int) fgetc(file);
+    } else {
+        val = val * 2;
+    }
+
+    if(x > y) {
+        fclose(access_closed_cont_get_file(&cont));
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    access_closed_struct(9, 10);
+    access_closed_struct(10, 11);
+    access_closed_struct(11, 10);
+#else
+    access_closed_struct(11, 11); /* DANGER */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/19_complex_refcount.c b/bench-moerman2018/file_operations/access_closed/19_complex_refcount.c
new file mode 100644
index 0000000000000000000000000000000000000000..7f8af502919a7862bd5ddf656cfcd752d9c3288b
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/19_complex_refcount.c
@@ -0,0 +1,79 @@
+#include "access_closed.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_FILES_AC_REFCOUNT
+#define s_FILES_AC_REFCOUNT
+void access_closed_cont_init(FileCont* cont) {
+    cont->refc = 1;
+    cont->file = 0;
+}
+
+FileCont* access_closed_cont_new() {
+    FileCont* new_cont;
+
+    new_cont = malloc(sizeof(FileCont));
+
+    if(new_cont) {
+        access_closed_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void access_closed_cont_ref(FileCont* cont) {
+    if(cont) {
+        cont->refc++;
+    }
+}
+void access_closed_cont_unref(FileCont* cont) {
+    if(cont->refc <= 1) {
+        if(cont->file) fclose(cont->file);
+    } else {
+        cont->refc--;
+    }
+}
+
+FILE* access_closed_cont_get_file(FileCont* cont) {
+    return cont->file;
+}
+void access_closed_cont_set_file(FileCont* cont, FILE* file) {
+    cont->file = file;
+}
+#endif //s_FILES_AC_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+    FileCont* cont;
+    FILE* file;
+    int val;
+
+    file = fopen("file.txt", "r");
+    if(!file) {
+        return -1;
+    }
+
+    cont = access_closed_cont_new();
+    if(!cont) {
+        fclose(file);
+        return 1;
+    }
+    access_closed_cont_set_file(cont, file);
+
+    access_closed_cont_ref(cont);
+    access_closed_cont_ref(cont);
+    access_closed_cont_unref(cont);
+    access_closed_cont_unref(cont);
+#ifdef NO_BUG
+    val = ((int) fgetc(access_closed_cont_get_file(cont)));
+    access_closed_cont_unref(cont);
+#else
+    access_closed_cont_unref(cont);
+    val = ((int) fgetc(access_closed_cont_get_file(cont)));
+#endif
+    free(cont);
+
+    printf("%i\n", val);
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/access_closed/access_closed.h b/bench-moerman2018/file_operations/access_closed/access_closed.h
new file mode 100644
index 0000000000000000000000000000000000000000..2c22086e891ceea38e36bb78a985d1fdced01e5e
--- /dev/null
+++ b/bench-moerman2018/file_operations/access_closed/access_closed.h
@@ -0,0 +1,37 @@
+#include <stdbool.h>
+#include <stdio.h>
+
+typedef struct _ResLeakRefCont FileCont;
+
+struct _ResLeakRefCont {
+    FILE* file;
+    unsigned int refc;
+};
+
+void access_closed_cont_init(FileCont* cont);
+FileCont* access_closed_cont_new();
+void access_closed_cont_ref(FileCont* cont);
+void access_closed_cont_unref(FileCont* cont);
+FILE* access_closed_cont_get_file(FileCont* cont);
+void access_closed_cont_set_file(FileCont* cont, FILE* file);
+
+void access_closed_for(int x);
+void access_closed_for_complex(int x);
+void access_closed_while_continue(int x);
+void access_closed_do_while_continue(int x);
+void access_closed_for_array(int x);
+void access_closed_for_pointer(int x);
+void access_closed_goto(int x);
+void access_closed_if_else(bool a, bool b);
+void access_closed_if_else_multi(bool a, bool b);
+void access_closed_if_else_int1(int x, int y);
+void access_closed_if_else_int2(int x, int y);
+void access_closed_pass_by_reference(bool a, bool b);
+int access_closed_switch(int x, int y);
+int access_closed_rec_multi(int x, int i, FILE** file_pt);
+int access_closed_rec(int x, int i, FILE** file_ptr);
+int access_closed_pseudo_rec1(int x, int y, int i, FILE** file_ptr);
+int access_closed_pseudo_rec2(int x, int y, int i, FILE** file_ptr);
+void access_closed_struct(int x, int y);
+void access_closed_function_pointer(bool a, bool b, int (*f)(FILE** dest, bool close_file));
+void access_closed_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/file_operations/double_close/01_simple_if.c b/bench-moerman2018/file_operations/double_close/01_simple_if.c
new file mode 100644
index 0000000000000000000000000000000000000000..c1bb6a370e699fa763d425093b3d194fb8b13943
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/01_simple_if.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "double_close.h"
+
+void double_close_if_else(bool a, bool b) {
+    FILE* file;
+    int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    if(a) {
+        val = ((int) fgetc(file)) * 2;
+    } else {
+        val = (int) fgetc(file);
+        fclose(file);
+    }
+
+    if(b) {
+        val += 37;
+    } else {
+        fclose(file);
+    }
+
+    if(a & b) {
+        fclose(file);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_close_if_else(true, true);
+    double_close_if_else(true, false);
+    double_close_if_else(false, true);
+#else
+    double_close_if_else(true, true); /* OK */
+    double_close_if_else(false, false); /* DANGER */
+    double_close_if_else(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/02_simple_if_int1.c b/bench-moerman2018/file_operations/double_close/02_simple_if_int1.c
new file mode 100644
index 0000000000000000000000000000000000000000..2697d674a955703ac9257b19f3f001fe6afa85c0
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/02_simple_if_int1.c
@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+void double_close_if_else_int1(int x, int y) {
+    int val = 0;
+    FILE* file;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && x < y) {
+        return;
+    }
+#endif
+
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    if(x <= 10) {
+        val = ((int) fgetc(file)) * 2;
+    } else {
+        val = (int) fgetc(file);
+        fclose(file);
+    }
+
+    if(x >= y) {
+        val += 37;
+    } else {
+        fclose(file);
+    }
+
+    if(x <= 10 && x >= y) {
+        fclose(file);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_close_if_else_int1(10, 10);
+    double_close_if_else_int1(10, 11);
+    double_close_if_else_int1(11, 11);
+#else
+    double_close_if_else_int1(10, 10); /* OK */
+    double_close_if_else_int1(11, 12); /* DANGER */
+    double_close_if_else_int1(11, 11); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/02_simple_if_int2.c b/bench-moerman2018/file_operations/double_close/02_simple_if_int2.c
new file mode 100644
index 0000000000000000000000000000000000000000..6b3181c514892cacd8f3b6217b306706737a1a8c
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/02_simple_if_int2.c
@@ -0,0 +1,61 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+void double_close_if_else_int2(int x, int y) {
+    FILE* file;
+    int val = 0;
+    int m, n;
+
+    m = -1;
+    n = 5;
+
+    x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && x < y) {
+        return;
+    }
+#endif
+
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    if(x <= 10) {
+        val = ((int) fgetc(file)) * 2;
+    } else {
+        val = (int) fgetc(file);
+        fclose(file);
+    }
+
+    if(x >= y) {
+        val += 37;
+    } else {
+        fclose(file);
+    }
+
+    if(x <= 10 && x >= y) {
+        fclose(file);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_close_if_else_int2(-5, 10);
+    double_close_if_else_int2(-5, 11);
+    double_close_if_else_int2(-6, 11);
+#else
+    double_close_if_else_int2(-5, 10); /* OK */
+    double_close_if_else_int2(-6, 12); /* DANGER */
+    double_close_if_else_int2(-6, 11); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/03_simple_if_multi_func.c b/bench-moerman2018/file_operations/double_close/03_simple_if_multi_func.c
new file mode 100644
index 0000000000000000000000000000000000000000..910d848eee988ce55e31f2a206d92d94ef9d9ce4
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/03_simple_if_multi_func.c
@@ -0,0 +1,56 @@
+#include "double_close.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void conditional_close(FILE** ptr, bool condition) {
+    if(condition) {
+        fclose(*ptr);
+    }
+}
+
+static int conditional_fgetc(FILE** ptr, int def, bool condition) {
+    if(condition) {
+        return fgetc(*ptr);
+    }
+    return def;
+}
+
+void double_close_if_else_multi(bool a, bool b) {
+    int val;
+    FILE* file;
+    FILE** file_ptr = &file;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    conditional_close(file_ptr, !a);
+    val = conditional_fgetc(file_ptr, 897, b & a);
+    conditional_close(file_ptr, !b);
+    conditional_close(file_ptr, a & b);
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_close_if_else_multi(true, true);
+    double_close_if_else_multi(true, false);
+    double_close_if_else_multi(false, true);
+#else
+    double_close_if_else_multi(true, true); /* OK */
+    double_close_if_else_multi(false, false); /* DANGER */
+    double_close_if_else_multi(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/04_simple_switch.c b/bench-moerman2018/file_operations/double_close/04_simple_switch.c
new file mode 100644
index 0000000000000000000000000000000000000000..0291ec2122ebf876c9e2955f9cc17fac0edbde89
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/04_simple_switch.c
@@ -0,0 +1,82 @@
+#include "double_close.h"
+#include <stdbool.h>
+#include <stdlib.h>
+
+int double_close_switch(int x, int y) {
+    FILE* file;
+    bool closed = false;
+    int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if((x == 10 || x == 5) && x <= y) {
+        return -1;
+    }
+#endif
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return -1;
+    }
+
+    if(x > y) {
+        fclose(file);
+        closed = true;
+    }
+
+    switch (x) {
+        case 5: {
+            fclose(file); /* DANGER: x >= y */
+            val = val * 5;
+            break;
+        }
+        case 7: {
+            if(!closed) {
+                val  = ((int) fgetc(file)) + 289;
+            } else {
+                val = 5687;
+            }
+            break;
+        }
+        case 10: {
+            fclose(file); /* DANGER: x >= y */
+            val = val * 2;
+            break;
+        }
+        case 12: {
+            if(!closed) {
+                val  = ((int) fgetc(file)) + 49807;
+            } else {
+                val = 576;
+            }
+            break;
+        }
+        default: {
+            val  = 7987;
+            break;
+        }
+    }
+
+    if(!closed) {
+        fclose(file);
+    }
+
+    return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_close_switch(5, 11);
+    double_close_switch(10, 11);
+    double_close_switch(11, 10);
+    double_close_switch(7, 5);
+#else
+    double_close_switch(5, 10); /* OK */
+    double_close_switch(10, 9); /* DANGER */
+    double_close_switch(11, 10); /* OK */
+    double_close_switch(7, 5); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/05_simple_goto.c b/bench-moerman2018/file_operations/double_close/05_simple_goto.c
new file mode 100644
index 0000000000000000000000000000000000000000..0a4c928f9fd3586eeb15c4cce0750af24755d99f
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/05_simple_goto.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+void double_close_goto(int x) {
+    FILE* file = 0;
+    int val = 0;
+    int i = 0;
+
+    if(i > x) {
+        return;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 0) {
+        return;
+    }
+#endif
+
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    val += (int) fgetc(file);
+
+GOTO_LABEL:
+    if(i <= x) {
+        fclose(file);
+    } else {
+        printf("%i\n", val);
+    }
+
+    if(i == 0) {
+        i++;
+        goto GOTO_LABEL;
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_close_goto(0);
+#else
+    double_close_goto(1);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/06_simple_pass_by_reference.c b/bench-moerman2018/file_operations/double_close/06_simple_pass_by_reference.c
new file mode 100644
index 0000000000000000000000000000000000000000..40def8672f59512192011324c8ac37e29a5b0914
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/06_simple_pass_by_reference.c
@@ -0,0 +1,59 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "double_close.h"
+
+static int assign_possibly_closed(FILE** dest, bool close_file) {
+    int val;
+    FILE* file = fopen("file.txt","r");
+    *dest = file;
+    if(!file) {
+        return -1;
+    }
+    val = (int) fgetc(file);
+    if(close_file) {
+        fclose(file);
+    }
+    return val;
+}
+
+void double_close_pass_by_reference(bool a, bool b) {
+    FILE* file;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    val = assign_possibly_closed(&file, !a);
+
+    if(!b) {
+        if(file) fclose(file);
+    } else {
+        val += 687;
+    }
+
+    if(a & b) {
+        if(file) fclose(file);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_close_pass_by_reference(true, true);
+    double_close_pass_by_reference(true, false);
+    double_close_pass_by_reference(false, true);
+#else
+    double_close_pass_by_reference(true, true); /* OK */
+    double_close_pass_by_reference(false, false); /* DANGER */
+    double_close_pass_by_reference(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/07_cross_file.c b/bench-moerman2018/file_operations/double_close/07_cross_file.c
new file mode 100644
index 0000000000000000000000000000000000000000..c24e16fb644b4762bd00fc5b98c8df872a0c9044
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/07_cross_file.c
@@ -0,0 +1,52 @@
+#include "double_close.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+void double_close_cross_file(bool a, bool b) {
+    int val;
+    FILE* file;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    val = (int) fgetc(file);
+
+    conditional_close(file, !a, 0);
+
+    if(b) {
+        val = 678;
+    } else {
+        fclose(file);
+    }
+
+    if(a & b) {
+        fclose(file);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_close_cross_file(true, true);
+    double_close_cross_file(true, false);
+    double_close_cross_file(false, true);
+#else
+    double_close_cross_file(true, true); /* OK */
+    double_close_cross_file(false, false); /* DANGER */
+    double_close_cross_file(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/08_loop_for.c b/bench-moerman2018/file_operations/double_close/08_loop_for.c
new file mode 100644
index 0000000000000000000000000000000000000000..c43df8dde0ce6768def50e95c1013e4521db177d
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/08_loop_for.c
@@ -0,0 +1,61 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+void double_close_for(int x) {
+    FILE* file;
+    int val = 0;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    file = fopen("file1.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    val = (int) fgetc(file);
+
+    fclose(file);
+
+    for(i = 0; i < 20; i++) {
+        if(i > x) {
+            fclose(file);
+            file = fopen("file1.txt","r");
+            if(!file) {
+                return;
+            }
+            val += (int) fgetc(file);
+        } else {
+            val += 24;
+        }
+        if(i == 10) {
+            file = fopen("file2.txt","r");
+            if(!file) {
+                return;
+            }
+        }
+    }
+
+    fclose(file);
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_close_for(10);
+#else
+    double_close_for(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/09_loop_for_complex.c b/bench-moerman2018/file_operations/double_close/09_loop_for_complex.c
new file mode 100644
index 0000000000000000000000000000000000000000..63e717e84a9a7c4145842a8578501c54504bc004
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/09_loop_for_complex.c
@@ -0,0 +1,64 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+void double_close_for_complex(int x) {
+    FILE* file;
+    int val = 0;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    file = fopen("file1.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    val = (int) fgetc(file);
+
+    fclose(file);
+
+    for(;;) {
+        if(i > x) {
+            fclose(file);
+            file = fopen("file1.txt","r");
+            if(!file) {
+                return;
+            }
+            val += (int) fgetc(file);
+        } else {
+            val += 24;
+        }
+        if(i == 10) {
+            file = fopen("file2.txt","r");
+            if(!file) {
+                return;
+            }
+        }
+        i++;
+        if(i >= 20) {
+            break;
+        }
+    }
+
+    fclose(file);
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_close_for_complex(10);
+#else
+    double_close_for_complex(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/10_loop_while_continue.c b/bench-moerman2018/file_operations/double_close/10_loop_while_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..fb76ac2cfc3e2078eb1f72632afcdfa8bb44bbb0
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/10_loop_while_continue.c
@@ -0,0 +1,68 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+void double_close_while_continue(int x) {
+    FILE* file;
+    int val = 0;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    file = fopen("file1.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    val = (int) fgetc(file);
+
+    fclose(file);
+
+    while(i < 30) {
+        if(i == 9) {
+            i++;
+            continue;
+        }
+        if(i > x) {
+            fclose(file);
+            file = fopen("file1.txt","r");
+            if(!file) {
+                return;
+            }
+            val += (int) fgetc(file);
+        } else {
+            val += 24;
+        }
+        if(i == 10) {
+            file = fopen("file2.txt","r");
+            if(!file) {
+                return;
+            }
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    }
+
+    fclose(file);
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_close_while_continue(10);
+#else
+    double_close_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/11_loop_while_do_continue.c b/bench-moerman2018/file_operations/double_close/11_loop_while_do_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..608dd51374b2da2dd652bcd9e315e7e186cf5adf
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/11_loop_while_do_continue.c
@@ -0,0 +1,68 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+void double_close_do_while_continue(int x) {
+    FILE* file;
+    int val = 0;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    file = fopen("file1.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    val = (int) fgetc(file);
+
+    fclose(file);
+
+    do {
+        if(i == 8) {
+            i++;
+            continue;
+        }
+        if(i > x) {
+            fclose(file);
+            file = fopen("file1.txt","r");
+            if(!file) {
+                return;
+            }
+            val += (int) fgetc(file);
+        } else {
+            val += 24;
+        }
+        if(i == 10) {
+            file = fopen("file2.txt","r");
+            if(!file) {
+                return;
+            }
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    } while(i < 30);
+
+    fclose(file);
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_close_do_while_continue(10);
+#else
+    double_close_do_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/12_loop_for_array_branching.c b/bench-moerman2018/file_operations/double_close/12_loop_for_array_branching.c
new file mode 100644
index 0000000000000000000000000000000000000000..46876fa70dca28fbb233a0ef01d73e8ca28f144c
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/12_loop_for_array_branching.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "double_close.h"
+
+void double_close_for_array(int x) {
+    FILE* file = 0;
+    int p[20];
+    int val = 0;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 19) {
+        return;
+    }
+#endif
+
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    val += ((int) fgetc(file));
+
+    for(i = 0; i < 20; i++) {
+        p[i] = 0;
+    }
+    p[x] = 1;
+
+    for(i = 0; i < 20; i++) {
+        if(p[i] == 1) {
+            fclose(file);
+        } else {
+            fclose(file);
+            file = fopen("file.txt","r");
+
+            if(!file) {
+                return;
+            }
+            val += ((int) fgetc(file)) + i;
+        }
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_close_for_array(19);
+#else
+    double_close_for_array(10);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/file_operations/double_close/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 0000000000000000000000000000000000000000..ba3fdfd8a68540bd755f543019149844ceaec147
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,80 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "double_close.h"
+
+static void initialize_array(FILE* ptr_arr[], int length) {
+    int i;
+    FILE** ptr = ptr_arr;
+
+    for(i = 0; i < length; i++, ptr++) {
+        *ptr = fopen("file.txt","r");
+    }
+}
+
+static void close_backwards(FILE** ptr, int to_close) {
+    int i;
+
+    for(i = 0; i < to_close; i++, ptr--) {
+        if(*ptr) fclose(*ptr);
+    }
+}
+
+static void close_forwards(FILE** ptr, int to_close) {
+    int i;
+
+    for(i = 0; i < to_close; i++, ptr++) {
+        if(*ptr) fclose(*ptr);
+    }
+}
+
+void double_close_for_pointer(int x) {
+    FILE* pointers[10];
+    FILE** ptr;
+    int val = 0, i;
+    int to_close;
+
+    if(x > 10) {
+        return;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 8) {
+        return;
+    }
+#endif
+
+    initialize_array(pointers, 10);
+
+    close_backwards(pointers + 9, 2);
+
+    ptr = pointers;
+    for(int i = 0; i < 8; i++, ptr++) {
+        if(*ptr) {
+            val += (int) fgetc(*ptr);
+        } else {
+            val--;
+        }
+    }
+
+    to_close = 8 - x;
+
+    close_forwards(pointers, x);
+
+    if(to_close > 0) {
+        close_forwards(pointers + x, to_close);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_close_for_pointer(4);
+#else
+    double_close_for_pointer(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/14_loop_recursion.c b/bench-moerman2018/file_operations/double_close/14_loop_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..7c356528dc769b600b246029f2d54b553a4fc34c
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/14_loop_recursion.c
@@ -0,0 +1,65 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+int double_close_rec(int x, int i, FILE** file_ptr) {
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && i >= 19) {
+        return -1;
+    }
+#endif
+
+    if(i <= 1) {
+        if(*file_ptr) fclose(*file_ptr);
+        *file_ptr = 0;
+        return 0;
+    }
+
+    if(i > 19 && !*file_ptr) {
+        *file_ptr = fopen("file.txt", "r");
+        return double_close_rec(x, i-1, file_ptr);
+    }
+    if(i == 19) {
+        if(*file_ptr) {
+            fclose(*file_ptr);
+        }
+        return double_close_rec(x, i-1, file_ptr);
+    }
+
+    if(i < x) {
+        fclose(*file_ptr);
+        *file_ptr = fopen("file.txt","r");
+        if(!*file_ptr) {
+            return -1;
+        }
+        val = (int) fgetc(*file_ptr);
+    } else {
+        val = 8;
+    }
+    if(i == 10 && !*file_ptr) {
+        *file_ptr = fopen("file.txt","r");
+        if(!*file_ptr) {
+            return -1;
+        }
+    }
+
+    return val + double_close_rec(x, i-1, file_ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+    FILE* file = 0;
+#ifdef NO_BUG
+    printf("%i\n", double_close_rec(10, 20, &file));
+    file = fopen("file.txt", "r");
+    printf("%i\n", double_close_rec(11, 18, &file));
+#else
+    printf("%i\n", double_close_rec(11, 20, &file));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/15_loop_recursion_multi.c b/bench-moerman2018/file_operations/double_close/15_loop_recursion_multi.c
new file mode 100644
index 0000000000000000000000000000000000000000..2f7fe440fccb95fb9cb738352537b9974ead0760
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/15_loop_recursion_multi.c
@@ -0,0 +1,69 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+int double_close_rec_decr(int x, int i, FILE** file_ptr) {
+    if(i <= 1) {
+        if(*file_ptr) fclose(*file_ptr);
+        *file_ptr = 0;
+        return 0;
+    }
+
+    return double_close_rec_multi(x, i-1, file_ptr);
+}
+
+int double_close_rec_multi(int x, int i, FILE** file_ptr) {
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10) {
+        return -1;
+    }
+#endif
+
+    if(i > 19 && !*file_ptr) {
+        *file_ptr = fopen("file.txt", "r");
+        return double_close_rec_decr(x, i, file_ptr);
+    }
+    if(i == 19) {
+        if(*file_ptr) {
+            fclose(*file_ptr);
+        }
+        return double_close_rec_decr(x, i, file_ptr);
+    }
+
+    if(i < x) {
+        fclose(*file_ptr);
+        *file_ptr = fopen("file.txt","r");
+        if(!*file_ptr) {
+            return -1;
+        }
+        val = (int) fgetc(*file_ptr);
+    } else {
+        val = 8;
+    }
+    if(i == 10 && !*file_ptr) {
+        *file_ptr = fopen("file.txt","r");
+        if(!*file_ptr) {
+            return -1;
+        }
+    }
+
+    return val + double_close_rec_decr(x, i, file_ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+    FILE* file = 0;
+#ifdef NO_BUG
+    printf("%i\n", double_close_rec_multi(10, 20, &file));
+    file = fopen("file.txt", "r");
+    printf("%i\n", double_close_rec_multi(11, 18, &file));
+#else
+    printf("%i\n", double_close_rec_multi(11, 20, &file));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/16_misc_pseudo_recursion.c b/bench-moerman2018/file_operations/double_close/16_misc_pseudo_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..826bcb83aedea772269e3eeeac63bca5c71f5f7b
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/16_misc_pseudo_recursion.c
@@ -0,0 +1,65 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+int double_close_pseudo_rec1(int x, int y, int i, FILE** file_ptr) {
+    int val;
+#ifdef CATCH_BAD_PARAM
+    if(x >= y && x < 10) {
+        return -1;
+    }
+#endif
+
+    if(!*file_ptr) {
+        return -1;
+    }
+
+    val = ((int) fgetc(*file_ptr));
+
+    if(i > 0) {
+        fclose(*file_ptr);
+        return 37;
+    }
+
+    if(x < y) {
+        fclose(*file_ptr);
+    } else {
+        fgetc(*file_ptr);
+    }
+
+    return val + double_close_pseudo_rec2(x, y, 1, file_ptr);
+}
+
+int double_close_pseudo_rec2(int x, int y, int i, FILE** file_ptr) {
+    int val = 78;
+    if(i > 0) {
+        if(x < 10) {
+            fclose(*file_ptr);
+        } else {
+            val += 2;
+        }
+
+        if(x >= y && x >= 10) {
+            fclose(*file_ptr);
+            *file_ptr = 0;
+        }
+        return val;
+    }
+
+    return 5 + double_close_pseudo_rec1(x, y, 1, file_ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+    FILE* file = fopen("file.txt", "r");
+#ifdef NO_BUG
+    printf("%i\n", double_close_pseudo_rec1(9, 10, 0, &file));
+    file = fopen("file.txt", "r");
+    printf("%i\n", double_close_pseudo_rec1(11, 10, 0, &file));
+#else
+    printf("%i\n", double_close_pseudo_rec1(9, 8, 0, &file));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/17_complex_function_pointers.c b/bench-moerman2018/file_operations/double_close/17_complex_function_pointers.c
new file mode 100644
index 0000000000000000000000000000000000000000..0bf2caed5312543c1701e1ba50c925a60441bbcc
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/17_complex_function_pointers.c
@@ -0,0 +1,59 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+static int assign_possibly_closed(FILE** dest, bool close_file) {
+    int val;
+    FILE* file = fopen("file.txt","r");
+    *dest = file;
+    if(!file) {
+        return -1;
+    }
+    val = (int) fgetc(file);
+    if(close_file) {
+        fclose(file);
+    }
+    return val;
+}
+
+void double_close_function_pointer(bool a, bool b, int (*f)(FILE** dest, bool close_file)) {
+    FILE* file;
+    int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(!f || (!a & !b)) {
+        return;
+    }
+#endif
+
+    val = (*f)(&file, a);
+
+    if(!b && file) {
+        fclose(file);
+    } else {
+        val += 687;
+    }
+
+    if(a && b && file) {
+        fclose(file);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_close_function_pointer(true, true, &assign_possibly_closed);
+    double_close_function_pointer(true, false, &assign_possibly_closed);
+    double_close_function_pointer(false, true, &assign_possibly_closed);
+#else
+    double_close_function_pointer(true, true, &assign_possibly_closed); /* OK */
+    double_close_function_pointer(false, false, &assign_possibly_closed); /* DANGER */
+    double_close_function_pointer(false, true, &assign_possibly_closed); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/18_complex_struct_multiple_methods.c b/bench-moerman2018/file_operations/double_close/18_complex_struct_multiple_methods.c
new file mode 100644
index 0000000000000000000000000000000000000000..ded3a9657989217a9be0fe06dfdcf318b843917f
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/18_complex_struct_multiple_methods.c
@@ -0,0 +1,95 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_close.h"
+
+#ifndef s_NULLPOINTER_REFCOUNT
+#define s_NULLPOINTER_REFCOUNT
+void double_close_cont_init(FileCont* cont) {
+    cont->refc = 1;
+    cont->file = 0;
+}
+
+FileCont* double_close_cont_new() {
+    FileCont* new_cont;
+
+    new_cont = malloc(sizeof(FileCont));
+
+    if(new_cont) {
+        double_close_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void double_close_cont_ref(FileCont* cont) {
+    if(cont) {
+        cont->refc++;
+    }
+}
+void double_close_cont_unref(FileCont* cont) {
+    if(cont->refc <= 1) {
+        fclose(cont->file);
+    } else {
+        cont->refc--;
+    }
+}
+
+FILE* double_close_cont_get_file(FileCont* cont) {
+    return cont->file;
+}
+void double_close_cont_set_file(FileCont* cont, FILE* file) {
+    cont->file = file;
+}
+#endif //s_NULLPOINTER_REFCOUNT
+
+void double_close_struct(int x, int y) {
+    FileCont cont;
+    FILE* file;
+    int val = 78;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && x <= y) {
+        return;
+    }
+#endif
+
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    double_close_cont_init(&cont);
+    double_close_cont_set_file(&cont, file);
+
+    val += (int) fgetc(file);
+
+    if(x <= y) {
+        fclose(double_close_cont_get_file(&cont));
+    }
+
+    if(x > 10) {
+        fclose(file);
+    } else {
+        val = val * 2;
+    }
+
+    if(x > y && x <= 10) {
+        fclose(double_close_cont_get_file(&cont));
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_close_struct(9, 10);
+    double_close_struct(10, 11);
+    double_close_struct(11, 10);
+#else
+    double_close_struct(11, 11); /* DANGER */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/19_complex_refcount.c b/bench-moerman2018/file_operations/double_close/19_complex_refcount.c
new file mode 100644
index 0000000000000000000000000000000000000000..a0a593d7175c6414594804fa4453e71470f0cf31
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/19_complex_refcount.c
@@ -0,0 +1,77 @@
+#include "double_close.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_FILES_DC_REFCOUNT
+#define s_FILES_DC_REFCOUNT
+void double_close_cont_init(FileCont* cont) {
+    cont->refc = 1;
+    cont->file = 0;
+}
+
+FileCont* double_close_cont_new() {
+    FileCont* new_cont;
+
+    new_cont = malloc(sizeof(FileCont));
+
+    if(new_cont) {
+        double_close_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void double_close_cont_ref(FileCont* cont) {
+    if(cont) {
+        cont->refc++;
+    }
+}
+void double_close_cont_unref(FileCont* cont) {
+    if(cont->refc <= 1) {
+        if(cont->file) fclose(cont->file);
+    } else {
+        cont->refc--;
+    }
+}
+
+FILE* double_close_cont_get_file(FileCont* cont) {
+    return cont->file;
+}
+void double_close_cont_set_file(FileCont* cont, FILE* file) {
+    cont->file = file;
+}
+#endif //s_FILES_DC_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+    FileCont* cont;
+    FILE* file;
+    int val;
+
+    file = fopen("file.txt", "r");
+    if(!file) {
+        return -1;
+    }
+
+    cont = double_close_cont_new();
+    if(!cont) {
+        fclose(file);
+        return 1;
+    }
+    double_close_cont_set_file(cont, file);
+
+    double_close_cont_ref(cont);
+    double_close_cont_ref(cont);
+    double_close_cont_unref(cont);
+    double_close_cont_unref(cont);
+    val = ((int) fgetc(double_close_cont_get_file(cont)));
+    double_close_cont_unref(cont);
+#ifndef NO_BUG
+    double_close_cont_unref(cont);
+#endif
+    free(cont);
+
+    printf("%i\n", val);
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/double_close/double_close.h b/bench-moerman2018/file_operations/double_close/double_close.h
new file mode 100644
index 0000000000000000000000000000000000000000..17b340149d20dcb1ce75c0f4f75fbb9f5b474d23
--- /dev/null
+++ b/bench-moerman2018/file_operations/double_close/double_close.h
@@ -0,0 +1,37 @@
+#include <stdbool.h>
+#include <stdio.h>
+
+typedef struct _ResLeakRefCont FileCont;
+
+struct _ResLeakRefCont {
+    FILE* file;
+    unsigned int refc;
+};
+
+void double_close_cont_init(FileCont* cont);
+FileCont* double_close_cont_new();
+void double_close_cont_ref(FileCont* cont);
+void double_close_cont_unref(FileCont* cont);
+FILE* double_close_cont_get_file(FileCont* cont);
+void double_close_cont_set_file(FileCont* cont, FILE* file);
+
+void double_close_for(int x);
+void double_close_for_complex(int x);
+void double_close_while_continue(int x);
+void double_close_do_while_continue(int x);
+void double_close_for_array(int x);
+void double_close_for_pointer(int x);
+void double_close_goto(int x);
+void double_close_if_else(bool a, bool b);
+void double_close_if_else_multi(bool a, bool b);
+void double_close_if_else_int1(int x, int y);
+void double_close_if_else_int2(int x, int y);
+void double_close_pass_by_reference(bool a, bool b);
+int double_close_switch(int x, int y);
+int double_close_rec_multi(int x, int i, FILE** file_pt);
+int double_close_rec(int x, int i, FILE** file_ptr);
+int double_close_pseudo_rec1(int x, int y, int i, FILE** file_ptr);
+int double_close_pseudo_rec2(int x, int y, int i, FILE** file_ptr);
+void double_close_struct(int x, int y);
+void double_close_function_pointer(bool a, bool b, int (*f)(FILE** dest, bool close_file));
+void double_close_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/file_operations/resource_leak/01_simple_if.c b/bench-moerman2018/file_operations/resource_leak/01_simple_if.c
new file mode 100644
index 0000000000000000000000000000000000000000..efafb809199bdc2502185cbb3a49cca065c6fc82
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/01_simple_if.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "resource_leak.h"
+
+void res_leak_if_else(bool a, bool b) {
+    FILE* file;
+    int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    if(a) {
+        val = (int) fgetc(file);
+        fclose(file);
+    } else {
+        val = ((int) fgetc(file)) * 2;
+    }
+
+    if(b & !a) {
+        val += (int) fgetc(file);
+        fclose(file);
+    } else {
+        val += 37;
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    res_leak_if_else(true, true);
+    res_leak_if_else(true, false);
+    res_leak_if_else(false, true);
+#else
+    res_leak_if_else(true, true); /* OK */
+    res_leak_if_else(false, false); /* DANGER */
+    res_leak_if_else(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/02_simple_if_int1.c b/bench-moerman2018/file_operations/resource_leak/02_simple_if_int1.c
new file mode 100644
index 0000000000000000000000000000000000000000..370e0adc28eff519f37e2a26ba5be9cf0ab700e1
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/02_simple_if_int1.c
@@ -0,0 +1,54 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+void res_leak_if_else_int1(int x, int y) {
+    int val = 0;
+    FILE* file;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && x < y) {
+        return;
+    }
+#endif
+
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    if(x <= 10) {
+        val = ((int) fgetc(file));
+        fclose(file);
+    } else {
+        val = ((int) fgetc(file))*2;
+    }
+
+    if(x >= y) {
+        if(x > 10) {
+            val = ((int) fgetc(file)) * 2;
+            fclose(file);
+        }
+    } else {
+        val += 10;
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    res_leak_if_else_int1(10, 10);
+    res_leak_if_else_int1(10, 11);
+    res_leak_if_else_int1(11, 11);
+#else
+    res_leak_if_else_int1(10, 10); /* OK */
+    res_leak_if_else_int1(11, 12); /* DANGER */
+    res_leak_if_else_int1(11, 11); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/02_simple_if_int2.c b/bench-moerman2018/file_operations/resource_leak/02_simple_if_int2.c
new file mode 100644
index 0000000000000000000000000000000000000000..3eb6fd75bbb6f6d1b4dcbe4e9de26b9bfc6a953a
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/02_simple_if_int2.c
@@ -0,0 +1,60 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+void res_leak_if_else_int2(int x, int y) {
+    FILE* file;
+    int val = 0;
+    int m, n;
+
+    m = -1;
+    n = 5;
+
+    x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && x < y) {
+        return;
+    }
+#endif
+
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    if(x <= 10) {
+        val = ((int) fgetc(file));
+        fclose(file);
+    } else {
+        val = ((int) fgetc(file))*2;
+    }
+
+    if(x >= y) {
+        if(x > 10) {
+            val = ((int) fgetc(file)) * 2;
+            fclose(file);
+        }
+    } else {
+        val += 10;
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    res_leak_if_else_int2(-5, 10);
+    res_leak_if_else_int2(-5, 11);
+    res_leak_if_else_int2(-6, 11);
+#else
+    res_leak_if_else_int2(-5, 10); /* OK */
+    res_leak_if_else_int2(-6, 12); /* DANGER */
+    res_leak_if_else_int2(-6, 11); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/03_simple_if_multi_func.c b/bench-moerman2018/file_operations/resource_leak/03_simple_if_multi_func.c
new file mode 100644
index 0000000000000000000000000000000000000000..f0f1d0a8cf2090bbf2e0fbb0e2df30b254dd2316
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/03_simple_if_multi_func.c
@@ -0,0 +1,55 @@
+#include "resource_leak.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void local_conditional_close(FILE** ptr, bool condition) {
+    if(condition) {
+        fclose(*ptr);
+    }
+}
+
+static int conditional_fgetc(FILE** ptr, int def, bool condition) {
+    if(condition) {
+        return fgetc(*ptr);
+    }
+    return def;
+}
+
+void res_leak_if_else_multi(bool a, bool b) {
+    int val;
+    FILE* file;
+    FILE** file_ptr = &file;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    local_conditional_close(file_ptr, a);
+    val = conditional_fgetc(file_ptr, 897, !a);
+    local_conditional_close(file_ptr, b & !a);
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    res_leak_if_else_multi(true, true);
+    res_leak_if_else_multi(true, false);
+    res_leak_if_else_multi(false, true);
+#else
+    res_leak_if_else_multi(true, true); /* OK */
+    res_leak_if_else_multi(false, false); /* DANGER */
+    res_leak_if_else_multi(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/04_simple_switch.c b/bench-moerman2018/file_operations/resource_leak/04_simple_switch.c
new file mode 100644
index 0000000000000000000000000000000000000000..99fd3fae0e70e34397e649c6065cbc1246613d0a
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/04_simple_switch.c
@@ -0,0 +1,84 @@
+#include "resource_leak.h"
+#include <stdbool.h>
+#include <stdlib.h>
+
+int res_leak_switch(int x, int y) {
+    FILE* file;
+    bool closed = false;
+    int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if((x == 10 || x == 5) && x > y) {
+        return -1;
+    }
+#endif
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return -1;
+    }
+
+    if(x <= y) {
+        fclose(file);
+        closed = true;
+    }
+
+    switch (x) {
+        case 5: {
+            if(!closed) val = ((int) fgetc(file));
+            closed = true; /* DANGER: x >= y */
+            break;
+        }
+        case 7: {
+            if(!closed) {
+                val  = ((int) fgetc(file)) + 289;
+                fclose(file);
+                closed = true;
+            }
+            break;
+        }
+        case 10: {
+            if(!closed) {
+                val = ((int) fgetc(file)) + 36;
+                closed = true; /* DANGER: x >= y */
+            }
+            break;
+        }
+        case 12: {
+            if(!closed) {
+                val  = ((int) fgetc(file)) + 49807;
+                fclose(file);
+            }
+            closed = true;
+            break;
+        }
+        default: {
+            val  = 7987;
+            break;
+        }
+    }
+
+    if(!closed) {
+        fclose(file);
+    }
+
+    return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    res_leak_switch(5, 11);
+    res_leak_switch(10, 11);
+    res_leak_switch(11, 10);
+    res_leak_switch(7, 5);
+#else
+    res_leak_switch(5, 10); /* OK */
+    res_leak_switch(10, 9); /* DANGER */
+    res_leak_switch(11, 10); /* OK */
+    res_leak_switch(7, 5); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/05_simple_goto.c b/bench-moerman2018/file_operations/resource_leak/05_simple_goto.c
new file mode 100644
index 0000000000000000000000000000000000000000..d98e721f6cb6a526cdacb5bfc82712edd5719928
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/05_simple_goto.c
@@ -0,0 +1,46 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+void res_leak_goto(int x) {
+    FILE* file = 0;
+    int val = 0;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 0) {
+        return;
+    }
+#endif
+
+GOTO_LABEL:
+    if(i <= x) {
+        file = fopen("file.txt","r");
+
+        if(!file) {
+            return;
+        }
+
+        val += ((int) fgetc(file));
+    } else {
+        printf("%i\n", val);
+    }
+
+    if(i == 0) {
+        i++;
+        if(file) fclose(file);
+        goto GOTO_LABEL;
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    res_leak_goto(0);
+#else
+    res_leak_goto(1);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/06_simple_pass_by_reference.c b/bench-moerman2018/file_operations/resource_leak/06_simple_pass_by_reference.c
new file mode 100644
index 0000000000000000000000000000000000000000..c2ec18e2f471ab4557ef3d83330e99158400f9ad
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/06_simple_pass_by_reference.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "resource_leak.h"
+
+static int assign_possibly_closed(FILE** dest, bool close_file) {
+    int val;
+    FILE* file = fopen("file.txt","r");
+    *dest = file;
+    if(!file) {
+        return -1;
+    }
+    val = (int) fgetc(file);
+    if(close_file) {
+        fclose(file);
+    }
+    return val;
+}
+
+void res_leak_pass_by_reference(bool a, bool b) {
+    FILE* file;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    val = assign_possibly_closed(&file, a);
+
+    if(b && !a && file) {
+        val += (int) fgetc(file);
+        fclose(file);
+    } else {
+        val += 687;
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    res_leak_pass_by_reference(true, true);
+    res_leak_pass_by_reference(true, false);
+    res_leak_pass_by_reference(false, true);
+#else
+    res_leak_pass_by_reference(true, true); /* OK */
+    res_leak_pass_by_reference(false, false); /* DANGER */
+    res_leak_pass_by_reference(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/07_cross_file.c b/bench-moerman2018/file_operations/resource_leak/07_cross_file.c
new file mode 100644
index 0000000000000000000000000000000000000000..3a49f0d72bdff05a50e00ecb964d176e514679de
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/07_cross_file.c
@@ -0,0 +1,47 @@
+#include "resource_leak.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+void res_leak_cross_file(bool a, bool b) {
+    int val;
+    FILE* file;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    conditional_close(file, a, 0);
+
+    if(b & !a) {
+        val = (int) fgetc(file);
+        fclose(file);
+    } else {
+        val = 678;
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    res_leak_cross_file(true, true);
+    res_leak_cross_file(true, false);
+    res_leak_cross_file(false, true);
+#else
+    res_leak_cross_file(true, true); /* OK */
+    res_leak_cross_file(false, false); /* DANGER */
+    res_leak_cross_file(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/08_loop_for.c b/bench-moerman2018/file_operations/resource_leak/08_loop_for.c
new file mode 100644
index 0000000000000000000000000000000000000000..463075b1b423ff5b00f79af6bcd289cbfebf2845
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/08_loop_for.c
@@ -0,0 +1,57 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+void res_leak_for(int x) {
+    FILE* file;
+    int val = 0;
+    bool do_close = false;
+    bool is_closed = true;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    for(i = 0; i < 20; i++) {
+        if(i > x && is_closed) {
+            file = fopen("file.txt","r");
+            if(!file) {
+                return;
+            }
+            val += (int) fgetc(file) * 2;
+            if(do_close) {
+                fclose(file);
+                is_closed = true;
+            } else {
+                is_closed = false;
+            }
+        } else {
+            if(!is_closed) {
+                val += (int) fgetc(file);
+            } else {
+                val += 37;
+            }
+        }
+        if(i == 10) {
+            do_close = true;
+        }
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    res_leak_for(10);
+#else
+    res_leak_for(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/09_loop_for_complex.c b/bench-moerman2018/file_operations/resource_leak/09_loop_for_complex.c
new file mode 100644
index 0000000000000000000000000000000000000000..bd517ef2ddeca85240f3a75d31a2f098687a4eba
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/09_loop_for_complex.c
@@ -0,0 +1,60 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+void res_leak_for_complex(int x) {
+    FILE* file;
+    int val = 0;
+    bool do_close = false;
+    bool is_closed = true;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    for(;;) {
+        if(i > x && is_closed) {
+            file = fopen("file.txt","r");
+            if(!file) {
+                return;
+            }
+            val += (int) fgetc(file) * 2;
+            if(do_close) {
+                fclose(file);
+                is_closed = true;
+            } else {
+                is_closed = false;
+            }
+        } else {
+            if(!is_closed) {
+                val += (int) fgetc(file);
+            } else {
+                val += 37;
+            }
+        }
+        if(i == 10) {
+            do_close = true;
+        }
+        i++;
+        if(i >= 20) {
+            break;
+        }
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    res_leak_for_complex(10);
+#else
+    res_leak_for_complex(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/10_loop_while_continue.c b/bench-moerman2018/file_operations/resource_leak/10_loop_while_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..a6e450973602cf6f39014b1e88daafb54bbdc093
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/10_loop_while_continue.c
@@ -0,0 +1,64 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+void res_leak_while_continue(int x) {
+    FILE* file;
+    int val = 0;
+    bool do_close = false;
+    bool is_closed = true;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    while(i < 30) {
+        if(i == 9) {
+            i++;
+            continue;
+        }
+        if(i > x && is_closed) {
+            file = fopen("file.txt","r");
+            if(!file) {
+                return;
+            }
+            val += (int) fgetc(file) * 2;
+            if(do_close) {
+                fclose(file);
+                is_closed = true;
+            } else {
+                is_closed = false;
+            }
+        } else {
+            if(!is_closed) {
+                val += (int) fgetc(file);
+            } else {
+                val += 37;
+            }
+        }
+        if(i == 10) {
+            do_close = true;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    res_leak_while_continue(10);
+#else
+    res_leak_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/11_loop_while_do_continue.c b/bench-moerman2018/file_operations/resource_leak/11_loop_while_do_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..14fcbc77b47fae04bbfc22b37b49846abccba3d8
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/11_loop_while_do_continue.c
@@ -0,0 +1,64 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+void res_leak_do_while_continue(int x) {
+    FILE* file;
+    int val = 0;
+    bool do_close = false;
+    bool is_closed = true;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    do {
+        if(i == 8) {
+            i++;
+            continue;
+        }
+        if(i > x && is_closed) {
+            file = fopen("file.txt","r");
+            if(!file) {
+                return;
+            }
+            val += (int) fgetc(file) * 2;
+            if(do_close) {
+                fclose(file);
+                is_closed = true;
+            } else {
+                is_closed = false;
+            }
+        } else {
+            if(!is_closed) {
+                val += (int) fgetc(file);
+            } else {
+                val += 37;
+            }
+        }
+        if(i == 10) {
+            do_close = true;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    } while(i < 30);
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    res_leak_do_while_continue(10);
+#else
+    res_leak_do_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/12_loop_for_array_branching.c b/bench-moerman2018/file_operations/resource_leak/12_loop_for_array_branching.c
new file mode 100644
index 0000000000000000000000000000000000000000..4dc464d40f3edc71c27e49fcfed0f0fb067338b9
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/12_loop_for_array_branching.c
@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "resource_leak.h"
+
+void res_leak_for_array(int x) {
+    FILE* file = 0;
+    int p[20];
+    int val = 0;
+    bool do_close = true;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 19) {
+        return;
+    }
+#endif
+
+    for(i = 0; i < 20; i++) {
+        p[i] = 0;
+    }
+    p[x] = 1;
+
+    for(i = 0; i < 20; i++) {
+        if(p[i] == 1) {
+            do_close = false;
+        } else {
+            if(!file) file = fopen("file.txt","r");
+
+            if(!file) {
+                return;
+            }
+
+            val += ((int) fgetc(file)) + i;
+            if(do_close) {
+                fclose(file);
+                file = 0;
+            }
+        }
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    res_leak_for_array(19);
+#else
+    res_leak_for_array(10);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/file_operations/resource_leak/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 0000000000000000000000000000000000000000..99ea6ae15624b7539bd91bf820a3c462fa324848
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,62 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "resource_leak.h"
+
+static void initialize_array(FILE* ptr_arr[], int length) {
+    int i;
+    FILE** ptr = ptr_arr;
+
+    for(i = 0; i < length; i++, ptr++) {
+        *ptr = fopen("file.txt","r");
+    }
+}
+
+static void close_array(FILE* ptr_arr[], int length) {
+    int i;
+    FILE** ptr = ptr_arr;
+
+    for(i = 0; i < length; i++, ptr++) {
+        if(*ptr) fclose(*ptr);
+    }
+}
+
+void res_leak_for_pointer(int x) {
+    FILE* pointers[10];
+    FILE** ptr;
+    int val = 0, i;
+
+    if(x > 10) {
+        return;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 10) {
+        return;
+    }
+#endif
+
+    initialize_array(pointers, 10);
+    ptr = pointers;
+    for(int i = 0; i < 10; i++, ptr++) {
+        if(*ptr) {
+            val += (int) fgetc(*ptr);
+        } else {
+            val--;
+        }
+    }
+
+    close_array(pointers, x);
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    res_leak_for_pointer(10);
+#else
+    res_leak_for_pointer(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/14_loop_recursion.c b/bench-moerman2018/file_operations/resource_leak/14_loop_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..4e3d3142f9b70d7a29ce790f86b6a9cd9ba207f3
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/14_loop_recursion.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+int res_leak_rec(int x, int i, FILE** file_ptr, bool do_close) {
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!do_close && x > 10) {
+        return -1;
+    }
+#endif
+
+    if(i <= 1) {
+        return 0;
+    }
+
+    if(i < x) {
+        *file_ptr = fopen("file.txt","r");
+        if(!*file_ptr) return -1;
+        val = ((int) fgetc(*file_ptr));
+        if(do_close) {
+            fclose(*file_ptr);
+            *file_ptr = 0;
+        }
+    } else {
+        if(*file_ptr) {
+            val = ((int) fgetc(*file_ptr)) / 2;
+        } else {
+            val = 8;
+        }
+    }
+    if(i == 10) {
+        do_close = true;
+    }
+
+    return val + res_leak_rec(x, i-1, file_ptr, do_close);
+}
+
+#ifndef NO_MAIN
+int main() {
+    FILE* file = 0;
+#ifdef NO_BUG
+    printf("%i\n", res_leak_rec(10, 20, &file, false));
+    printf("%i\n", res_leak_rec(11, 20, &file, true));
+#else
+    printf("%i\n", res_leak_rec(11, 20, &file, false));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/15_loop_recursion_multi.c b/bench-moerman2018/file_operations/resource_leak/15_loop_recursion_multi.c
new file mode 100644
index 0000000000000000000000000000000000000000..caddb4451d5c1736532876659af696ddf7bf67a6
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/15_loop_recursion_multi.c
@@ -0,0 +1,61 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+int res_leak_rec_decr(int x, int i, FILE** file_ptr, bool do_close) {
+    if(i <= 1) {
+        return 0;
+    }
+
+    return res_leak_rec_multi(x, i-1, file_ptr, do_close);
+}
+
+int res_leak_rec_multi(int x, int i, FILE** file_ptr, bool do_close) {
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!do_close && x > 10) {
+        return -1;
+    }
+#endif
+
+    if(i <= 1) {
+        return 0;
+    }
+
+    if(i < x) {
+        *file_ptr = fopen("file.txt","r");
+        if(!*file_ptr) return -1;
+        val = ((int) fgetc(*file_ptr));
+        if(do_close) {
+            fclose(*file_ptr);
+            *file_ptr = 0;
+        }
+    } else {
+        if(*file_ptr) {
+            val = ((int) fgetc(*file_ptr)) / 2;
+        } else {
+            val = 8;
+        }
+    }
+    if(i == 10) {
+        do_close = true;
+    }
+
+    return val + res_leak_rec_decr(x, i, file_ptr, do_close);
+}
+
+#ifndef NO_MAIN
+int main() {
+    FILE* file = 0;
+#ifdef NO_BUG
+    printf("%i\n", res_leak_rec_multi(10, 20, &file, false));
+    printf("%i\n", res_leak_rec_multi(11, 20, &file, true));
+#else
+    printf("%i\n", res_leak_rec_multi(11, 20, &file, false));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/16_misc_pseudo_recursion.c b/bench-moerman2018/file_operations/resource_leak/16_misc_pseudo_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..6a295f68243fb8fb5798553edf7865e0c9b811a0
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/16_misc_pseudo_recursion.c
@@ -0,0 +1,66 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+int res_leak_pseudo_rec1(int x, int y, int i, char* file_name) {
+    FILE* file;
+    FILE** file_ptr;
+    int val;
+#ifdef CATCH_BAD_PARAM
+    if(x >= y && x < 10) {
+        return -1;
+    }
+#endif
+
+    file = fopen(file_name, "r");
+    if(!file) {
+        return -1;
+    }
+    file_ptr = &file;
+    val = ((int) fgetc(file));
+
+    if(i > 0) {
+        fclose(file);
+        return 37;
+    }
+
+    if(x < y) {
+        fclose(file);
+        file = 0;
+    } else {
+        fgetc(file);
+    }
+
+    return val + res_leak_pseudo_rec2(x, y, 1, file_ptr, file_name);
+}
+
+int res_leak_pseudo_rec2(int x, int y, int i, FILE** file_ptr, char* file_name) {
+    int val = 78;
+    if(i <= 0) {
+        return 5 + res_leak_pseudo_rec1(x, y, 1, file_name);
+    }
+
+    if(x < 10) {
+        val += 2;
+    } else {
+        if(*file_ptr) {
+            val -= ((int) fgetc(*file_ptr));
+            fclose(*file_ptr);
+            *file_ptr = 0;
+        }
+    }
+    return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    printf("%i\n", res_leak_pseudo_rec1(9, 10, 0, "file.txt"));
+    printf("%i\n", res_leak_pseudo_rec1(11, 10, 0, "file.txt"));
+#else
+    printf("%i\n", res_leak_pseudo_rec1(9, 8, 0, "file.txt"));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/17_complex_function_pointers.c b/bench-moerman2018/file_operations/resource_leak/17_complex_function_pointers.c
new file mode 100644
index 0000000000000000000000000000000000000000..adfd3c4219a269ece1460895edc7b3385e36cf39
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/17_complex_function_pointers.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+static int assign_possibly_closed(FILE** dest, bool close_file) {
+    int val;
+    FILE* file = fopen("file.txt","r");
+    *dest = file;
+    if(!file) {
+        return -1;
+    }
+    val = (int) fgetc(file);
+    if(close_file) {
+        fclose(file);
+    }
+    return val;
+}
+
+void res_leak_function_pointer(bool a, bool b, int (*f)(FILE** dest, bool close_file)) {
+    FILE* file;
+    int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(!f || (!a & !b)) {
+        return;
+    }
+#endif
+
+    val = (*f)(&file, a);
+
+    if(b && !a && file) {
+        val += (int) fgetc(file);
+        fclose(file);
+    } else {
+        val += 687;
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    res_leak_function_pointer(true, true, &assign_possibly_closed);
+    res_leak_function_pointer(true, false, &assign_possibly_closed);
+    res_leak_function_pointer(false, true, &assign_possibly_closed);
+#else
+    res_leak_function_pointer(true, true, &assign_possibly_closed); /* OK */
+    res_leak_function_pointer(false, false, &assign_possibly_closed); /* DANGER */
+    res_leak_function_pointer(false, true, &assign_possibly_closed); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/18_complex_struct_multiple_methods.c b/bench-moerman2018/file_operations/resource_leak/18_complex_struct_multiple_methods.c
new file mode 100644
index 0000000000000000000000000000000000000000..6e0838a21f956d82edb745f12046b53d009ce5bb
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/18_complex_struct_multiple_methods.c
@@ -0,0 +1,93 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "resource_leak.h"
+
+#ifndef s_FILES_RL_REFCOUNT
+#define s_FILES_RL_REFCOUNT
+void res_leak_cont_init(FileCont* cont) {
+    cont->refc = 1;
+    cont->file = 0;
+}
+
+FileCont* res_leak_cont_new() {
+    FileCont* new_cont;
+
+    new_cont = malloc(sizeof(FileCont));
+
+    if(new_cont) {
+        res_leak_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void res_leak_cont_ref(FileCont* cont) {
+    if(cont) {
+        cont->refc++;
+    }
+}
+void res_leak_cont_unref(FileCont* cont) {
+    if(cont->refc <= 1) {
+        fclose(cont->file);
+    } else {
+        cont->refc--;
+    }
+}
+
+FILE* res_leak_cont_get_file(FileCont* cont) {
+    return cont->file;
+}
+void res_leak_cont_set_file(FileCont* cont, FILE* file) {
+    cont->file = file;
+}
+#endif //s_FILES_RL_REFCOUNT
+
+void res_leak_struct(int x, int y) {
+    FileCont cont;
+    FILE* file;
+    int val = 78;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && x <= y) {
+        return;
+    }
+#endif
+
+    file = fopen("file.txt","r");
+
+    if(!file) {
+        return;
+    }
+
+    res_leak_cont_init(&cont);
+    res_leak_cont_set_file(&cont, file);
+
+    if(x > y) {
+        fclose(file);
+        file = 0;
+    }
+
+    if(x <= 10) {
+        if(file) {
+            val = (int) fgetc(file);
+            fclose(res_leak_cont_get_file(&cont));
+        }
+    } else {
+        val = val * 2;
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    res_leak_struct(9, 10);
+    res_leak_struct(10, 11);
+    res_leak_struct(11, 10);
+#else
+    res_leak_struct(11, 11); /* DANGER */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/19_complex_refcount.c b/bench-moerman2018/file_operations/resource_leak/19_complex_refcount.c
new file mode 100644
index 0000000000000000000000000000000000000000..0be3e3a943e014c6552e260ef3f77ed61e6f8ba7
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/19_complex_refcount.c
@@ -0,0 +1,76 @@
+#include "resource_leak.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_FILES_RL_REFCOUNT
+#define s_FILES_RL_REFCOUNT
+void res_leak_cont_init(FileCont* cont) {
+    cont->refc = 1;
+    cont->file = 0;
+}
+
+FileCont* res_leak_cont_new() {
+    FileCont* new_cont;
+
+    new_cont = malloc(sizeof(FileCont));
+
+    if(new_cont) {
+        res_leak_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void res_leak_cont_ref(FileCont* cont) {
+    if(cont) {
+        cont->refc++;
+    }
+}
+void res_leak_cont_unref(FileCont* cont) {
+    if(cont->refc <= 1) {
+        if(cont->file) fclose(cont->file);
+    } else {
+        cont->refc--;
+    }
+}
+
+FILE* res_leak_cont_get_file(FileCont* cont) {
+    return cont->file;
+}
+void res_leak_cont_set_file(FileCont* cont, FILE* file) {
+    cont->file = file;
+}
+#endif //s_FILES_RL_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+    FileCont* cont;
+    FILE* file;
+    int val;
+
+    file = fopen("file.txt", "r");
+    if(!file) {
+        return -1;
+    }
+
+    cont = res_leak_cont_new();
+    if(!cont) {
+        fclose(file);
+        return 1;
+    }
+    res_leak_cont_set_file(cont, file);
+
+    res_leak_cont_ref(cont);
+    res_leak_cont_ref(cont);
+    res_leak_cont_unref(cont);
+    res_leak_cont_unref(cont);
+    val = ((int) fgetc(res_leak_cont_get_file(cont)));
+#ifdef NO_BUG
+    res_leak_cont_unref(cont);
+#endif
+    free(cont);
+
+    printf("%i\n", val);
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/file_operations/resource_leak/resource_leak.h b/bench-moerman2018/file_operations/resource_leak/resource_leak.h
new file mode 100644
index 0000000000000000000000000000000000000000..424c340ba21ed0ac10169faf3545d86a1236b5b9
--- /dev/null
+++ b/bench-moerman2018/file_operations/resource_leak/resource_leak.h
@@ -0,0 +1,37 @@
+#include <stdbool.h>
+#include <stdio.h>
+
+typedef struct _ResLeakRefCont FileCont;
+
+struct _ResLeakRefCont {
+    FILE* file;
+    unsigned int refc;
+};
+
+void res_leak_cont_init(FileCont* cont);
+FileCont* res_leak_cont_new();
+void res_leak_cont_ref(FileCont* cont);
+void res_leak_cont_unref(FileCont* cont);
+FILE* res_leak_cont_get_file(FileCont* cont);
+void res_leak_cont_set_file(FileCont* cont, FILE* file);
+
+void res_leak_for(int x);
+void res_leak_for_complex(int x);
+void res_leak_while_continue(int x);
+void res_leak_do_while_continue(int x);
+void res_leak_for_array(int x);
+void res_leak_for_pointer(int x);
+void res_leak_goto(int x);
+void res_leak_if_else(bool a, bool b);
+void res_leak_if_else_multi(bool a, bool b);
+void res_leak_if_else_int1(int x, int y);
+void res_leak_if_else_int2(int x, int y);
+void res_leak_pass_by_reference(bool a, bool b);
+int res_leak_switch(int x, int y);
+int res_leak_rec_multi(int x, int i, FILE** file_ptr, bool do_close);
+int res_leak_rec(int x, int i, FILE** file_ptr, bool do_close);
+int res_leak_pseudo_rec1(int x, int y, int i, char* file_name);
+int res_leak_pseudo_rec2(int x, int y, int i, FILE** file_ptr, char* file_name);
+void res_leak_struct(int x, int y);
+void res_leak_function_pointer(bool a, bool b, int (*f)(FILE** dest, bool close_file));
+void res_leak_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/general/divide_by_zero/01_simple_if.c b/bench-moerman2018/general/divide_by_zero/01_simple_if.c
new file mode 100644
index 0000000000000000000000000000000000000000..afa94f1c04ba03d7ed4557e897ca56971490887a
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/01_simple_if.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "divide_by_zero.h"
+
+void divide_zero_if_else(bool a, bool b) {
+    int divisor;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    if(a) {
+        divisor = 1;
+    } else {
+        divisor = 2;
+    }
+
+    if(b) {
+        val = 37 / (divisor + 2);
+    } else {
+        val = 11 / (divisor - 2); /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    divide_zero_if_else(true, true);
+    divide_zero_if_else(true, false);
+    divide_zero_if_else(false, true);
+#else
+    divide_zero_if_else(true, true); /* OK */
+    divide_zero_if_else(false, false); /* DANGER */
+    divide_zero_if_else(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/02_simple_if_int1.c b/bench-moerman2018/general/divide_by_zero/02_simple_if_int1.c
new file mode 100644
index 0000000000000000000000000000000000000000..a31d9c861be97639d8b77bbb3e01967376615318
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/02_simple_if_int1.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+void divide_zero_if_else_int1(int x, int y) {
+    int divisor;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    if(x < y) {
+        divisor = 1;
+    } else {
+        divisor = 2;
+    }
+
+    if(x > 10) {
+        val = 37 / (divisor + 2);
+    } else {
+        val = 11 / (divisor - 2); /* DANGER, if x <= 10 & x >= y */
+    }
+
+    printf("x=%i: %i", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    divide_zero_if_else_int1(9, 10);
+    divide_zero_if_else_int1(10, 11);
+    divide_zero_if_else_int1(11, 10);
+#else
+    divide_zero_if_else_int1(9, 10); /* OK */
+    divide_zero_if_else_int1(10, 10); /* DANGER */
+    divide_zero_if_else_int1(11, 10); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/02_simple_if_int2.c b/bench-moerman2018/general/divide_by_zero/02_simple_if_int2.c
new file mode 100644
index 0000000000000000000000000000000000000000..da8b555713de53368c67e6df667f010451613f80
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/02_simple_if_int2.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+void divide_zero_if_else_int2(int x, int y) {
+    int divisor;
+    int val, m, n;
+
+    m = -1;
+    n = 5;
+
+    x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    if(x < y) {
+        divisor = 1;
+    } else {
+        divisor = 2;
+    }
+
+    if(x > 10) {
+        val = 37 / (divisor + 2);
+    } else {
+        val = 11 / (divisor - 2); /* DANGER, if x <= 10 & x >= y */
+    }
+
+    printf("x=%i: %i", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    divide_zero_if_else_int2(-4, 11);
+    divide_zero_if_else_int2(-5, 11);
+    divide_zero_if_else_int2(-6, 11);
+#else
+    divide_zero_if_else_int2(-4, 10); /* OK */
+    divide_zero_if_else_int2(-5, 10); /* DANGER */
+    divide_zero_if_else_int2(-6, 10); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/03_simple_if_multi_func.c b/bench-moerman2018/general/divide_by_zero/03_simple_if_multi_func.c
new file mode 100644
index 0000000000000000000000000000000000000000..51b83a4457d1231add6abf0229006e531acc52af
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/03_simple_if_multi_func.c
@@ -0,0 +1,50 @@
+#include "divide_by_zero.h"
+#include <stdbool.h>
+#include <stdio.h>
+
+static int choose_divisor(int div1, int div2, bool condition) {
+    if(condition) {
+        return div1;
+    } else {
+        return div2;
+    }
+}
+
+static int conditional_divide(int val, int div1, int div2, bool condition) {
+    if(condition) {
+        return val / div1;
+    }
+    return val / div2;
+}
+
+void divide_zero_if_else_multi(bool a, bool b) {
+    int divisor;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    divisor = choose_divisor(5, 0, a);
+
+    val = conditional_divide(25, divisor+2, divisor, b); /* DANGER, if !a & !b */
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    divide_zero_if_else_multi(true, true);
+    divide_zero_if_else_multi(true, false);
+    divide_zero_if_else_multi(false, true);
+#else
+    divide_zero_if_else_multi(true, true); /* OK */
+    divide_zero_if_else_multi(false, false); /* DANGER */
+    divide_zero_if_else_multi(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/04_simple_switch.c b/bench-moerman2018/general/divide_by_zero/04_simple_switch.c
new file mode 100644
index 0000000000000000000000000000000000000000..6251c2d4ff02967aa118246f33aa796950622749
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/04_simple_switch.c
@@ -0,0 +1,61 @@
+#include "divide_by_zero.h"
+
+int divide_zero_switch(int x, int y) {
+    int divisor;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if((x == 10 || x == 5) && x >= y) {
+        return -1;
+    }
+#endif
+
+    if(x < y) {
+        divisor = 1;
+    } else {
+        divisor = 2;
+    }
+
+    switch (x) {
+        case 5: {
+            val = 37 / (divisor - 2); /* DANGER: x >= y */
+            break;
+        }
+        case 7: {
+            val = -37 / (divisor + 2);
+            break;
+        }
+        case 10: {
+            val = 73 / (divisor - 2); /* DANGER: x >= y */
+            break;
+        }
+        case 12: {
+            val = 73 / (divisor + 1);
+            break;
+        }
+        default: {
+            val = 100 / divisor;
+            break;
+        }
+    };
+
+    return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    divide_zero_switch(5, 11);
+    divide_zero_switch(10, 11);
+    divide_zero_switch(11, 11);
+    divide_zero_switch(7, 5);
+#else
+    divide_zero_switch(5, 10); /* OK */
+    divide_zero_switch(10, 10); /* DANGER */
+    divide_zero_switch(11, 10); /* OK */
+    divide_zero_switch(7, 5); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/05_simple_goto.c b/bench-moerman2018/general/divide_by_zero/05_simple_goto.c
new file mode 100644
index 0000000000000000000000000000000000000000..c0e37ab375e2b9e28168ca4125140fde65126cd1
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/05_simple_goto.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+void divide_zero_goto(int x) {
+    int val, i;
+    int divisor = 1;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 0) {
+        return;
+    }
+#endif
+
+    val = 37 / 3;
+    i = 0;
+
+GOTO_LABEL:
+    if(i <= x) {
+        val += 10 / (divisor + 1);
+    } else {
+        printf("%i\n", val);
+    }
+
+    divisor -= 2;
+
+    if(i == 0) {
+        i++;
+        goto GOTO_LABEL;
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    divide_zero_goto(0);
+#else
+    divide_zero_goto(1);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/06_simple_pass_by_reference.c b/bench-moerman2018/general/divide_by_zero/06_simple_pass_by_reference.c
new file mode 100644
index 0000000000000000000000000000000000000000..369f80e2760ff1d14cbb7e66eb62976c81f38b56
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/06_simple_pass_by_reference.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "divide_by_zero.h"
+
+static void assign_int(int* dest, int int1, int int2, bool condition) {
+    if(condition) {
+        *dest = int1;
+    } else {
+        *dest = int2;
+    }
+}
+
+void divide_zero_pass_by_reference(bool a, bool b) {
+    int divisor;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    assign_int(&divisor, 2, 0, a);
+
+    if(b) {
+        val = 25 / 4;
+    } else {
+        val = 91 / divisor; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    divide_zero_pass_by_reference(true, true);
+    divide_zero_pass_by_reference(true, false);
+    divide_zero_pass_by_reference(false, true);
+#else
+    divide_zero_pass_by_reference(true, true); /* OK */
+    divide_zero_pass_by_reference(false, false); /* DANGER */
+    divide_zero_pass_by_reference(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/07_simple_cross_file.c b/bench-moerman2018/general/divide_by_zero/07_simple_cross_file.c
new file mode 100644
index 0000000000000000000000000000000000000000..3763d888107f0c9e81627deb39429f265e3e9611
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/07_simple_cross_file.c
@@ -0,0 +1,40 @@
+#include "divide_by_zero.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+
+void divide_zero_cross_file(bool a, bool b) {
+    int divisor;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    divisor = choose_int(2, 0, a);
+
+    if(b) {
+        val = 10 / (divisor + 2);
+    } else {
+        val = 10 / divisor; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    divide_zero_cross_file(true, true);
+    divide_zero_cross_file(true, false);
+    divide_zero_cross_file(false, true);
+#else
+    divide_zero_cross_file(true, true); /* OK */
+    divide_zero_cross_file(false, false); /* DANGER */
+    divide_zero_cross_file(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/08_loop_for.c b/bench-moerman2018/general/divide_by_zero/08_loop_for.c
new file mode 100644
index 0000000000000000000000000000000000000000..80fb2eb6959e71e8f00d428c8b73d4abff5c6908
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/08_loop_for.c
@@ -0,0 +1,40 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+void divide_zero_for(int x) {
+    int divisor = 2;
+    int val = 0;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    for(i = 0; i < 20; i++) {
+        if(i > x) {
+            val += 10 / (divisor - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 / (divisor + 2);
+        }
+        if(i == 10) {
+            divisor = 4;
+            val += 10 / divisor;
+        }
+    }
+
+    printf("val = %i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    divide_zero_for(10);
+#else
+    divide_zero_for(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/09_loop_for_complex.c b/bench-moerman2018/general/divide_by_zero/09_loop_for_complex.c
new file mode 100644
index 0000000000000000000000000000000000000000..5d5dd0a471b58651f80387fa132f37a7740edbc5
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/09_loop_for_complex.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+void divide_zero_for_complex(int x) {
+    int divisor = 2;
+    int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    for(;;) {
+        if(i > x) {
+            val += 10 / (divisor - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 / (divisor + 2);
+        }
+        if(i == 10) {
+            divisor = 4;
+            val += 10 / divisor;
+        }
+        i++;
+        if(i >= 20) {
+            break;
+        }
+    }
+
+    printf("val = %i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    divide_zero_for_complex(10);
+#else
+    divide_zero_for_complex(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/10_loop_while_continue.c b/bench-moerman2018/general/divide_by_zero/10_loop_while_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..7aa484627745de4be35e076a36fd7471e0993068
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/10_loop_while_continue.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+void divide_zero_while_continue(int x) {
+    int divisor = 2;
+    int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    while(i < 30) {
+        if(i > x) {
+            val += 10 / (divisor - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 / (divisor + 2);
+        }
+        if(i == 10) {
+            divisor = 4;
+            val += 10 / divisor;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    }
+
+    printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    divide_zero_while_continue(10);
+#else
+    divide_zero_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/11_loop_while_do_continue.c b/bench-moerman2018/general/divide_by_zero/11_loop_while_do_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..47aa15bb0409cfae308f8b5f19afca2b54910c1c
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/11_loop_while_do_continue.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+void divide_zero_do_while_continue(int x) {
+    int divisor = 2;
+    int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    do {
+        if(i > x) {
+            val += 10 / (divisor - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 / (divisor + 2);
+        }
+        if(i == 10) {
+            divisor = 4;
+            val += 10 / divisor;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    } while(i < 30);
+
+    printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    divide_zero_do_while_continue(10);
+#else
+    divide_zero_do_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/12_loop_for_array_branching.c b/bench-moerman2018/general/divide_by_zero/12_loop_for_array_branching.c
new file mode 100644
index 0000000000000000000000000000000000000000..9072950ba7187783a9d7076149d8a38975b635c5
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/12_loop_for_array_branching.c
@@ -0,0 +1,45 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+void divide_zero_for_array(int x) {
+    int divisor = 2;
+    int p[20];
+    int val = 0, i = 0;
+
+    if(x < 0 || x > 19) {
+        return;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 19) {
+        return;
+    }
+#endif
+
+    for(i = 0; i < 20; i++) {
+        p[i] = 0;
+    }
+    p[x] = 1;
+
+    for(i = 0; i < 20; i++) {
+        if(p[i] == 1) {
+            divisor -= 2;
+        } else {
+            val = 10 / divisor; /* DANGER: x < 19 */
+        }
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    divide_zero_for_array(19);
+#else
+    divide_zero_for_array(10);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/general/divide_by_zero/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 0000000000000000000000000000000000000000..e281be05565e207fac38b57235ccb5ea580c4f2e
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,51 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+static void initialize_to_zero(int arr[], int length) {
+    int i;
+
+    for(i = 0; i < length; i++) {
+        arr[i] = 0;
+    }
+}
+
+void divide_zero_for_pointer(int x) {
+    int divisors[10];
+    int* ptr;
+    int val = 0, i;
+
+    if(x < 0 || x > 10) {
+        return;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 10) {
+        return;
+    }
+#endif
+
+    initialize_to_zero(divisors, 10);
+
+    for(i = 0, ptr = divisors; i < x; i++, ptr++) {
+        *ptr = i + 1;
+    }
+
+    for(i = 0, ptr = divisors; i <= 9; i++, ptr++) {
+        val += 100 / (*ptr);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    divide_zero_for_pointer(10);
+#else
+    divide_zero_for_pointer(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/14_loop_recursion.c b/bench-moerman2018/general/divide_by_zero/14_loop_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..50f62c20c9d651aea4b9cbac79673e26c54e8c79
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/14_loop_recursion.c
@@ -0,0 +1,39 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+int divide_zero_rec(int x, int i, int div1, int div2) {
+    int divisor;
+
+    if(i <= 1 || div1 == 0) {
+        return 0;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && i < x && div2 == 0) {
+        return divide_zero_rec(x, i-1, div1, div1);
+    }
+#endif
+
+    if(i < x) {
+        divisor = div2;
+    } else {
+        divisor = div1;
+    }
+    if(i == 10) {
+        div2 = div1;
+    }
+    return divide_zero_rec(x, i-1, div1, div2) + 100 / divisor;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    printf("%i\n", divide_zero_rec(10, 20, 5, 0));
+    printf("%i\n", divide_zero_rec(11, 20, 5, 6));
+#else
+    printf("%i\n", divide_zero_rec(11, 20, 5, 0));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/15_loop_recursion_multi.c b/bench-moerman2018/general/divide_by_zero/15_loop_recursion_multi.c
new file mode 100644
index 0000000000000000000000000000000000000000..b026d4c13cb52ffc77aa00bd32d91436a3b93bf4
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/15_loop_recursion_multi.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+int divide_zero_rec_decr(int x, int i, int div1, int div2) {
+    if(i <= 1) {
+        return 0;
+    }
+
+    return divide_zero_rec_multi(x, i-1, div1, div2);
+}
+
+int divide_zero_rec_multi(int x, int i, int div1, int div2) {
+    int divisor;
+
+    if(i <= 1 || div1 == 0) {
+        return 0;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && i < x && div2 == 0) {
+        return divide_zero_rec(x, i-1, div1, div1);
+    }
+#endif
+
+    if(i < x) {
+        divisor = div2;
+    } else {
+        divisor = div1;
+    }
+    if(i == 10) {
+        div2 = div1;
+    }
+    return divide_zero_rec_decr(x, i, div1, div2) + 100 / divisor;
+}
+
+
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    printf("%i", divide_zero_rec_multi(10, 20, 6, 0));
+#else
+    printf("%i", divide_zero_rec_multi(11, 20, 6, 0));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/16_misc_pseudo_recursion.c b/bench-moerman2018/general/divide_by_zero/16_misc_pseudo_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..6730681b2b830691191ea2bba864bc821bd3e6aa
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/16_misc_pseudo_recursion.c
@@ -0,0 +1,52 @@
+#include <stdio.h>
+#include "divide_by_zero.h"
+
+int divide_zero_pseudo_rec1(int x, int y, int i, int div1, int div2) {
+#ifdef CATCH_BAD_PARAM
+    if(!div2 && x >= y && x < 10) {
+        return 0;
+    }
+    if(!div1 && (x > 10 || (x <= 10 && x < y))) {
+        return 0;
+    }
+#endif
+
+    if(i > 0) {
+        return 37;
+    }
+
+    if(x < y) {
+        div2 = div1;
+    }
+
+    return divide_zero_pseudo_rec2(x, y, 1, div1, div2);
+}
+
+int divide_zero_pseudo_rec2(int x, int y, int i, int div1, int div2) {
+    int divisor;
+    if(i <= 0) {
+        return 10 / div1 + divide_zero_pseudo_rec1(x, y, 1, div1, div2);
+    }
+
+    if(x > 10) {
+        divisor = div1;
+    } else {
+        divisor = div2;
+    }
+
+    return 100 / divisor;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    printf("%i\n", divide_zero_pseudo_rec1(9, 10, 0, 5, 0));
+    printf("%i\n", divide_zero_pseudo_rec1(10, 10, 0, 5, 6));
+    printf("%i\n", divide_zero_pseudo_rec1(11, 10, 0, 5, 0));
+#else
+    printf("%i\n", divide_zero_pseudo_rec1(10, 10, 0, 5, 0));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/17_complex_function_pointers.c b/bench-moerman2018/general/divide_by_zero/17_complex_function_pointers.c
new file mode 100644
index 0000000000000000000000000000000000000000..f1f04ac481ce0853ab23d9afc4530b47cacce386
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/17_complex_function_pointers.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "divide_by_zero.h"
+
+static void assign_int(int* dest, int int1, int int2, bool condition) {
+    if(condition) {
+        *dest = int1;
+    } else {
+        *dest = int2;
+    }
+}
+
+void divide_zero_function_pointer(bool a, bool b, void (*f)(int*, int, int, bool)) {
+    int divisor;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!f || (!a & !b)) {
+        return;
+    }
+#endif
+
+    (*f)(&divisor, 2, 0, a);
+
+    if(b) {
+        val = 25 / 4;
+    } else {
+        val = 91 / divisor; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    divide_zero_function_pointer(true, true, &assign_int);
+    divide_zero_function_pointer(true, false, &assign_int);
+    divide_zero_function_pointer(false, true, &assign_int);
+#else
+    divide_zero_function_pointer(true, true, &assign_int); /* OK */
+    divide_zero_function_pointer(false, false, &assign_int); /* DANGER */
+    divide_zero_function_pointer(false, true, &assign_int); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/18_complex_struct_multiple_methods.c b/bench-moerman2018/general/divide_by_zero/18_complex_struct_multiple_methods.c
new file mode 100644
index 0000000000000000000000000000000000000000..7988245d2fa63b9de1315179eeb836dd6130ffec
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/18_complex_struct_multiple_methods.c
@@ -0,0 +1,78 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "divide_by_zero.h"
+
+#ifndef s_DIVBYZERO_REFCOUNT
+#define s_DIVBYZERO_REFCOUNT
+DivideCont* divide_zero_cont_new() {
+    DivideCont* new_cont;
+
+    new_cont = malloc(sizeof(DivideCont));
+
+    if(new_cont) {
+        new_cont->counter = 1;
+        new_cont->divisor = 0;
+    }
+    return new_cont;
+}
+
+void divide_zero_cont_incr(DivideCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void divide_zero_cont_decr(DivideCont* cont) {
+    if(cont->counter <= 1) {
+        cont->divisor = 0;
+    } else {
+        cont->counter--;
+    }
+}
+
+int divide_zero_cont_get_divisor(DivideCont* cont) {
+    return cont->divisor;
+}
+void divide_zero_cont_set_divisor(DivideCont* cont, int divisor) {
+    cont->divisor = divisor;
+}
+#endif //s_DIVBYZERO_REFCOUNT
+
+void divide_zero_struct(int x, int y) {
+    DivideCont cont;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    divide_zero_cont_set_divisor(&cont, 0);
+
+    if(x < y) {
+        divide_zero_cont_set_divisor(&cont, 7);
+    }
+
+    if(x > 10) {
+        val = 50 / 37;
+    } else {
+        /* DANGER: if x <= 10 & x >= y */
+        val = 30 / divide_zero_cont_get_divisor(&cont);
+    }
+
+    printf("x=%i: %i\n", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    divide_zero_struct(9, 10);
+    divide_zero_struct(10, 11);
+    divide_zero_struct(11, 10);
+#else
+    divide_zero_struct(10, 10); /* DANGER */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/19_complex_refcount.c b/bench-moerman2018/general/divide_by_zero/19_complex_refcount.c
new file mode 100644
index 0000000000000000000000000000000000000000..bcf3580d8c13d5871aad8476506a2325ff17a31e
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/19_complex_refcount.c
@@ -0,0 +1,67 @@
+#include "divide_by_zero.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_DIVBYZERO_REFCOUNT
+#define s_DIVBYZERO_REFCOUNT
+DivideCont* divide_zero_cont_new() {
+    DivideCont* new_cont;
+
+    new_cont = malloc(sizeof(DivideCont));
+
+    if(new_cont) {
+        new_cont->counter = 1;
+        new_cont->divisor = 0;
+    }
+    return new_cont;
+}
+
+void divide_zero_cont_incr(DivideCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void divide_zero_cont_decr(DivideCont* cont) {
+    if(cont->counter <= 1) {
+        cont->divisor = 0;
+    } else {
+        cont->counter--;
+    }
+}
+
+int divide_zero_cont_get_divisor(DivideCont* cont) {
+    return cont->divisor;
+}
+void divide_zero_cont_set_divisor(DivideCont* cont, int divisor) {
+    cont->divisor = divisor;
+}
+#endif //s_DIVBYZERO_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+    DivideCont* cont;
+    int val;
+
+    cont = divide_zero_cont_new();
+    if(!cont) {
+        return 1;
+    }
+    divide_zero_cont_set_divisor(cont, 35);
+
+    divide_zero_cont_incr(cont);
+    divide_zero_cont_incr(cont);
+    divide_zero_cont_decr(cont);
+    divide_zero_cont_decr(cont);
+#ifndef NO_BUG
+    divide_zero_cont_decr(cont);
+#endif
+
+    val = 30 / divide_zero_cont_get_divisor(cont);
+
+    printf("%i\n", val);
+
+    free(cont);
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/divide_by_zero/divide_by_zero.h b/bench-moerman2018/general/divide_by_zero/divide_by_zero.h
new file mode 100644
index 0000000000000000000000000000000000000000..2fda41f72dbad5d2cbdda30033420f8cce67167e
--- /dev/null
+++ b/bench-moerman2018/general/divide_by_zero/divide_by_zero.h
@@ -0,0 +1,35 @@
+#include <stdbool.h>
+
+typedef struct _DivideCont DivideCont;
+
+struct _DivideCont {
+    int divisor;
+    unsigned int counter;
+};
+
+DivideCont* divide_zero_cont_new();
+void divide_zero_cont_incr(DivideCont* cont);
+void divide_zero_cont_decr(DivideCont* cont);
+int divide_zero_cont_get_divisor(DivideCont* cont);
+void divide_zero_cont_set_divisor(DivideCont* cont, int divisor);
+
+void divide_zero_for(int x);
+void divide_zero_for_complex(int x);
+void divide_zero_while_continue(int x);
+void divide_zero_do_while_continue(int x);
+void divide_zero_for_array(int x);
+void divide_zero_for_pointer(int x);
+void divide_zero_goto(int x);
+void divide_zero_if_else(bool a, bool b);
+void divide_zero_if_else_multi(bool a, bool b);
+void divide_zero_if_else_int1(int x, int y);
+void divide_zero_if_else_int2(int x, int y);
+void divide_zero_pass_by_reference(bool a, bool b);
+int divide_zero_switch(int x, int y);
+int divide_zero_rec_multi(int x, int i, int div1, int div2);
+int divide_zero_rec(int x, int i, int div1, int div2);
+int divide_zero_pseudo_rec1(int x, int y, int i, int div1, int div2);
+int divide_zero_pseudo_rec2(int x, int y, int i, int div1, int div2);
+void divide_zero_struct(int x, int y);
+void divide_zero_function_pointer(bool a, bool b, void (*f)(int*, int, int, bool));
+void divide_zero_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/general/nullpointer/01_simple_if.c b/bench-moerman2018/general/nullpointer/01_simple_if.c
new file mode 100644
index 0000000000000000000000000000000000000000..9f48baaedea5128c302272d00f67fb0eb92694a1
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/01_simple_if.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "nullpointer.h"
+
+void nullpointer_if_else(bool a, bool b) {
+    int arr[3] = {1, 2, 3};
+    int* ptr = 0;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    if(a) {
+        ptr = arr;
+    }
+
+    if(b) {
+        val = arr[2];
+    } else {
+        val = ptr[2]; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    nullpointer_if_else(true, true);
+    nullpointer_if_else(true, false);
+    nullpointer_if_else(false, true);
+#else
+    nullpointer_if_else(true, true); /* OK */
+    nullpointer_if_else(false, false); /* DANGER */
+    nullpointer_if_else(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/02_simple_if_int1.c b/bench-moerman2018/general/nullpointer/02_simple_if_int1.c
new file mode 100644
index 0000000000000000000000000000000000000000..09e38e5d898aeb912accf78de4b9d641549c136b
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/02_simple_if_int1.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+void nullpointer_if_else_int1(int x, int y) {
+    int arr[3] = {1, 2, 3};
+    int* ptr = 0;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    if(x < y) {
+        ptr = arr;
+    }
+
+    if(x > 10) {
+        val = arr[2];
+    } else {
+        val = ptr[2]; /* DANGER, if x <= 10 & x >= y */
+    }
+
+    printf("x=%i: %i", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    nullpointer_if_else_int1(9, 10);
+    nullpointer_if_else_int1(10, 11);
+    nullpointer_if_else_int1(11, 10);
+#else
+    nullpointer_if_else_int1(9, 10); /* OK */
+    nullpointer_if_else_int1(10, 10); /* DANGER */
+    nullpointer_if_else_int1(11, 10); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/02_simple_if_int2.c b/bench-moerman2018/general/nullpointer/02_simple_if_int2.c
new file mode 100644
index 0000000000000000000000000000000000000000..e1acecb3cb5d16a115f47d90dcdb4c8efbaaffe9
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/02_simple_if_int2.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+void nullpointer_if_else_int2(int x, int y) {
+    int arr[3] = {1, 2, 3};
+    int* ptr = 0;
+    int val, m, n;
+
+    m = -1;
+    n = 5;
+
+    x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    if(x < y) {
+        ptr = arr;
+    }
+
+    if(x > 10) {
+        val = arr[2];
+    } else {
+        val = ptr[2]; /* DANGER: x <= 10 && x >= y */
+    }
+
+    printf("x=%i: %i", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    nullpointer_if_else_int2(-4, 11);
+    nullpointer_if_else_int2(-5, 11);
+    nullpointer_if_else_int2(-6, 11);
+#else
+    nullpointer_if_else_int2(-4, 10); /* OK */
+    nullpointer_if_else_int2(-5, 10); /* DANGER */
+    nullpointer_if_else_int2(-6, 10); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/03_simple_if_multi_func.c b/bench-moerman2018/general/nullpointer/03_simple_if_multi_func.c
new file mode 100644
index 0000000000000000000000000000000000000000..f096cb9e9856a69334e074abebcaaef6808cefe1
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/03_simple_if_multi_func.c
@@ -0,0 +1,51 @@
+#include "nullpointer.h"
+#include <stdbool.h>
+#include <stdio.h>
+
+static int* choose_pointer_local(int* source1, int* source2, bool condition) {
+    if(condition) {
+        return source1;
+    } else {
+        return source2;
+    }
+}
+
+static int int_dereference_choice_local(int* source1, int* source2, bool condition) {
+    if(condition) {
+        return *source1;
+    }
+    return *source2;
+}
+
+void nullpointer_if_else_multi(bool a, bool b) {
+    int arr[3] = {1, 2, 3};
+    int* ptr = 0;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    ptr = choose_pointer_local(arr+1, 0, a);
+
+    val = int_dereference_choice_local(arr+2, ptr, b); /* DANGER, if !a & !b */
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    nullpointer_if_else_multi(true, true);
+    nullpointer_if_else_multi(true, false);
+    nullpointer_if_else_multi(false, true);
+#else
+    nullpointer_if_else_multi(true, true); /* OK */
+    nullpointer_if_else_multi(false, false); /* DANGER */
+    nullpointer_if_else_multi(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/04_simple_switch.c b/bench-moerman2018/general/nullpointer/04_simple_switch.c
new file mode 100644
index 0000000000000000000000000000000000000000..b2289b46b2e324bfa67ba01fef9918f715b2406a
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/04_simple_switch.c
@@ -0,0 +1,60 @@
+#include "nullpointer.h"
+
+int nullpointer_switch(int x, int y) {
+    int arr[3] = {1, 2, 3};
+    int* ptr = 0;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if((x == 10 || x == 5) && x >= y) {
+        return -1;
+    }
+#endif
+
+    if(x < y) {
+        ptr = arr;
+    }
+
+    switch (x) {
+        case 5: {
+            val = *(ptr+2); /* DANGER: x >= y */
+            break;
+        }
+        case 7: {
+            val = arr[0] + 5;
+            break;
+        }
+        case 10: {
+            val = *ptr; /* DANGER: x >= y */
+            break;
+        }
+        case 12: {
+            val = arr[2] + 5;
+            break;
+        }
+        default: {
+            val = arr[1];
+            break;
+        }
+    };
+
+    return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    nullpointer_switch(5, 11);
+    nullpointer_switch(10, 11);
+    nullpointer_switch(11, 10);
+    nullpointer_switch(7, 5);
+#else
+    nullpointer_switch(5, 10); /* OK */
+    nullpointer_switch(10, 10); /* DANGER */
+    nullpointer_switch(11, 10); /* OK */
+    nullpointer_switch(7, 5); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/05_simple_goto.c b/bench-moerman2018/general/nullpointer/05_simple_goto.c
new file mode 100644
index 0000000000000000000000000000000000000000..8ef65e01c8b914b27bb56c576d7f3bcfb106e324
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/05_simple_goto.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+void nullpointer_goto(int x) {
+    int arr[3] = {1, 2, 3};
+    int* ptr = arr;
+    int val, i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 0) {
+        return;
+    }
+#endif
+
+    val = *(ptr+1);
+    i = 0;
+
+GOTO_LABEL:
+    if(i <= x) {
+        val += *ptr;
+    } else {
+        printf("%i\n", val);
+    }
+
+    ptr = 0;
+
+    if(i == 0) {
+        i++;
+        goto GOTO_LABEL;
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    nullpointer_goto(0);
+#else
+    nullpointer_goto(1);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/06_simple_pass_by_reference.c b/bench-moerman2018/general/nullpointer/06_simple_pass_by_reference.c
new file mode 100644
index 0000000000000000000000000000000000000000..3e16dd360c68f3a1ea3b2796fa903efc5747dcfc
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/06_simple_pass_by_reference.c
@@ -0,0 +1,49 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "nullpointer.h"
+
+static void local_assign_pointer(void** dest, void* source1, void* source2, bool condition) {
+    if(condition) {
+        *dest = source1;
+    } else {
+        *dest = source2;
+    }
+}
+
+void nullpointer_pass_by_reference(bool a, bool b) {
+    int arr[3] = {1, 2, 3};
+    int* ptr;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    local_assign_pointer((void**) &ptr, (void*) arr, 0, a);
+
+    if(b) {
+        val = arr[2];
+    } else {
+        val = ptr[2]; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    nullpointer_pass_by_reference(true, true);
+    nullpointer_pass_by_reference(true, false);
+    nullpointer_pass_by_reference(false, true);
+#else
+    nullpointer_pass_by_reference(true, true); /* OK */
+    nullpointer_pass_by_reference(false, false); /* DANGER */
+    nullpointer_pass_by_reference(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/07_cross_file.c b/bench-moerman2018/general/nullpointer/07_cross_file.c
new file mode 100644
index 0000000000000000000000000000000000000000..a427f32ce2bd4c0624a620c72feacd9f25511f87
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/07_cross_file.c
@@ -0,0 +1,41 @@
+#include "nullpointer.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+
+void nullpointer_cross_file(bool a, bool b) {
+    int arr[3] = {1, 2, 3};
+    int* ptr = 0;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    ptr = (int*)choose_pointer((void*)(arr+1), 0, a);
+
+    if(b) {
+        val = arr[1];
+    } else {
+        val = ptr[1]; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    nullpointer_cross_file(true, true);
+    nullpointer_cross_file(true, false);
+    nullpointer_cross_file(false, true);
+#else
+    nullpointer_cross_file(true, true); /* OK */
+    nullpointer_cross_file(false, false); /* DANGER */
+    nullpointer_cross_file(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/08_loop_for.c b/bench-moerman2018/general/nullpointer/08_loop_for.c
new file mode 100644
index 0000000000000000000000000000000000000000..59e9f762c40314d31e03e918c57aae62039581ab
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/08_loop_for.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+void nullpointer_for(int x) {
+    int arr[3] = {1, 2, 3};
+    int* ptr = 0;
+    int val = 0;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    for(i = 0; i < 20; i++) {
+        if(i > x) {
+            val += *ptr; /* DANGER: x < 10 */
+        } else {
+            val += arr[0];
+        }
+        if(i == 10) {
+            ptr = arr;
+            val += *ptr;
+        }
+    }
+
+    printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    nullpointer_for(10);
+#else
+    nullpointer_for(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/09_loop_for_complex.c b/bench-moerman2018/general/nullpointer/09_loop_for_complex.c
new file mode 100644
index 0000000000000000000000000000000000000000..7e738eb4dfaecd82a30a1ac3430a8544a964ac6c
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/09_loop_for_complex.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+void nullpointer_for_complex(int x) {
+    int arr[3] = {1, 2, 3};
+    int* ptr = 0;
+    int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    for(;;) {
+        if(i > x) {
+            val += *ptr; /* DANGER: x < 10 */
+        } else {
+            val += arr[0];
+        }
+        if(i == 10) {
+            ptr = arr;
+            val += *ptr;
+        }
+        i++;
+        if(i >= 20) {
+            break;
+        }
+    }
+
+    printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    nullpointer_for_complex(10);
+#else
+    nullpointer_for_complex(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/10_loop_while_continue.c b/bench-moerman2018/general/nullpointer/10_loop_while_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..f81e4557c25aeb6f0d971f908d345fb7c75db3b2
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/10_loop_while_continue.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+void nullpointer_while_continue(int x) {
+    int arr[3] = {1, 2, 3};
+    int* ptr = 0;
+    int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    while(i < 30) {
+        if(i > x) {
+            val += *ptr; /* DANGER: x < 10 */
+        } else {
+            val += arr[0];
+        }
+        if(i == 10) {
+            ptr = arr;
+            val += *ptr;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    }
+
+    printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    nullpointer_while_continue(10);
+#else
+    nullpointer_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/11_loop_while_do_continue.c b/bench-moerman2018/general/nullpointer/11_loop_while_do_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..0122f8f6a1bd2f6f02ba0998abdbe7124350625a
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/11_loop_while_do_continue.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+void nullpointer_do_while_continue(int x) {
+    int arr[3] = {1, 2, 3};
+    int* ptr = 0;
+    int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    do {
+        if(i > x) {
+            val += *ptr; /* DANGER: x < 10 */
+        } else {
+            val += arr[0];
+        }
+        if(i == 10) {
+            ptr = arr;
+            val += *ptr;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    } while(i < 30);
+
+    printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    nullpointer_do_while_continue(10);
+#else
+    nullpointer_do_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/12_loop_for_array_branching.c b/bench-moerman2018/general/nullpointer/12_loop_for_array_branching.c
new file mode 100644
index 0000000000000000000000000000000000000000..7742003bfe335e4d6c81c1b64fe6593fcbda385c
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/12_loop_for_array_branching.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+void nullpointer_for_array(int x) {
+    int p[20];
+    int* ptr = p;
+    int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 19) {
+        return;
+    }
+#endif
+
+    for(i = 0; i < 20; i++) {
+        p[i] = 0;
+    }
+    p[x] = 1;
+
+    for(i = 0; i < 20; i++) {
+        if(p[i] == 1) {
+            ptr = 0;
+        } else {
+            val = *ptr; /* DANGER: x < 19 */
+        }
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    nullpointer_for_array(19);
+#else
+    nullpointer_for_array(10);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/general/nullpointer/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 0000000000000000000000000000000000000000..62c389e7d8d2a2325167a55cfbf4eeeefaff5e91
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,52 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "nullpointer.h"
+
+static void initialize_to_null(int* ptr_arr[], int length) {
+    int i;
+
+    for(i = 0; i < length; i++) {
+        ptr_arr[i] = 0;
+    }
+}
+
+void nullpointer_for_pointer(int x) {
+    int* pointers[10];
+    int** ptr;
+    int source[10];
+    int val = 0, i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 10) {
+        return;
+    }
+#endif
+
+    initialize_to_null(pointers, 10);
+
+    for(i = 0, ptr = pointers; i < x; i++, ptr++) {
+        *(ptr) = source + i;
+    }
+
+    for(i = 0, ptr = pointers; i <= 9; i++, ptr++) {
+        **(ptr) = i;
+    }
+
+    for(i = 0, ptr = pointers; i <= 9; i++, ptr++) {
+        val += **(ptr);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    nullpointer_for_pointer(10);
+#else
+    nullpointer_for_pointer(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/14_loop_recursion.c b/bench-moerman2018/general/nullpointer/14_loop_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..794f8f19dc3037d033e50ffc851c54ec47dedeb6
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/14_loop_recursion.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+int nullpointer_rec(int x, int i, int* ptr1, int* ptr2) {
+    int* ptr;
+    int val = 0;
+
+    if(i <= 1) {
+        return 0;
+    }
+
+    if(!ptr1 || !ptr2) { /* Signal the tools that these can be null (for -DNO_MAIN) */
+        val++;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(!ptr1 && (!ptr2 || i >= x || i >= 10)) {
+        return -1;
+    }
+    if(!ptr2 && (x > 2 || (i > 10 && x > 10))) {
+        return nullpointer_rec(x, i-1, ptr1, ptr1);
+    }
+#endif
+
+    if(i < x) {
+        ptr = ptr2;
+    } else {
+        ptr = ptr1;
+    }
+    if(i == 10) {
+        return *ptr + nullpointer_rec(x, i-1, ptr1, ptr1);
+    }
+    return val + *ptr + nullpointer_rec(x, i-1, ptr1, ptr2);
+}
+
+#ifndef NO_MAIN
+int main() {
+    int arr[3] = {1, 2, 3};
+#ifdef NO_BUG
+    printf("%i\n", nullpointer_rec(10, 20, arr, 0));
+    printf("%i\n", nullpointer_rec(11, 20, arr, arr+1));
+#else
+    printf("%i\n", nullpointer_rec(11, 20, arr, 0));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/15_loop_recursion_multi.c b/bench-moerman2018/general/nullpointer/15_loop_recursion_multi.c
new file mode 100644
index 0000000000000000000000000000000000000000..a8197ec2a22977c622b4512c24f04d4750fb850a
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/15_loop_recursion_multi.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+int nullpointer_rec_decr(int x, int i, int* ptr1, int* ptr2) {
+    if(i <= 1) {
+        return 0;
+    }
+
+    return nullpointer_rec_multi(x, i-1, ptr1, ptr2);
+}
+
+int nullpointer_rec_multi(int x, int i, int* ptr1, int* ptr2) {
+    int val = 0;
+    int* ptr;
+
+    if(!ptr1 || !ptr2) { /* Signal the tools that these can be null (for -DNO_MAIN) */
+        val++;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(!ptr1 && (!ptr2 || i >= x || i >= 10)) {
+        return -1;
+    }
+    if(!ptr2 && (x > 2 || (i > 10 && x > 10))) {
+        return nullpointer_rec(x, i-1, ptr1, ptr1);
+    }
+#endif
+
+    if(i < x) {
+        ptr = ptr2;
+    } else {
+        ptr = ptr1;
+    }
+    if(i == 10) {
+        ptr2 = ptr1;
+    }
+    return val + *ptr + nullpointer_rec_decr(x, i, ptr1, ptr2);
+}
+
+
+
+#ifndef NO_MAIN
+int main() {
+    int arr[3] = {1, 2, 3};
+#ifdef NO_BUG
+    printf("%i", nullpointer_rec_multi(10, 20, arr, 0));
+#else
+    printf("%i", nullpointer_rec_multi(11, 20, arr, 0));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/16_misc_pseudo_recursion.c b/bench-moerman2018/general/nullpointer/16_misc_pseudo_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..129877cd66c698b7a56ea274662dc0b66a87e4f1
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/16_misc_pseudo_recursion.c
@@ -0,0 +1,60 @@
+#include <stdio.h>
+#include "nullpointer.h"
+
+int nullpointer_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2) {
+    int val = 0;
+
+    if(!ptr1 || !ptr2) { /* Signal the tools that these can be null (for -DNO_MAIN) */
+        val++;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(!ptr1 && (x < y || x > 10)) {
+        return -1;
+    }
+    if(!ptr2 && x >= y && x <= 10) {
+        return -1;
+    }
+#endif
+
+    if(i > 0) {
+        return 37;
+    }
+
+    if(x < y) {
+        ptr2 = ptr1;
+    }
+
+    return val + nullpointer_pseudo_rec2(x, y, 1, ptr1, ptr2);
+}
+
+int nullpointer_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2) {
+    int* ptr;
+
+    if(i <= 0) {
+        return *ptr1 + nullpointer_pseudo_rec1(x, y, 1, ptr1, ptr2);
+    }
+
+    if(x > 10) {
+        ptr = ptr1;
+    } else {
+        ptr = ptr2;
+    }
+
+    return *ptr;
+}
+
+#ifndef NO_MAIN
+int main() {
+    int arr[3] = {1, 2, 3};
+#ifdef NO_BUG
+    printf("%i\n", nullpointer_pseudo_rec1(9, 10, 0, arr, 0));
+    printf("%i\n", nullpointer_pseudo_rec1(10, 10, 0, arr, arr+1));
+    printf("%i\n", nullpointer_pseudo_rec1(11, 10, 0, arr, 0));
+#else
+    printf("%i\n", nullpointer_pseudo_rec1(10, 10, 0, arr, 0));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/17_complex_function_pointers.c b/bench-moerman2018/general/nullpointer/17_complex_function_pointers.c
new file mode 100644
index 0000000000000000000000000000000000000000..10d6e1d8b41b05eae6bb4e2d5f4fa772a82bd3b4
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/17_complex_function_pointers.c
@@ -0,0 +1,49 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "nullpointer.h"
+
+static void local_assign_pointer(void** dest, void* source1, void* source2, bool condition) {
+    if(condition) {
+        *dest = source1;
+    } else {
+        *dest = source2;
+    }
+}
+
+void nullpointer_function_pointer(bool a, bool b, void (*f)(void**, void*, void*, bool)) {
+    int arr[3] = {1, 2, 3};
+    int* ptr;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!f || (!a & !b)) {
+        return;
+    }
+#endif
+
+    (*f)((void**) &ptr, (void*) arr, 0, a);
+
+    if(b) {
+        val = arr[2];
+    } else {
+        val = ptr[2]; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    nullpointer_function_pointer(true, true, &local_assign_pointer);
+    nullpointer_function_pointer(true, false, &local_assign_pointer);
+    nullpointer_function_pointer(false, true, &local_assign_pointer);
+#else
+    nullpointer_function_pointer(true, true, &local_assign_pointer); /* OK */
+    nullpointer_function_pointer(false, false, &local_assign_pointer); /* DANGER */
+    nullpointer_function_pointer(false, true, &local_assign_pointer); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/18_complex_struct_multiple_methods.c b/bench-moerman2018/general/nullpointer/18_complex_struct_multiple_methods.c
new file mode 100644
index 0000000000000000000000000000000000000000..03bb9d7b6dd4f194de7a7d5c8f621af653f6e3da
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/18_complex_struct_multiple_methods.c
@@ -0,0 +1,91 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "nullpointer.h"
+
+#ifndef s_NULLPOINTER_REFCOUNT
+#define s_NULLPOINTER_REFCOUNT
+NRefCont* null_ref_cont_new() {
+    NRefCont* new_cont;
+
+    new_cont = malloc(sizeof(NRefCont));
+
+    if(new_cont) {
+        new_cont->refc = 1;
+        new_cont->p_data = 0;
+    }
+    return new_cont;
+}
+
+void null_ref(NRefCont* cont) {
+    if(cont) {
+        cont->refc++;
+    }
+}
+void null_unref(NRefCont* cont) {
+    if(cont->refc <= 1) {
+        if(cont->p_data) {
+            cont->p_data = 0;
+        }
+    } else {
+        cont->refc--;
+    }
+}
+
+void* null_ref_cont_get_pointer(NRefCont* cont) {
+    return cont->p_data;
+}
+void null_ref_cont_set_pointer(NRefCont* cont, void* p) {
+    cont->p_data = p;
+}
+#endif //s_NULLPOINTER_REFCOUNT
+
+void nullpointer_struct(int x, int y) {
+    int* data;
+    int val;
+    NRefCont cont;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    null_ref_cont_set_pointer(&cont, 0);
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    *data = 37;
+
+    if(x < y) {
+        null_ref_cont_set_pointer(&cont, data);
+    }
+
+    if(x > 10) {
+        val = *data;
+    } else {
+        /* DANGER: if x <= 10 & x >= y */
+        val = *((int*) null_ref_cont_get_pointer(&cont));
+    }
+
+    printf("x=%i: %i", x, val);
+    free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+
+#ifdef NO_BUG
+    nullpointer_struct(9, 10);
+    nullpointer_struct(10, 11);
+    nullpointer_struct(11, 10);
+#else
+    nullpointer_struct(10, 10); /* DANGER */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/19_complex_refcount.c b/bench-moerman2018/general/nullpointer/19_complex_refcount.c
new file mode 100644
index 0000000000000000000000000000000000000000..32e52c42b28220d869618ec5d1231e4ca791366e
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/19_complex_refcount.c
@@ -0,0 +1,70 @@
+#include "nullpointer.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_NULLPOINTER_REFCOUNT
+#define s_NULLPOINTER_REFCOUNT
+NRefCont* null_ref_cont_new() {
+    NRefCont* new_cont;
+
+    new_cont = malloc(sizeof(NRefCont));
+
+    if(new_cont) {
+        new_cont->refc = 1;
+        new_cont->p_data = 0;
+    }
+    return new_cont;
+}
+
+void null_ref(NRefCont* cont) {
+    if(cont) {
+        cont->refc++;
+    }
+}
+void null_unref(NRefCont* cont) {
+    if(cont->refc <= 1) {
+        if(cont->p_data) {
+            cont->p_data = 0;
+        }
+    } else {
+        cont->refc--;
+    }
+}
+
+void* null_ref_cont_get_pointer(NRefCont* cont) {
+    return cont->p_data;
+}
+void null_ref_cont_set_pointer(NRefCont* cont, void* p) {
+    cont->p_data = p;
+}
+#endif //s_NULLPOINTER_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+    NRefCont* cont;
+    int arr[3] = {1, 2, 3};
+    int val;
+
+    cont = null_ref_cont_new();
+    if(!cont) {
+        return 1;
+    }
+    null_ref_cont_set_pointer(cont, arr);
+
+    null_ref(cont);
+    null_ref(cont);
+    null_unref(cont);
+    null_unref(cont);
+#ifndef NO_BUG
+    null_unref(cont);
+#endif
+
+    val = *((int*) null_ref_cont_get_pointer(cont));
+
+    printf("%i\n", val);
+
+    free(cont);
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/nullpointer/nullpointer.h b/bench-moerman2018/general/nullpointer/nullpointer.h
new file mode 100644
index 0000000000000000000000000000000000000000..f79e51eb28383d11874dc9fa4a2b8d1921eabd2e
--- /dev/null
+++ b/bench-moerman2018/general/nullpointer/nullpointer.h
@@ -0,0 +1,36 @@
+#include <stdbool.h>
+
+typedef struct _NullRefCont NRefCont;
+
+struct _NullRefCont {
+    void* p_data;
+    unsigned int refc;
+};
+
+NRefCont* null_ref_cont_new();
+void null_ref(NRefCont* cont);
+void null_unref(NRefCont* cont);
+void* null_ref_cont_get_pointer(NRefCont* cont);
+void null_ref_cont_set_pointer(NRefCont* cont, void* p);
+
+void nullpointer_for(int x);
+void nullpointer_for_complex(int x);
+void nullpointer_while_continue(int x);
+void nullpointer_do_while_continue(int x);
+void nullpointer_for_array(int x);
+void nullpointer_for_pointer(int x);
+void nullpointer_goto(int x);
+void nullpointer_if_else(bool a, bool b);
+void nullpointer_if_else_multi(bool a, bool b);
+void nullpointer_if_else_int1(int x, int y);
+void nullpointer_if_else_int2(int x, int y);
+void nullpointer_pass_by_reference(bool a, bool b);
+int nullpointer_switch(int x, int y);
+int nullpointer_rec_multi(int x, int i, int* ptr1, int* ptr2);
+int nullpointer_rec(int x, int i, int* ptr1, int* ptr2);
+int nullpointer_rec_assign(int x, int i, int* ptr1, int* ptr2);
+int nullpointer_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2);
+int nullpointer_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2);
+void nullpointer_struct(int x, int y);
+void nullpointer_function_pointer(bool a, bool b, void (*f)(void**, void*, void*, bool));
+void nullpointer_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/general/uninitialized/pointer/01_simple_if.c b/bench-moerman2018/general/uninitialized/pointer/01_simple_if.c
new file mode 100644
index 0000000000000000000000000000000000000000..0c7f930835926e5d56df99dae47a26d886f86a64
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/01_simple_if.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "uninit_ptr.h"
+
+void uninit_ptr_if_else(bool a, bool b) {
+    int arr[3] = {1, 2, 3};
+    int* ptr;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    if(a) {
+        ptr = arr;
+    }
+
+    if(b) {
+        val = arr[2];
+    } else {
+        val = ptr[2]; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_ptr_if_else(true, true);
+    uninit_ptr_if_else(true, false);
+    uninit_ptr_if_else(false, true);
+#else
+    uninit_ptr_if_else(true, true); /* OK */
+    uninit_ptr_if_else(false, false); /* DANGER */
+    uninit_ptr_if_else(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/02_simple_if_int1.c b/bench-moerman2018/general/uninitialized/pointer/02_simple_if_int1.c
new file mode 100644
index 0000000000000000000000000000000000000000..ac79dec79edeb1dcd4560c19dfe7c0feeec855b4
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/02_simple_if_int1.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+void uninit_ptr_if_else_int1(int x, int y) {
+    int arr[3] = {1, 2, 3};
+    int* ptr;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    if(x < y) {
+        ptr = arr;
+    }
+
+    if(x > 10) {
+        val = arr[2];
+    } else {
+        val = ptr[2]; /* DANGER, if x <= 10 & x >= y */
+    }
+
+    printf("x=%i: %i", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_ptr_if_else_int1(9, 10);
+    uninit_ptr_if_else_int1(10, 11);
+    uninit_ptr_if_else_int1(11, 10);
+#else
+    uninit_ptr_if_else_int1(9, 10); /* OK */
+    uninit_ptr_if_else_int1(10, 10); /* DANGER */
+    uninit_ptr_if_else_int1(11, 10); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/02_simple_if_int2.c b/bench-moerman2018/general/uninitialized/pointer/02_simple_if_int2.c
new file mode 100644
index 0000000000000000000000000000000000000000..c377178f22331bf690a683dd456c79e7e94f1e57
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/02_simple_if_int2.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+void uninit_ptr_if_else_int2(int x, int y) {
+    int arr[3] = {1, 2, 3};
+    int* ptr;
+    int val, m, n;
+
+    m = -1;
+    n = 5;
+
+    x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    if(x < y) {
+        ptr = arr;
+    }
+
+    if(x > 10) {
+        val = arr[2];
+    } else {
+        val = ptr[2]; /* DANGER: x <= 10 && x >= y */
+    }
+
+    printf("x=%i: %i", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_ptr_if_else_int2(-4, 11);
+    uninit_ptr_if_else_int2(-5, 11);
+    uninit_ptr_if_else_int2(-6, 11);
+#else
+    uninit_ptr_if_else_int2(-4, 10); /* OK */
+    uninit_ptr_if_else_int2(-5, 10); /* DANGER */
+    uninit_ptr_if_else_int2(-6, 10); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/03_simple_if_multi_func.c b/bench-moerman2018/general/uninitialized/pointer/03_simple_if_multi_func.c
new file mode 100644
index 0000000000000000000000000000000000000000..768eca5b44422bf27991a7d6beb7aa3478c95c2f
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/03_simple_if_multi_func.c
@@ -0,0 +1,53 @@
+#include "uninit_ptr.h"
+#include <stdbool.h>
+#include <stdio.h>
+
+static int** choose_pointer_local(int** source1, int** source2, bool condition) {
+    if(condition) {
+        return source1;
+    } else {
+        return source2;
+    }
+}
+
+static int int_dereference_choice_local(int** source1, int** source2, bool condition) {
+    if(condition) {
+        return **source1;
+    }
+    return **source2;
+}
+
+void uninit_ptr_if_else_multi(bool a, bool b) {
+    int arr[3] = {1, 2, 3};
+    int* arr_allias = arr;
+    int** ptr;
+    int* uninit;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    ptr = choose_pointer_local(&arr_allias, &uninit, a);
+
+    val = int_dereference_choice_local(&arr_allias, ptr, b); /* DANGER, if !a & !b */
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_ptr_if_else_multi(true, true);
+    uninit_ptr_if_else_multi(true, false);
+    uninit_ptr_if_else_multi(false, true);
+#else
+    uninit_ptr_if_else_multi(true, true); /* OK */
+    uninit_ptr_if_else_multi(false, false); /* DANGER */
+    uninit_ptr_if_else_multi(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/04_simple_switch.c b/bench-moerman2018/general/uninitialized/pointer/04_simple_switch.c
new file mode 100644
index 0000000000000000000000000000000000000000..5b48f93c23f20e5d1aa9cfbdf8999b3d0b613221
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/04_simple_switch.c
@@ -0,0 +1,60 @@
+#include "uninit_ptr.h"
+
+int uninit_ptr_switch(int x, int y) {
+    int arr[3] = {1, 2, 3};
+    int* ptr;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if((x == 10 || x == 5) && x >= y) {
+        return -1;
+    }
+#endif
+
+    if(x < y) {
+        ptr = arr;
+    }
+
+    switch (x) {
+        case 5: {
+            val = *(ptr+2); /* DANGER: x >= y */
+            break;
+        }
+        case 7: {
+            val = arr[0] + 5;
+            break;
+        }
+        case 10: {
+            val = *ptr; /* DANGER: x >= y */
+            break;
+        }
+        case 12: {
+            val = arr[2] + 5;
+            break;
+        }
+        default: {
+            val = arr[1];
+            break;
+        }
+    };
+
+    return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_ptr_switch(5, 11);
+    uninit_ptr_switch(10, 11);
+    uninit_ptr_switch(11, 10);
+    uninit_ptr_switch(7, 5);
+#else
+    uninit_ptr_switch(5, 10); /* OK */
+    uninit_ptr_switch(10, 10); /* DANGER */
+    uninit_ptr_switch(11, 10); /* OK */
+    uninit_ptr_switch(7, 5); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/05_simple_goto.c b/bench-moerman2018/general/uninitialized/pointer/05_simple_goto.c
new file mode 100644
index 0000000000000000000000000000000000000000..1aa1aa8b91dd3cad58f1e6c89dc5101950612ce3
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/05_simple_goto.c
@@ -0,0 +1,45 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+void uninit_ptr_goto(int x) {
+    int arr[3] = {1, 2, 3};
+    int* arr_allias = arr;
+    int** ptr = &arr_allias;
+    int* uninit;
+    int val, i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 0) {
+        return;
+    }
+#endif
+
+    val = *(*(ptr) + 1);
+    i = 0;
+
+GOTO_LABEL:
+    if(i <= x) {
+        val += **ptr;
+    } else {
+        printf("%i\n", val);
+    }
+
+    ptr = &uninit;
+
+    if(i == 0) {
+        i++;
+        goto GOTO_LABEL;
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_ptr_goto(0);
+#else
+    uninit_ptr_goto(1);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/06_simple_pass_by_reference.c b/bench-moerman2018/general/uninitialized/pointer/06_simple_pass_by_reference.c
new file mode 100644
index 0000000000000000000000000000000000000000..c66b061b003ba40a6699194158961d28a0f3ba62
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/06_simple_pass_by_reference.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "uninit_ptr.h"
+
+static void local_assign_pointer(int*** dest, int** source1, int** source2, bool condition) {
+    if(condition) {
+        *dest = source1;
+    } else {
+        *dest = source2;
+    }
+}
+
+void uninit_ptr_pass_by_reference(bool a, bool b) {
+    int arr[3] = {1, 2, 3};
+    int* arr_allias = arr;
+    int** ptr;
+    int* uninit;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    local_assign_pointer(&ptr, &arr_allias, &uninit, a);
+
+    if(b) {
+        val = arr[2];
+    } else {
+        val = **ptr; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_ptr_pass_by_reference(true, true);
+    uninit_ptr_pass_by_reference(true, false);
+    uninit_ptr_pass_by_reference(false, true);
+#else
+    uninit_ptr_pass_by_reference(true, true); /* OK */
+    uninit_ptr_pass_by_reference(false, false); /* DANGER */
+    uninit_ptr_pass_by_reference(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/07_cross_file.c b/bench-moerman2018/general/uninitialized/pointer/07_cross_file.c
new file mode 100644
index 0000000000000000000000000000000000000000..323490233cfcd5245b9df350030ba135b7a8628e
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/07_cross_file.c
@@ -0,0 +1,43 @@
+#include "uninit_ptr.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+
+void uninit_ptr_cross_file(bool a, bool b) {
+    int arr[3] = {1, 2, 3};
+    int* arr_allias = arr;
+    int** ptr;
+    int* uninit;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    ptr = (int**)choose_pointer((void*) &arr_allias, (void*) &uninit, a);
+
+    if(b) {
+        val = arr[2];
+    } else {
+        val = **ptr; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_ptr_cross_file(true, true);
+    uninit_ptr_cross_file(true, false);
+    uninit_ptr_cross_file(false, true);
+#else
+    uninit_ptr_cross_file(true, true); /* OK */
+    uninit_ptr_cross_file(false, false); /* DANGER */
+    uninit_ptr_cross_file(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/08_loop_for.c b/bench-moerman2018/general/uninitialized/pointer/08_loop_for.c
new file mode 100644
index 0000000000000000000000000000000000000000..af0d51e78d3e1eb5a92404afc897c76f30b321ab
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/08_loop_for.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+void uninit_ptr_for(int x) {
+    int arr[3] = {1, 2, 3};
+    int* ptr;
+    int val = 0;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    for(i = 0; i < 20; i++) {
+        if(i > x) {
+            val += *ptr; /* DANGER: x < 10 */
+        } else {
+            val += arr[0];
+        }
+        if(i == 10) {
+            ptr = arr;
+            val += *ptr;
+        }
+    }
+
+    printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_ptr_for(10);
+#else
+    uninit_ptr_for(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/09_loop_for_complex.c b/bench-moerman2018/general/uninitialized/pointer/09_loop_for_complex.c
new file mode 100644
index 0000000000000000000000000000000000000000..fa5b22643bde98c49713271975181cfc68dd92ea
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/09_loop_for_complex.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+void uninit_ptr_for_complex(int x) {
+    int arr[3] = {1, 2, 3};
+    int* ptr;
+    int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    for(;;) {
+        if(i > x) {
+            val += *ptr; /* DANGER: x < 10 */
+        } else {
+            val += arr[0];
+        }
+        if(i == 10) {
+            ptr = arr;
+            val += *ptr;
+        }
+        i++;
+        if(i >= 20) {
+            break;
+        }
+    }
+
+    printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_ptr_for_complex(10);
+#else
+    uninit_ptr_for_complex(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/10_loop_while_continue.c b/bench-moerman2018/general/uninitialized/pointer/10_loop_while_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..a0bdfe4d7afc02fc5937a086829f21b3c7698f30
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/10_loop_while_continue.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+void uninit_ptr_while_continue(int x) {
+    int arr[3] = {1, 2, 3};
+    int* ptr;
+    int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    while(i < 30) {
+        if(i > x) {
+            val += *ptr; /* DANGER: x < 10 */
+        } else {
+            val += arr[0];
+        }
+        if(i == 10) {
+            ptr = arr;
+            val += *ptr;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    }
+
+    printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_ptr_while_continue(10);
+#else
+    uninit_ptr_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/11_loop_while_do_continue.c b/bench-moerman2018/general/uninitialized/pointer/11_loop_while_do_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..e4cc07c91274bad98dd18c3ad9a803d5cc24e54b
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/11_loop_while_do_continue.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+void uninit_ptr_do_while_continue(int x) {
+    int arr[3] = {1, 2, 3};
+    int* ptr;
+    int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    do {
+        if(i > x) {
+            val += *ptr; /* DANGER: x < 10 */
+        } else {
+            val += arr[0];
+        }
+        if(i == 10) {
+            ptr = arr;
+            val += *ptr;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    } while(i < 30);
+
+    printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_ptr_do_while_continue(10);
+#else
+    uninit_ptr_do_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/12_loop_for_array_branching.c b/bench-moerman2018/general/uninitialized/pointer/12_loop_for_array_branching.c
new file mode 100644
index 0000000000000000000000000000000000000000..99f8cfaa80b2a8db3a659a4f64a201baef57b18b
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/12_loop_for_array_branching.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+void uninit_ptr_for_array(int x) {
+    int p[20];
+    int* arr_allias = p;
+    int** ptr = &arr_allias;
+    int* uninit;
+    int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 19) {
+        return;
+    }
+#endif
+
+    for(i = 0; i < 20; i++) {
+        p[i] = 0;
+    }
+    p[x] = 1;
+
+    for(i = 0; i < 20; i++) {
+        if(p[i] == 1) {
+            ptr = &uninit;
+        } else {
+            val = **ptr; /* DANGER: x < 19 */
+        }
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_ptr_for_array(19);
+#else
+    uninit_ptr_for_array(10);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/general/uninitialized/pointer/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 0000000000000000000000000000000000000000..69c685479324234c42b9ee2d505820d72b9970a7
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,42 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+void uninit_ptr_for_pointer(int x) {
+    int* pointers[10];
+    int** ptr;
+    int source[10];
+    int val = 0, i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 10) {
+        return;
+    }
+#endif
+
+    for(i = 0, ptr = pointers; i < x; i++, ptr++) {
+        *(ptr) = source + i;
+    }
+
+    for(i = 0, ptr = pointers; i <= 9; i++, ptr++) {
+        **(ptr) = i;
+    }
+
+    for(i = 0, ptr = pointers; i <= 9; i++, ptr++) {
+        val += **(ptr);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_ptr_for_pointer(10);
+#else
+    uninit_ptr_for_pointer(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/14_loop_recursion.c b/bench-moerman2018/general/uninitialized/pointer/14_loop_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..d53a9b811ba117703a7a447792e91e6aad31fea2
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/14_loop_recursion.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+int uninit_ptr_rec(int x, int i, int** ptr1, int** ptr2) {
+    int** ptr;
+    int* uninit;
+
+    if(i <= 1 || !ptr1) {
+        return 0;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(!ptr2 && ((i < 10 && x > 2) || (i >= 10 && x > 10))) {
+         return uninit_ptr_rec(x, i-1, ptr1, ptr1);
+    }
+#endif
+    if(!ptr2) {
+        ptr2 = &uninit;
+    }
+
+    if(i < x) {
+        ptr = ptr2;
+    } else {
+        ptr = ptr1;
+    }
+    if(i == 10) {
+        return **ptr + uninit_ptr_rec(x, i-1, ptr1, ptr1);
+    }
+    return **ptr + uninit_ptr_rec(x, i-1, ptr1, ptr2);
+}
+
+#ifndef NO_MAIN
+int main() {
+    int arr[3] = {1, 2, 3};
+    int* arr_allias = arr;
+    int* uninit;
+#ifdef NO_BUG
+    int* arr_allias2 = arr+1;
+    printf("%i\n", uninit_ptr_rec(10, 20, &arr_allias, &uninit));
+    printf("%i\n", uninit_ptr_rec(11, 20, &arr_allias, &arr_allias2));
+#else
+    printf("%i\n", uninit_ptr_rec(11, 20, &arr_allias, &uninit));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/15_loop_recursion_multi.c b/bench-moerman2018/general/uninitialized/pointer/15_loop_recursion_multi.c
new file mode 100644
index 0000000000000000000000000000000000000000..0da4052025d2dc25cd55ff81d51a745defd0d815
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/15_loop_recursion_multi.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+int uninit_ptr_rec_decr(int x, int i, int** ptr1, int** ptr2) {
+    if(i <= 1) {
+        return 0;
+    }
+
+    return uninit_ptr_rec_multi(x, i-1, ptr1, ptr2);
+}
+
+int uninit_ptr_rec_multi(int x, int i, int** ptr1, int** ptr2) {
+    int** ptr;
+    int* uninit;
+
+    if(!ptr1) {
+        return -1;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(!ptr2 && ((i < 10 && x > 2) || (i >= 10 && x > 10))) {
+         return uninit_ptr_rec_decr(x, i, ptr1, ptr1);
+    }
+#endif
+    if(!ptr2) {
+        ptr2 = &uninit;
+    }
+
+    if(i < x) {
+        ptr = ptr2;
+    } else {
+        ptr = ptr1;
+    }
+    if(i == 10) {
+        ptr2 = ptr1;
+    }
+
+    return **ptr + uninit_ptr_rec_decr(x, i, ptr1, ptr2);
+}
+
+
+
+#ifndef NO_MAIN
+int main() {
+    int arr[3] = {1, 2, 3};
+    int* arr_allias = arr;
+    int* uninit;
+#ifdef NO_BUG
+    printf("%i", uninit_ptr_rec_multi(10, 20, &arr_allias, &uninit));
+#else
+    printf("%i", uninit_ptr_rec_multi(11, 20, &arr_allias, &uninit));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/16_misc_pseudo_recursion.c b/bench-moerman2018/general/uninitialized/pointer/16_misc_pseudo_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..702d4bdd3a21873aa48fea0c75b5408536e39cfd
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/16_misc_pseudo_recursion.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include "uninit_ptr.h"
+
+int uninit_ptr_pseudo_rec1(int x, int y, int i, int** ptr1, int** ptr2) {
+    int* uninit;
+#ifdef CATCH_BAD_PARAM
+    if(!ptr2 && x <= 10 && x >= y) {
+        return 0;
+    }
+#endif
+    if(!ptr2) {
+        ptr2 = &uninit;
+    }
+
+    if(i > 0) {
+        return 37;
+    }
+
+    if(x < y) {
+        ptr2 = ptr1;
+    }
+
+    return uninit_ptr_pseudo_rec2(x, y, 1, ptr1, ptr2);
+}
+
+int uninit_ptr_pseudo_rec2(int x, int y, int i, int** ptr1, int** ptr2) {
+    int** ptr;
+
+    if(i > 0) {
+        return **ptr1 + uninit_ptr_pseudo_rec1(x, y, 1, ptr1, ptr2);
+    }
+
+    if(x > 10) {
+        ptr = ptr1;
+    } else {
+        ptr = ptr2;
+    }
+
+    return **ptr;
+}
+
+#ifndef NO_MAIN
+int main() {
+    int arr[3] = {1, 2, 3};
+    int* arr_allias = arr;
+    int* uninit;
+#ifdef NO_BUG
+    int* arr_allias2 = arr+1;
+    printf("%i\n", uninit_ptr_pseudo_rec1(9, 10, 0, &arr_allias, &uninit));
+    printf("%i\n", uninit_ptr_pseudo_rec1(10, 10, 0, &arr_allias, &arr_allias2));
+    printf("%i\n", uninit_ptr_pseudo_rec1(11, 10, 0, &arr_allias, &uninit));
+#else
+    printf("%i\n", uninit_ptr_pseudo_rec1(10, 10, 0, &arr_allias, &uninit));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/17_complex_function_pointers.c b/bench-moerman2018/general/uninitialized/pointer/17_complex_function_pointers.c
new file mode 100644
index 0000000000000000000000000000000000000000..40b04805a14630a767eb36d09f3fe702601eee41
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/17_complex_function_pointers.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "uninit_ptr.h"
+
+static void local_assign_pointer(int*** dest, int** source1, int** source2, bool condition) {
+    if(condition) {
+        *dest = source1;
+    } else {
+        *dest = source2;
+    }
+}
+
+void uninit_ptr_function_pointer(bool a, bool b, void (*f)(int***, int**, int**, bool)) {
+    int arr[3] = {1, 2, 3};
+    int* arr_allias = arr;
+    int* uninit;
+    int** ptr;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!f || (!a & !b)) {
+        return;
+    }
+#endif
+
+    (*f)(&ptr, &arr_allias, &uninit, a);
+
+    if(b) {
+        val = arr[2];
+    } else {
+        val = **ptr; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_ptr_function_pointer(true, true, &local_assign_pointer);
+    uninit_ptr_function_pointer(true, false, &local_assign_pointer);
+    uninit_ptr_function_pointer(false, true, &local_assign_pointer);
+#else
+    uninit_ptr_function_pointer(true, true, &local_assign_pointer); /* OK */
+    uninit_ptr_function_pointer(false, false, &local_assign_pointer); /* DANGER */
+    uninit_ptr_function_pointer(false, true, &local_assign_pointer); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/18_complex_struct_multiple_methods.c b/bench-moerman2018/general/uninitialized/pointer/18_complex_struct_multiple_methods.c
new file mode 100644
index 0000000000000000000000000000000000000000..e87a941ef3aa7985f800aee0709be812a3333545
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/18_complex_struct_multiple_methods.c
@@ -0,0 +1,92 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninit_ptr.h"
+
+#ifndef s_UNINITIALIZED_P_REFCOUNT
+#define s_UNINITIALIZED_P_REFCOUNT
+void init_uninit_ref_cont(URefCont* cont) {
+    cont->refc = 1;
+    cont->data_ptr = &(cont->data);
+}
+
+URefCont* uninit_ref_cont_new() {
+    URefCont* new_cont;
+
+    new_cont = malloc(sizeof(URefCont));
+
+    if(new_cont) {
+        init_uninit_ref_cont(new_cont);
+    }
+    return new_cont;
+}
+
+void uninit_ref(URefCont* cont) {
+    if(cont) {
+        cont->refc++;
+    }
+}
+void uninit_unref(URefCont* cont) {
+    if(cont->refc <= 1) {
+        cont->data_ptr = &(cont->uninit);
+    } else {
+        cont->refc--;
+    }
+}
+
+void* uninit_ref_cont_get_pointer(URefCont* cont) {
+    return *(cont->data_ptr);
+}
+void uninit_ref_cont_set_pointer(URefCont* cont, void* p) {
+    cont->data = p;
+}
+#endif //s_UNINITIALIZED_P_REFCOUNT
+
+void uninit_ptr_struct(int x, int y) {
+    URefCont cont;
+    int* data;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    init_uninit_ref_cont(&cont);
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    *data = 37;
+
+    if(x < y) {
+        uninit_ref_cont_set_pointer(&cont, data);
+    }
+
+    if(x > 10) {
+        val = *data;
+    } else {
+        /* DANGER: if x <= 10 & x >= y */
+        val = *((int*) uninit_ref_cont_get_pointer(&cont));
+    }
+
+    printf("x=%i: %i", x, val);
+    free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_ptr_struct(9, 10);
+    uninit_ptr_struct(10, 11);
+    uninit_ptr_struct(11, 10);
+#else
+    uninit_ptr_struct(10, 10); /* DANGER */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/19_complex_refcount.c b/bench-moerman2018/general/uninitialized/pointer/19_complex_refcount.c
new file mode 100644
index 0000000000000000000000000000000000000000..512945af82bef0cc4e402149ad08d7204a54002a
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/19_complex_refcount.c
@@ -0,0 +1,72 @@
+#include "uninit_ptr.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_UNINITIALIZED_P_REFCOUNT
+#define s_UNINITIALIZED_P_REFCOUNT
+void init_uninit_ref_cont(URefCont* cont) {
+    cont->refc = 1;
+    cont->data_ptr = &(cont->data);
+}
+
+URefCont* uninit_ref_cont_new() {
+    URefCont* new_cont;
+
+    new_cont = malloc(sizeof(URefCont));
+
+    if(new_cont) {
+        init_uninit_ref_cont(new_cont);
+    }
+    return new_cont;
+}
+
+void uninit_ref(URefCont* cont) {
+    if(cont) {
+        cont->refc++;
+    }
+}
+void uninit_unref(URefCont* cont) {
+    if(cont->refc <= 1) {
+        cont->data_ptr = &(cont->uninit);
+    } else {
+        cont->refc--;
+    }
+}
+
+void* uninit_ref_cont_get_pointer(URefCont* cont) {
+    return *(cont->data_ptr);
+}
+void uninit_ref_cont_set_pointer(URefCont* cont, void* p) {
+    cont->data = p;
+}
+#endif //s_UNINITIALIZED_P_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+    URefCont* cont;
+    int arr[3] = {1, 2, 3};
+    int val;
+
+    cont = uninit_ref_cont_new();
+    if(!cont) {
+        return 1;
+    }
+    uninit_ref_cont_set_pointer(cont, arr);
+
+    uninit_ref(cont);
+    uninit_ref(cont);
+    uninit_unref(cont);
+    uninit_unref(cont);
+#ifndef NO_BUG
+    uninit_unref(cont);
+#endif
+
+    val = *((int*) uninit_ref_cont_get_pointer(cont));
+
+    printf("%i\n", val);
+
+    free(cont);
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/pointer/uninit_ptr.h b/bench-moerman2018/general/uninitialized/pointer/uninit_ptr.h
new file mode 100644
index 0000000000000000000000000000000000000000..dea78620f589b936b446e07f4479eaf644b4b6b1
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/pointer/uninit_ptr.h
@@ -0,0 +1,39 @@
+#include <stdbool.h>
+
+typedef struct _UninitRefCont URefCont;
+
+struct _UninitRefCont {
+    void** data_ptr;
+    void* data;
+    void* uninit;
+    unsigned int refc;
+};
+
+void init_uninit_ref_cont(URefCont* cont);
+URefCont* uninit_ref_cont_new();
+void uninit_ref(URefCont* cont);
+void uninit_unref(URefCont* cont);
+void* uninit_ref_cont_get_pointer(URefCont* cont);
+void uninit_ref_cont_set_pointer(URefCont* cont, void* p);
+
+void uninit_ptr_for(int x);
+void uninit_ptr_for_complex(int x);
+void uninit_ptr_while_continue(int x);
+void uninit_ptr_do_while_continue(int x);
+void uninit_ptr_for_array(int x);
+void uninit_ptr_for_pointer(int x);
+void uninit_ptr_goto(int x);
+void uninit_ptr_if_else(bool a, bool b);
+void uninit_ptr_if_else_multi(bool a, bool b);
+void uninit_ptr_if_else_int1(int x, int y);
+void uninit_ptr_if_else_int2(int x, int y);
+void uninit_ptr_pass_by_reference(bool a, bool b);
+int uninit_ptr_switch(int x, int y);
+int uninit_ptr_rec_multi(int x, int i, int** ptr1, int** ptr2);
+int uninit_ptr_rec(int x, int i, int** ptr1, int** ptr2);
+int uninit_ptr_rec_assign(int x, int i, int* ptr1, int* ptr2);
+int uninit_ptr_pseudo_rec1(int x, int y, int i, int** ptr1, int** ptr2);
+int uninit_ptr_pseudo_rec2(int x, int y, int i, int** ptr1, int** ptr2);
+void uninit_ptr_struct(int x, int y);
+void uninit_ptr_function_pointer(bool a, bool b, void (*f)(int***, int**, int**, bool));
+void uninit_ptr_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/general/uninitialized/value/01_simple_if.c b/bench-moerman2018/general/uninitialized/value/01_simple_if.c
new file mode 100644
index 0000000000000000000000000000000000000000..81784b0e66785c03b64e417535e5fb842d3dba3a
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/01_simple_if.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "uninitialized_value.h"
+
+void uninit_val_if_else(bool a, bool b) {
+    int possibly_uninit;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    if(a) {
+        possibly_uninit = 1;
+    }
+
+    if(b) {
+        val = 37 * 2;
+    } else {
+        val = 11 * possibly_uninit; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_val_if_else(true, true);
+    uninit_val_if_else(true, false);
+    uninit_val_if_else(false, true);
+#else
+    uninit_val_if_else(true, true); /* OK */
+    uninit_val_if_else(false, false); /* DANGER */
+    uninit_val_if_else(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/02_simple_if_int1.c b/bench-moerman2018/general/uninitialized/value/02_simple_if_int1.c
new file mode 100644
index 0000000000000000000000000000000000000000..dd8fa61444dca349bc9763aac1102ba056d50ad0
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/02_simple_if_int1.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+void uninit_val_if_else_int1(int x, int y) {
+    int possibly_uninit;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    if(x < y) {
+        possibly_uninit = 1;
+    }
+
+    if(x > 10) {
+        val = 37 * 2;
+    } else {
+        val = 11 * possibly_uninit; /* DANGER, if x <= 10 & x >= y */
+    }
+
+    printf("x=%i: %i", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_val_if_else_int1(9, 10);
+    uninit_val_if_else_int1(10, 11);
+    uninit_val_if_else_int1(11, 10);
+#else
+    uninit_val_if_else_int1(9, 10); /* OK */
+    uninit_val_if_else_int1(10, 10); /* DANGER */
+    uninit_val_if_else_int1(11, 10); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/02_simple_if_int2.c b/bench-moerman2018/general/uninitialized/value/02_simple_if_int2.c
new file mode 100644
index 0000000000000000000000000000000000000000..65e1e779bcc36ef9ea37d3d84c308f51150a5127
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/02_simple_if_int2.c
@@ -0,0 +1,46 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+void uninit_val_if_else_int2(int x, int y) {
+    int possibly_uninit;
+    int val, m, n;
+
+    m = -1;
+    n = 5;
+
+    x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    if(x < y) {
+        possibly_uninit = 1;
+    }
+
+    if(x > 10) {
+        val = 37 * 2;
+    } else {
+        val = 11 * possibly_uninit; /* DANGER, if x <= 10 & x >= y */
+    }
+
+    printf("x=%i: %i", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_val_if_else_int2(-4, 11);
+    uninit_val_if_else_int2(-5, 11);
+    uninit_val_if_else_int2(-6, 11);
+#else
+    uninit_val_if_else_int2(-4, 10); /* OK */
+    uninit_val_if_else_int2(-5, 10); /* DANGER */
+    uninit_val_if_else_int2(-6, 10); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/03_simple_if_multi_func.c b/bench-moerman2018/general/uninitialized/value/03_simple_if_multi_func.c
new file mode 100644
index 0000000000000000000000000000000000000000..feae3f210da2611f2b757d9a6c7e0bcc8b3db78f
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/03_simple_if_multi_func.c
@@ -0,0 +1,52 @@
+#include "uninitialized_value.h"
+#include <stdbool.h>
+#include <stdio.h>
+
+static int* choose_int_ptr(int* ptr1, int* ptr2, bool condition) {
+    if(condition) {
+        return ptr1;
+    } else {
+        return ptr2;
+    }
+}
+
+static int conditional_assign(int* ptr1, int* ptr2, bool condition) {
+    if(condition) {
+        return *ptr1;
+    }
+    return *ptr2;
+}
+
+void uninit_val_if_else_multi(bool a, bool b) {
+    int temp_val = 5;
+    int uninit_value;
+    int* temp_ptr;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    temp_ptr = choose_int_ptr(&temp_val, &uninit_value, a);
+
+    val = conditional_assign(&temp_val, temp_ptr, b); /* DANGER, if !a & !b */
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_val_if_else_multi(true, true);
+    uninit_val_if_else_multi(true, false);
+    uninit_val_if_else_multi(false, true);
+#else
+    uninit_val_if_else_multi(true, true); /* OK */
+    uninit_val_if_else_multi(false, false); /* DANGER */
+    uninit_val_if_else_multi(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/04_simple_switch.c b/bench-moerman2018/general/uninitialized/value/04_simple_switch.c
new file mode 100644
index 0000000000000000000000000000000000000000..788117b907cf928d840540996aa7f727b733302d
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/04_simple_switch.c
@@ -0,0 +1,59 @@
+#include "uninitialized_value.h"
+
+int uninit_val_switch(int x, int y) {
+    int possibly_uninit;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if((x == 10 || x == 5) && x >= y) {
+        return -1;
+    }
+#endif
+
+    if(x < y) {
+        possibly_uninit = 1;
+    }
+
+    switch (x) {
+        case 5: {
+            val = 37 * possibly_uninit; /* DANGER: x >= y */
+            break;
+        }
+        case 7: {
+            val = -37 * 2;
+            break;
+        }
+        case 10: {
+            val = 73 * possibly_uninit; /* DANGER: x >= y */
+            break;
+        }
+        case 12: {
+            val = 73 * 5;
+            break;
+        }
+        default: {
+            val = 100 * 8;
+            break;
+        }
+    };
+
+    return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_val_switch(5, 11);
+    uninit_val_switch(10, 11);
+    uninit_val_switch(11, 11);
+    uninit_val_switch(7, 5);
+#else
+    uninit_val_switch(5, 10); /* OK */
+    uninit_val_switch(10, 10); /* DANGER */
+    uninit_val_switch(11, 10); /* OK */
+    uninit_val_switch(7, 5); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/05_simple_goto.c b/bench-moerman2018/general/uninitialized/value/05_simple_goto.c
new file mode 100644
index 0000000000000000000000000000000000000000..a826c5b9796d69d9e87263cacc39b92c6864481a
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/05_simple_goto.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+void uninit_val_goto(int x) {
+    int val, i;
+    int possibly_uninit = 1;
+    int uninit_value;
+    int* val_ptr = &possibly_uninit;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 0) {
+        return;
+    }
+#endif
+
+    val = 37 * *val_ptr;
+    i = 0;
+
+GOTO_LABEL:
+    if(i <= x) {
+        val += *val_ptr;
+    } else {
+        printf("%i\n", val);
+    }
+
+    val_ptr = &uninit_value;
+
+    if(i == 0) {
+        i++;
+        goto GOTO_LABEL;
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_val_goto(0);
+#else
+    uninit_val_goto(1);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/06_simple_pass_by_reference.c b/bench-moerman2018/general/uninitialized/value/06_simple_pass_by_reference.c
new file mode 100644
index 0000000000000000000000000000000000000000..a214848bfd1cbc314dad0d9a82115382c69ea54c
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/06_simple_pass_by_reference.c
@@ -0,0 +1,52 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "uninitialized_value.h"
+
+static void assign_int_ptr(int** dest, int* ptr1, int* ptr2, bool condition) {
+    if(condition) {
+        *dest = ptr1;
+    } else {
+        *dest = ptr2;
+    }
+}
+
+void uninit_val_pass_by_reference(bool a, bool b) {
+    int* possibly_uninit;
+    int uninit_value;
+    int init_value = 5;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    /* To be used if NO_BUG is defined */
+    /* and tool warns about possible dangerous input */
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    assign_int_ptr(&possibly_uninit, &init_value, &uninit_value, a);
+
+    if(b) {
+        val = 25 * 4;
+    } else {
+        val = 91 * (*possibly_uninit); /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_val_pass_by_reference(true, true);
+    uninit_val_pass_by_reference(true, false);
+    uninit_val_pass_by_reference(false, true);
+#else
+    uninit_val_pass_by_reference(true, true); /* OK */
+    uninit_val_pass_by_reference(false, false); /* DANGER */
+    uninit_val_pass_by_reference(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/07_simple_cross_file.c b/bench-moerman2018/general/uninitialized/value/07_simple_cross_file.c
new file mode 100644
index 0000000000000000000000000000000000000000..1c9ae9b104b1570a3ef611e01d9280c6c61c1cd6
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/07_simple_cross_file.c
@@ -0,0 +1,42 @@
+#include "uninitialized_value.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+
+void uninit_val_cross_file(bool a, bool b) {
+    int* possibly_uninit;
+    int init_value = 5;
+    int uninit_value;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    possibly_uninit = (int*) choose_pointer((void*) &init_value, (void*) &uninit_value, a);
+
+    if(b) {
+        val = 10 * 2;
+    } else {
+        val = 10 * (*possibly_uninit); /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_val_cross_file(true, true);
+    uninit_val_cross_file(true, false);
+    uninit_val_cross_file(false, true);
+#else
+    uninit_val_cross_file(true, true); /* OK */
+    uninit_val_cross_file(false, false); /* DANGER */
+    uninit_val_cross_file(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/08_loop_for.c b/bench-moerman2018/general/uninitialized/value/08_loop_for.c
new file mode 100644
index 0000000000000000000000000000000000000000..3ce24b0deee0cd881c226d84a69d78f866f0f5b7
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/08_loop_for.c
@@ -0,0 +1,40 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+void uninit_val_for(int x) {
+    int possibly_uninit;
+    int val = 0;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    for(i = 0; i < 20; i++) {
+        if(i > x) {
+            val += 10 * (possibly_uninit - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            possibly_uninit = 4;
+            val += 10 * possibly_uninit;
+        }
+    }
+
+    printf("val = %i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_val_for(10);
+#else
+    uninit_val_for(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/09_loop_for_complex.c b/bench-moerman2018/general/uninitialized/value/09_loop_for_complex.c
new file mode 100644
index 0000000000000000000000000000000000000000..2dec8dfdb76b51f84fc2b7d0270babe8b158ec0d
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/09_loop_for_complex.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+void uninit_val_for_complex(int x) {
+    int possibly_uninit;
+    int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    for(;;) {
+        if(i > x) {
+            val += 10 * (possibly_uninit - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            possibly_uninit = 4;
+            val += 10 * possibly_uninit;
+        }
+        i++;
+        if(i >= 20) {
+            break;
+        }
+    }
+
+    printf("val = %i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_val_for_complex(10);
+#else
+    uninit_val_for_complex(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/10_loop_while_continue.c b/bench-moerman2018/general/uninitialized/value/10_loop_while_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..5895515566afc7394c71e03011e1ce2d2b9cc2bc
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/10_loop_while_continue.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+void uninit_val_while_continue(int x) {
+    int possibly_uninit;
+    int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    while(i < 30) {
+        if(i > x) {
+            val += 10 * (possibly_uninit - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            possibly_uninit = 4;
+            val += 10 * possibly_uninit;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    }
+
+    printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_val_while_continue(10);
+#else
+    uninit_val_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/11_loop_while_do_continue.c b/bench-moerman2018/general/uninitialized/value/11_loop_while_do_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..c00ae8627e9993b9c4e866816f9027a0be9f3ec1
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/11_loop_while_do_continue.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+void uninit_val_do_while_continue(int x) {
+    int possibly_uninit;
+    int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    do {
+        if(i > x) {
+            val += 10 * (possibly_uninit - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            possibly_uninit = 4;
+            val += 10 * possibly_uninit;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    } while(i < 30);
+
+    printf("val = %i", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_val_do_while_continue(10);
+#else
+    uninit_val_do_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/12_loop_for_array_branching.c b/bench-moerman2018/general/uninitialized/value/12_loop_for_array_branching.c
new file mode 100644
index 0000000000000000000000000000000000000000..f3ac7fb5c37b58a0f4c661d6b754b679dfe2b637
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/12_loop_for_array_branching.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+void uninit_val_for_array(int x) {
+    int uninit_value;
+    int init_value = 35;
+    int* possibly_uninit = &init_value;
+    int p[20];
+    int val = 0, i = 0;
+
+    if(x < 0 || x > 19) {
+        return;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 19) {
+        return;
+    }
+#endif
+
+    for(i = 0; i < 20; i++) {
+        p[i] = 0;
+    }
+    p[x] = 1;
+
+    for(i = 0; i < 20; i++) {
+        if(p[i] == 1) {
+            possibly_uninit = &uninit_value;
+        } else {
+            val += *possibly_uninit; /* DANGER: x < 19 */
+        }
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_val_for_array(19);
+#else
+    uninit_val_for_array(10);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/general/uninitialized/value/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 0000000000000000000000000000000000000000..87fb431ffa0c22804821593b1d3d437ac5427cf5
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,51 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+static void initialize_to_zero(int arr[], int length) {
+    int i;
+
+    for(i = 0; i < length; i++) {
+        arr[i] = 0;
+    }
+}
+
+void uninit_val_for_pointer(int x) {
+    int possibly_uninits[10];
+    int* ptr;
+    int val = 0, i;
+
+    if(x < 0 || x > 10) {
+        return;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 10) {
+        return;
+    }
+#endif
+
+    ptr = possibly_uninits;
+    for(i = 0; i < x; i++, ptr++) {
+        *ptr = i + 1;
+    }
+
+    ptr = possibly_uninits;
+    for(i = 0; i <= 9; i++, ptr++) {
+        val += *ptr;
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_val_for_pointer(10);
+#else
+    uninit_val_for_pointer(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/14_loop_recursion.c b/bench-moerman2018/general/uninitialized/value/14_loop_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..10946d456415c215ebd9bb319b9396b5328ac750
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/14_loop_recursion.c
@@ -0,0 +1,45 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+int uninit_val_rec(int x, int i, int* ptr1, int* ptr2) {
+    int* possibly_uninit;
+    int uninit_val;
+
+    if(i <= 1 || !ptr1) {
+        return 0;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(!ptr2 && ((i < 10 && x > 2) || (i >= 10 && x > 10))) {
+         return 0;
+    }
+#endif
+    if(!ptr2) {
+        ptr2 = &uninit_val;
+    }
+
+    if(i < x) {
+        possibly_uninit = ptr2;
+    } else {
+        possibly_uninit = ptr1;
+    }
+    if(i == 10) {
+        *ptr2 = *ptr1;
+    }
+    return 3 * *possibly_uninit + uninit_val_rec(x, i, ptr1, ptr2);
+}
+
+#ifndef NO_MAIN
+int main() {
+    int init_val = 6;
+    int uninit_val;
+#ifdef NO_BUG
+    printf("%i\n", uninit_val_rec(10, 20, &init_val, &uninit_val));
+    printf("%i\n", uninit_val_rec(11, 20, &init_val, &init_val));
+#else
+    printf("%i\n", uninit_val_rec(11, 20, &init_val, &uninit_val));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/15_loop_recursion_multi.c b/bench-moerman2018/general/uninitialized/value/15_loop_recursion_multi.c
new file mode 100644
index 0000000000000000000000000000000000000000..ec211a69d413c732dcdd5f9a6414d8fbadadf30c
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/15_loop_recursion_multi.c
@@ -0,0 +1,52 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+int uninit_val_rec_decr(int x, int i, int* ptr1, int* ptr2) {
+    if(i <= 1) {
+        return 0;
+    }
+
+    return uninit_val_rec_multi(x, i-1, ptr1, ptr2);
+}
+
+int uninit_val_rec_multi(int x, int i, int* ptr1, int* ptr2) {
+    int* possibly_uninit;
+    int uninit_val;
+
+    if(i <= 1 || !ptr1) {
+        return 0;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(!ptr2 && ((i < 10 && x > 2) || (i >= 10 && x > 10))) {
+         return 0;
+    }
+#endif
+    if(!ptr2) {
+        ptr2 = &uninit_val;
+    }
+
+    if(i < x) {
+        possibly_uninit = ptr2;
+    } else {
+        possibly_uninit = ptr1;
+    }
+    if(i == 10) {
+        *ptr2 = *ptr1;
+    }
+    return 3 * *possibly_uninit + uninit_val_rec_decr(x, i, ptr1, ptr2);
+}
+
+#ifndef NO_MAIN
+int main() {
+    int init_val = 6;
+    int uninit_val;
+#ifdef NO_BUG
+    printf("%i", uninit_val_rec_multi(10, 20, &init_val, &uninit_val));
+#else
+    printf("%i", uninit_val_rec_multi(11, 20, &init_val, &uninit_val));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/16_misc_pseudo_recursion.c b/bench-moerman2018/general/uninitialized/value/16_misc_pseudo_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..ea0e752a4777d42620e618a7e2efb573a1687be0
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/16_misc_pseudo_recursion.c
@@ -0,0 +1,64 @@
+#include <stdio.h>
+#include "uninitialized_value.h"
+
+int uninit_val_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2) {
+    int uninit_val;
+    int val;
+
+    if(!ptr1) {
+        return 0;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(!ptr2 && x <= 10 && x >= y) {
+        return 0;
+    }
+#endif
+    if(!ptr2) {
+        ptr2 = &uninit_val;
+    }
+
+    if(i > 0) {
+        return 37;
+    }
+
+    if(x < y) {
+        *ptr2 = *ptr1;
+    }
+
+    val = uninit_val_pseudo_rec2(x, y, 1, ptr1, ptr2);
+    ptr2 = 0;
+    return 1 + val;
+}
+
+int uninit_val_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2) {
+    int* possibly_uninit;
+
+    if(i <= 0) {
+        return 3 * *ptr1 + uninit_val_pseudo_rec1(x, y, 1, ptr1, ptr2);
+    }
+
+    if(x > 10) {
+        possibly_uninit = ptr1;
+    } else {
+        possibly_uninit = ptr2;
+    }
+
+    return 3 * *possibly_uninit;
+}
+
+#ifndef NO_MAIN
+int main() {
+    int init_val = 6;
+    int uninit_val;
+#ifdef NO_BUG
+    printf("%i\n", uninit_val_pseudo_rec1(9, 10, 0, &init_val, &uninit_val));
+    printf("%i\n", uninit_val_pseudo_rec1(10, 10, 0, &init_val, &init_val));
+    printf("%i\n", uninit_val_pseudo_rec1(11, 10, 0, &init_val, &uninit_val));
+#else
+    printf("%i\n", uninit_val_pseudo_rec1(10, 10, 0, &init_val, &uninit_val));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/17_complex_function_pointers.c b/bench-moerman2018/general/uninitialized/value/17_complex_function_pointers.c
new file mode 100644
index 0000000000000000000000000000000000000000..be31afa2257035ac34c35b63cdb14ecccb365376
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/17_complex_function_pointers.c
@@ -0,0 +1,52 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include "uninitialized_value.h"
+
+static void assign_int_ptr(int** dest, int* ptr1, int* ptr2, bool condition) {
+    if(condition) {
+        *dest = ptr1;
+    } else {
+        *dest = ptr2;
+    }
+}
+
+void uninit_val_function_pointer(bool a, bool b, void (*f)(int**, int*, int*, bool)) {
+    int* possibly_uninit;
+    int uninit_val;
+    int init_val = 7;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    /* To be used if NO_BUG is defined */
+    /* and tool warns about possible dangerous input */
+    if(!f || (!a & !b)) {
+        return;
+    }
+#endif
+
+    (*f)(&possibly_uninit, &init_val, &uninit_val, a);
+
+    if(b) {
+        val = 25 * 4;
+    } else {
+        val = 91 * (*possibly_uninit); /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_val_function_pointer(true, true, &assign_int_ptr);
+    uninit_val_function_pointer(true, false, &assign_int_ptr);
+    uninit_val_function_pointer(false, true, &assign_int_ptr);
+#else
+    uninit_val_function_pointer(true, true, &assign_int_ptr); /* OK */
+    uninit_val_function_pointer(false, false, &assign_int_ptr); /* DANGER */
+    uninit_val_function_pointer(false, true, &assign_int_ptr); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/18_complex_struct_multiple_methods.c b/bench-moerman2018/general/uninitialized/value/18_complex_struct_multiple_methods.c
new file mode 100644
index 0000000000000000000000000000000000000000..dbe9be46639c85a21a10148eebbe1e5adbbec2b5
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/18_complex_struct_multiple_methods.c
@@ -0,0 +1,82 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_value.h"
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_val_cont_init(DivideCont* cont) {
+    cont->counter = 1;
+    cont->possibly_uninit = &(cont->init_val);
+}
+
+DivideCont* uninit_val_cont_new() {
+    DivideCont* new_cont;
+
+    new_cont = malloc(sizeof(DivideCont));
+
+    if(new_cont) {
+        uninit_val_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void uninit_val_cont_incr(DivideCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void uninit_val_cont_decr(DivideCont* cont) {
+    if(cont->counter <= 1) {
+        cont->possibly_uninit = &(cont->uninit_val);
+    } else {
+        cont->counter--;
+    }
+}
+
+int uninit_val_cont_get_value(DivideCont* cont) {
+    return *(cont->possibly_uninit);
+}
+void uninit_val_cont_set_value(DivideCont* cont, int value) {
+    cont->init_val = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
+void uninit_val_struct(int x, int y) {
+    DivideCont cont;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    uninit_val_cont_init(&cont);
+
+    if(x < y) {
+        uninit_val_cont_set_value(&cont, 7);
+    }
+
+    if(x > 10) {
+        val = 50 * 37;
+    } else {
+        /* DANGER: if x <= 10 & x >= y */
+        val = 30 * uninit_val_cont_get_value(&cont);
+    }
+
+    printf("x=%i: %i\n", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_val_struct(9, 10);
+    uninit_val_struct(10, 11);
+    uninit_val_struct(11, 10);
+#else
+    uninit_val_struct(10, 10); /* DANGER */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/19_complex_refcount.c b/bench-moerman2018/general/uninitialized/value/19_complex_refcount.c
new file mode 100644
index 0000000000000000000000000000000000000000..c3cd05278693bf75fbf75c54f0b9570c38fc4e43
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/19_complex_refcount.c
@@ -0,0 +1,71 @@
+#include "uninitialized_value.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_UNINITIALIZED_P_REFCOUNT
+#define s_UNINITIALIZED_P_REFCOUNT
+void uninit_val_cont_init(DivideCont* cont) {
+    cont->counter = 1;
+    cont->possibly_uninit = &(cont->init_val);
+}
+
+DivideCont* uninit_val_cont_new() {
+    DivideCont* new_cont;
+
+    new_cont = malloc(sizeof(DivideCont));
+
+    if(new_cont) {
+        uninit_val_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void uninit_val_cont_incr(DivideCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void uninit_val_cont_decr(DivideCont* cont) {
+    if(cont->counter <= 1) {
+        cont->possibly_uninit = &(cont->uninit_val);
+    } else {
+        cont->counter--;
+    }
+}
+
+int uninit_val_cont_get_value(DivideCont* cont) {
+    return *(cont->possibly_uninit);
+}
+void uninit_val_cont_set_value(DivideCont* cont, int value) {
+    cont->init_val = value;
+}
+#endif //s_UNINITIALIZED_P_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+    DivideCont* cont;
+    int val;
+
+    cont = uninit_val_cont_new();
+    if(!cont) {
+        return 1;
+    }
+    uninit_val_cont_set_value(cont, 35);
+
+    uninit_val_cont_incr(cont);
+    uninit_val_cont_incr(cont);
+    uninit_val_cont_decr(cont);
+    uninit_val_cont_decr(cont);
+#ifndef NO_BUG
+    uninit_val_cont_decr(cont);
+#endif
+
+    val = 30 * uninit_val_cont_get_value(cont);
+
+    printf("%i\n", val);
+
+    free(cont);
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/general/uninitialized/value/uninitialized_value.h b/bench-moerman2018/general/uninitialized/value/uninitialized_value.h
new file mode 100644
index 0000000000000000000000000000000000000000..7b7dfbcd78299a72e9ceefe91c11ef1713c3d220
--- /dev/null
+++ b/bench-moerman2018/general/uninitialized/value/uninitialized_value.h
@@ -0,0 +1,38 @@
+#include <stdbool.h>
+
+typedef struct _DivideCont DivideCont;
+
+struct _DivideCont {
+    int* possibly_uninit;
+    int uninit_val;
+    int init_val;
+    unsigned int counter;
+};
+
+void uninit_val_cont_init(DivideCont* cont);
+DivideCont* uninit_val_cont_new();
+void uninit_val_cont_incr(DivideCont* cont);
+void uninit_val_cont_decr(DivideCont* cont);
+int uninit_val_cont_get_value(DivideCont* cont);
+void uninit_val_cont_set_value(DivideCont* cont, int value);
+
+void uninit_val_for(int x);
+void uninit_val_for_complex(int x);
+void uninit_val_while_continue(int x);
+void uninit_val_do_while_continue(int x);
+void uninit_val_for_array(int x);
+void uninit_val_for_pointer(int x);
+void uninit_val_goto(int x);
+void uninit_val_if_else(bool a, bool b);
+void uninit_val_if_else_multi(bool a, bool b);
+void uninit_val_if_else_int1(int x, int y);
+void uninit_val_if_else_int2(int x, int y);
+void uninit_val_pass_by_reference(bool a, bool b);
+int uninit_val_switch(int x, int y);
+int uninit_val_rec_multi(int x, int i, int* ptr1, int* ptr2);
+int uninit_val_rec(int x, int i, int* ptr1, int* ptr2);
+int uninit_val_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2);
+int uninit_val_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2);
+void uninit_val_struct(int x, int y);
+void uninit_val_function_pointer(bool a, bool b, void (*f)(int**, int*, int*, bool));
+void uninit_val_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/integers/overflow/01_simple_if.c b/bench-moerman2018/integers/overflow/01_simple_if.c
new file mode 100644
index 0000000000000000000000000000000000000000..17f0d07e946e6b2e0da9e30d75b026073a502eb1
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/01_simple_if.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_if_else(bool a, bool b) {
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    if(a) {
+        val = INT_MAX / 3 - 1;
+    } else {
+        val = INT_MAX / 2 - 1;
+    }
+
+    if(b) {
+        val = val * 2;
+    } else {
+        val = val * 3; /* DANGER if !a */
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    integer_overflow_if_else(true, true);
+    integer_overflow_if_else(true, false);
+    integer_overflow_if_else(false, true);
+#else
+    integer_overflow_if_else(true, true); /* OK */
+    integer_overflow_if_else(false, false); /* DANGER */
+    integer_overflow_if_else(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/02_simple_if_int1.c b/bench-moerman2018/integers/overflow/02_simple_if_int1.c
new file mode 100644
index 0000000000000000000000000000000000000000..985462ecf8a186ec0f053b0f388f988f9b3720f0
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/02_simple_if_int1.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_if_else_int1(int x, int y) {
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    if(x < y) {
+        val = INT_MAX / 3 - 1;
+    } else {
+        val = INT_MAX / 2 - 1;
+    }
+
+    if(x > 10) {
+        val = val * 2;
+    } else {
+        val = val * 3; /* DANGER if x <= 10 & x >= y */
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    integer_overflow_if_else_int1(9, 10);
+    integer_overflow_if_else_int1(10, 11);
+    integer_overflow_if_else_int1(11, 10);
+#else
+    integer_overflow_if_else_int1(9, 10); /* OK */
+    integer_overflow_if_else_int1(10, 10); /* DANGER */
+    integer_overflow_if_else_int1(11, 10); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/02_simple_if_int2.c b/bench-moerman2018/integers/overflow/02_simple_if_int2.c
new file mode 100644
index 0000000000000000000000000000000000000000..f0cb1a12b1afe9086041d92e5c673f0b8ae35956
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/02_simple_if_int2.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_if_else_int2(int x, int y) {
+    int val, m, n;
+
+    m = -1;
+    n = 5;
+
+    x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    if(x < y) {
+        val = INT_MAX / 3 - 1;
+    } else {
+        val = INT_MAX / 2 - 1;
+    }
+
+    if(x > 10) {
+        val = val * 2;
+    } else {
+        val = val * 3; /* DANGER if x <= 10 & x >= y */
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    integer_overflow_if_else_int2(-4, 11);
+    integer_overflow_if_else_int2(-5, 11);
+    integer_overflow_if_else_int2(-6, 11);
+#else
+    integer_overflow_if_else_int2(-4, 10); /* OK */
+    integer_overflow_if_else_int2(-5, 10); /* DANGER */
+    integer_overflow_if_else_int2(-6, 10); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/03_simple_if_multi_func.c b/bench-moerman2018/integers/overflow/03_simple_if_multi_func.c
new file mode 100644
index 0000000000000000000000000000000000000000..f543749c1c596cec9bc7e105864c8ac342235680
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/03_simple_if_multi_func.c
@@ -0,0 +1,50 @@
+#include "integer_overflow.h"
+#include <stdbool.h>
+#include <stdio.h>
+#include <limits.h>
+
+static int local_choose_int(int int1, int int2, bool condition) {
+    if(condition) {
+        return int1;
+    } else {
+        return int2;
+    }
+}
+
+static int conditional_mult(int val, int mult1, int mult2, bool condition) {
+    if(condition) {
+        return val * mult1;
+    }
+    return val * mult2;
+}
+
+void integer_overflow_if_else_multi(bool a, bool b) {
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    val = local_choose_int(INT_MAX / 3 - 1, INT_MAX / 2 - 1, a);
+
+    val = conditional_mult(val, 2, 3, b); /* DANGER, if !a & !b */
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    integer_overflow_if_else_multi(true, true);
+    integer_overflow_if_else_multi(true, false);
+    integer_overflow_if_else_multi(false, true);
+#else
+    integer_overflow_if_else_multi(true, true); /* OK */
+    integer_overflow_if_else_multi(false, false); /* DANGER */
+    integer_overflow_if_else_multi(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/04_simple_switch.c b/bench-moerman2018/integers/overflow/04_simple_switch.c
new file mode 100644
index 0000000000000000000000000000000000000000..d5476ea4034727484b539fb7a0e4f6785dd55670
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/04_simple_switch.c
@@ -0,0 +1,62 @@
+#include "integer_overflow.h"
+#include <limits.h>
+#include <stdio.h>
+
+void integer_overflow_switch(int x, int y) {
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if((x == 10 || x == 5) && x >= y) {
+        return;
+    }
+#endif
+
+    if(x < y) {
+        val = INT_MAX / 4 - 1;
+    } else {
+        val = INT_MAX / 2 - 1;
+    }
+
+    switch (x) {
+        case 5: {
+            val = val * 3; /* DANGER: x >= y */
+            break;
+        }
+        case 7: {
+            val = -val;
+            break;
+        }
+        case 10: {
+            val = val * 4; /* DANGER: x >= y */
+            break;
+        }
+        case 12: {
+            val = 2 * val;
+            break;
+        }
+        default: {
+           val = -2 * val;
+            break;
+        }
+    };
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    integer_overflow_switch(5, 11);
+    integer_overflow_switch(10, 11);
+    integer_overflow_switch(11, 11);
+    integer_overflow_switch(7, 5);
+#else
+    integer_overflow_switch(5, 10); /* OK */
+    integer_overflow_switch(10, 10); /* DANGER */
+    integer_overflow_switch(11, 10); /* OK */
+    integer_overflow_switch(7, 5); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/05_simple_goto.c b/bench-moerman2018/integers/overflow/05_simple_goto.c
new file mode 100644
index 0000000000000000000000000000000000000000..c4b1514f2633e1af921eb4df8a87c9e0a77d26a2
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/05_simple_goto.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_goto(int x) {
+    int val = INT_MAX / 3 - 1;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 0) {
+        return;
+    }
+#endif
+
+    i = 0;
+
+GOTO_LABEL:
+    if(i <= x) {
+        printf("%i\n", val * 3);
+    } else {
+        printf("%i\n", val);
+    }
+
+    if(i == 0) {
+        i++;
+        val = val * 2;
+        goto GOTO_LABEL;
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    integer_overflow_goto(0);
+#else
+    integer_overflow_goto(1);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/06_simple_pass_by_reference.c b/bench-moerman2018/integers/overflow/06_simple_pass_by_reference.c
new file mode 100644
index 0000000000000000000000000000000000000000..3ce79813bef5bc36b4c81ea862abac0b4839f2e4
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/06_simple_pass_by_reference.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+static void assign_int(int* dest, int int1, int int2, bool condition) {
+    if(condition) {
+        *dest = int1;
+    } else {
+        *dest = int2;
+    }
+}
+
+void integer_overflow_pass_by_reference(bool a, bool b) {
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    assign_int(&val, INT_MAX / 3 - 1, INT_MAX / 2 - 1, a);
+
+    if(b) {
+        val = val * 2;
+    } else {
+        val = val * 3; /* DANGER if !a */
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    integer_overflow_pass_by_reference(true, true);
+    integer_overflow_pass_by_reference(true, false);
+    integer_overflow_pass_by_reference(false, true);
+#else
+    integer_overflow_pass_by_reference(true, true); /* OK */
+    integer_overflow_pass_by_reference(false, false); /* DANGER */
+    integer_overflow_pass_by_reference(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/07_simple_cross_file.c b/bench-moerman2018/integers/overflow/07_simple_cross_file.c
new file mode 100644
index 0000000000000000000000000000000000000000..4e16be901ee92a9ad804c05deb157e311543ee25
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/07_simple_cross_file.c
@@ -0,0 +1,40 @@
+#include "integer_overflow.h"
+#include "common.h"
+#include <stdbool.h>
+#include <limits.h>
+#include <stdio.h>
+
+void integer_overflow_cross_file(bool a, bool b) {
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    val = choose_int (INT_MAX / 3 - 1, INT_MAX / 2 - 1, a);
+
+    if(b) {
+        val = val * 2;
+    } else {
+        val = val * 3; /* DANGER if !a */
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    integer_overflow_cross_file(true, true);
+    integer_overflow_cross_file(true, false);
+    integer_overflow_cross_file(false, true);
+#else
+    integer_overflow_cross_file(true, true); /* OK */
+    integer_overflow_cross_file(false, false); /* DANGER */
+    integer_overflow_cross_file(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/08_loop_for.c b/bench-moerman2018/integers/overflow/08_loop_for.c
new file mode 100644
index 0000000000000000000000000000000000000000..c795073cb0102e52421f2add50ab49e52ab9f2b5
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/08_loop_for.c
@@ -0,0 +1,38 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_for(int x) {
+    int val = INT_MAX - 20;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 9) {
+        return;
+    }
+#endif
+
+    for(i = 0; i < 20; i++) {
+        if(i > x) {
+             val += 10; /* DANGER: x < 10 */
+        } else {
+             val++;
+        }
+        if(i == 10) {
+            val -= 100;
+        }
+    }
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    integer_overflow_for(9);
+#else
+    integer_overflow_for(8);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/09_loop_for_complex.c b/bench-moerman2018/integers/overflow/09_loop_for_complex.c
new file mode 100644
index 0000000000000000000000000000000000000000..560ff3e5a98e3f76e9bf540ffc3edd33a70e2f17
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/09_loop_for_complex.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_for_complex(int x) {
+    int val = INT_MAX / 2 - 20;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    for(;;) {
+        if(i > x) {
+             printf("%i\n", val * 3); /* DANGER: x < 10 */
+        } else {
+             printf("%i\n", val * 2);
+        }
+        if(i == 10) {
+            val = INT_MAX / 3 - 1;
+        }
+        i++;
+        if(i >= 20) {
+            break;
+        }
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    integer_overflow_for_complex(10);
+#else
+    integer_overflow_for_complex(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/10_loop_while_continue.c b/bench-moerman2018/integers/overflow/10_loop_while_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..19631d00b70ea26f5d9fbe7c7026b9787b4eff0e
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/10_loop_while_continue.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_while_continue(int x) {
+    int val = INT_MAX / 2 - 20;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    while(i < 30) {
+        if(i > x) {
+             printf("%i\n", val * 3); /* DANGER: x < 10 */
+        } else {
+             printf("%i\n", val * 2);
+        }
+        if(i == 10) {
+            val = INT_MAX / 3 - 1;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    integer_overflow_while_continue(10);
+#else
+    integer_overflow_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/11_loop_while_do_continue.c b/bench-moerman2018/integers/overflow/11_loop_while_do_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..f8148c3c44ba08cc4baf443eda3b8947cdfd7ede
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/11_loop_while_do_continue.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_do_while_continue(int x) {
+    int val = INT_MAX / 2 - 20;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    do {
+        if(i > x) {
+             printf("%i\n", val * 3); /* DANGER: x < 10 */
+        } else {
+             printf("%i\n", val * 2);
+        }
+        if(i == 10) {
+            val = INT_MAX / 3 - 1;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    } while(i < 30);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    integer_overflow_do_while_continue(10);
+#else
+    integer_overflow_do_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/12_loop_for_array_branching.c b/bench-moerman2018/integers/overflow/12_loop_for_array_branching.c
new file mode 100644
index 0000000000000000000000000000000000000000..562dac8126399ea4b6bdde94aa169b2a84bc5b7a
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/12_loop_for_array_branching.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_for_array(int x) {
+    int p[20];
+    int val = INT_MAX - 29;
+    int incr_ammount = 1;
+    int i = 0;
+
+    if(x < 0 || x > 19) {
+        return;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x >= 18) {
+        return;
+    }
+#endif
+
+    for(i = 0; i < 20; i++) {
+        p[i] = 0;
+    }
+    p[x] = 1;
+
+    for(i = 0; i < 20; i++) {
+        if(p[i] == 1) {
+            val += incr_ammount;
+            incr_ammount = 10;
+        } else {
+            val += incr_ammount;
+        }
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    integer_overflow_for_array(18);
+#else
+    integer_overflow_for_array(10);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/integers/overflow/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 0000000000000000000000000000000000000000..50b4ab079ed1c377449c8a10aa540fbaeb3ac0f5
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,54 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+static void initialize_to_value(int arr[], int value, int length) {
+    int i;
+
+    for(i = 0; i < length; i++) {
+        arr[i] = value;
+    }
+}
+
+void integer_overflow_for_pointer(int x) {
+    int arr[10];
+    int* ptr;
+    int i;
+
+    if(x < 0 || x > 10) {
+        return;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 10) {
+        return;
+    }
+#endif
+
+    initialize_to_value(arr, INT_MAX, 10);
+
+    ptr = arr;
+
+    for(i = 0; i < x; i++, ptr++) {
+        *ptr -= 20 + i;
+    }
+
+    ptr = arr;
+
+    for(i = 0; i < 10; i++, ptr++) {
+        printf("%i\n", *ptr + i);
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    integer_overflow_for_pointer(10);
+#else
+    integer_overflow_for_pointer(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/14_loop_recursion.c b/bench-moerman2018/integers/overflow/14_loop_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..63f21d6210f837bd0732099eaf4e065d30076c35
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/14_loop_recursion.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_rec(int x, int i, int val) {
+    if(i <= 1) {
+        printf("%i\n", val);
+        return;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10) {
+        printf("%i\n", val);
+        return;
+    }
+#endif
+
+    if(i < x) {
+        val += 10;
+    } else {
+        val += 1;
+    }
+
+    if(i == 10) {
+        printf("%i\n", val);
+        val = INT_MAX - 10;
+    }
+    integer_overflow_rec(x, i-1, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    integer_overflow_rec(10, 20, INT_MAX - 110);
+#else
+    integer_overflow_rec(12, 20, INT_MAX - 110);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/15_loop_recursion_multi.c b/bench-moerman2018/integers/overflow/15_loop_recursion_multi.c
new file mode 100644
index 0000000000000000000000000000000000000000..552e26997e8d4bbd59cafeeb13ae1d845d3c5d5b
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/15_loop_recursion_multi.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_rec_decr(int x, int i, int val) {
+    if(i <= 1) {
+        printf("%i\n", val);
+        return;
+    }
+
+    integer_overflow_rec_multi(x, i-1, val);
+}
+
+void integer_overflow_rec_multi(int x, int i, int val) {
+#ifdef CATCH_BAD_PARAM
+    if(x > 10) {
+        printf("%i\n", val);
+        return;
+    }
+#endif
+
+    if(i < x) {
+        val += 10;
+    } else {
+        val += 1;
+    }
+
+    if(i == 10) {
+        printf("%i\n", val);
+        val = INT_MAX - 10;
+    }
+    integer_overflow_rec_decr(x, i, val);
+}
+
+
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    integer_overflow_rec_multi(10, 20, INT_MAX - 110);
+#else
+    integer_overflow_rec_multi(12, 20, INT_MAX - 110);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/16_misc_pseudo_recursion.c b/bench-moerman2018/integers/overflow/16_misc_pseudo_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..9801e580ca31d0bf47722a94fa44dbc3387127e6
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/16_misc_pseudo_recursion.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+void integer_overflow_pseudo_rec1(int x, int y, int i, int val) {
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    if(i > 0) {
+        return;
+    }
+
+    if(x > 10) {
+        val = INT_MAX - 30;
+    } else {
+        val = INT_MAX - 10;
+    }
+
+    integer_overflow_pseudo_rec2(x, y, 1, val);
+}
+
+void integer_overflow_pseudo_rec2(int x, int y, int i, int val) {
+    if(i > 0) {
+        if(x < y) {
+            val += 5;
+        } else {
+            val += 25;
+        }
+        printf("%i\n", val);
+    } else {
+        integer_overflow_pseudo_rec1(x, y, 1, val);
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    integer_overflow_pseudo_rec1(9, 10, 0, 0);
+    integer_overflow_pseudo_rec1(11, 10, 0, 0);
+#else
+    integer_overflow_pseudo_rec1(10, 10, 0, 0);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/17_complex_function_pointers.c b/bench-moerman2018/integers/overflow/17_complex_function_pointers.c
new file mode 100644
index 0000000000000000000000000000000000000000..61de9e00c658a4492ac26f35ad426837b6203365
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/17_complex_function_pointers.c
@@ -0,0 +1,46 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+static void assign_int(int* dest, int int1, int int2, bool condition) {
+    if(condition) {
+        *dest = int1;
+    } else {
+        *dest = int2;
+    }
+}
+
+void integer_overflow_function_pointer(bool a, bool b, void (*f)(int*, int, int, bool)) {
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!f || (!a & !b)) {
+        return;
+    }
+#endif
+
+    (*f)(&val, INT_MAX / 3 - 1, INT_MAX / 2 - 1, a);
+
+    if(b) {
+        printf("%i\n", val * 2 - 15);
+    } else {
+        printf("%i\n", val * 3 - 37); /* DANGER, if !a & !b */
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    integer_overflow_function_pointer(true, true, &assign_int);
+    integer_overflow_function_pointer(true, false, &assign_int);
+    integer_overflow_function_pointer(false, true, &assign_int);
+#else
+    integer_overflow_function_pointer(true, true, &assign_int); /* OK */
+    integer_overflow_function_pointer(false, false, &assign_int); /* DANGER */
+    integer_overflow_function_pointer(false, true, &assign_int); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/18_complex_struct_multiple_methods.c b/bench-moerman2018/integers/overflow/18_complex_struct_multiple_methods.c
new file mode 100644
index 0000000000000000000000000000000000000000..e5a677bd171ddc0db1d2e6df120b8612406488b4
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/18_complex_struct_multiple_methods.c
@@ -0,0 +1,84 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <limits.h>
+#include "integer_overflow.h"
+
+#ifndef s_INTEGERS_O_REFCOUNT
+#define s_INTEGERS_O_REFCOUNT
+void integer_overflow_cont_init(IntCont* cont) {
+    cont->counter = 1;
+    cont->int_value = 0;
+}
+
+IntCont* integer_overflow_cont_new() {
+    IntCont* new_cont;
+
+    new_cont = malloc(sizeof(IntCont));
+
+    if(new_cont) {
+        integer_overflow_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void integer_overflow_cont_incr(IntCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void integer_overflow_cont_decr(IntCont* cont) {
+    if(cont->counter <= 1) {
+        cont->int_value = INT_MAX;
+    } else {
+        cont->counter--;
+    }
+}
+
+int integer_overflow_cont_get_int(IntCont* cont) {
+    return cont->int_value;
+}
+void integer_overflow_cont_set_int(IntCont* cont, int int_value) {
+    cont->int_value = int_value;
+}
+#endif //s_INTEGERS_O_REFCOUNT
+
+void integer_overflow_struct(int x, int y) {
+    IntCont cont;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+    integer_overflow_cont_init(&cont);
+
+    integer_overflow_cont_set_int(&cont, INT_MAX - 300);
+
+    if(x < y) {
+        integer_overflow_cont_set_int(&cont, INT_MAX - 500);
+    }
+
+    if(x > 10) {
+        val = integer_overflow_cont_get_int(&cont) + 200;
+    } else {
+        /* DANGER: if x <= 10 & x >= y */
+        val = integer_overflow_cont_get_int(&cont) + 400;
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    integer_overflow_struct(9, 10);
+    integer_overflow_struct(10, 11);
+    integer_overflow_struct(11, 10);
+#else
+    integer_overflow_struct(10, 10); /* DANGER */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/19_complex_refcount.c b/bench-moerman2018/integers/overflow/19_complex_refcount.c
new file mode 100644
index 0000000000000000000000000000000000000000..93e2f4079aba1cba3ac2d7b812f1b8bac0ebb8d7
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/19_complex_refcount.c
@@ -0,0 +1,69 @@
+#include "integer_overflow.h"
+#include <stdlib.h>
+#include <stdio.h>
+#include <limits.h>
+
+#ifndef s_INTEGERS_O_REFCOUNT
+#define s_INTEGERS_O_REFCOUNT
+void integer_overflow_cont_init(IntCont* cont) {
+    cont->counter = 1;
+    cont->int_value = 0;
+}
+
+IntCont* integer_overflow_cont_new() {
+    IntCont* new_cont;
+
+    new_cont = malloc(sizeof(IntCont));
+
+    if(new_cont) {
+        integer_overflow_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void integer_overflow_cont_incr(IntCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void integer_overflow_cont_decr(IntCont* cont) {
+    if(cont->counter <= 1) {
+        cont->int_value = INT_MAX;
+    } else {
+        cont->counter--;
+    }
+}
+
+int integer_overflow_cont_get_int(IntCont* cont) {
+    return cont->int_value;
+}
+void integer_overflow_cont_set_int(IntCont* cont, int int_value) {
+    cont->int_value = int_value;
+}
+#endif //s_INTEGERS_O_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+    IntCont* cont;
+
+    cont = integer_overflow_cont_new();
+    if(!cont) {
+        return 1;
+    }
+    integer_overflow_cont_set_int(cont, 35);
+
+    integer_overflow_cont_incr(cont);
+    integer_overflow_cont_incr(cont);
+    integer_overflow_cont_decr(cont);
+    integer_overflow_cont_decr(cont);
+#ifndef NO_BUG
+    integer_overflow_cont_decr(cont);
+#endif
+
+    printf("%i\n", integer_overflow_cont_get_int(cont) + 512);
+
+    free(cont);
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/integers/overflow/integer_overflow.h b/bench-moerman2018/integers/overflow/integer_overflow.h
new file mode 100644
index 0000000000000000000000000000000000000000..de7893473a4a62b672c5e049fd3a025278ccee30
--- /dev/null
+++ b/bench-moerman2018/integers/overflow/integer_overflow.h
@@ -0,0 +1,36 @@
+#include <stdbool.h>
+
+typedef struct _IntCont IntCont;
+
+struct _IntCont {
+    int int_value;
+    unsigned int counter;
+};
+
+void integer_overflow_cont_init(IntCont* cont);
+IntCont* integer_overflow_cont_new();
+void integer_overflow_cont_incr(IntCont* cont);
+void integer_overflow_cont_decr(IntCont* cont);
+int integer_overflow_cont_get_int(IntCont* cont);
+void integer_overflow_cont_set_int(IntCont* cont, int int_value);
+
+void integer_overflow_for(int x);
+void integer_overflow_for_complex(int x);
+void integer_overflow_while_continue(int x);
+void integer_overflow_do_while_continue(int x);
+void integer_overflow_for_array(int x);
+void integer_overflow_for_pointer(int x);
+void integer_overflow_goto(int x);
+void integer_overflow_if_else(bool a, bool b);
+void integer_overflow_if_else_multi(bool a, bool b);
+void integer_overflow_if_else_int1(int x, int y);
+void integer_overflow_if_else_int2(int x, int y);
+void integer_overflow_pass_by_reference(bool a, bool b);
+void integer_overflow_switch(int x, int y);
+void integer_overflow_rec_multi(int x, int i, int val);
+void integer_overflow_rec(int x, int i, int val);
+void integer_overflow_pseudo_rec1(int x, int y, int i, int val);
+void integer_overflow_pseudo_rec2(int x, int y, int i, int val);
+void integer_overflow_struct(int x, int y);
+void integer_overflow_function_pointer(bool a, bool b, void (*f)(int*, int, int, bool));
+void integer_overflow_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/memory/access_uninit/01_simple_if.c b/bench-moerman2018/memory/access_uninit/01_simple_if.c
new file mode 100644
index 0000000000000000000000000000000000000000..465d91a3f0f25b447cad6f31bdc7c5a47573bd68
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/01_simple_if.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else(bool a, bool b) {
+    int* data;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(a) {
+        *data = 1;
+    }
+
+    if(b) {
+        val = 37 * 2;
+    } else {
+        val = 11 * *data; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+
+    free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_malloc_if_else(true, true);
+    uninit_malloc_if_else(true, false);
+    uninit_malloc_if_else(false, true);
+#else
+    uninit_malloc_if_else(true, true); /* OK */
+    uninit_malloc_if_else(false, false); /* DANGER */
+    uninit_malloc_if_else(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/02_simple_if_int1.c b/bench-moerman2018/memory/access_uninit/02_simple_if_int1.c
new file mode 100644
index 0000000000000000000000000000000000000000..88ead44695e41224f2db74324ae36e41c78c7e67
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/02_simple_if_int1.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int1(int x, int y) {
+    int* data;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(x < y) {
+        *data = 1;
+    }
+
+    if(x > 10) {
+        val = 37 * 2;
+    } else {
+        val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+    }
+
+    printf("x=%i: %i", x, val);
+
+    free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_malloc_if_else_int1(9, 10);
+    uninit_malloc_if_else_int1(10, 11);
+    uninit_malloc_if_else_int1(11, 10);
+#else
+    uninit_malloc_if_else_int1(9, 10); /* OK */
+    uninit_malloc_if_else_int1(10, 10); /* DANGER */
+    uninit_malloc_if_else_int1(11, 10); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/02_simple_if_int2.c b/bench-moerman2018/memory/access_uninit/02_simple_if_int2.c
new file mode 100644
index 0000000000000000000000000000000000000000..015c85215b80967f542c5c5be5a4e1631a49287c
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/02_simple_if_int2.c
@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int2(int x, int y) {
+    int* data;
+    int val, m, n;
+
+    m = -1;
+    n = 5;
+
+    x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(x < y) {
+        *data = 1;
+    }
+
+    if(x > 10) {
+        val = 37 * 2;
+    } else {
+        val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+    }
+
+    printf("x=%i: %i", x, val);
+
+    free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_malloc_if_else_int2(-4, 11);
+    uninit_malloc_if_else_int2(-5, 11);
+    uninit_malloc_if_else_int2(-6, 11);
+#else
+    uninit_malloc_if_else_int2(-4, 10); /* OK */
+    uninit_malloc_if_else_int2(-5, 10); /* DANGER */
+    uninit_malloc_if_else_int2(-6, 10); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/03_simple_if_multi_func.c b/bench-moerman2018/memory/access_uninit/03_simple_if_multi_func.c
new file mode 100644
index 0000000000000000000000000000000000000000..203fee53aa32a4eaf1f5ea80f60ea2b56bba6662
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/03_simple_if_multi_func.c
@@ -0,0 +1,57 @@
+#include "uninitialized_malloc.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void possibly_assign(int* dest, int val, bool condition) {
+    if(condition) {
+        *dest = val;
+    }
+}
+
+static int conditional_assign(int* ptr1, int* ptr2, bool condition) {
+    if(condition) {
+        return *ptr1;
+    }
+    return *ptr2;
+}
+
+void uninit_malloc_if_else_multi(bool a, bool b) {
+    int* data;
+    int val = -7189;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    possibly_assign(data, 37, a);
+
+    val = conditional_assign(&val, data, b); /* DANGER, if !a & !b */
+
+    printf("%i\n", val);
+
+    free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_malloc_if_else_multi(true, true);
+    uninit_malloc_if_else_multi(true, false);
+    uninit_malloc_if_else_multi(false, true);
+#else
+    uninit_malloc_if_else_multi(true, true); /* OK */
+    uninit_malloc_if_else_multi(false, false); /* DANGER */
+    uninit_malloc_if_else_multi(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/04_simple_switch.c b/bench-moerman2018/memory/access_uninit/04_simple_switch.c
new file mode 100644
index 0000000000000000000000000000000000000000..7da5ba9844558181efef691e164b1694200e167e
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/04_simple_switch.c
@@ -0,0 +1,66 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+
+int uninit_malloc_switch(int x, int y) {
+    int* data;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if((x == 10 || x == 5) && x >= y) {
+        return -1;
+    }
+#endif
+    data = malloc(sizeof(int));
+    if(!data) {
+        return -1;
+    }
+
+    if(x < y) {
+        *data = 1;
+    }
+
+    switch (x) {
+        case 5: {
+            val = 37 * *data; /* DANGER: x >= y */
+            break;
+        }
+        case 7: {
+            val = -37 * 2;
+            break;
+        }
+        case 10: {
+            val = 73 * *data; /* DANGER: x >= y */
+            break;
+        }
+        case 12: {
+            val = 73 * 5;
+            break;
+        }
+        default: {
+            val = 100 * 8;
+            break;
+        }
+    };
+
+    free(data);
+
+    return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_malloc_switch(5, 11);
+    uninit_malloc_switch(10, 11);
+    uninit_malloc_switch(11, 11);
+    uninit_malloc_switch(7, 5);
+#else
+    uninit_malloc_switch(5, 10); /* OK */
+    uninit_malloc_switch(10, 10); /* DANGER */
+    uninit_malloc_switch(11, 10); /* OK */
+    uninit_malloc_switch(7, 5); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/05_simple_goto.c b/bench-moerman2018/memory/access_uninit/05_simple_goto.c
new file mode 100644
index 0000000000000000000000000000000000000000..b60552fa226af0714e7f9ae16811224629435fff
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/05_simple_goto.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_goto(int x) {
+    int val = 0, i = 0;
+    int* data;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 0) {
+        return;
+    }
+#endif
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    *data = x;
+
+GOTO_LABEL:
+    if(i <= x) {
+        if(data) {
+            val += *data;
+        }
+    } else {
+        printf("%i\n", val);
+    }
+
+    free(data);
+    data = malloc(sizeof(int));
+
+    if(i == 0) {
+        i++;
+        goto GOTO_LABEL;
+    }
+
+    free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_malloc_goto(0);
+#else
+    uninit_malloc_goto(1);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/06_simple_pass_by_reference.c b/bench-moerman2018/memory/access_uninit/06_simple_pass_by_reference.c
new file mode 100644
index 0000000000000000000000000000000000000000..4ee825094fddf3b7d13aecf300df32feb6dd8eb0
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/06_simple_pass_by_reference.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+    if(condition) {
+        **dest = val;
+    }
+}
+
+void uninit_malloc_pass_by_reference(bool a, bool b) {
+    int* data;
+
+#ifdef CATCH_BAD_PARAM
+    /* To be used if NO_BUG is defined */
+    /* and tool warns about possible dangerous input */
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    possibly_assign(&data, 5, a);
+    possibly_assign(&data, 13, b);
+
+    printf("%i\n", *data);
+
+    free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_malloc_pass_by_reference(true, true);
+    uninit_malloc_pass_by_reference(true, false);
+    uninit_malloc_pass_by_reference(false, true);
+#else
+    uninit_malloc_pass_by_reference(true, true); /* OK */
+    uninit_malloc_pass_by_reference(false, false); /* DANGER */
+    uninit_malloc_pass_by_reference(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/07_simple_cross_file.c b/bench-moerman2018/memory/access_uninit/07_simple_cross_file.c
new file mode 100644
index 0000000000000000000000000000000000000000..4a8b96ac41cb673e2b42bd2be2e5eb6630700f36
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/07_simple_cross_file.c
@@ -0,0 +1,50 @@
+#include "uninitialized_malloc.h"
+#include "common.h"
+#include <stdlib.h>
+#include <stdbool.h>
+#include <stdio.h>
+
+void uninit_malloc_cross_file(bool a, bool b) {
+    int* data;
+    int val;
+    int* int_ptr;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    int_ptr = (int*) choose_pointer((void*) data, (void*) &val, a);
+    *int_ptr = 768;
+
+    if(b) {
+        val = 10 * 2;
+    } else {
+        val = 10 * *data; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+    free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_malloc_cross_file(true, true);
+    uninit_malloc_cross_file(true, false);
+    uninit_malloc_cross_file(false, true);
+#else
+    uninit_malloc_cross_file(true, true); /* OK */
+    uninit_malloc_cross_file(false, false); /* DANGER */
+    uninit_malloc_cross_file(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/08_loop_for.c b/bench-moerman2018/memory/access_uninit/08_loop_for.c
new file mode 100644
index 0000000000000000000000000000000000000000..289134fe3b37a286a070f98e123285be2cc71ca7
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/08_loop_for.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for(int x) {
+    int* data;
+    int val = 0;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    for(i = 0; i < 20; i++) {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+    }
+
+    printf("val = %i\n", val);
+    free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_malloc_for(10);
+#else
+    uninit_malloc_for(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/09_loop_for_complex.c b/bench-moerman2018/memory/access_uninit/09_loop_for_complex.c
new file mode 100644
index 0000000000000000000000000000000000000000..c7609a9053b7dc9518fe6ebab9d3d95b96a0784b
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/09_loop_for_complex.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_complex(int x) {
+    int* data;
+    int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    for(;;) {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+        i++;
+        if(i >= 20) {
+            break;
+        }
+    }
+
+    printf("val = %i\n", val);
+    free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_malloc_for_complex(10);
+#else
+    uninit_malloc_for_complex(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/10_loop_while_continue.c b/bench-moerman2018/memory/access_uninit/10_loop_while_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..2ef0ff0d77922947247af80a1d797d8ff66f048b
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/10_loop_while_continue.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_while_continue(int x) {
+    int* data;
+    int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    while(i < 30) {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    }
+
+    printf("val = %i", val);
+    free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_malloc_while_continue(10);
+#else
+    uninit_malloc_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/11_loop_while_do_continue.c b/bench-moerman2018/memory/access_uninit/11_loop_while_do_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..bee5902e1a1f8a406f0587793bef2b9b334f57c3
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/11_loop_while_do_continue.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_do_while_continue(int x) {
+    int* data;
+    int val = 0, i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    do {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    } while(i < 30);
+
+    printf("val = %i", val);
+    free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_malloc_do_while_continue(10);
+#else
+    uninit_malloc_do_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/12_loop_for_array_branching.c b/bench-moerman2018/memory/access_uninit/12_loop_for_array_branching.c
new file mode 100644
index 0000000000000000000000000000000000000000..b866ba675304ebcc7e4a269316d88158bd84efd2
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/12_loop_for_array_branching.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_array(int x) {
+    int* data;
+    int p[20];
+    int val = 0, i = 0;
+
+    if(x < 0 || x > 19) {
+        return;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 19) {
+        return;
+    }
+#endif
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    *data = 12;
+
+    for(i = 0; i < 20; i++) {
+        p[i] = 0;
+    }
+    p[x] = 1;
+
+    for(i = 0; i < 20; i++) {
+        if(p[i] == 1) {
+            free(data);
+            data = malloc(sizeof(int));
+            if(!data) {
+                return;
+            }
+        } else {
+            val += *data; /* DANGER: x < 19 */
+        }
+    }
+
+    printf("%i\n", val);
+    free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_malloc_for_array(19);
+#else
+    uninit_malloc_for_array(10);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/memory/access_uninit/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 0000000000000000000000000000000000000000..02d29049d0379dc089a880a8299b97038e400647
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,54 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_pointer(int x) {
+    int* pointers[10];
+    int** pointers_alias = pointers;
+    int val = 0, i;
+
+    if(x < 0 || x > 10) {
+        return;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 10) {
+        return;
+    }
+#endif
+
+    for(i = 0; i < 10; i++, pointers_alias++) {
+        *pointers_alias = malloc(sizeof(int));
+    }
+
+    pointers_alias = pointers;
+    for(i = 0; i < x; i++, pointers_alias++) {
+        if(!(*pointers_alias)) {
+            continue;
+        }
+        **pointers_alias = i;
+    }
+
+    pointers_alias = pointers;
+    for(i = 0; i < 10; i++, pointers_alias++) {
+        if(!(*pointers_alias)) {
+            continue;
+        }
+        val += **pointers_alias;
+        free(*pointers_alias);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_malloc_for_pointer(10);
+#else
+    uninit_malloc_for_pointer(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/14_loop_recursion.c b/bench-moerman2018/memory/access_uninit/14_loop_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..314047aedbbb7cd707b53f840ba92026c1694438
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/14_loop_recursion.c
@@ -0,0 +1,66 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec(int x, int i, int* ptr1, int* ptr2) {
+    int val;
+
+    if(i <= 1) {
+        free(ptr1);
+        free(ptr2);
+        return 0;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && i < x && ptr2 == 0) {
+        return uninit_malloc_rec(x, i-1, ptr1, ptr1);
+    }
+#endif
+
+    if(!ptr1) {
+        ptr1 = malloc(sizeof(int));
+        if(ptr1) {
+            *ptr1 = 1;
+        } else {
+            if(ptr2) {
+                free(ptr2);
+            }
+            return -1;
+        }
+    }
+    if(!ptr2) {
+        ptr2 = malloc(sizeof(int));
+        if(!ptr2) {
+            free(ptr1);
+            return -1;
+        }
+        return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 2 * *ptr1;
+    }
+
+    if(i < x) {
+        val = *ptr2;
+    } else {
+        val = *ptr1;
+    }
+    if(i == 10) {
+        *ptr2 = *ptr1;
+    }
+    return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 3 * val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    int* initialized = malloc(sizeof(int));
+    printf("%i\n", uninit_malloc_rec(10, 20, 0, 0));
+    if(initialized) {
+        *initialized = 2;
+        printf("%i\n", uninit_malloc_rec(11, 20, 0, initialized));
+    }
+#else
+    printf("%i\n", uninit_malloc_rec(11, 20, 0, 0));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/15_loop_recursion_multi.c b/bench-moerman2018/memory/access_uninit/15_loop_recursion_multi.c
new file mode 100644
index 0000000000000000000000000000000000000000..a94b2f7aafcfaa3fb8eec1f8c89abfe9c9263242
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/15_loop_recursion_multi.c
@@ -0,0 +1,78 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec_decr(int x, int i, int* ptr1, int* ptr2) {
+    if(i <= 1) {
+        free(ptr1);
+        free(ptr2);
+        return 0;
+    }
+
+    return uninit_malloc_rec_multi(x, i-1, ptr1, ptr2);
+}
+
+int uninit_malloc_rec_multi(int x, int i, int* ptr1, int* ptr2) {
+    int val;
+
+    if(i <= 1) {
+        free(ptr1);
+        free(ptr2);
+        return 0;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(!ptr2) {
+        if((x > 0 && i < 10) || (i >= 10 && x > 10)) {
+            return uninit_malloc_rec(x, i-1, ptr1, ptr1);
+        }
+    }
+#endif
+
+    if(!ptr1) {
+        ptr1 = malloc(sizeof(int));
+        if(ptr1) {
+            *ptr1 = 1;
+        } else {
+            if(ptr2) {
+                free(ptr2);
+            }
+            return -1;
+        }
+    }
+    if(!ptr2) {
+        ptr2 = malloc(sizeof(int));
+        if(!ptr2) {
+            free(ptr1);
+            return -1;
+        }
+        return 2 * *ptr1 + uninit_malloc_rec_decr(x, i, ptr1, ptr2);
+    }
+
+    if(i < x) {
+        val = *ptr2;
+    } else {
+        val = *ptr1;
+    }
+    if(i == 10) {
+        *ptr2 = *ptr1;
+    }
+    return uninit_malloc_rec_decr(x, i, ptr1, ptr2) + 3 * val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    int* initialized = malloc(sizeof(int));;
+    printf("%i\n", uninit_malloc_rec_multi(10, 20, 0, 0));
+    if(initialized) {
+        *initialized = 2;
+        printf("%i\n", uninit_malloc_rec_multi(11, 20, 0, initialized));
+    }
+#else
+    printf("%i\n", uninit_malloc_rec_multi(11, 20, 0, 0));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/16_misc_pseudo_recursion.c b/bench-moerman2018/memory/access_uninit/16_misc_pseudo_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..ba85b87bd23bbcfbfed143bfec85a2592e7fbf8d
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/16_misc_pseudo_recursion.c
@@ -0,0 +1,78 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2) {
+    int *data;
+#ifdef CATCH_BAD_PARAM
+    if(!ptr2 && x >= y && x < 10) {
+        return 0;
+    }
+#endif
+
+    if(i > 0) {
+        return 37;
+    }
+
+    if(!ptr1) {
+        ptr1 = malloc(sizeof(int));
+        if(ptr1) {
+            *ptr1 = 1;
+        } else {
+            if(ptr2) {
+                free(ptr2);
+            }
+            return -1;
+        }
+    }
+    if(!ptr2) {
+        ptr2 = malloc(sizeof(int));
+        if(!ptr2) {
+            free(ptr1);
+            return -1;
+        }
+    }
+
+    if(x < y) {
+        *ptr2 = *ptr1;
+    }
+
+    return uninit_malloc_pseudo_rec2(x, y, 1, ptr1, ptr2);
+}
+
+int uninit_malloc_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2) {
+    int val;
+
+    if(i <= 0) {
+        return 3 * (*ptr1) + uninit_malloc_pseudo_rec1(x, y, 1, ptr1, ptr2);
+    }
+
+    if(x > 10) {
+        val = *ptr1;
+    } else {
+        val = *ptr2;
+    }
+
+    free(ptr1);
+    free(ptr2);
+
+    return 3 * val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    int* initialized = malloc(sizeof(int));
+    printf("%i\n", uninit_malloc_pseudo_rec1(9, 10, 0, 0, 0));
+    if(initialized) {
+        *initialized = 2;
+        printf("%i\n", uninit_malloc_pseudo_rec1(10, 10, 0, 0, initialized));
+    }
+    printf("%i\n", uninit_malloc_pseudo_rec1(11, 10, 0, 0, 0));
+#else
+    printf("%i\n", uninit_malloc_pseudo_rec1(10, 10, 0, 0, 0));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/17_complex_function_pointers.c b/bench-moerman2018/memory/access_uninit/17_complex_function_pointers.c
new file mode 100644
index 0000000000000000000000000000000000000000..db44cacf31f3690d90c40fece0749c77ce843e3f
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/17_complex_function_pointers.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+    if(condition) {
+        **dest = val;
+    }
+}
+
+void uninit_malloc_function_pointer(bool a, bool b, void (*f)(int**, int, bool)) {
+    int *data;
+
+#ifdef CATCH_BAD_PARAM
+    /* To be used if NO_BUG is defined */
+    /* and tool warns about possible dangerous input */
+    if(!f || (!a & !b)) {
+        return;
+    }
+#endif
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    (*f)(&data, 5, a);
+    (*f)(&data, 13, b);
+
+    printf("%i\n", *data);
+
+    free(data);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_malloc_function_pointer(true, true, &possibly_assign);
+    uninit_malloc_function_pointer(true, false, &possibly_assign);
+    uninit_malloc_function_pointer(false, true, &possibly_assign);
+#else
+    uninit_malloc_function_pointer(true, true, &possibly_assign); /* OK */
+    uninit_malloc_function_pointer(false, false, &possibly_assign); /* DANGER */
+    uninit_malloc_function_pointer(false, true, &possibly_assign); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/18_complex_struct_multiple_methods.c b/bench-moerman2018/memory/access_uninit/18_complex_struct_multiple_methods.c
new file mode 100644
index 0000000000000000000000000000000000000000..71880c70fd8388fa2c41e6ed0be1fa824995da35
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/18_complex_struct_multiple_methods.c
@@ -0,0 +1,102 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+#ifndef s_MEMORY_AU_REFCOUNT
+#define s_MEMORY_AU_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+    cont->counter = 1;
+    cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+    MallocIntCont* new_cont;
+
+    new_cont = malloc(sizeof(MallocIntCont));
+
+    if(new_cont) {
+        uninit_malloc_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+    if(cont->counter <= 1) {
+        if(cont->data) {
+           free(cont->data);
+        }
+        cont->data = malloc(sizeof(int));
+    } else {
+        cont->counter--;
+    }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+    if(cont->data) {
+        free(cont->data);
+    }
+    free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+    if(cont->data) {
+        return *(cont->data);
+    }
+    return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+    if(!cont->data) {
+        return;
+    }
+    *(cont->data) = value;
+}
+#endif //s_MEMORY_AU_REFCOUNT
+
+void uninit_malloc_struct(int x, int y) {
+    MallocIntCont cont;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    uninit_malloc_cont_init(&cont);
+
+    if(x < y) {
+        uninit_malloc_cont_set_value(&cont, 7);
+    }
+
+    if(x > 10) {
+        val = 50 * 37;
+    } else {
+        /* DANGER: if x <= 10 & x >= y */
+        val = 30 * uninit_malloc_cont_get_value(&cont);
+    }
+
+    if(cont.data) {
+        free(cont.data);
+    }
+
+    printf("x=%i: %i\n", x, val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    uninit_malloc_struct(9, 10);
+    uninit_malloc_struct(10, 11);
+    uninit_malloc_struct(11, 10);
+#else
+    uninit_malloc_struct(10, 10); /* DANGER */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/19_complex_refcount.c b/bench-moerman2018/memory/access_uninit/19_complex_refcount.c
new file mode 100644
index 0000000000000000000000000000000000000000..119168f8884c360f16713818738895994fd9a1fa
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/19_complex_refcount.c
@@ -0,0 +1,87 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_MEMORY_AU_REFCOUNT
+#define s_MEMORY_AU_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+    cont->counter = 1;
+    cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+    MallocIntCont* new_cont;
+
+    new_cont = malloc(sizeof(MallocIntCont));
+
+    if(new_cont) {
+        uninit_malloc_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+    if(cont->counter <= 1) {
+        if(cont->data) {
+           free(cont->data);
+        }
+        cont->data = malloc(sizeof(int));
+    } else {
+        cont->counter--;
+    }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+    if(cont->data) {
+        free(cont->data);
+    }
+    free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+    if(cont->data) {
+        return *(cont->data);
+    }
+    return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+    if(!cont->data) {
+        return;
+    }
+    *(cont->data) = value;
+}
+#endif //s_MEMORY_AU_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+    MallocIntCont* cont;
+    int val;
+
+    cont = uninit_malloc_cont_new();
+    if(!cont) {
+        return 1;
+    }
+    uninit_malloc_cont_set_value(cont, 35);
+
+    uninit_malloc_cont_incr(cont);
+    uninit_malloc_cont_incr(cont);
+    uninit_malloc_cont_decr(cont);
+    uninit_malloc_cont_decr(cont);
+#ifndef NO_BUG
+    uninit_malloc_cont_decr(cont);
+#endif
+
+    val = 30 * uninit_malloc_cont_get_value(cont);
+
+    printf("%i\n", val);
+
+    uninint_val_cont_free(cont);
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/01_simple_if.c b/bench-moerman2018/memory/access_uninit/test_correct/01_simple_if.c
new file mode 100644
index 0000000000000000000000000000000000000000..736c54e6dec97acb7435e76afbf1aa299b8734fc
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/01_simple_if.c
@@ -0,0 +1,38 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else(bool a, bool b) {
+    int* data;
+    int val;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(a) {
+        *data = 1;
+    }
+
+    if(b) {
+        val = 37 * 2;
+    } else {
+        val = 11 * *data; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+
+    free(data);
+}
+
+int main() {
+    uninit_malloc_if_else(true, true);
+    uninit_malloc_if_else(true, false);
+    uninit_malloc_if_else(false, true);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/02_simple_if_int1.c b/bench-moerman2018/memory/access_uninit/test_correct/02_simple_if_int1.c
new file mode 100644
index 0000000000000000000000000000000000000000..bbc98b1c88a77b45c407b373f9193ba5da7c59be
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/02_simple_if_int1.c
@@ -0,0 +1,37 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int1(int x, int y) {
+    int* data;
+    int val;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(x < y) {
+        *data = 1;
+    }
+
+    if(x > 10) {
+        val = 37 * 2;
+    } else {
+        val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+    }
+
+    printf("x=%i: %i", x, val);
+
+    free(data);
+}
+
+int main() {
+    uninit_malloc_if_else_int1(9, 10);
+    uninit_malloc_if_else_int1(10, 11);
+    uninit_malloc_if_else_int1(11, 10);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/02_simple_if_int2.c b/bench-moerman2018/memory/access_uninit/test_correct/02_simple_if_int2.c
new file mode 100644
index 0000000000000000000000000000000000000000..75ef7880642ea44850029c1a0604075618179964
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/02_simple_if_int2.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int2(int x, int y) {
+    int* data;
+    int val, m, n;
+
+    m = -1;
+    n = 5;
+
+    x = x*m+n;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(x < y) {
+        *data = 1;
+    }
+
+    if(x > 10) {
+        val = 37 * 2;
+    } else {
+        val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+    }
+
+    printf("x=%i: %i", x, val);
+
+    free(data);
+}
+
+int main() {
+    uninit_malloc_if_else_int2(-4, 11);
+    uninit_malloc_if_else_int2(-5, 11);
+    uninit_malloc_if_else_int2(-6, 11);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/03_simple_if_multi_func.c b/bench-moerman2018/memory/access_uninit/test_correct/03_simple_if_multi_func.c
new file mode 100644
index 0000000000000000000000000000000000000000..14b0e2e4086f1a9c2d1dcbb836c4b5228f67f510
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/03_simple_if_multi_func.c
@@ -0,0 +1,44 @@
+#include "uninitialized_malloc.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void possibly_assign(int* dest, int val, bool condition) {
+    if(condition) {
+        *dest = val;
+    }
+}
+
+static int conditional_assign(int* ptr1, int* ptr2, bool condition) {
+    if(condition) {
+        return *ptr1;
+    }
+    return *ptr2;
+}
+
+void uninit_malloc_if_else_multi(bool a, bool b) {
+    int* data;
+    int val = -7189;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    possibly_assign(data, 37, a);
+
+    val = conditional_assign(&val, data, b); /* DANGER, if !a & !b */
+
+    printf("%i\n", val);
+
+    free(data);
+}
+
+int main() {
+    uninit_malloc_if_else_multi(true, true);
+    uninit_malloc_if_else_multi(true, false);
+    uninit_malloc_if_else_multi(false, true);
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/04_simple_switch.c b/bench-moerman2018/memory/access_uninit/test_correct/04_simple_switch.c
new file mode 100644
index 0000000000000000000000000000000000000000..033ae56b52d0ac22740064680dac9b7b6f355e04
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/04_simple_switch.c
@@ -0,0 +1,52 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+
+int uninit_malloc_switch(int x, int y) {
+    int* data;
+    int val;
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return -1;
+    }
+
+    if(x < y) {
+        *data = 1;
+    }
+
+    switch (x) {
+        case 5: {
+            val = 37 * *data; /* DANGER: x >= y */
+            break;
+        }
+        case 7: {
+            val = -37 * 2;
+            break;
+        }
+        case 10: {
+            val = 73 * *data; /* DANGER: x >= y */
+            break;
+        }
+        case 12: {
+            val = 73 * 5;
+            break;
+        }
+        default: {
+            val = 100 * 8;
+            break;
+        }
+    };
+
+    free(data);
+
+    return val;
+}
+
+int main() {
+    uninit_malloc_switch(5, 11);
+    uninit_malloc_switch(10, 11);
+    uninit_malloc_switch(11, 11);
+    uninit_malloc_switch(7, 5);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/05_simple_goto.c b/bench-moerman2018/memory/access_uninit/test_correct/05_simple_goto.c
new file mode 100644
index 0000000000000000000000000000000000000000..4be75e5044ef837132f89a3141be6f5ad63f8a73
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/05_simple_goto.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_goto(int x) {
+    int val = 0, i = 0;
+    int* data;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    *data = x;
+
+GOTO_LABEL:
+    if(i <= x) {
+        if(data) {
+            val += *data;
+        }
+    } else {
+        printf("%i\n", val);
+    }
+
+    free(data);
+    data = malloc(sizeof(int));
+
+    if(i == 0) {
+        i++;
+        goto GOTO_LABEL;
+    }
+
+    free(data);
+}
+
+int main() {
+    uninit_malloc_goto(0);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/06_simple_pass_by_reference.c b/bench-moerman2018/memory/access_uninit/test_correct/06_simple_pass_by_reference.c
new file mode 100644
index 0000000000000000000000000000000000000000..a6bd50fe835449b16ac082979808cd2acc64e55b
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/06_simple_pass_by_reference.c
@@ -0,0 +1,36 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+    if(condition) {
+        **dest = val;
+    }
+}
+
+void uninit_malloc_pass_by_reference(bool a, bool b) {
+    int* data;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    possibly_assign(&data, 5, a);
+    possibly_assign(&data, 13, b);
+
+    printf("%i\n", *data);
+
+    free(data);
+}
+
+int main() {
+    uninit_malloc_pass_by_reference(true, true);
+    uninit_malloc_pass_by_reference(true, false);
+    uninit_malloc_pass_by_reference(false, true);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/07_simple_cross_file.c b/bench-moerman2018/memory/access_uninit/test_correct/07_simple_cross_file.c
new file mode 100644
index 0000000000000000000000000000000000000000..b9e871304bc4fc49b4e5418b3218be9a13d2fd3f
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/07_simple_cross_file.c
@@ -0,0 +1,37 @@
+#include "uninitialized_malloc.h"
+#include "common.h"
+#include <stdlib.h>
+#include <stdbool.h>
+#include <stdio.h>
+
+void uninit_malloc_cross_file(bool a, bool b) {
+    int* data;
+    int val;
+    int* int_ptr;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    int_ptr = (int*) choose_pointer((void*) data, (void*) &val, a);
+    *int_ptr = 768;
+
+    if(b) {
+        val = 10 * 2;
+    } else {
+        val = 10 * *data; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+    free(data);
+}
+
+int main() {
+    uninit_malloc_cross_file(true, true);
+    uninit_malloc_cross_file(true, false);
+    uninit_malloc_cross_file(false, true);
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/08_loop_for.c b/bench-moerman2018/memory/access_uninit/test_correct/08_loop_for.c
new file mode 100644
index 0000000000000000000000000000000000000000..b6ee431b1875674992d49489194d4fbe48bfd751
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/08_loop_for.c
@@ -0,0 +1,36 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for(int x) {
+    int* data;
+    int val = 0;
+    int i;
+
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    for(i = 0; i < 20; i++) {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+    }
+
+    printf("val = %i\n", val);
+    free(data);
+}
+
+int main() {
+    uninit_malloc_for(10);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/09_loop_for_complex.c b/bench-moerman2018/memory/access_uninit/test_correct/09_loop_for_complex.c
new file mode 100644
index 0000000000000000000000000000000000000000..be2c1bfcd93e26557b0cac1d57ddb227e1778903
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/09_loop_for_complex.c
@@ -0,0 +1,39 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_complex(int x) {
+    int* data;
+    int val = 0, i = 0;
+
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    for(;;) {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+        i++;
+        if(i >= 20) {
+            break;
+        }
+    }
+
+    printf("val = %i\n", val);
+    free(data);
+}
+
+int main() {
+    uninit_malloc_for_complex(10);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/10_loop_while_continue.c b/bench-moerman2018/memory/access_uninit/test_correct/10_loop_while_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..8489e21251c6a63775e4acf7183311ae7f44cfa1
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/10_loop_while_continue.c
@@ -0,0 +1,39 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_while_continue(int x) {
+    int* data;
+    int val = 0, i = 0;
+
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    while(i < 30) {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    }
+
+    printf("val = %i", val);
+    free(data);
+}
+
+int main() {
+    uninit_malloc_while_continue(10);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/11_loop_while_do_continue.c b/bench-moerman2018/memory/access_uninit/test_correct/11_loop_while_do_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..f301fc39718f2285bed61b374d3ad4017ddaac8a
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/11_loop_while_do_continue.c
@@ -0,0 +1,39 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_do_while_continue(int x) {
+    int* data;
+    int val = 0, i = 0;
+
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    do {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    } while(i < 30);
+
+    printf("val = %i", val);
+    free(data);
+}
+
+int main() {
+    uninit_malloc_do_while_continue(10);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/12_loop_for_array_branching.c b/bench-moerman2018/memory/access_uninit/test_correct/12_loop_for_array_branching.c
new file mode 100644
index 0000000000000000000000000000000000000000..92a70f01b46bfd4bcc53eec4f84a99f286c2ae43
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/12_loop_for_array_branching.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_array(int x) {
+    int* data;
+    int p[20];
+    int val = 0, i = 0;
+
+    if(x < 0 || x > 19) {
+        return;
+    }
+
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    *data = 12;
+
+    for(i = 0; i < 20; i++) {
+        p[i] = 0;
+    }
+    p[x] = 1;
+
+    for(i = 0; i < 20; i++) {
+        if(p[i] == 1) {
+            free(data);
+            data = malloc(sizeof(int));
+            if(!data) {
+                return;
+            }
+        } else {
+            val += *data; /* DANGER: x < 19 */
+        }
+    }
+
+    printf("%i\n", val);
+    free(data);
+}
+
+int main() {
+    uninit_malloc_for_array(19);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/memory/access_uninit/test_correct/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 0000000000000000000000000000000000000000..ffda1d828f2ba24fa5a869508d52847a664c2698
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,43 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_pointer(int x) {
+    int* pointers[10];
+    int** pointers_alias = pointers;
+    int val = 0, i;
+
+    if(x < 0 || x > 10) {
+        return;
+    }
+
+
+    for(i = 0; i < 10; i++, pointers_alias++) {
+        *pointers_alias = malloc(sizeof(int));
+    }
+
+    pointers_alias = pointers;
+    for(i = 0; i < x; i++, pointers_alias++) {
+        if(!(*pointers_alias)) {
+            continue;
+        }
+        **pointers_alias = i;
+    }
+
+    pointers_alias = pointers;
+    for(i = 0; i < 10; i++, pointers_alias++) {
+        if(!(*pointers_alias)) {
+            continue;
+        }
+        val += **pointers_alias;
+        free(*pointers_alias);
+    }
+
+    printf("%i\n", val);
+}
+
+int main() {
+    uninit_malloc_for_pointer(10);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/14_loop_recursion.c b/bench-moerman2018/memory/access_uninit/test_correct/14_loop_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..2d911d22b10f338d5367836aeb910cfb8747610e
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/14_loop_recursion.c
@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec(int x, int i, int* ptr1, int* ptr2) {
+    int val;
+
+    if(i <= 1) {
+        free(ptr1);
+        free(ptr2);
+        return 0;
+    }
+
+
+    if(!ptr1) {
+        ptr1 = malloc(sizeof(int));
+        if(ptr1) {
+            *ptr1 = 1;
+        } else {
+            if(ptr2) {
+                free(ptr2);
+            }
+            return -1;
+        }
+    }
+    if(!ptr2) {
+        ptr2 = malloc(sizeof(int));
+        if(!ptr2) {
+            free(ptr1);
+            return -1;
+        }
+        return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 2 * *ptr1;
+    }
+
+    if(i < x) {
+        val = *ptr2;
+    } else {
+        val = *ptr1;
+    }
+    if(i == 10) {
+        *ptr2 = *ptr1;
+    }
+    return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 3 * val;
+}
+
+int main() {
+    int* initialized = malloc(sizeof(int));
+    printf("%i\n", uninit_malloc_rec(10, 20, 0, 0));
+    if(initialized) {
+        *initialized = 2;
+        printf("%i\n", uninit_malloc_rec(11, 20, 0, initialized));
+    }
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/15_loop_recursion_multi.c b/bench-moerman2018/memory/access_uninit/test_correct/15_loop_recursion_multi.c
new file mode 100644
index 0000000000000000000000000000000000000000..b0f65e8251c6fdd2d9741ca9d65e71a7c5e55235
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/15_loop_recursion_multi.c
@@ -0,0 +1,63 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec_decr(int x, int i, int* ptr1, int* ptr2) {
+    if(i <= 1) {
+        return 0;
+    }
+
+    return uninit_malloc_rec_multi(x, i-1, ptr1, ptr2);
+}
+
+int uninit_malloc_rec_multi(int x, int i, int* ptr1, int* ptr2) {
+    int val;
+
+    if(i <= 1) {
+        free(ptr1);
+        free(ptr2);
+        return 0;
+    }
+
+
+    if(!ptr1) {
+        ptr1 = malloc(sizeof(int));
+        if(ptr1) {
+            *ptr1 = 1;
+        } else {
+            if(ptr2) {
+                free(ptr2);
+            }
+            return -1;
+        }
+    }
+    if(!ptr2) {
+        ptr2 = malloc(sizeof(int));
+        if(!ptr2) {
+            free(ptr1);
+            return -1;
+        }
+        return 2 * *ptr1 + uninit_malloc_rec_decr(x, i, ptr1, ptr2);
+    }
+
+    if(i < x) {
+        val = *ptr2;
+    } else {
+        val = *ptr1;
+    }
+    if(i == 10) {
+        *ptr2 = *ptr1;
+    }
+    return uninit_malloc_rec_decr(x, i, ptr1, ptr2) + 3 * val;
+}
+
+int main() {
+    int* initialized = malloc(sizeof(int));;
+    printf("%i\n", uninit_malloc_rec_multi(10, 20, 0, 0));
+    if(initialized) {
+        *initialized = 2;
+        printf("%i\n", uninit_malloc_rec_multi(11, 20, 0, initialized));
+    }
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/16_misc_pseudo_recursion.c b/bench-moerman2018/memory/access_uninit/test_correct/16_misc_pseudo_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..4419dfc4d2e6bcd4d87c93e2e33cbeadb918c218
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/16_misc_pseudo_recursion.c
@@ -0,0 +1,67 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2) {
+    int *data;
+
+    if(i > 0) {
+        return 37;
+    }
+
+    if(!ptr1) {
+        ptr1 = malloc(sizeof(int));
+        if(ptr1) {
+            *ptr1 = 1;
+        } else {
+            if(ptr2) {
+                free(ptr2);
+            }
+            return -1;
+        }
+    }
+    if(!ptr2) {
+        ptr2 = malloc(sizeof(int));
+        if(!ptr2) {
+            free(ptr1);
+            return -1;
+        }
+    }
+
+    if(x < y) {
+        *ptr2 = *ptr1;
+    }
+
+    return uninit_malloc_pseudo_rec2(x, y, 1, ptr1, ptr2);
+}
+
+int uninit_malloc_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2) {
+    int val;
+
+    if(i <= 0) {
+        return 3 * (*ptr1) + uninit_malloc_pseudo_rec1(x, y, 1, ptr1, ptr2);
+    }
+
+    if(x > 10) {
+        val = *ptr1;
+    } else {
+        val = *ptr2;
+    }
+
+    free(ptr1);
+    free(ptr2);
+
+    return 3 * val;
+}
+
+int main() {
+    int* initialized = malloc(sizeof(int));
+    printf("%i\n", uninit_malloc_pseudo_rec1(9, 10, 0, 0, 0));
+    if(initialized) {
+        *initialized = 2;
+        printf("%i\n", uninit_malloc_pseudo_rec1(10, 10, 0, 0, initialized));
+    }
+    printf("%i\n", uninit_malloc_pseudo_rec1(11, 10, 0, 0, 0));
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/17_complex_function_pointers.c b/bench-moerman2018/memory/access_uninit/test_correct/17_complex_function_pointers.c
new file mode 100644
index 0000000000000000000000000000000000000000..d2db683f12bcf5c530f955efe6a34374c606d193
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/17_complex_function_pointers.c
@@ -0,0 +1,36 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+    if(condition) {
+        **dest = val;
+    }
+}
+
+void uninit_malloc_function_pointer(bool a, bool b, void (*f)(int**, int, bool)) {
+    int *data;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    (*f)(&data, 5, a);
+    (*f)(&data, 13, b);
+
+    printf("%i\n", *data);
+
+    free(data);
+}
+
+int main() {
+    uninit_malloc_function_pointer(true, true, &possibly_assign);
+    uninit_malloc_function_pointer(true, false, &possibly_assign);
+    uninit_malloc_function_pointer(false, true, &possibly_assign);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/18_complex_struct_multiple_methods.c b/bench-moerman2018/memory/access_uninit/test_correct/18_complex_struct_multiple_methods.c
new file mode 100644
index 0000000000000000000000000000000000000000..9f34bdaa17a382fd3c861cfbd6b24568c4c5b9fe
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/18_complex_struct_multiple_methods.c
@@ -0,0 +1,91 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+    cont->counter = 1;
+    cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+    MallocIntCont* new_cont;
+
+    new_cont = malloc(sizeof(MallocIntCont));
+
+    if(new_cont) {
+        uninit_malloc_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+    if(cont->counter <= 1) {
+        if(cont->data) {
+           free(cont->data);
+        }
+        cont->data = malloc(sizeof(int));
+    } else {
+        cont->counter--;
+    }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+    if(cont->data) {
+        free(cont->data);
+    }
+    free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+    if(cont->data) {
+        return *(cont->data);
+    }
+    return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+    if(!cont->data) {
+        return;
+    }
+    *(cont->data) = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
+void uninit_malloc_struct(int x, int y) {
+    MallocIntCont cont;
+    int val;
+
+
+    uninit_malloc_cont_init(&cont);
+
+    if(x < y) {
+        uninit_malloc_cont_set_value(&cont, 7);
+    }
+
+    if(x > 10) {
+        val = 50 * 37;
+    } else {
+        /* DANGER: if x <= 10 & x >= y */
+        val = 30 * uninit_malloc_cont_get_value(&cont);
+    }
+
+    if(cont.data) {
+        free(cont.data);
+    }
+
+    printf("x=%i: %i\n", x, val);
+}
+
+int main() {
+    uninit_malloc_struct(9, 10);
+    uninit_malloc_struct(10, 11);
+    uninit_malloc_struct(11, 10);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct/19_complex_refcount.c b/bench-moerman2018/memory/access_uninit/test_correct/19_complex_refcount.c
new file mode 100644
index 0000000000000000000000000000000000000000..d9b3c7973306aec9a6e2f07dc5d6f14deb41d04d
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct/19_complex_refcount.c
@@ -0,0 +1,82 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+    cont->counter = 1;
+    cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+    MallocIntCont* new_cont;
+
+    new_cont = malloc(sizeof(MallocIntCont));
+
+    if(new_cont) {
+        uninit_malloc_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+    if(cont->counter <= 1) {
+        if(cont->data) {
+           free(cont->data);
+        }
+        cont->data = malloc(sizeof(int));
+    } else {
+        cont->counter--;
+    }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+    if(cont->data) {
+        free(cont->data);
+    }
+    free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+    if(cont->data) {
+        return *(cont->data);
+    }
+    return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+    if(!cont->data) {
+        return;
+    }
+    *(cont->data) = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
+int main() {
+    MallocIntCont* cont;
+    int val;
+
+    cont = uninit_malloc_cont_new();
+    if(!cont) {
+        return 1;
+    }
+    uninit_malloc_cont_set_value(cont, 35);
+
+    uninit_malloc_cont_incr(cont);
+    uninit_malloc_cont_incr(cont);
+    uninit_malloc_cont_decr(cont);
+    uninit_malloc_cont_decr(cont);
+
+    val = 30 * uninit_malloc_cont_get_value(cont);
+
+    printf("%i\n", val);
+
+    uninint_val_cont_free(cont);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/01_simple_if.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/01_simple_if.c
new file mode 100644
index 0000000000000000000000000000000000000000..b7d85dc19452de833e9f812658b41f7c974e89ae
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/01_simple_if.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else(bool a, bool b) {
+    int* data;
+    int val;
+
+    if(!a & !b) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(a) {
+        *data = 1;
+    }
+
+    if(b) {
+        val = 37 * 2;
+    } else {
+        val = 11 * *data; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+
+    free(data);
+}
+
+int main() {
+    uninit_malloc_if_else(true, true);
+    uninit_malloc_if_else(true, false);
+    uninit_malloc_if_else(false, true);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/02_simple_if_int1.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/02_simple_if_int1.c
new file mode 100644
index 0000000000000000000000000000000000000000..ed6acaa3687769184b41b0b974c4b30fc69949eb
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/02_simple_if_int1.c
@@ -0,0 +1,40 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int1(int x, int y) {
+    int* data;
+    int val;
+
+    if(x <= 10 && x >= y) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(x < y) {
+        *data = 1;
+    }
+
+    if(x > 10) {
+        val = 37 * 2;
+    } else {
+        val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+    }
+
+    printf("x=%i: %i", x, val);
+
+    free(data);
+}
+
+int main() {
+    uninit_malloc_if_else_int1(9, 10);
+    uninit_malloc_if_else_int1(10, 11);
+    uninit_malloc_if_else_int1(11, 10);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/02_simple_if_int2.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/02_simple_if_int2.c
new file mode 100644
index 0000000000000000000000000000000000000000..53516575452cc4a9539c441f25a7630be7c6f4da
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/02_simple_if_int2.c
@@ -0,0 +1,45 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int2(int x, int y) {
+    int* data;
+    int val, m, n;
+
+    m = -1;
+    n = 5;
+
+    x = x*m+n;
+
+    if(x <= 10 && x >= y) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(x < y) {
+        *data = 1;
+    }
+
+    if(x > 10) {
+        val = 37 * 2;
+    } else {
+        val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+    }
+
+    printf("x=%i: %i", x, val);
+
+    free(data);
+}
+
+int main() {
+    uninit_malloc_if_else_int2(-4, 11);
+    uninit_malloc_if_else_int2(-5, 11);
+    uninit_malloc_if_else_int2(-6, 11);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/03_simple_if_multi_func.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/03_simple_if_multi_func.c
new file mode 100644
index 0000000000000000000000000000000000000000..d141e27365879291e68e7c8a396d4b7c89cfe433
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/03_simple_if_multi_func.c
@@ -0,0 +1,47 @@
+#include "uninitialized_malloc.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void possibly_assign(int* dest, int val, bool condition) {
+    if(condition) {
+        *dest = val;
+    }
+}
+
+static int conditional_assign(int* ptr1, int* ptr2, bool condition) {
+    if(condition) {
+        return *ptr1;
+    }
+    return *ptr2;
+}
+
+void uninit_malloc_if_else_multi(bool a, bool b) {
+    int* data;
+    int val = -7189;
+
+    if(!a & !b) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    possibly_assign(data, 37, a);
+
+    val = conditional_assign(&val, data, b); /* DANGER, if !a & !b */
+
+    printf("%i\n", val);
+
+    free(data);
+}
+
+int main() {
+    uninit_malloc_if_else_multi(true, true);
+    uninit_malloc_if_else_multi(true, false);
+    uninit_malloc_if_else_multi(false, true);
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/04_simple_switch.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/04_simple_switch.c
new file mode 100644
index 0000000000000000000000000000000000000000..ad43af9bbbcbee0d472e9d595ab09289a882f26d
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/04_simple_switch.c
@@ -0,0 +1,55 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+
+int uninit_malloc_switch(int x, int y) {
+    int* data;
+    int val;
+
+    if((x == 10 || x == 5) && x >= y) {
+        return -1;
+    }
+    data = malloc(sizeof(int));
+    if(!data) {
+        return -1;
+    }
+
+    if(x < y) {
+        *data = 1;
+    }
+
+    switch (x) {
+        case 5: {
+            val = 37 * *data; /* DANGER: x >= y */
+            break;
+        }
+        case 7: {
+            val = -37 * 2;
+            break;
+        }
+        case 10: {
+            val = 73 * *data; /* DANGER: x >= y */
+            break;
+        }
+        case 12: {
+            val = 73 * 5;
+            break;
+        }
+        default: {
+            val = 100 * 8;
+            break;
+        }
+    };
+
+    free(data);
+
+    return val;
+}
+
+int main() {
+    uninit_malloc_switch(5, 11);
+    uninit_malloc_switch(10, 11);
+    uninit_malloc_switch(11, 11);
+    uninit_malloc_switch(7, 5);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/05_simple_goto.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/05_simple_goto.c
new file mode 100644
index 0000000000000000000000000000000000000000..d2d477e3a484417f5858b7657d4e376d5b78cbc0
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/05_simple_goto.c
@@ -0,0 +1,45 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_goto(int x) {
+    int val = 0, i = 0;
+    int* data;
+
+    if(x > 0) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    *data = x;
+
+GOTO_LABEL:
+    if(i <= x) {
+        if(data) {
+            val += *data;
+        }
+    } else {
+        printf("%i\n", val);
+    }
+
+    free(data);
+    data = malloc(sizeof(int));
+
+    if(i == 0) {
+        i++;
+        goto GOTO_LABEL;
+    }
+
+    free(data);
+}
+
+int main() {
+    uninit_malloc_goto(0);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/06_simple_pass_by_reference.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/06_simple_pass_by_reference.c
new file mode 100644
index 0000000000000000000000000000000000000000..2dc599331a0d7e9c9ec7e1aab804b4f9855cae47
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/06_simple_pass_by_reference.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+    if(condition) {
+        **dest = val;
+    }
+}
+
+void uninit_malloc_pass_by_reference(bool a, bool b) {
+    int* data;
+
+    /* To be used if  is defined */
+    /* and tool warns about possible dangerous input */
+    if(!a & !b) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    possibly_assign(&data, 5, a);
+    possibly_assign(&data, 13, b);
+
+    printf("%i\n", *data);
+
+    free(data);
+}
+
+int main() {
+    uninit_malloc_pass_by_reference(true, true);
+    uninit_malloc_pass_by_reference(true, false);
+    uninit_malloc_pass_by_reference(false, true);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/07_simple_cross_file.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/07_simple_cross_file.c
new file mode 100644
index 0000000000000000000000000000000000000000..ff5082a00882942e72210718d9835b6d169ab157
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/07_simple_cross_file.c
@@ -0,0 +1,40 @@
+#include "uninitialized_malloc.h"
+#include "common.h"
+#include <stdlib.h>
+#include <stdbool.h>
+#include <stdio.h>
+
+void uninit_malloc_cross_file(bool a, bool b) {
+    int* data;
+    int val;
+    int* int_ptr;
+
+    if(!a & !b) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    int_ptr = (int*) choose_pointer((void*) data, (void*) &val, a);
+    *int_ptr = 768;
+
+    if(b) {
+        val = 10 * 2;
+    } else {
+        val = 10 * *data; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+    free(data);
+}
+
+int main() {
+    uninit_malloc_cross_file(true, true);
+    uninit_malloc_cross_file(true, false);
+    uninit_malloc_cross_file(false, true);
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/08_loop_for.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/08_loop_for.c
new file mode 100644
index 0000000000000000000000000000000000000000..4dd16d30fa793d42af72d99bbbe114bfa37d4fd7
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/08_loop_for.c
@@ -0,0 +1,39 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for(int x) {
+    int* data;
+    int val = 0;
+    int i;
+
+    if(x < 10) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    for(i = 0; i < 20; i++) {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+    }
+
+    printf("val = %i\n", val);
+    free(data);
+}
+
+int main() {
+    uninit_malloc_for(10);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/09_loop_for_complex.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/09_loop_for_complex.c
new file mode 100644
index 0000000000000000000000000000000000000000..afe949b36b64d030234f14ffb6df398a1540be7b
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/09_loop_for_complex.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_complex(int x) {
+    int* data;
+    int val = 0, i = 0;
+
+    if(x < 10) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    for(;;) {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+        i++;
+        if(i >= 20) {
+            break;
+        }
+    }
+
+    printf("val = %i\n", val);
+    free(data);
+}
+
+int main() {
+    uninit_malloc_for_complex(10);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/10_loop_while_continue.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/10_loop_while_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..722db934f2caf983db8732420ef73ffb77438441
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/10_loop_while_continue.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_while_continue(int x) {
+    int* data;
+    int val = 0, i = 0;
+
+    if(x < 10) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    while(i < 30) {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    }
+
+    printf("val = %i", val);
+    free(data);
+}
+
+int main() {
+    uninit_malloc_while_continue(10);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/11_loop_while_do_continue.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/11_loop_while_do_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..b3d11f9e4995987522575a532c25d1ea1c1da47b
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/11_loop_while_do_continue.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_do_while_continue(int x) {
+    int* data;
+    int val = 0, i = 0;
+
+    if(x < 10) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    do {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    } while(i < 30);
+
+    printf("val = %i", val);
+    free(data);
+}
+
+int main() {
+    uninit_malloc_do_while_continue(10);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/12_loop_for_array_branching.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/12_loop_for_array_branching.c
new file mode 100644
index 0000000000000000000000000000000000000000..a53538de2b38ccd6b739bf5d22a64a813622550b
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/12_loop_for_array_branching.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_array(int x) {
+    int* data;
+    int p[20];
+    int val = 0, i = 0;
+
+    if(x < 0 || x > 19) {
+        return;
+    }
+
+    if(x != 19) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    *data = 12;
+
+    for(i = 0; i < 20; i++) {
+        p[i] = 0;
+    }
+    p[x] = 1;
+
+    for(i = 0; i < 20; i++) {
+        if(p[i] == 1) {
+            free(data);
+            data = malloc(sizeof(int));
+            if(!data) {
+                return;
+            }
+        } else {
+            val += *data; /* DANGER: x < 19 */
+        }
+    }
+
+    printf("%i\n", val);
+    free(data);
+}
+
+int main() {
+    uninit_malloc_for_array(19);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 0000000000000000000000000000000000000000..f4101ee9285ceb2caa6e02bbf62aaa5d63d3a1b2
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,46 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_pointer(int x) {
+    int* pointers[10];
+    int** pointers_alias = pointers;
+    int val = 0, i;
+
+    if(x < 0 || x > 10) {
+        return;
+    }
+
+    if(x != 10) {
+        return;
+    }
+
+    for(i = 0; i < 10; i++, pointers_alias++) {
+        *pointers_alias = malloc(sizeof(int));
+    }
+
+    pointers_alias = pointers;
+    for(i = 0; i < x; i++, pointers_alias++) {
+        if(!(*pointers_alias)) {
+            continue;
+        }
+        **pointers_alias = i;
+    }
+
+    pointers_alias = pointers;
+    for(i = 0; i < 10; i++, pointers_alias++) {
+        if(!(*pointers_alias)) {
+            continue;
+        }
+        val += **pointers_alias;
+        free(*pointers_alias);
+    }
+
+    printf("%i\n", val);
+}
+
+int main() {
+    uninit_malloc_for_pointer(10);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/14_loop_recursion.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/14_loop_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..39b2b0edf36b904d25f4f64fd222d4b4c7d72a9d
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/14_loop_recursion.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec(int x, int i, int* ptr1, int* ptr2) {
+    int val;
+
+    if(i <= 1) {
+        free(ptr1);
+        free(ptr2);
+        return 0;
+    }
+
+    if(x > 10 && i < x && ptr2 == 0) {
+        return uninit_malloc_rec(x, i-1, ptr1, ptr1);
+    }
+
+    if(!ptr1) {
+        ptr1 = malloc(sizeof(int));
+        if(ptr1) {
+            *ptr1 = 1;
+        } else {
+            if(ptr2) {
+                free(ptr2);
+            }
+            return -1;
+        }
+    }
+    if(!ptr2) {
+        ptr2 = malloc(sizeof(int));
+        if(!ptr2) {
+            free(ptr1);
+            return -1;
+        }
+        return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 2 * *ptr1;
+    }
+
+    if(i < x) {
+        val = *ptr2;
+    } else {
+        val = *ptr1;
+    }
+    if(i == 10) {
+        *ptr2 = *ptr1;
+    }
+    return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 3 * val;
+}
+
+int main() {
+    int* initialized = malloc(sizeof(int));
+    printf("%i\n", uninit_malloc_rec(10, 20, 0, 0));
+    if(initialized) {
+        *initialized = 2;
+        printf("%i\n", uninit_malloc_rec(11, 20, 0, initialized));
+    }
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/15_loop_recursion_multi.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/15_loop_recursion_multi.c
new file mode 100644
index 0000000000000000000000000000000000000000..e6fad4edaf681c44a229e397e8fc62c26b57051b
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/15_loop_recursion_multi.c
@@ -0,0 +1,68 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec_decr(int x, int i, int* ptr1, int* ptr2) {
+    if(i <= 1) {
+        return 0;
+    }
+
+    return uninit_malloc_rec_multi(x, i-1, ptr1, ptr2);
+}
+
+int uninit_malloc_rec_multi(int x, int i, int* ptr1, int* ptr2) {
+    int val;
+
+    if(i <= 1) {
+        free(ptr1);
+        free(ptr2);
+        return 0;
+    }
+
+    if(!ptr2) {
+        if((x > 0 && i < 10) || (i >= 10 && x > 10)) {
+            return uninit_malloc_rec(x, i-1, ptr1, ptr1);
+        }
+    }
+
+    if(!ptr1) {
+        ptr1 = malloc(sizeof(int));
+        if(ptr1) {
+            *ptr1 = 1;
+        } else {
+            if(ptr2) {
+                free(ptr2);
+            }
+            return -1;
+        }
+    }
+    if(!ptr2) {
+        ptr2 = malloc(sizeof(int));
+        if(!ptr2) {
+            free(ptr1);
+            return -1;
+        }
+        return 2 * *ptr1 + uninit_malloc_rec_decr(x, i, ptr1, ptr2);
+    }
+
+    if(i < x) {
+        val = *ptr2;
+    } else {
+        val = *ptr1;
+    }
+    if(i == 10) {
+        *ptr2 = *ptr1;
+    }
+    return uninit_malloc_rec_decr(x, i, ptr1, ptr2) + 3 * val;
+}
+
+int main() {
+    int* initialized = malloc(sizeof(int));;
+    printf("%i\n", uninit_malloc_rec_multi(10, 20, 0, 0));
+    if(initialized) {
+        *initialized = 2;
+        printf("%i\n", uninit_malloc_rec_multi(11, 20, 0, initialized));
+    }
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/16_misc_pseudo_recursion.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/16_misc_pseudo_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..6faf3e849228a8bbef34e75ec0c0dc3d9235c491
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/16_misc_pseudo_recursion.c
@@ -0,0 +1,70 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2) {
+    int *data;
+    if(!ptr2 && x >= y && x < 10) {
+        return 0;
+    }
+
+    if(i > 0) {
+        return 37;
+    }
+
+    if(!ptr1) {
+        ptr1 = malloc(sizeof(int));
+        if(ptr1) {
+            *ptr1 = 1;
+        } else {
+            if(ptr2) {
+                free(ptr2);
+            }
+            return -1;
+        }
+    }
+    if(!ptr2) {
+        ptr2 = malloc(sizeof(int));
+        if(!ptr2) {
+            free(ptr1);
+            return -1;
+        }
+    }
+
+    if(x < y) {
+        *ptr2 = *ptr1;
+    }
+
+    return uninit_malloc_pseudo_rec2(x, y, 1, ptr1, ptr2);
+}
+
+int uninit_malloc_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2) {
+    int val;
+
+    if(i <= 0) {
+        return 3 * (*ptr1) + uninit_malloc_pseudo_rec1(x, y, 1, ptr1, ptr2);
+    }
+
+    if(x > 10) {
+        val = *ptr1;
+    } else {
+        val = *ptr2;
+    }
+
+    free(ptr1);
+    free(ptr2);
+
+    return 3 * val;
+}
+
+int main() {
+    int* initialized = malloc(sizeof(int));
+    printf("%i\n", uninit_malloc_pseudo_rec1(9, 10, 0, 0, 0));
+    if(initialized) {
+        *initialized = 2;
+        printf("%i\n", uninit_malloc_pseudo_rec1(10, 10, 0, 0, initialized));
+    }
+    printf("%i\n", uninit_malloc_pseudo_rec1(11, 10, 0, 0, 0));
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/17_complex_function_pointers.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/17_complex_function_pointers.c
new file mode 100644
index 0000000000000000000000000000000000000000..4c94f898bcede01c3f9e4f20f0bb4168335c4f96
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/17_complex_function_pointers.c
@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+    if(condition) {
+        **dest = val;
+    }
+}
+
+void uninit_malloc_function_pointer(bool a, bool b, void (*f)(int**, int, bool)) {
+    int *data;
+
+    /* To be used if  is defined */
+    /* and tool warns about possible dangerous input */
+    if(!f || (!a & !b)) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    (*f)(&data, 5, a);
+    (*f)(&data, 13, b);
+
+    printf("%i\n", *data);
+
+    free(data);
+}
+
+int main() {
+    uninit_malloc_function_pointer(true, true, &possibly_assign);
+    uninit_malloc_function_pointer(true, false, &possibly_assign);
+    uninit_malloc_function_pointer(false, true, &possibly_assign);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/18_complex_struct_multiple_methods.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/18_complex_struct_multiple_methods.c
new file mode 100644
index 0000000000000000000000000000000000000000..d9cc96f8ee596bb0d2a146242e31dcb579f6bdd4
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/18_complex_struct_multiple_methods.c
@@ -0,0 +1,94 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+    cont->counter = 1;
+    cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+    MallocIntCont* new_cont;
+
+    new_cont = malloc(sizeof(MallocIntCont));
+
+    if(new_cont) {
+        uninit_malloc_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+    if(cont->counter <= 1) {
+        if(cont->data) {
+           free(cont->data);
+        }
+        cont->data = malloc(sizeof(int));
+    } else {
+        cont->counter--;
+    }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+    if(cont->data) {
+        free(cont->data);
+    }
+    free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+    if(cont->data) {
+        return *(cont->data);
+    }
+    return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+    if(!cont->data) {
+        return;
+    }
+    *(cont->data) = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
+void uninit_malloc_struct(int x, int y) {
+    MallocIntCont cont;
+    int val;
+
+    if(x <= 10 && x >= y) {
+        return;
+    }
+
+    uninit_malloc_cont_init(&cont);
+
+    if(x < y) {
+        uninit_malloc_cont_set_value(&cont, 7);
+    }
+
+    if(x > 10) {
+        val = 50 * 37;
+    } else {
+        /* DANGER: if x <= 10 & x >= y */
+        val = 30 * uninit_malloc_cont_get_value(&cont);
+    }
+
+    if(cont.data) {
+        free(cont.data);
+    }
+
+    printf("x=%i: %i\n", x, val);
+}
+
+int main() {
+    uninit_malloc_struct(9, 10);
+    uninit_malloc_struct(10, 11);
+    uninit_malloc_struct(11, 10);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/19_complex_refcount.c b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/19_complex_refcount.c
new file mode 100644
index 0000000000000000000000000000000000000000..d9b3c7973306aec9a6e2f07dc5d6f14deb41d04d
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_correct_catch_bad/19_complex_refcount.c
@@ -0,0 +1,82 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+    cont->counter = 1;
+    cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+    MallocIntCont* new_cont;
+
+    new_cont = malloc(sizeof(MallocIntCont));
+
+    if(new_cont) {
+        uninit_malloc_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+    if(cont->counter <= 1) {
+        if(cont->data) {
+           free(cont->data);
+        }
+        cont->data = malloc(sizeof(int));
+    } else {
+        cont->counter--;
+    }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+    if(cont->data) {
+        free(cont->data);
+    }
+    free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+    if(cont->data) {
+        return *(cont->data);
+    }
+    return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+    if(!cont->data) {
+        return;
+    }
+    *(cont->data) = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
+int main() {
+    MallocIntCont* cont;
+    int val;
+
+    cont = uninit_malloc_cont_new();
+    if(!cont) {
+        return 1;
+    }
+    uninit_malloc_cont_set_value(cont, 35);
+
+    uninit_malloc_cont_incr(cont);
+    uninit_malloc_cont_incr(cont);
+    uninit_malloc_cont_decr(cont);
+    uninit_malloc_cont_decr(cont);
+
+    val = 30 * uninit_malloc_cont_get_value(cont);
+
+    printf("%i\n", val);
+
+    uninint_val_cont_free(cont);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/01_simple_if.c b/bench-moerman2018/memory/access_uninit/test_incorrect/01_simple_if.c
new file mode 100644
index 0000000000000000000000000000000000000000..37d2ea31d77d88497ac56fcc79d60b4b3cf8af09
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/01_simple_if.c
@@ -0,0 +1,38 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else(bool a, bool b) {
+    int* data;
+    int val;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(a) {
+        *data = 1;
+    }
+
+    if(b) {
+        val = 37 * 2;
+    } else {
+        val = 11 * *data; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+
+    free(data);
+}
+
+int main() {
+    uninit_malloc_if_else(true, true); /* OK */
+    uninit_malloc_if_else(false, false); /* DANGER */
+    uninit_malloc_if_else(false, true); /* OK */
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/02_simple_if_int1.c b/bench-moerman2018/memory/access_uninit/test_incorrect/02_simple_if_int1.c
new file mode 100644
index 0000000000000000000000000000000000000000..af69b525ef010849b9c0cf67d10e0bc2ac2cf790
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/02_simple_if_int1.c
@@ -0,0 +1,37 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int1(int x, int y) {
+    int* data;
+    int val;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(x < y) {
+        *data = 1;
+    }
+
+    if(x > 10) {
+        val = 37 * 2;
+    } else {
+        val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+    }
+
+    printf("x=%i: %i", x, val);
+
+    free(data);
+}
+
+int main() {
+    uninit_malloc_if_else_int1(9, 10); /* OK */
+    uninit_malloc_if_else_int1(10, 10); /* DANGER */
+    uninit_malloc_if_else_int1(11, 10); /* OK */
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/02_simple_if_int2.c b/bench-moerman2018/memory/access_uninit/test_incorrect/02_simple_if_int2.c
new file mode 100644
index 0000000000000000000000000000000000000000..02124b7fb8068fd8b7562a290395b1436a9ef902
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/02_simple_if_int2.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int2(int x, int y) {
+    int* data;
+    int val, m, n;
+
+    m = -1;
+    n = 5;
+
+    x = x*m+n;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(x < y) {
+        *data = 1;
+    }
+
+    if(x > 10) {
+        val = 37 * 2;
+    } else {
+        val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+    }
+
+    printf("x=%i: %i", x, val);
+
+    free(data);
+}
+
+int main() {
+    uninit_malloc_if_else_int2(-4, 10); /* OK */
+    uninit_malloc_if_else_int2(-5, 10); /* DANGER */
+    uninit_malloc_if_else_int2(-6, 10); /* OK */
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/03_simple_if_multi_func.c b/bench-moerman2018/memory/access_uninit/test_incorrect/03_simple_if_multi_func.c
new file mode 100644
index 0000000000000000000000000000000000000000..d6db6248c9eef2207284c6c80ab03d0adeb75328
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/03_simple_if_multi_func.c
@@ -0,0 +1,44 @@
+#include "uninitialized_malloc.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void possibly_assign(int* dest, int val, bool condition) {
+    if(condition) {
+        *dest = val;
+    }
+}
+
+static int conditional_assign(int* ptr1, int* ptr2, bool condition) {
+    if(condition) {
+        return *ptr1;
+    }
+    return *ptr2;
+}
+
+void uninit_malloc_if_else_multi(bool a, bool b) {
+    int* data;
+    int val = -7189;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    possibly_assign(data, 37, a);
+
+    val = conditional_assign(&val, data, b); /* DANGER, if !a & !b */
+
+    printf("%i\n", val);
+
+    free(data);
+}
+
+int main() {
+    uninit_malloc_if_else_multi(true, true); /* OK */
+    uninit_malloc_if_else_multi(false, false); /* DANGER */
+    uninit_malloc_if_else_multi(false, true); /* OK */
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/04_simple_switch.c b/bench-moerman2018/memory/access_uninit/test_incorrect/04_simple_switch.c
new file mode 100644
index 0000000000000000000000000000000000000000..db966f2aa613c08cba0b2cf26f553ea6a49c29a5
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/04_simple_switch.c
@@ -0,0 +1,52 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+
+int uninit_malloc_switch(int x, int y) {
+    int* data;
+    int val;
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return -1;
+    }
+
+    if(x < y) {
+        *data = 1;
+    }
+
+    switch (x) {
+        case 5: {
+            val = 37 * *data; /* DANGER: x >= y */
+            break;
+        }
+        case 7: {
+            val = -37 * 2;
+            break;
+        }
+        case 10: {
+            val = 73 * *data; /* DANGER: x >= y */
+            break;
+        }
+        case 12: {
+            val = 73 * 5;
+            break;
+        }
+        default: {
+            val = 100 * 8;
+            break;
+        }
+    };
+
+    free(data);
+
+    return val;
+}
+
+int main() {
+    uninit_malloc_switch(5, 10); /* OK */
+    uninit_malloc_switch(10, 10); /* DANGER */
+    uninit_malloc_switch(11, 10); /* OK */
+    uninit_malloc_switch(7, 5); /* OK */
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/05_simple_goto.c b/bench-moerman2018/memory/access_uninit/test_incorrect/05_simple_goto.c
new file mode 100644
index 0000000000000000000000000000000000000000..d55ddf23abfce913484103fa58f99ffedb88f5bc
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/05_simple_goto.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_goto(int x) {
+    int val = 0, i = 0;
+    int* data;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    *data = x;
+
+GOTO_LABEL:
+    if(i <= x) {
+        if(data) {
+            val += *data;
+        }
+    } else {
+        printf("%i\n", val);
+    }
+
+    free(data);
+    data = malloc(sizeof(int));
+
+    if(i == 0) {
+        i++;
+        goto GOTO_LABEL;
+    }
+
+    free(data);
+}
+
+int main() {
+    uninit_malloc_goto(1);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/06_simple_pass_by_reference.c b/bench-moerman2018/memory/access_uninit/test_incorrect/06_simple_pass_by_reference.c
new file mode 100644
index 0000000000000000000000000000000000000000..c2856a44c23ba39d4beba94792eebcc8caf3b242
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/06_simple_pass_by_reference.c
@@ -0,0 +1,36 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+    if(condition) {
+        **dest = val;
+    }
+}
+
+void uninit_malloc_pass_by_reference(bool a, bool b) {
+    int* data;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    possibly_assign(&data, 5, a);
+    possibly_assign(&data, 13, b);
+
+    printf("%i\n", *data);
+
+    free(data);
+}
+
+int main() {
+    uninit_malloc_pass_by_reference(true, true); /* OK */
+    uninit_malloc_pass_by_reference(false, false); /* DANGER */
+    uninit_malloc_pass_by_reference(false, true); /* OK */
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/07_simple_cross_file.c b/bench-moerman2018/memory/access_uninit/test_incorrect/07_simple_cross_file.c
new file mode 100644
index 0000000000000000000000000000000000000000..720ae445ba2d3b7092f4c1a8f812be254f8c160c
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/07_simple_cross_file.c
@@ -0,0 +1,37 @@
+#include "uninitialized_malloc.h"
+#include "common.h"
+#include <stdlib.h>
+#include <stdbool.h>
+#include <stdio.h>
+
+void uninit_malloc_cross_file(bool a, bool b) {
+    int* data;
+    int val;
+    int* int_ptr;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    int_ptr = (int*) choose_pointer((void*) data, (void*) &val, a);
+    *int_ptr = 768;
+
+    if(b) {
+        val = 10 * 2;
+    } else {
+        val = 10 * *data; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+    free(data);
+}
+
+int main() {
+    uninit_malloc_cross_file(true, true); /* OK */
+    uninit_malloc_cross_file(false, false); /* DANGER */
+    uninit_malloc_cross_file(false, true); /* OK */
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/08_loop_for.c b/bench-moerman2018/memory/access_uninit/test_incorrect/08_loop_for.c
new file mode 100644
index 0000000000000000000000000000000000000000..05b9c9df0c29b38e8d855f204c900689570d0dba
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/08_loop_for.c
@@ -0,0 +1,36 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for(int x) {
+    int* data;
+    int val = 0;
+    int i;
+
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    for(i = 0; i < 20; i++) {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+    }
+
+    printf("val = %i\n", val);
+    free(data);
+}
+
+int main() {
+    uninit_malloc_for(9);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/09_loop_for_complex.c b/bench-moerman2018/memory/access_uninit/test_incorrect/09_loop_for_complex.c
new file mode 100644
index 0000000000000000000000000000000000000000..023b07d0ce012c22d870aa18c720cadf3d7d60c5
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/09_loop_for_complex.c
@@ -0,0 +1,39 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_complex(int x) {
+    int* data;
+    int val = 0, i = 0;
+
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    for(;;) {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+        i++;
+        if(i >= 20) {
+            break;
+        }
+    }
+
+    printf("val = %i\n", val);
+    free(data);
+}
+
+int main() {
+    uninit_malloc_for_complex(9);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/10_loop_while_continue.c b/bench-moerman2018/memory/access_uninit/test_incorrect/10_loop_while_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..6852d0c8e750bb32da9dd6c77aca83f223a96bff
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/10_loop_while_continue.c
@@ -0,0 +1,39 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_while_continue(int x) {
+    int* data;
+    int val = 0, i = 0;
+
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    while(i < 30) {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    }
+
+    printf("val = %i", val);
+    free(data);
+}
+
+int main() {
+    uninit_malloc_while_continue(9);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/11_loop_while_do_continue.c b/bench-moerman2018/memory/access_uninit/test_incorrect/11_loop_while_do_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..4a210a0e3dc9df7511931472208f2a1654f9f294
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/11_loop_while_do_continue.c
@@ -0,0 +1,39 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_do_while_continue(int x) {
+    int* data;
+    int val = 0, i = 0;
+
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    do {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    } while(i < 30);
+
+    printf("val = %i", val);
+    free(data);
+}
+
+int main() {
+    uninit_malloc_do_while_continue(9);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/12_loop_for_array_branching.c b/bench-moerman2018/memory/access_uninit/test_incorrect/12_loop_for_array_branching.c
new file mode 100644
index 0000000000000000000000000000000000000000..a9b1a0e5631d94030e84cbf7420db028dfd028b9
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/12_loop_for_array_branching.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_array(int x) {
+    int* data;
+    int p[20];
+    int val = 0, i = 0;
+
+    if(x < 0 || x > 19) {
+        return;
+    }
+
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    *data = 12;
+
+    for(i = 0; i < 20; i++) {
+        p[i] = 0;
+    }
+    p[x] = 1;
+
+    for(i = 0; i < 20; i++) {
+        if(p[i] == 1) {
+            free(data);
+            data = malloc(sizeof(int));
+            if(!data) {
+                return;
+            }
+        } else {
+            val += *data; /* DANGER: x < 19 */
+        }
+    }
+
+    printf("%i\n", val);
+    free(data);
+}
+
+int main() {
+    uninit_malloc_for_array(10);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/memory/access_uninit/test_incorrect/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 0000000000000000000000000000000000000000..f6ed2b464fad573060dd0e84da77a3d6246d81fa
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,43 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_pointer(int x) {
+    int* pointers[10];
+    int** pointers_alias = pointers;
+    int val = 0, i;
+
+    if(x < 0 || x > 10) {
+        return;
+    }
+
+
+    for(i = 0; i < 10; i++, pointers_alias++) {
+        *pointers_alias = malloc(sizeof(int));
+    }
+
+    pointers_alias = pointers;
+    for(i = 0; i < x; i++, pointers_alias++) {
+        if(!(*pointers_alias)) {
+            continue;
+        }
+        **pointers_alias = i;
+    }
+
+    pointers_alias = pointers;
+    for(i = 0; i < 10; i++, pointers_alias++) {
+        if(!(*pointers_alias)) {
+            continue;
+        }
+        val += **pointers_alias;
+        free(*pointers_alias);
+    }
+
+    printf("%i\n", val);
+}
+
+int main() {
+    uninit_malloc_for_pointer(9);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/14_loop_recursion.c b/bench-moerman2018/memory/access_uninit/test_incorrect/14_loop_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..caed78493f38f2bd804ec34813ae94fac10231b3
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/14_loop_recursion.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec(int x, int i, int* ptr1, int* ptr2) {
+    int val;
+
+    if(i <= 1) {
+        free(ptr1);
+        free(ptr2);
+        return 0;
+    }
+
+
+    if(!ptr1) {
+        ptr1 = malloc(sizeof(int));
+        if(ptr1) {
+            *ptr1 = 1;
+        } else {
+            if(ptr2) {
+                free(ptr2);
+            }
+            return -1;
+        }
+    }
+    if(!ptr2) {
+        ptr2 = malloc(sizeof(int));
+        if(!ptr2) {
+            free(ptr1);
+            return -1;
+        }
+        return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 2 * *ptr1;
+    }
+
+    if(i < x) {
+        val = *ptr2;
+    } else {
+        val = *ptr1;
+    }
+    if(i == 10) {
+        *ptr2 = *ptr1;
+    }
+    return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 3 * val;
+}
+
+int main() {
+    printf("%i\n", uninit_malloc_rec(11, 20, 0, 0));
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/15_loop_recursion_multi.c b/bench-moerman2018/memory/access_uninit/test_incorrect/15_loop_recursion_multi.c
new file mode 100644
index 0000000000000000000000000000000000000000..78da23e0249090c80e169dea4b3d53253d77e6d8
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/15_loop_recursion_multi.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec_decr(int x, int i, int* ptr1, int* ptr2) {
+    if(i <= 1) {
+        return 0;
+    }
+
+    return uninit_malloc_rec_multi(x, i-1, ptr1, ptr2);
+}
+
+int uninit_malloc_rec_multi(int x, int i, int* ptr1, int* ptr2) {
+    int val;
+
+    if(i <= 1) {
+        free(ptr1);
+        free(ptr2);
+        return 0;
+    }
+
+
+    if(!ptr1) {
+        ptr1 = malloc(sizeof(int));
+        if(ptr1) {
+            *ptr1 = 1;
+        } else {
+            if(ptr2) {
+                free(ptr2);
+            }
+            return -1;
+        }
+    }
+    if(!ptr2) {
+        ptr2 = malloc(sizeof(int));
+        if(!ptr2) {
+            free(ptr1);
+            return -1;
+        }
+        return 2 * *ptr1 + uninit_malloc_rec_decr(x, i, ptr1, ptr2);
+    }
+
+    if(i < x) {
+        val = *ptr2;
+    } else {
+        val = *ptr1;
+    }
+    if(i == 10) {
+        *ptr2 = *ptr1;
+    }
+    return uninit_malloc_rec_decr(x, i, ptr1, ptr2) + 3 * val;
+}
+
+int main() {
+    printf("%i\n", uninit_malloc_rec_multi(11, 20, 0, 0));
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/16_misc_pseudo_recursion.c b/bench-moerman2018/memory/access_uninit/test_incorrect/16_misc_pseudo_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..fb83e88a362fc490362f46d998b5941dd426354f
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/16_misc_pseudo_recursion.c
@@ -0,0 +1,61 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2) {
+    int *data;
+
+    if(i > 0) {
+        return 37;
+    }
+
+    if(!ptr1) {
+        ptr1 = malloc(sizeof(int));
+        if(ptr1) {
+            *ptr1 = 1;
+        } else {
+            if(ptr2) {
+                free(ptr2);
+            }
+            return -1;
+        }
+    }
+    if(!ptr2) {
+        ptr2 = malloc(sizeof(int));
+        if(!ptr2) {
+            free(ptr1);
+            return -1;
+        }
+    }
+
+    if(x < y) {
+        *ptr2 = *ptr1;
+    }
+
+    return uninit_malloc_pseudo_rec2(x, y, 1, ptr1, ptr2);
+}
+
+int uninit_malloc_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2) {
+    int val;
+
+    if(i <= 0) {
+        return 3 * (*ptr1) + uninit_malloc_pseudo_rec1(x, y, 1, ptr1, ptr2);
+    }
+
+    if(x > 10) {
+        val = *ptr1;
+    } else {
+        val = *ptr2;
+    }
+
+    free(ptr1);
+    free(ptr2);
+
+    return 3 * val;
+}
+
+int main() {
+    printf("%i\n", uninit_malloc_pseudo_rec1(10, 10, 0, 0, 0));
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/17_complex_function_pointers.c b/bench-moerman2018/memory/access_uninit/test_incorrect/17_complex_function_pointers.c
new file mode 100644
index 0000000000000000000000000000000000000000..c52e4146a319445602163c5715d50c42ec130848
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/17_complex_function_pointers.c
@@ -0,0 +1,36 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+    if(condition) {
+        **dest = val;
+    }
+}
+
+void uninit_malloc_function_pointer(bool a, bool b, void (*f)(int**, int, bool)) {
+    int *data;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    (*f)(&data, 5, a);
+    (*f)(&data, 13, b);
+
+    printf("%i\n", *data);
+
+    free(data);
+}
+
+int main() {
+    uninit_malloc_function_pointer(true, true, &possibly_assign); /* OK */
+    uninit_malloc_function_pointer(false, false, &possibly_assign); /* DANGER */
+    uninit_malloc_function_pointer(false, true, &possibly_assign); /* OK */
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/18_complex_struct_multiple_methods.c b/bench-moerman2018/memory/access_uninit/test_incorrect/18_complex_struct_multiple_methods.c
new file mode 100644
index 0000000000000000000000000000000000000000..16503cfdb44184ab0d2bc04b0c6678e1954f7454
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/18_complex_struct_multiple_methods.c
@@ -0,0 +1,89 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+    cont->counter = 1;
+    cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+    MallocIntCont* new_cont;
+
+    new_cont = malloc(sizeof(MallocIntCont));
+
+    if(new_cont) {
+        uninit_malloc_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+    if(cont->counter <= 1) {
+        if(cont->data) {
+           free(cont->data);
+        }
+        cont->data = malloc(sizeof(int));
+    } else {
+        cont->counter--;
+    }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+    if(cont->data) {
+        free(cont->data);
+    }
+    free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+    if(cont->data) {
+        return *(cont->data);
+    }
+    return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+    if(!cont->data) {
+        return;
+    }
+    *(cont->data) = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
+void uninit_malloc_struct(int x, int y) {
+    MallocIntCont cont;
+    int val;
+
+
+    uninit_malloc_cont_init(&cont);
+
+    if(x < y) {
+        uninit_malloc_cont_set_value(&cont, 7);
+    }
+
+    if(x > 10) {
+        val = 50 * 37;
+    } else {
+        /* DANGER: if x <= 10 & x >= y */
+        val = 30 * uninit_malloc_cont_get_value(&cont);
+    }
+
+    if(cont.data) {
+        free(cont.data);
+    }
+
+    printf("x=%i: %i\n", x, val);
+}
+
+int main() {
+    uninit_malloc_struct(10, 10); /* DANGER */
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_incorrect/19_complex_refcount.c b/bench-moerman2018/memory/access_uninit/test_incorrect/19_complex_refcount.c
new file mode 100644
index 0000000000000000000000000000000000000000..5205aa5c9132c5d0a1e0d91de370e9aee3c8e128
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_incorrect/19_complex_refcount.c
@@ -0,0 +1,83 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+    cont->counter = 1;
+    cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+    MallocIntCont* new_cont;
+
+    new_cont = malloc(sizeof(MallocIntCont));
+
+    if(new_cont) {
+        uninit_malloc_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+    if(cont->counter <= 1) {
+        if(cont->data) {
+           free(cont->data);
+        }
+        cont->data = malloc(sizeof(int));
+    } else {
+        cont->counter--;
+    }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+    if(cont->data) {
+        free(cont->data);
+    }
+    free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+    if(cont->data) {
+        return *(cont->data);
+    }
+    return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+    if(!cont->data) {
+        return;
+    }
+    *(cont->data) = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
+int main() {
+    MallocIntCont* cont;
+    int val;
+
+    cont = uninit_malloc_cont_new();
+    if(!cont) {
+        return 1;
+    }
+    uninit_malloc_cont_set_value(cont, 35);
+
+    uninit_malloc_cont_incr(cont);
+    uninit_malloc_cont_incr(cont);
+    uninit_malloc_cont_decr(cont);
+    uninit_malloc_cont_decr(cont);
+    uninit_malloc_cont_decr(cont);
+
+    val = 30 * uninit_malloc_cont_get_value(cont);
+
+    printf("%i\n", val);
+
+    uninint_val_cont_free(cont);
+
+    return 1;
+}
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/01_simple_if.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/01_simple_if.c
new file mode 100644
index 0000000000000000000000000000000000000000..5277b1cc5701a3fdbe795cc9e83106c3f0af9f46
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/01_simple_if.c
@@ -0,0 +1,34 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else(bool a, bool b) {
+    int* data;
+    int val;
+
+    if(!a & !b) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(a) {
+        *data = 1;
+    }
+
+    if(b) {
+        val = 37 * 2;
+    } else {
+        val = 11 * *data; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/02_simple_if_int1.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/02_simple_if_int1.c
new file mode 100644
index 0000000000000000000000000000000000000000..4d6edc85b4cf9656ba7d79a0d8556cdc18a359d9
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/02_simple_if_int1.c
@@ -0,0 +1,33 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int1(int x, int y) {
+    int* data;
+    int val;
+
+    if(x <= 10 && x >= y) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(x < y) {
+        *data = 1;
+    }
+
+    if(x > 10) {
+        val = 37 * 2;
+    } else {
+        val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+    }
+
+    printf("x=%i: %i", x, val);
+
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/02_simple_if_int2.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/02_simple_if_int2.c
new file mode 100644
index 0000000000000000000000000000000000000000..39c31e2880e104d1da5f794b890e8a81105ef1d5
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/02_simple_if_int2.c
@@ -0,0 +1,38 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int2(int x, int y) {
+    int* data;
+    int val, m, n;
+
+    m = -1;
+    n = 5;
+
+    x = x*m+n;
+
+    if(x <= 10 && x >= y) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(x < y) {
+        *data = 1;
+    }
+
+    if(x > 10) {
+        val = 37 * 2;
+    } else {
+        val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+    }
+
+    printf("x=%i: %i", x, val);
+
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/03_simple_if_multi_func.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/03_simple_if_multi_func.c
new file mode 100644
index 0000000000000000000000000000000000000000..668baee4ab840cff7c4a9de81527f13ee1ed0b2c
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/03_simple_if_multi_func.c
@@ -0,0 +1,41 @@
+#include "uninitialized_malloc.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void possibly_assign(int* dest, int val, bool condition) {
+    if(condition) {
+        *dest = val;
+    }
+}
+
+static int conditional_assign(int* ptr1, int* ptr2, bool condition) {
+    if(condition) {
+        return *ptr1;
+    }
+    return *ptr2;
+}
+
+void uninit_malloc_if_else_multi(bool a, bool b) {
+    int* data;
+    int val = -7189;
+
+    if(!a & !b) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    possibly_assign(data, 37, a);
+
+    val = conditional_assign(&val, data, b); /* DANGER, if !a & !b */
+
+    printf("%i\n", val);
+
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/04_simple_switch.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/04_simple_switch.c
new file mode 100644
index 0000000000000000000000000000000000000000..e7fcb02628d2f46655d6f1b1b5cca860fdc67c9b
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/04_simple_switch.c
@@ -0,0 +1,47 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+
+int uninit_malloc_switch(int x, int y) {
+    int* data;
+    int val;
+
+    if((x == 10 || x == 5) && x >= y) {
+        return -1;
+    }
+    data = malloc(sizeof(int));
+    if(!data) {
+        return -1;
+    }
+
+    if(x < y) {
+        *data = 1;
+    }
+
+    switch (x) {
+        case 5: {
+            val = 37 * *data; /* DANGER: x >= y */
+            break;
+        }
+        case 7: {
+            val = -37 * 2;
+            break;
+        }
+        case 10: {
+            val = 73 * *data; /* DANGER: x >= y */
+            break;
+        }
+        case 12: {
+            val = 73 * 5;
+            break;
+        }
+        default: {
+            val = 100 * 8;
+            break;
+        }
+    };
+
+    free(data);
+
+    return val;
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/05_simple_goto.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/05_simple_goto.c
new file mode 100644
index 0000000000000000000000000000000000000000..73f9042494a215bd06da2ed0b5575841fccb9c4c
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/05_simple_goto.c
@@ -0,0 +1,40 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_goto(int x) {
+    int val = 0, i = 0;
+    int* data;
+
+    if(x > 0) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    *data = x;
+
+GOTO_LABEL:
+    if(i <= x) {
+        if(data) {
+            val += *data;
+        }
+    } else {
+        printf("%i\n", val);
+    }
+
+    free(data);
+    data = malloc(sizeof(int));
+
+    if(i == 0) {
+        i++;
+        goto GOTO_LABEL;
+    }
+
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/06_simple_pass_by_reference.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/06_simple_pass_by_reference.c
new file mode 100644
index 0000000000000000000000000000000000000000..624c7fe17d585eeff85da67e47304519c862e7fb
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/06_simple_pass_by_reference.c
@@ -0,0 +1,34 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+    if(condition) {
+        **dest = val;
+    }
+}
+
+void uninit_malloc_pass_by_reference(bool a, bool b) {
+    int* data;
+
+    /* To be used if NO_BUG is defined */
+    /* and tool warns about possible dangerous input */
+    if(!a & !b) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    possibly_assign(&data, 5, a);
+    possibly_assign(&data, 13, b);
+
+    printf("%i\n", *data);
+
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/07_simple_cross_file.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/07_simple_cross_file.c
new file mode 100644
index 0000000000000000000000000000000000000000..c84d5e15fd59003a8a45228eef983ffd8b25eda1
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/07_simple_cross_file.c
@@ -0,0 +1,34 @@
+#include "uninitialized_malloc.h"
+#include "common.h"
+#include <stdlib.h>
+#include <stdbool.h>
+#include <stdio.h>
+
+void uninit_malloc_cross_file(bool a, bool b) {
+    int* data;
+    int val;
+    int* int_ptr;
+
+    if(!a & !b) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    int_ptr = (int*) choose_pointer((void*) data, (void*) &val, a);
+    *int_ptr = 768;
+
+    if(b) {
+        val = 10 * 2;
+    } else {
+        val = 10 * *data; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/08_loop_for.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/08_loop_for.c
new file mode 100644
index 0000000000000000000000000000000000000000..16628d2c220ae85d1d1246e091760c7161151896
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/08_loop_for.c
@@ -0,0 +1,34 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for(int x) {
+    int* data;
+    int val = 0;
+    int i;
+
+    if(x < 10) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    for(i = 0; i < 20; i++) {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+    }
+
+    printf("val = %i\n", val);
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/09_loop_for_complex.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/09_loop_for_complex.c
new file mode 100644
index 0000000000000000000000000000000000000000..47195dff36edcf668baf361c4b57a7fe90b95f83
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/09_loop_for_complex.c
@@ -0,0 +1,37 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_complex(int x) {
+    int* data;
+    int val = 0, i = 0;
+
+    if(x < 10) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    for(;;) {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+        i++;
+        if(i >= 20) {
+            break;
+        }
+    }
+
+    printf("val = %i\n", val);
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/10_loop_while_continue.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/10_loop_while_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..5931bb104cc3008b2a51e71b85f7b4373256110c
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/10_loop_while_continue.c
@@ -0,0 +1,37 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_while_continue(int x) {
+    int* data;
+    int val = 0, i = 0;
+
+    if(x < 10) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    while(i < 30) {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    }
+
+    printf("val = %i", val);
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/11_loop_while_do_continue.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/11_loop_while_do_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..0dfd697895d021a66a4840d7fc24a9c77a09fc72
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/11_loop_while_do_continue.c
@@ -0,0 +1,37 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_do_while_continue(int x) {
+    int* data;
+    int val = 0, i = 0;
+
+    if(x < 10) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    do {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    } while(i < 30);
+
+    printf("val = %i", val);
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/12_loop_for_array_branching.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/12_loop_for_array_branching.c
new file mode 100644
index 0000000000000000000000000000000000000000..e80bd1608e56fee65c294109a6992843b1242c0d
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/12_loop_for_array_branching.c
@@ -0,0 +1,45 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_array(int x) {
+    int* data;
+    int p[20];
+    int val = 0, i = 0;
+
+    if(x < 0 || x > 19) {
+        return;
+    }
+
+    if(x != 19) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    *data = 12;
+
+    for(i = 0; i < 20; i++) {
+        p[i] = 0;
+    }
+    p[x] = 1;
+
+    for(i = 0; i < 20; i++) {
+        if(p[i] == 1) {
+            free(data);
+            data = malloc(sizeof(int));
+            if(!data) {
+                return;
+            }
+        } else {
+            val += *data; /* DANGER: x < 19 */
+        }
+    }
+
+    printf("%i\n", val);
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 0000000000000000000000000000000000000000..151f89666309ac78c57dd691f44b265e2aeef402
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,41 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_pointer(int x) {
+    int* pointers[10];
+    int** pointers_alias = pointers;
+    int val = 0, i;
+
+    if(x < 0 || x > 10) {
+        return;
+    }
+
+    if(x != 10) {
+        return;
+    }
+
+    for(i = 0; i < 10; i++, pointers_alias++) {
+        *pointers_alias = malloc(sizeof(int));
+    }
+
+    pointers_alias = pointers;
+    for(i = 0; i < x; i++, pointers_alias++) {
+        if(!(*pointers_alias)) {
+            continue;
+        }
+        **pointers_alias = i;
+    }
+
+    pointers_alias = pointers;
+    for(i = 0; i < 10; i++, pointers_alias++) {
+        if(!(*pointers_alias)) {
+            continue;
+        }
+        val += **pointers_alias;
+        free(*pointers_alias);
+    }
+
+    printf("%i\n", val);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/14_loop_recursion.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/14_loop_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..7f3b85126c79462cc9473d787fdea371289cd107
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/14_loop_recursion.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec(int x, int i, int* ptr1, int* ptr2) {
+    int val;
+
+    if(i <= 1) {
+        free(ptr1);
+        free(ptr2);
+        return 0;
+    }
+
+    if(x > 10 && i < x && ptr2 == 0) {
+        return uninit_malloc_rec(x, i-1, ptr1, ptr1);
+    }
+
+    if(!ptr1) {
+        ptr1 = malloc(sizeof(int));
+        if(ptr1) {
+            *ptr1 = 1;
+        } else {
+            if(ptr2) {
+                free(ptr2);
+            }
+            return -1;
+        }
+    }
+    if(!ptr2) {
+        ptr2 = malloc(sizeof(int));
+        if(!ptr2) {
+            free(ptr1);
+            return -1;
+        }
+        return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 2 * *ptr1;
+    }
+
+    if(i < x) {
+        val = *ptr2;
+    } else {
+        val = *ptr1;
+    }
+    if(i == 10) {
+        *ptr2 = *ptr1;
+    }
+    return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 3 * val;
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/15_loop_recursion_multi.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/15_loop_recursion_multi.c
new file mode 100644
index 0000000000000000000000000000000000000000..60df7846ac289a6f03f5312e432505961d329a8b
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/15_loop_recursion_multi.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec_decr(int x, int i, int* ptr1, int* ptr2) {
+    if(i <= 1) {
+        return 0;
+    }
+
+    return uninit_malloc_rec_multi(x, i-1, ptr1, ptr2);
+}
+
+int uninit_malloc_rec_multi(int x, int i, int* ptr1, int* ptr2) {
+    int val;
+
+    if(i <= 1) {
+        free(ptr1);
+        free(ptr2);
+        return 0;
+    }
+
+    if(!ptr2) {
+        if((x > 0 && i < 10) || (i >= 10 && x > 10)) {
+            return uninit_malloc_rec(x, i-1, ptr1, ptr1);
+        }
+    }
+
+    if(!ptr1) {
+        ptr1 = malloc(sizeof(int));
+        if(ptr1) {
+            *ptr1 = 1;
+        } else {
+            if(ptr2) {
+                free(ptr2);
+            }
+            return -1;
+        }
+    }
+    if(!ptr2) {
+        ptr2 = malloc(sizeof(int));
+        if(!ptr2) {
+            free(ptr1);
+            return -1;
+        }
+        return 2 * *ptr1 + uninit_malloc_rec_decr(x, i, ptr1, ptr2);
+    }
+
+    if(i < x) {
+        val = *ptr2;
+    } else {
+        val = *ptr1;
+    }
+    if(i == 10) {
+        *ptr2 = *ptr1;
+    }
+    return uninit_malloc_rec_decr(x, i, ptr1, ptr2) + 3 * val;
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/16_misc_pseudo_recursion.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/16_misc_pseudo_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..eb621d03d5b00a017cd4f19f2adac391e0019bed
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/16_misc_pseudo_recursion.c
@@ -0,0 +1,59 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2) {
+    int *data;
+    if(!ptr2 && x >= y && x < 10) {
+        return 0;
+    }
+
+    if(i > 0) {
+        return 37;
+    }
+
+    if(!ptr1) {
+        ptr1 = malloc(sizeof(int));
+        if(ptr1) {
+            *ptr1 = 1;
+        } else {
+            if(ptr2) {
+                free(ptr2);
+            }
+            return -1;
+        }
+    }
+    if(!ptr2) {
+        ptr2 = malloc(sizeof(int));
+        if(!ptr2) {
+            free(ptr1);
+            return -1;
+        }
+    }
+
+    if(x < y) {
+        *ptr2 = *ptr1;
+    }
+
+    return uninit_malloc_pseudo_rec2(x, y, 1, ptr1, ptr2);
+}
+
+int uninit_malloc_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2) {
+    int val;
+
+    if(i <= 0) {
+        return 3 * (*ptr1) + uninit_malloc_pseudo_rec1(x, y, 1, ptr1, ptr2);
+    }
+
+    if(x > 10) {
+        val = *ptr1;
+    } else {
+        val = *ptr2;
+    }
+
+    free(ptr1);
+    free(ptr2);
+
+    return 3 * val;
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/17_complex_function_pointers.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/17_complex_function_pointers.c
new file mode 100644
index 0000000000000000000000000000000000000000..1acc624b1052df8fc819270aecd5fc808c5289f9
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/17_complex_function_pointers.c
@@ -0,0 +1,34 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+    if(condition) {
+        **dest = val;
+    }
+}
+
+void uninit_malloc_function_pointer(bool a, bool b, void (*f)(int**, int, bool)) {
+    int *data;
+
+    /* To be used if NO_BUG is defined */
+    /* and tool warns about possible dangerous input */
+    if(!f || (!a & !b)) {
+        return;
+    }
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    (*f)(&data, 5, a);
+    (*f)(&data, 13, b);
+
+    printf("%i\n", *data);
+
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/18_complex_struct_multiple_methods.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/18_complex_struct_multiple_methods.c
new file mode 100644
index 0000000000000000000000000000000000000000..bd12b5c44d6e41fb5197264b0dd7bdab132d5f8e
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/18_complex_struct_multiple_methods.c
@@ -0,0 +1,87 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+    cont->counter = 1;
+    cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+    MallocIntCont* new_cont;
+
+    new_cont = malloc(sizeof(MallocIntCont));
+
+    if(new_cont) {
+        uninit_malloc_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+    if(cont->counter <= 1) {
+        if(cont->data) {
+           free(cont->data);
+        }
+        cont->data = malloc(sizeof(int));
+    } else {
+        cont->counter--;
+    }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+    if(cont->data) {
+        free(cont->data);
+    }
+    free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+    if(cont->data) {
+        return *(cont->data);
+    }
+    return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+    if(!cont->data) {
+        return;
+    }
+    *(cont->data) = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
+void uninit_malloc_struct(int x, int y) {
+    MallocIntCont cont;
+    int val;
+
+    if(x <= 10 && x >= y) {
+        return;
+    }
+
+    uninit_malloc_cont_init(&cont);
+
+    if(x < y) {
+        uninit_malloc_cont_set_value(&cont, 7);
+    }
+
+    if(x > 10) {
+        val = 50 * 37;
+    } else {
+        /* DANGER: if x <= 10 & x >= y */
+        val = 30 * uninit_malloc_cont_get_value(&cont);
+    }
+
+    if(cont.data) {
+        free(cont.data);
+    }
+
+    printf("x=%i: %i\n", x, val);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_correct/19_complex_refcount.c b/bench-moerman2018/memory/access_uninit/test_lib_correct/19_complex_refcount.c
new file mode 100644
index 0000000000000000000000000000000000000000..3e2b9f1afb5fd0376833499f23b25db324bb3ef5
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_correct/19_complex_refcount.c
@@ -0,0 +1,59 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+    cont->counter = 1;
+    cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+    MallocIntCont* new_cont;
+
+    new_cont = malloc(sizeof(MallocIntCont));
+
+    if(new_cont) {
+        uninit_malloc_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+    if(cont->counter <= 1) {
+        if(cont->data) {
+           free(cont->data);
+        }
+        cont->data = malloc(sizeof(int));
+    } else {
+        cont->counter--;
+    }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+    if(cont->data) {
+        free(cont->data);
+    }
+    free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+    if(cont->data) {
+        return *(cont->data);
+    }
+    return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+    if(!cont->data) {
+        return;
+    }
+    *(cont->data) = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/01_simple_if.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/01_simple_if.c
new file mode 100644
index 0000000000000000000000000000000000000000..6a83c16b7f203d12596c48e7360cfddf193b8bb8
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/01_simple_if.c
@@ -0,0 +1,31 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else(bool a, bool b) {
+    int* data;
+    int val;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(a) {
+        *data = 1;
+    }
+
+    if(b) {
+        val = 37 * 2;
+    } else {
+        val = 11 * *data; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/02_simple_if_int1.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/02_simple_if_int1.c
new file mode 100644
index 0000000000000000000000000000000000000000..6ef90c4fadd6dcef8469f1c36a6704f538c720d0
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/02_simple_if_int1.c
@@ -0,0 +1,30 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int1(int x, int y) {
+    int* data;
+    int val;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(x < y) {
+        *data = 1;
+    }
+
+    if(x > 10) {
+        val = 37 * 2;
+    } else {
+        val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+    }
+
+    printf("x=%i: %i", x, val);
+
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/02_simple_if_int2.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/02_simple_if_int2.c
new file mode 100644
index 0000000000000000000000000000000000000000..36383ca677e38a57eec7e28a8504c3578beb9eaf
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/02_simple_if_int2.c
@@ -0,0 +1,35 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_if_else_int2(int x, int y) {
+    int* data;
+    int val, m, n;
+
+    m = -1;
+    n = 5;
+
+    x = x*m+n;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(x < y) {
+        *data = 1;
+    }
+
+    if(x > 10) {
+        val = 37 * 2;
+    } else {
+        val = 11 * *data; /* DANGER, if x <= 10 & x >= y */
+    }
+
+    printf("x=%i: %i", x, val);
+
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/03_simple_if_multi_func.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/03_simple_if_multi_func.c
new file mode 100644
index 0000000000000000000000000000000000000000..f6639f806f36e3d1beb199267e6a51755c63fea4
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/03_simple_if_multi_func.c
@@ -0,0 +1,38 @@
+#include "uninitialized_malloc.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void possibly_assign(int* dest, int val, bool condition) {
+    if(condition) {
+        *dest = val;
+    }
+}
+
+static int conditional_assign(int* ptr1, int* ptr2, bool condition) {
+    if(condition) {
+        return *ptr1;
+    }
+    return *ptr2;
+}
+
+void uninit_malloc_if_else_multi(bool a, bool b) {
+    int* data;
+    int val = -7189;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    possibly_assign(data, 37, a);
+
+    val = conditional_assign(&val, data, b); /* DANGER, if !a & !b */
+
+    printf("%i\n", val);
+
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/04_simple_switch.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/04_simple_switch.c
new file mode 100644
index 0000000000000000000000000000000000000000..011f04d662583586bc677e9e164433823714e04d
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/04_simple_switch.c
@@ -0,0 +1,44 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+
+int uninit_malloc_switch(int x, int y) {
+    int* data;
+    int val;
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return -1;
+    }
+
+    if(x < y) {
+        *data = 1;
+    }
+
+    switch (x) {
+        case 5: {
+            val = 37 * *data; /* DANGER: x >= y */
+            break;
+        }
+        case 7: {
+            val = -37 * 2;
+            break;
+        }
+        case 10: {
+            val = 73 * *data; /* DANGER: x >= y */
+            break;
+        }
+        case 12: {
+            val = 73 * 5;
+            break;
+        }
+        default: {
+            val = 100 * 8;
+            break;
+        }
+    };
+
+    free(data);
+
+    return val;
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/05_simple_goto.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/05_simple_goto.c
new file mode 100644
index 0000000000000000000000000000000000000000..443d4f2807b074d81620cf88381b88fef2d0d6ad
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/05_simple_goto.c
@@ -0,0 +1,37 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_goto(int x) {
+    int val = 0, i = 0;
+    int* data;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    *data = x;
+
+GOTO_LABEL:
+    if(i <= x) {
+        if(data) {
+            val += *data;
+        }
+    } else {
+        printf("%i\n", val);
+    }
+
+    free(data);
+    data = malloc(sizeof(int));
+
+    if(i == 0) {
+        i++;
+        goto GOTO_LABEL;
+    }
+
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/06_simple_pass_by_reference.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/06_simple_pass_by_reference.c
new file mode 100644
index 0000000000000000000000000000000000000000..0e5d75d5476a75283ee101771d8958793690a94b
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/06_simple_pass_by_reference.c
@@ -0,0 +1,29 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+    if(condition) {
+        **dest = val;
+    }
+}
+
+void uninit_malloc_pass_by_reference(bool a, bool b) {
+    int* data;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    possibly_assign(&data, 5, a);
+    possibly_assign(&data, 13, b);
+
+    printf("%i\n", *data);
+
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/07_simple_cross_file.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/07_simple_cross_file.c
new file mode 100644
index 0000000000000000000000000000000000000000..5a966148596beffa5802597ad7bb04ca71ed92e7
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/07_simple_cross_file.c
@@ -0,0 +1,31 @@
+#include "uninitialized_malloc.h"
+#include "common.h"
+#include <stdlib.h>
+#include <stdbool.h>
+#include <stdio.h>
+
+void uninit_malloc_cross_file(bool a, bool b) {
+    int* data;
+    int val;
+    int* int_ptr;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    int_ptr = (int*) choose_pointer((void*) data, (void*) &val, a);
+    *int_ptr = 768;
+
+    if(b) {
+        val = 10 * 2;
+    } else {
+        val = 10 * *data; /* DANGER, if !a & !b */
+    }
+
+    printf("%i\n", val);
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/08_loop_for.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/08_loop_for.c
new file mode 100644
index 0000000000000000000000000000000000000000..e2fc33b1517b8db7ef1dca7a4c4baa99a2de8fec
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/08_loop_for.c
@@ -0,0 +1,31 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for(int x) {
+    int* data;
+    int val = 0;
+    int i;
+
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    for(i = 0; i < 20; i++) {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+    }
+
+    printf("val = %i\n", val);
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/09_loop_for_complex.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/09_loop_for_complex.c
new file mode 100644
index 0000000000000000000000000000000000000000..40ae089803ec56a92b407024a6c545e28bc9c84c
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/09_loop_for_complex.c
@@ -0,0 +1,34 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_complex(int x) {
+    int* data;
+    int val = 0, i = 0;
+
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    for(;;) {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+        i++;
+        if(i >= 20) {
+            break;
+        }
+    }
+
+    printf("val = %i\n", val);
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/10_loop_while_continue.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/10_loop_while_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..45021fd7c84b0d59c587515cfb2681a9b7bc8b45
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/10_loop_while_continue.c
@@ -0,0 +1,34 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_while_continue(int x) {
+    int* data;
+    int val = 0, i = 0;
+
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    while(i < 30) {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    }
+
+    printf("val = %i", val);
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/11_loop_while_do_continue.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/11_loop_while_do_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..abbef5a00fb8f09be47face9ad11a25106575f31
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/11_loop_while_do_continue.c
@@ -0,0 +1,34 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_do_while_continue(int x) {
+    int* data;
+    int val = 0, i = 0;
+
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    do {
+        if(i > x) {
+            val += 10 * (*data - 2); /* DANGER: x < 10 */
+        } else {
+            val += 10 * 4;
+        }
+        if(i == 10) {
+            *data = 4;
+            val += 10 * *data;
+        }
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    } while(i < 30);
+
+    printf("val = %i", val);
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/12_loop_for_array_branching.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/12_loop_for_array_branching.c
new file mode 100644
index 0000000000000000000000000000000000000000..0afcf7c39319f45144d6c9b901e5dfbf233b45e3
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/12_loop_for_array_branching.c
@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_array(int x) {
+    int* data;
+    int p[20];
+    int val = 0, i = 0;
+
+    if(x < 0 || x > 19) {
+        return;
+    }
+
+
+    data = malloc(sizeof(int));
+    if(!data) {
+        return;
+    }
+
+    *data = 12;
+
+    for(i = 0; i < 20; i++) {
+        p[i] = 0;
+    }
+    p[x] = 1;
+
+    for(i = 0; i < 20; i++) {
+        if(p[i] == 1) {
+            free(data);
+            data = malloc(sizeof(int));
+            if(!data) {
+                return;
+            }
+        } else {
+            val += *data; /* DANGER: x < 19 */
+        }
+    }
+
+    printf("%i\n", val);
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 0000000000000000000000000000000000000000..142857af0d7514d7d6685e2ef8dc5447dfbffdb3
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,38 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "uninitialized_malloc.h"
+
+void uninit_malloc_for_pointer(int x) {
+    int* pointers[10];
+    int** pointers_alias = pointers;
+    int val = 0, i;
+
+    if(x < 0 || x > 10) {
+        return;
+    }
+
+
+    for(i = 0; i < 10; i++, pointers_alias++) {
+        *pointers_alias = malloc(sizeof(int));
+    }
+
+    pointers_alias = pointers;
+    for(i = 0; i < x; i++, pointers_alias++) {
+        if(!(*pointers_alias)) {
+            continue;
+        }
+        **pointers_alias = i;
+    }
+
+    pointers_alias = pointers;
+    for(i = 0; i < 10; i++, pointers_alias++) {
+        if(!(*pointers_alias)) {
+            continue;
+        }
+        val += **pointers_alias;
+        free(*pointers_alias);
+    }
+
+    printf("%i\n", val);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/14_loop_recursion.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/14_loop_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..ccb1bdf2f04306321cc7c5070a847b154fdcbe19
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/14_loop_recursion.c
@@ -0,0 +1,45 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec(int x, int i, int* ptr1, int* ptr2) {
+    int val;
+
+    if(i <= 1) {
+        free(ptr1);
+        free(ptr2);
+        return 0;
+    }
+
+
+    if(!ptr1) {
+        ptr1 = malloc(sizeof(int));
+        if(ptr1) {
+            *ptr1 = 1;
+        } else {
+            if(ptr2) {
+                free(ptr2);
+            }
+            return -1;
+        }
+    }
+    if(!ptr2) {
+        ptr2 = malloc(sizeof(int));
+        if(!ptr2) {
+            free(ptr1);
+            return -1;
+        }
+        return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 2 * *ptr1;
+    }
+
+    if(i < x) {
+        val = *ptr2;
+    } else {
+        val = *ptr1;
+    }
+    if(i == 10) {
+        *ptr2 = *ptr1;
+    }
+    return uninit_malloc_rec(x, i-1, ptr1, ptr2) + 3 * val;
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/15_loop_recursion_multi.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/15_loop_recursion_multi.c
new file mode 100644
index 0000000000000000000000000000000000000000..3b89210dd55e25e4d4a54b833f8ae5ded72cdc5f
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/15_loop_recursion_multi.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_rec_decr(int x, int i, int* ptr1, int* ptr2) {
+    if(i <= 1) {
+        return 0;
+    }
+
+    return uninit_malloc_rec_multi(x, i-1, ptr1, ptr2);
+}
+
+int uninit_malloc_rec_multi(int x, int i, int* ptr1, int* ptr2) {
+    int val;
+
+    if(i <= 1) {
+        free(ptr1);
+        free(ptr2);
+        return 0;
+    }
+
+
+    if(!ptr1) {
+        ptr1 = malloc(sizeof(int));
+        if(ptr1) {
+            *ptr1 = 1;
+        } else {
+            if(ptr2) {
+                free(ptr2);
+            }
+            return -1;
+        }
+    }
+    if(!ptr2) {
+        ptr2 = malloc(sizeof(int));
+        if(!ptr2) {
+            free(ptr1);
+            return -1;
+        }
+        return 2 * *ptr1 + uninit_malloc_rec_decr(x, i, ptr1, ptr2);
+    }
+
+    if(i < x) {
+        val = *ptr2;
+    } else {
+        val = *ptr1;
+    }
+    if(i == 10) {
+        *ptr2 = *ptr1;
+    }
+    return uninit_malloc_rec_decr(x, i, ptr1, ptr2) + 3 * val;
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/16_misc_pseudo_recursion.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/16_misc_pseudo_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..b62ae16ff21f19863ae4a659e2200e9a6526aea0
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/16_misc_pseudo_recursion.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+int uninit_malloc_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2) {
+    int *data;
+
+    if(i > 0) {
+        return 37;
+    }
+
+    if(!ptr1) {
+        ptr1 = malloc(sizeof(int));
+        if(ptr1) {
+            *ptr1 = 1;
+        } else {
+            if(ptr2) {
+                free(ptr2);
+            }
+            return -1;
+        }
+    }
+    if(!ptr2) {
+        ptr2 = malloc(sizeof(int));
+        if(!ptr2) {
+            free(ptr1);
+            return -1;
+        }
+    }
+
+    if(x < y) {
+        *ptr2 = *ptr1;
+    }
+
+    return uninit_malloc_pseudo_rec2(x, y, 1, ptr1, ptr2);
+}
+
+int uninit_malloc_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2) {
+    int val;
+
+    if(i <= 0) {
+        return 3 * (*ptr1) + uninit_malloc_pseudo_rec1(x, y, 1, ptr1, ptr2);
+    }
+
+    if(x > 10) {
+        val = *ptr1;
+    } else {
+        val = *ptr2;
+    }
+
+    free(ptr1);
+    free(ptr2);
+
+    return 3 * val;
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/17_complex_function_pointers.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/17_complex_function_pointers.c
new file mode 100644
index 0000000000000000000000000000000000000000..668fed31b769e4444256f6cfb7ef7fd1c0d4a635
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/17_complex_function_pointers.c
@@ -0,0 +1,29 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "uninitialized_malloc.h"
+
+static void possibly_assign(int** dest, int val, bool condition) {
+    if(condition) {
+        **dest = val;
+    }
+}
+
+void uninit_malloc_function_pointer(bool a, bool b, void (*f)(int**, int, bool)) {
+    int *data;
+
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    (*f)(&data, 5, a);
+    (*f)(&data, 13, b);
+
+    printf("%i\n", *data);
+
+    free(data);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/18_complex_struct_multiple_methods.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/18_complex_struct_multiple_methods.c
new file mode 100644
index 0000000000000000000000000000000000000000..e98c8522b82f98ba5dbc32a0ddf521555ebfa4ad
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/18_complex_struct_multiple_methods.c
@@ -0,0 +1,84 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "uninitialized_malloc.h"
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+    cont->counter = 1;
+    cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+    MallocIntCont* new_cont;
+
+    new_cont = malloc(sizeof(MallocIntCont));
+
+    if(new_cont) {
+        uninit_malloc_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+    if(cont->counter <= 1) {
+        if(cont->data) {
+           free(cont->data);
+        }
+        cont->data = malloc(sizeof(int));
+    } else {
+        cont->counter--;
+    }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+    if(cont->data) {
+        free(cont->data);
+    }
+    free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+    if(cont->data) {
+        return *(cont->data);
+    }
+    return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+    if(!cont->data) {
+        return;
+    }
+    *(cont->data) = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
+void uninit_malloc_struct(int x, int y) {
+    MallocIntCont cont;
+    int val;
+
+
+    uninit_malloc_cont_init(&cont);
+
+    if(x < y) {
+        uninit_malloc_cont_set_value(&cont, 7);
+    }
+
+    if(x > 10) {
+        val = 50 * 37;
+    } else {
+        /* DANGER: if x <= 10 & x >= y */
+        val = 30 * uninit_malloc_cont_get_value(&cont);
+    }
+
+    if(cont.data) {
+        free(cont.data);
+    }
+
+    printf("x=%i: %i\n", x, val);
+}
+
diff --git a/bench-moerman2018/memory/access_uninit/test_lib_incorrect/19_complex_refcount.c b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/19_complex_refcount.c
new file mode 100644
index 0000000000000000000000000000000000000000..3e2b9f1afb5fd0376833499f23b25db324bb3ef5
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/test_lib_incorrect/19_complex_refcount.c
@@ -0,0 +1,59 @@
+#include "uninitialized_malloc.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_UNINIT_VAL_REFCOUNT
+#define s_UNINIT_VAL_REFCOUNT
+void uninit_malloc_cont_init(MallocIntCont* cont) {
+    cont->counter = 1;
+    cont->data = malloc(sizeof(int));
+}
+
+MallocIntCont* uninit_malloc_cont_new() {
+    MallocIntCont* new_cont;
+
+    new_cont = malloc(sizeof(MallocIntCont));
+
+    if(new_cont) {
+        uninit_malloc_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void uninit_malloc_cont_incr(MallocIntCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void uninit_malloc_cont_decr(MallocIntCont* cont) {
+    if(cont->counter <= 1) {
+        if(cont->data) {
+           free(cont->data);
+        }
+        cont->data = malloc(sizeof(int));
+    } else {
+        cont->counter--;
+    }
+}
+
+void uninint_val_cont_free(MallocIntCont* cont) {
+    if(cont->data) {
+        free(cont->data);
+    }
+    free(cont);
+}
+
+int uninit_malloc_cont_get_value(MallocIntCont* cont) {
+    if(cont->data) {
+        return *(cont->data);
+    }
+    return 0;
+}
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value) {
+    if(!cont->data) {
+        return;
+    }
+    *(cont->data) = value;
+}
+#endif //s_UNINIT_VAL_REFCOUNT
+
diff --git a/bench-moerman2018/memory/access_uninit/uninitialized_malloc.h b/bench-moerman2018/memory/access_uninit/uninitialized_malloc.h
new file mode 100644
index 0000000000000000000000000000000000000000..7d9c052e59f9ff1551d7e2101280ebeacebdd68a
--- /dev/null
+++ b/bench-moerman2018/memory/access_uninit/uninitialized_malloc.h
@@ -0,0 +1,37 @@
+#include <stdbool.h>
+
+typedef struct _MallocIntCont MallocIntCont;
+
+struct _MallocIntCont {
+    int* data;
+    unsigned int counter;
+};
+
+void uninit_malloc_cont_init(MallocIntCont* cont);
+MallocIntCont* uninit_malloc_cont_new();
+void uninit_malloc_cont_incr(MallocIntCont* cont);
+void uninit_malloc_cont_decr(MallocIntCont* cont);
+int uninit_malloc_cont_get_value(MallocIntCont* cont);
+void uninit_malloc_cont_set_value(MallocIntCont* cont, int value);
+void uninint_val_cont_free(MallocIntCont* cont);
+
+void uninit_malloc_for(int x);
+void uninit_malloc_for_complex(int x);
+void uninit_malloc_while_continue(int x);
+void uninit_malloc_do_while_continue(int x);
+void uninit_malloc_for_array(int x);
+void uninit_malloc_for_pointer(int x);
+void uninit_malloc_goto(int x);
+void uninit_malloc_if_else(bool a, bool b);
+void uninit_malloc_if_else_multi(bool a, bool b);
+void uninit_malloc_if_else_int1(int x, int y);
+void uninit_malloc_if_else_int2(int x, int y);
+void uninit_malloc_pass_by_reference(bool a, bool b);
+int uninit_malloc_switch(int x, int y);
+int uninit_malloc_rec_multi(int x, int i, int* ptr1, int* ptr2);
+int uninit_malloc_rec(int x, int i, int* ptr1, int* ptr2);
+int uninit_malloc_pseudo_rec1(int x, int y, int i, int* ptr1, int* ptr2);
+int uninit_malloc_pseudo_rec2(int x, int y, int i, int* ptr1, int* ptr2);
+void uninit_malloc_struct(int x, int y);
+void uninit_malloc_function_pointer(bool a, bool b, void (*f)(int**, int, bool));
+void uninit_malloc_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/memory/double_free/01_simple_if.c b/bench-moerman2018/memory/double_free/01_simple_if.c
new file mode 100644
index 0000000000000000000000000000000000000000..3743ee41fb61c0868f68b526c27a801f782decfe
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/01_simple_if.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "double_free.h"
+
+void double_free_if_else(bool a, bool b) {
+    int* data;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(!a) {
+        free(data);
+    }
+
+    if(b) {
+        if(a) {
+            free(data);
+        }
+    } else {
+        free(data); /* DANGER, if !a & !b */
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_free_if_else(true, true);
+    double_free_if_else(true, false);
+    double_free_if_else(false, true);
+#else
+    double_free_if_else(true, true); /* OK */
+    double_free_if_else(false, false); /* DANGER */
+    double_free_if_else(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/02_simple_if_int1.c b/bench-moerman2018/memory/double_free/02_simple_if_int1.c
new file mode 100644
index 0000000000000000000000000000000000000000..e1b74d93aa445bbcdf7f1840abcaeba387103002
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/02_simple_if_int1.c
@@ -0,0 +1,49 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+void double_free_if_else_int1(int x, int y) {
+    int* data;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && x < y) {
+        return;
+    }
+#endif
+
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(x > 10) {
+        free(data);
+    } else {
+        data[3] = -4;
+    }
+
+    if(x < y) {
+        free(data); /* DANGER, if x <= 10 & x >= y */
+    }
+
+    if(x <= 10 && x >= y) {
+        free(data);
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_free_if_else_int1(10, 10);
+    double_free_if_else_int1(10, 11);
+    double_free_if_else_int1(11, 11);
+#else
+    double_free_if_else_int1(10, 10); /* OK */
+    double_free_if_else_int1(11, 12); /* DANGER */
+    double_free_if_else_int1(11, 11); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/02_simple_if_int2.c b/bench-moerman2018/memory/double_free/02_simple_if_int2.c
new file mode 100644
index 0000000000000000000000000000000000000000..442de79aa9d5c287116a8a6921d9addcdc0aaa52
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/02_simple_if_int2.c
@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+void double_free_if_else_int2(int x, int y) {
+    int* data;
+    int val, m, n;
+
+    m = -1;
+    n = 5;
+
+    x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && x < y) {
+        return;
+    }
+#endif
+
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(x > 10) {
+        free(data);
+    } else {
+        data[3] = -4;
+    }
+
+    if(x < y) {
+        free(data); /* DANGER, if x <= 10 & x >= y */
+    }
+
+    if(x <= 10 && x >= y) {
+        free(data);
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_free_if_else_int2(-5, 10);
+    double_free_if_else_int2(-5, 11);
+    double_free_if_else_int2(-6, 11);
+#else
+    double_free_if_else_int2(-5, 10); /* OK */
+    double_free_if_else_int2(-6, 12); /* DANGER */
+    double_free_if_else_int2(-6, 11); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/03_simple_if_multi_func.c b/bench-moerman2018/memory/double_free/03_simple_if_multi_func.c
new file mode 100644
index 0000000000000000000000000000000000000000..a0dda4e6cf5fee73ad5d0a35df0f4a5febd82b24
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/03_simple_if_multi_func.c
@@ -0,0 +1,45 @@
+#include "double_free.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void local_conditional_free(int** ptr, bool condition) {
+    if(condition) {
+        free(*ptr);
+    }
+}
+
+void double_free_if_else_multi(bool a, bool b) {
+    int* data;
+    int** data_ptr = &data;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    local_conditional_free(data_ptr, a & b);
+    local_conditional_free(data_ptr, !b);
+    local_conditional_free(data_ptr, !a); /* DANGER, if !a & !b */
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_free_if_else_multi(true, true);
+    double_free_if_else_multi(true, false);
+    double_free_if_else_multi(false, true);
+#else
+    double_free_if_else_multi(true, true); /* OK */
+    double_free_if_else_multi(false, false); /* DANGER */
+    double_free_if_else_multi(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/04_simple_switch.c b/bench-moerman2018/memory/double_free/04_simple_switch.c
new file mode 100644
index 0000000000000000000000000000000000000000..56f69897acc09d23052493c74b3478ca13718258
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/04_simple_switch.c
@@ -0,0 +1,62 @@
+#include "double_free.h"
+#include <stdlib.h>
+
+void double_free_switch(int x, int y) {
+    int* data;
+
+#ifdef CATCH_BAD_PARAM
+    if((x == 10 || x == 5) && x > y) {
+        return;
+    }
+#endif
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    if(x > y) {
+        free(data);
+    }
+
+    switch (x) {
+        case 5: {
+            free(data); /* DANGER: x >= y */
+            break;
+        }
+        case 7: {
+            if(x <= y) free(data);
+            break;
+        }
+        case 10: {
+            free(data); /* DANGER: x >= y */
+            break;
+        }
+        case 12: {
+            if(x <= y) free(data);
+            break;
+        }
+        default: {
+            if(x <= y) free(data);
+            break;
+        }
+    };
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_free_switch(5, 11);
+    double_free_switch(10, 11);
+    double_free_switch(11, 10);
+    double_free_switch(7, 5);
+#else
+    double_free_switch(5, 10); /* OK */
+    double_free_switch(10, 9); /* DANGER */
+    double_free_switch(11, 10); /* OK */
+    double_free_switch(7, 5); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/05_simple_goto.c b/bench-moerman2018/memory/double_free/05_simple_goto.c
new file mode 100644
index 0000000000000000000000000000000000000000..da78fe63072d1b6b67518dede570af5b9017e33c
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/05_simple_goto.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+void double_free_goto(int x) {
+    int* data;
+    int i = 0;
+
+    if(x <= 0) {
+        return;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 0) {
+        return;
+    }
+#endif
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+GOTO_LABEL:
+    if(i <= x) {
+        free(data);
+    } else {
+        printf("Data is freed\n");
+    }
+
+    if(i == 0) {
+        i++;
+        goto GOTO_LABEL;
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_free_goto(0);
+#else
+    double_free_goto(1);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/06_simple_pass_by_reference.c b/bench-moerman2018/memory/double_free/06_simple_pass_by_reference.c
new file mode 100644
index 0000000000000000000000000000000000000000..c060f269b11412d903680f94d657865f73a24882
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/06_simple_pass_by_reference.c
@@ -0,0 +1,49 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "double_free.h"
+
+static void assign_possibly_freed(int** dest, bool free_data) {
+    int* data = malloc(5*sizeof(int));
+    *dest = data;
+    if(free_data && data) {
+        free(data);
+    }
+}
+
+void double_free_pass_by_reference(bool a, bool b) {
+    int* data;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    assign_possibly_freed(&data, !a);
+    if(b) {
+        if(a && data) {
+            free(data);
+        }
+    } else {
+        if(data) {
+            free(data); /* DANGER, if !a & !b */
+        }
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_free_pass_by_reference(true, true);
+    double_free_pass_by_reference(true, false);
+    double_free_pass_by_reference(false, true);
+#else
+    double_free_pass_by_reference(true, true); /* OK */
+    double_free_pass_by_reference(false, false); /* DANGER */
+    double_free_pass_by_reference(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/07_cross_file.c b/bench-moerman2018/memory/double_free/07_cross_file.c
new file mode 100644
index 0000000000000000000000000000000000000000..0fe149f1a4fa743e89557446bd05be5af7977623
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/07_cross_file.c
@@ -0,0 +1,45 @@
+#include "double_free.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+void double_free_cross_file(bool a, bool b) {
+    int* data;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    conditional_free((void*) data, !a, 0);
+
+    if(b) {
+        if (a) {
+            free(data);
+        }
+    } else {
+        free(data); /* DANGER, if !a & !b */
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_free_cross_file(true, true);
+    double_free_cross_file(true, false);
+    double_free_cross_file(false, true);
+#else
+    double_free_cross_file(true, true); /* OK */
+    double_free_cross_file(false, false); /* DANGER */
+    double_free_cross_file(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/08_loop_for.c b/bench-moerman2018/memory/double_free/08_loop_for.c
new file mode 100644
index 0000000000000000000000000000000000000000..887021030b70417144ae6cc1cb8d5c137c6162aa
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/08_loop_for.c
@@ -0,0 +1,64 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+void double_free_for(int x) {
+    int* data;
+    bool is_freed;
+    int n_freed = 21;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    free(data);
+    is_freed = true;
+
+    for(i = 0; i < 20; i++) {
+        if(i > x && is_freed) { /* should be !is_freed */
+            free(data); /* DANGER: x < 10 */
+            data = malloc(5*sizeof(int));
+            if(!data) {
+                return;
+            }
+            is_freed = false;
+        } else {
+            n_freed--;
+        }
+        if(i == 10) {
+            data = malloc(5*sizeof(int));
+            if(!data) {
+                return;
+            }
+            is_freed = false;
+        }
+    }
+
+    if(!is_freed) {
+        free(data);
+        n_freed--;
+    }
+
+    printf("Times freed = %i", n_freed);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_free_for(10);
+#else
+    double_free_for(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/09_loop_for_complex.c b/bench-moerman2018/memory/double_free/09_loop_for_complex.c
new file mode 100644
index 0000000000000000000000000000000000000000..c0a438906d2b65435991f3f0906c16beb9c196de
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/09_loop_for_complex.c
@@ -0,0 +1,67 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+void double_free_for_complex(int x) {
+    int* data;
+    bool is_freed;
+    int n_freed = 21;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    free(data);
+    is_freed = true;
+
+    for(;;) {
+        if(i > x && is_freed) { /* should be !is_freed */
+            free(data); /* DANGER: x < 10 */
+            data = malloc(5*sizeof(int));
+            if(!data) {
+                return;
+            }
+            is_freed = false;
+        } else {
+            n_freed--;
+        }
+        if(i == 10) {
+            data = malloc(5*sizeof(int));
+            if(!data) {
+                return;
+            }
+            is_freed = false;
+        }
+        i++;
+        if(i >= 20) {
+            break;
+        }
+    }
+
+    if(!is_freed) {
+        free(data);
+        n_freed--;
+    }
+
+    printf("Times freed = %i", n_freed);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_free_for_complex(10);
+#else
+    double_free_for_complex(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/10_loop_while_continue.c b/bench-moerman2018/memory/double_free/10_loop_while_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..d3c2cb3004f10e72048dfaf592cdecb3411f09df
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/10_loop_while_continue.c
@@ -0,0 +1,68 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+void double_free_while_continue(int x) {
+    int* data;
+    bool is_freed;
+    int n_freed = 30;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    free(data);
+    is_freed = true;
+
+    while(i < 30) {
+        if(i == 9) {
+            i++;
+            continue;
+        }
+        if(i > x && is_freed) { /* should be !is_freed */
+            free(data); /* DANGER: x < 10 */
+            data = malloc(5*sizeof(int));
+            if(!data) {
+                return;
+            }
+            is_freed = false;
+        } else {
+            n_freed--;
+        }
+        if(i == 10) {
+            data = malloc(5*sizeof(int));
+            if(!data) {
+                return;
+            }
+            is_freed = false;
+        }
+        i++;
+    }
+
+    if(!is_freed) {
+        free(data);
+        n_freed--;
+    }
+
+    printf("Times freed = %i", n_freed);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_free_while_continue(10);
+#else
+    double_free_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/11_loop_while_do_continue.c b/bench-moerman2018/memory/double_free/11_loop_while_do_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..25a3b9bfc194feb6ece812192f6de10c46794082
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/11_loop_while_do_continue.c
@@ -0,0 +1,68 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+void double_free_do_while_continue(int x) {
+    int* data;
+    bool is_freed;
+    int n_freed = 30;
+    int i = 0;
+    printf("Times freed = %i\n", n_freed);
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    free(data);
+    is_freed = true;
+
+    do {
+        if(i == 8) {
+            i++;
+            continue;
+        }
+        if(i > x && is_freed) { /* should be !is_freed */
+            free(data); /* DANGER: x < 10 */
+            data = malloc(5*sizeof(int));
+            if(!data) {
+                return;
+            }
+            is_freed = false;
+        } else {
+            n_freed--;
+        }
+        if(i == 10) {
+            data = malloc(5*sizeof(int));
+            if(!data) {
+                return;
+            }
+            is_freed = false;
+        }
+        i++;
+    } while(i < 30);
+
+    if(!is_freed) {
+        free(data);
+        n_freed--;
+    }
+
+    printf("Times freed = %i\n", n_freed);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_free_do_while_continue(10);
+#else
+    double_free_do_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/12_loop_for_array_branching.c b/bench-moerman2018/memory/double_free/12_loop_for_array_branching.c
new file mode 100644
index 0000000000000000000000000000000000000000..16acb83d048fdb399590ea961a79ebc5786bf22a
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/12_loop_for_array_branching.c
@@ -0,0 +1,57 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+void double_free_for_array(int x) {
+    int* data;
+    int p[20];
+    int val = 0;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 19) {
+        return;
+    }
+#endif
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    *data = 27;
+
+    for(i = 0; i < 20; i++) {
+        p[i] = 0;
+    }
+    p[x] = 1;
+
+    for(i = 0; i < 20; i++) {
+        if(p[i] == 1) {
+            val = *data;
+            free(data);
+        } else {
+            free(data); /* DANGER: x < 19 */
+            data = malloc(sizeof(int));
+            if(!data) {
+                break;
+            }
+            *data = i;
+        }
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_free_for_array(19);
+#else
+    double_free_for_array(10);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/memory/double_free/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 0000000000000000000000000000000000000000..48b0686adcab7345cc7d700184c4a8ed6db6d543
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,47 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "double_free.h"
+
+static void initialize_array(int* ptr_arr[], int length) {
+    int i;
+
+    for(i = 0; i < length; i++) {
+        ptr_arr[i] = malloc(sizeof(int));
+        if(ptr_arr[i]) *ptr_arr[i] = i;
+    }
+}
+
+static void free_array(int* ptr_arr[], int length) {
+    int i;
+
+    for(i = 0; i < length; i++) {
+        if(ptr_arr[i]) free(ptr_arr[i]);
+    }
+}
+
+void double_free_for_pointer(int x) {
+    int* pointers[10];
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 10) {
+        return;
+    }
+#endif
+
+    initialize_array(pointers, 10);
+    free_array(pointers, 10);
+    initialize_array(pointers, x);
+    free_array(pointers, 10);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_free_for_pointer(10);
+#else
+    double_free_for_pointer(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/14_loop_recursion.c b/bench-moerman2018/memory/double_free/14_loop_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..ddb4614024ab4fa3cee8c8997ed6725dfc659135
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/14_loop_recursion.c
@@ -0,0 +1,65 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+int double_free_rec(int x, int i, int** data_ptr, bool* is_freed) {
+    int n_freed = 0;
+
+    if(i <= 1) {
+        return 0;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && *is_freed) {
+        return -1;
+    }
+#endif
+
+    if(i < 20 && i < x) {
+        free(*data_ptr); /* DANGER: x > 10 */
+        *data_ptr = malloc(5*sizeof(int));
+        if(!data_ptr) {
+            *is_freed = true;
+            return 0;
+        }
+        *is_freed = false;
+    } else {
+        n_freed--;
+    }
+    if(i == 10 && *is_freed) {
+        *data_ptr = malloc(5*sizeof(int));
+        if(!(*data_ptr)) {
+            *is_freed = true;
+            return 0;
+        }
+        *is_freed = false;
+    }
+
+    return 1 + n_freed + double_free_rec(x, i-1, data_ptr, is_freed);
+}
+
+#ifndef NO_MAIN
+int main() {
+    int* data = malloc(sizeof(int));
+    int** data_ptr = &data;
+    free(data);
+    bool is_freed = true;
+#ifdef NO_BUG
+    printf("%i\n", double_free_rec(10, 20, data_ptr, &is_freed));
+    if(is_freed) {
+        data = malloc(sizeof(int));
+        is_freed = false;
+    }
+    printf("%i\n", double_free_rec(11, 20, data_ptr, &is_freed));
+#else
+    printf("%i\n", double_free_rec(11, 20, data_ptr, &is_freed));
+#endif
+    if(!is_freed) {
+        free(data);
+        is_freed = true;
+    }
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/14_loop_recursion_alt.c b/bench-moerman2018/memory/double_free/14_loop_recursion_alt.c
new file mode 100644
index 0000000000000000000000000000000000000000..bbd46f611d9dd1757a03e6f0efc882767f1f03ef
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/14_loop_recursion_alt.c
@@ -0,0 +1,59 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+int double_free_rec_alt(int x, int i, int** data_ptr, bool* is_freed) {
+    int n_freed = 0;
+
+    if(i <= 1) {
+        return 0;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 9 && i >= 10) {
+        return -1;
+    }
+#endif
+
+    if(i < 20 && i > x) {
+        free(*data_ptr); /* DANGER: x < 9 */
+        *data_ptr = malloc(5*sizeof(int));
+        if(!data_ptr) {
+            *is_freed = true;
+            return 0;
+        }
+        *is_freed = false;
+    } else {
+        n_freed--;
+    }
+    if(i == 10 && !*is_freed) {
+        free(*data_ptr);
+        *is_freed = true;
+        n_freed++;
+    }
+
+    return 1 + n_freed + double_free_rec_alt(x, i-1, data_ptr, is_freed);
+}
+
+#ifndef NO_MAIN
+int main() {
+    int* data = malloc(sizeof(int));
+    bool is_freed = false;
+    if(!data) {
+        return 1;
+    }
+
+#ifdef NO_BUG
+    printf("%i\n", double_free_rec_alt(9, 20, &data, &is_freed));
+#else
+    printf("%i\n", double_free_rec_alt(8, 20, &data, &is_freed));
+#endif
+    if(!is_freed) {
+        free(data);
+        is_freed = true;
+    }
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/15_loop_recursion_multi.c b/bench-moerman2018/memory/double_free/15_loop_recursion_multi.c
new file mode 100644
index 0000000000000000000000000000000000000000..4db5c291644679e620f93aa21d0f549e5dafd03f
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/15_loop_recursion_multi.c
@@ -0,0 +1,73 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+int double_free_rec_decr(int x, int i, int** data_ptr, bool* is_freed) {
+    if(i <= 1) {
+        return 0;
+    }
+
+    return double_free_rec_multi(x, i-1, data_ptr, is_freed);
+}
+
+int double_free_rec_multi(int x, int i, int** data_ptr, bool* is_freed) {
+    int n_freed = 0;
+
+    if(i <= 1) {
+        return 0;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && *is_freed) {
+        return -1;
+    }
+#endif
+
+    if(i < 20 && i < x) {
+        free(*data_ptr); /* DANGER: x > 10 */
+        *data_ptr = malloc(5*sizeof(int));
+        if(!data_ptr) {
+            *is_freed = true;
+            return 0;
+        }
+        *is_freed = false;
+    } else {
+        n_freed--;
+    }
+    if(i == 10 && *is_freed) {
+        *data_ptr = malloc(5*sizeof(int));
+        if(!(*data_ptr)) {
+            *is_freed = true;
+            return 0;
+        }
+        *is_freed = false;
+    }
+
+    return 1 + n_freed + double_free_rec_decr(x, i, data_ptr, is_freed);
+}
+
+#ifndef NO_MAIN
+int main() {
+    int* data = malloc(sizeof(int));
+    int** data_ptr = &data;
+    free(data);
+    bool is_freed = true;
+#ifdef NO_BUG
+    printf("%i\n", double_free_rec_multi(10, 20, data_ptr, &is_freed));
+    if(is_freed) {
+        data = malloc(sizeof(int));
+        is_freed = false;
+    }
+    printf("%i\n", double_free_rec_multi(11, 20, data_ptr, &is_freed));
+#else
+    printf("%i\n", double_free_rec_multi(11, 20, data_ptr, &is_freed));
+#endif
+    if(!is_freed) {
+        free(data);
+        is_freed = true;
+    }
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/15_loop_recursion_multi_alt.c b/bench-moerman2018/memory/double_free/15_loop_recursion_multi_alt.c
new file mode 100644
index 0000000000000000000000000000000000000000..578c091bea5045e8c413c841729f21432efa1c63
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/15_loop_recursion_multi_alt.c
@@ -0,0 +1,66 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+int double_free_rec_decr_alt(int x, int i, int** data_ptr, bool* is_freed) {
+    if(i <= 1) {
+        return 0;
+    }
+
+    return double_free_rec_multi_alt(x, i-1, data_ptr, is_freed);
+}
+
+int double_free_rec_multi_alt(int x, int i, int** data_ptr, bool* is_freed) {
+    int n_freed = 0;
+
+    if(i <= 1) {
+        return 0;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 9 && i >= 10) {
+        return -1;
+    }
+#endif
+
+    if(i < 20 && i > x) {
+        free(*data_ptr); /* DANGER: x < 9 */
+        *data_ptr = malloc(5*sizeof(int));
+        if(!data_ptr) {
+            *is_freed = true;
+            return 0;
+        }
+        *is_freed = false;
+    } else {
+        n_freed--;
+    }
+    if(i == 10 && !*is_freed) {
+        free(*data_ptr);
+        *is_freed = true;
+        n_freed++;
+    }
+
+    return 1 + n_freed + double_free_rec_decr_alt(x, i, data_ptr, is_freed);
+}
+
+#ifndef NO_MAIN
+int main() {
+    int* data = malloc(sizeof(int));
+    bool is_freed = false;
+    if(!data) {
+        return 1;
+    }
+#ifdef NO_BUG
+    printf("%i\n", double_free_rec_multi_alt(9, 20, &data, &is_freed));
+#else
+    printf("%i\n", double_free_rec_multi_alt(8, 20, &data, &is_freed));
+#endif
+    if(!is_freed) {
+        free(data);
+        is_freed = true;
+    }
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/16_misc_pseudo_recursion.c b/bench-moerman2018/memory/double_free/16_misc_pseudo_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..ecb5f62977bc16c2e43e01dcf05663bd027d409d
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/16_misc_pseudo_recursion.c
@@ -0,0 +1,60 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+int double_free_pseudo_rec1(int x, int y, int i, int** data_ptr) {
+    int data_value = **data_ptr;
+#ifdef CATCH_BAD_PARAM
+    if(x >= y && x <= 10) {
+        free(*data_ptr);
+        return -1;
+    }
+#endif
+
+    if(i > 0) {
+        free(*data_ptr);
+        return 37;
+    }
+
+    if(x >= y) {
+        free(*data_ptr);
+    }
+
+    return data_value + double_free_pseudo_rec2(x, y, 1, data_ptr);
+}
+
+int double_free_pseudo_rec2(int x, int y, int i, int** data_ptr) {
+    if(i > 0) {
+        if(x <= 10) {
+            free(*data_ptr);
+        } else if(x > 10 && x < y) {
+            free(*data_ptr);
+        }
+        return -1;
+    }
+
+    return 5 + double_free_pseudo_rec1(x, y, 1, data_ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+    int* data = malloc(sizeof(int));
+    if(!data) {
+        return -1;
+    }
+    *data = 35;
+#ifdef NO_BUG
+    printf("%i\n", double_free_pseudo_rec1(9, 10, 0, &data));
+    data = malloc(sizeof(int));
+    if(!data) {
+        return -1;
+    }
+    *data = 35;
+    printf("%i\n", double_free_pseudo_rec1(11, 10, 0, &data));
+#else
+    printf("%i\n", double_free_pseudo_rec1(10, 10, 0, &data));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/17_complex_function_pointers.c b/bench-moerman2018/memory/double_free/17_complex_function_pointers.c
new file mode 100644
index 0000000000000000000000000000000000000000..63ed0c84c321b8dc8ae83d29b30189a489652158
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/17_complex_function_pointers.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+static void assign_possibly_freed(int** dest, bool free_data) {
+    int* data = malloc(5*sizeof(int));
+    *dest = data;
+    if(free_data && data) {
+        free(data);
+    }
+}
+
+void double_free_function_pointer(bool a, bool b, void (*f)(int** dest, bool free_data)) {
+    int* data;
+
+#ifdef CATCH_BAD_PARAM
+    if(!f || (!a & !b)) {
+        return;
+    }
+#endif
+
+    (*f)(&data, !a);
+
+    if(b) {
+        if(a && data) {
+            free(data);
+        }
+    } else {
+        if(data) {
+            free(data); /* DANGER, if !a & !b */
+        }
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_free_function_pointer(true, true, &assign_possibly_freed);
+    double_free_function_pointer(true, false, &assign_possibly_freed);
+    double_free_function_pointer(false, true, &assign_possibly_freed);
+#else
+    double_free_function_pointer(true, true, &assign_possibly_freed); /* OK */
+    double_free_function_pointer(false, false, &assign_possibly_freed); /* DANGER */
+    double_free_function_pointer(false, true, &assign_possibly_freed); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/18_complex_struct_multiple_methods.c b/bench-moerman2018/memory/double_free/18_complex_struct_multiple_methods.c
new file mode 100644
index 0000000000000000000000000000000000000000..16ddfbdce6ad2da60fb2bb56123da3c318600e41
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/18_complex_struct_multiple_methods.c
@@ -0,0 +1,90 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "double_free.h"
+
+#ifndef s_MEMORY_DF_REFCOUNT
+#define s_MEMORY_DF_REFCOUNT
+void double_free_cont_init(DRefCont* cont) {
+    cont->refc = 1;
+    cont->data = 0;
+}
+
+DRefCont* double_free_cont_new() {
+    DRefCont* new_cont;
+
+    new_cont = malloc(sizeof(DRefCont));
+
+    if(new_cont) {
+        double_free_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void double_free_cont_ref(DRefCont* cont) {
+    if(cont) {
+        cont->refc++;
+    }
+}
+void double_free_cont_unref(DRefCont* cont) {
+    if(cont->refc <= 1) {
+        free(cont);
+    } else {
+        cont->refc--;
+    }
+}
+
+void* double_free_cont_get_pointer(DRefCont* cont) {
+    return cont->data;
+}
+void double_free_cont_set_pointer(DRefCont* cont, void* p) {
+    cont->data = p;
+}
+#endif //s_MEMORY_DF_REFCOUNT
+
+void double_free_struct(int x, int y) {
+    DRefCont cont;
+    int* data;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x > y) {
+        return;
+    }
+#endif
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    double_free_cont_init(&cont);
+    double_free_cont_set_pointer(&cont, data);
+
+    *data = 37;
+
+    if(x > y) {
+        free(data);
+    }
+
+    if(x > 10) {
+        if(x <= y) {
+            free(double_free_cont_get_pointer(&cont));
+        }
+    } else {
+        free(double_free_cont_get_pointer(&cont)); /* DANGER: if x <= 10 & x > y */
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    double_free_struct(9, 10);
+    double_free_struct(10, 11);
+    double_free_struct(11, 10);
+#else
+    double_free_struct(10, 9); /* DANGER */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/19_complex_refcount.c b/bench-moerman2018/memory/double_free/19_complex_refcount.c
new file mode 100644
index 0000000000000000000000000000000000000000..99e775d4b8fb102afa276d648759b4cacd1e846a
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/19_complex_refcount.c
@@ -0,0 +1,71 @@
+#include "double_free.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_MEMORY_DF_REFCOUNT
+#define s_MEMORY_DF_REFCOUNT
+void double_free_cont_init(DRefCont* cont) {
+    cont->refc = 1;
+    cont->data = 0;
+}
+
+DRefCont* double_free_cont_new() {
+    DRefCont* new_cont;
+
+    new_cont = malloc(sizeof(DRefCont));
+
+    if(new_cont) {
+        double_free_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void double_free_cont_ref(DRefCont* cont) {
+    if(cont) {
+        cont->refc++;
+    }
+}
+void double_free_cont_unref(DRefCont* cont) {
+    if(cont->refc <= 1) {
+        free(cont);
+    } else {
+        cont->refc--;
+    }
+}
+
+void* double_free_cont_get_pointer(DRefCont* cont) {
+    return cont->data;
+}
+void double_free_cont_set_pointer(DRefCont* cont, void* p) {
+    cont->data = p;
+}
+#endif //s_MEMORY_DF_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+    DRefCont* cont;
+    int arr[1] = {99};
+    int val;
+
+    cont = double_free_cont_new();
+    if(!cont) {
+        return 1;
+    }
+    double_free_cont_set_pointer(cont, arr);
+
+    double_free_cont_ref(cont);
+    double_free_cont_ref(cont);
+    double_free_cont_unref(cont);
+    double_free_cont_unref(cont);
+    val = *((int*) double_free_cont_get_pointer(cont));
+#ifndef NO_BUG
+    double_free_cont_unref(cont);
+#endif
+
+    printf("%i\n", val);
+
+    free(cont);
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/double_free/double_free.h b/bench-moerman2018/memory/double_free/double_free.h
new file mode 100644
index 0000000000000000000000000000000000000000..b4a071298a00095bdbff7a8b5c3415edd6ca08e5
--- /dev/null
+++ b/bench-moerman2018/memory/double_free/double_free.h
@@ -0,0 +1,38 @@
+#include <stdbool.h>
+
+typedef struct _DoubleFreeRefCont DRefCont;
+
+struct _DoubleFreeRefCont {
+    void* data;
+    unsigned int refc;
+};
+
+void double_free_cont_init(DRefCont* cont);
+DRefCont* double_free_cont_new();
+void double_free_cont_ref(DRefCont* cont);
+void double_free_cont_unref(DRefCont* cont);
+void* double_free_cont_get_pointer(DRefCont* cont);
+void double_free_cont_set_pointer(DRefCont* cont, void* p);
+
+void double_free_for(int x);
+void double_free_for_complex(int x);
+void double_free_while_continue(int x);
+void double_free_do_while_continue(int x);
+void double_free_for_array(int x);
+void double_free_for_pointer(int x);
+void double_free_goto(int x);
+void double_free_if_else(bool a, bool b);
+void double_free_if_else_multi(bool a, bool b);
+void double_free_if_else_int1(int x, int y);
+void double_free_if_else_int2(int x, int y);
+void double_free_pass_by_reference(bool a, bool b);
+void double_free_switch(int x, int y);
+int double_free_rec_multi(int x, int i, int** data_ptr, bool* is_freed);
+int double_free_rec_multi_alt(int x, int i, int** data_ptr, bool* is_freed);
+int double_free_rec(int x, int i, int** data_ptr, bool* is_freed);
+int double_free_rec_alt(int x, int i, int** data_ptr, bool* is_freed);
+int double_free_pseudo_rec1(int x, int y, int i, int** data_ptr);
+int double_free_pseudo_rec2(int x, int y, int i, int** data_ptr);
+void double_free_struct(int x, int y);
+void double_free_function_pointer(bool a, bool b, void (*f)(int** dest, bool free_data));
+void double_free_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/memory/leak/01_simple_if.c b/bench-moerman2018/memory/leak/01_simple_if.c
new file mode 100644
index 0000000000000000000000000000000000000000..691418eae46aff902dd6e261aba1ca46d4291e93
--- /dev/null
+++ b/bench-moerman2018/memory/leak/01_simple_if.c
@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "memory_leak.h"
+
+void mem_leak_if_else(bool a, bool b) {
+    int* data;
+    int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    *data = 27;
+
+    if(a) {
+        val = *data;
+        free(data);
+    } else {
+        (*data)++;
+    }
+
+    if(b & !a) {
+        val = *data;
+        free(data);
+    } else {
+        val += 37;
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    mem_leak_if_else(true, true);
+    mem_leak_if_else(true, false);
+    mem_leak_if_else(false, true);
+#else
+    mem_leak_if_else(true, true); /* OK */
+    mem_leak_if_else(false, false); /* DANGER */
+    mem_leak_if_else(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/02_simple_if_int1.c b/bench-moerman2018/memory/leak/02_simple_if_int1.c
new file mode 100644
index 0000000000000000000000000000000000000000..fdf0764e7f4942308f9da1f32c5c24db06b4c033
--- /dev/null
+++ b/bench-moerman2018/memory/leak/02_simple_if_int1.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+void mem_leak_if_else_int1(int x, int y) {
+    int val = 0;
+    int* data;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x < y) {
+        return;
+    }
+#endif
+
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    *data = 27;
+
+    if(x <= 10) {
+        val = *data;
+        free(data);
+    } else {
+        (*data)++;
+    }
+
+    if(x >= y) {
+        if(x > 10) {
+            val = *data * 2;
+            free(data);
+        }
+    } else {
+        val += 10;
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    mem_leak_if_else_int1(10, 10);
+    mem_leak_if_else_int1(10, 11);
+    mem_leak_if_else_int1(11, 11);
+#else
+    mem_leak_if_else_int1(10, 10); /* OK */
+    mem_leak_if_else_int1(11, 12); /* DANGER */
+    mem_leak_if_else_int1(11, 11); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/02_simple_if_int2.c b/bench-moerman2018/memory/leak/02_simple_if_int2.c
new file mode 100644
index 0000000000000000000000000000000000000000..23d5ae75cabe6118c2f10e4d2587faf1cbacbda4
--- /dev/null
+++ b/bench-moerman2018/memory/leak/02_simple_if_int2.c
@@ -0,0 +1,62 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+void mem_leak_if_else_int2(int x, int y) {
+    int* data;
+    int val = 0;
+    int m, n;
+
+    m = -1;
+    n = 5;
+
+    x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && x < y) {
+        return;
+    }
+#endif
+
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    *data = 27;
+
+    if(x <= 10) {
+        val = *data;
+        free(data);
+    } else {
+        (*data)++;
+    }
+
+    if(x >= y) {
+        if(x > 10) {
+            val = *data * 2;
+            free(data);
+        }
+    } else {
+        val += 10;
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    mem_leak_if_else_int2(-5, 10);
+    mem_leak_if_else_int2(-5, 11);
+    mem_leak_if_else_int2(-6, 11);
+#else
+    mem_leak_if_else_int2(-5, 10); /* OK */
+    mem_leak_if_else_int2(-6, 12); /* DANGER */
+    mem_leak_if_else_int2(-6, 11); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/03_simple_if_multi_func.c b/bench-moerman2018/memory/leak/03_simple_if_multi_func.c
new file mode 100644
index 0000000000000000000000000000000000000000..4adab435abcd18cd7bb6f3eba620c93a79cc5c5d
--- /dev/null
+++ b/bench-moerman2018/memory/leak/03_simple_if_multi_func.c
@@ -0,0 +1,57 @@
+#include "memory_leak.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void local_conditional_free(int** ptr, bool condition) {
+    if(condition) {
+        free(*ptr);
+    }
+}
+
+static int conditional_dereference(int** ptr, int def, bool condition) {
+    if(condition) {
+        return **ptr;
+    }
+    return def;
+}
+
+void mem_leak_if_else_multi(bool a, bool b) {
+    int val;
+    int* data;
+    int** data_ptr = &data;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    *data = 27;
+
+    local_conditional_free(data_ptr, a);
+    val = conditional_dereference(data_ptr, 897, !a);
+    local_conditional_free(data_ptr, b & !a);
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    mem_leak_if_else_multi(true, true);
+    mem_leak_if_else_multi(true, false);
+    mem_leak_if_else_multi(false, true);
+#else
+    mem_leak_if_else_multi(true, true); /* OK */
+    mem_leak_if_else_multi(false, false); /* DANGER */
+    mem_leak_if_else_multi(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/04_simple_switch.c b/bench-moerman2018/memory/leak/04_simple_switch.c
new file mode 100644
index 0000000000000000000000000000000000000000..ec310e164b83f1b575bd6ebb687a73ee2c3a6725
--- /dev/null
+++ b/bench-moerman2018/memory/leak/04_simple_switch.c
@@ -0,0 +1,86 @@
+#include "memory_leak.h"
+#include <stdbool.h>
+#include <stdlib.h>
+
+int mem_leak_switch(int x, int y) {
+    int* data;
+    bool freed = false;
+    int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if((x == 10 || x == 5) && x > y) {
+        return -1;
+    }
+#endif
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return -1;
+    }
+
+    *data = -1;
+
+    if(x <= y) {
+        free(data);
+        freed = true;
+    }
+
+    switch (x) {
+        case 5: {
+            if(!freed) val = *data;
+            freed = true; /* DANGER: x >= y */
+            break;
+        }
+        case 7: {
+            if(!freed) {
+                val  = *data + 289;
+                free(data);
+                freed = true;
+            }
+            break;
+        }
+        case 10: {
+            if(!freed) {
+                val = *data + 36;
+                freed = true; /* DANGER: x >= y */
+            }
+            break;
+        }
+        case 12: {
+            if(!freed) {
+                val  = *data + 49807;
+                free(data);
+            }
+            freed = true;
+            break;
+        }
+        default: {
+            val  = 7987;
+            break;
+        }
+    }
+
+    if(!freed) {
+        free(data);
+    }
+
+    return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    mem_leak_switch(5, 11);
+    mem_leak_switch(10, 11);
+    mem_leak_switch(11, 10);
+    mem_leak_switch(7, 5);
+#else
+    mem_leak_switch(5, 10); /* OK */
+    mem_leak_switch(10, 9); /* DANGER */
+    mem_leak_switch(11, 10); /* OK */
+    mem_leak_switch(7, 5); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/05_simple_goto.c b/bench-moerman2018/memory/leak/05_simple_goto.c
new file mode 100644
index 0000000000000000000000000000000000000000..4a756d37f9c394d4a691fb9fca037aad018512e8
--- /dev/null
+++ b/bench-moerman2018/memory/leak/05_simple_goto.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+void mem_leak_goto(int x) {
+    int* data = 0;
+    int val = 0;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 0) {
+        return;
+    }
+#endif
+
+GOTO_LABEL:
+    if(i <= x) {
+        data = malloc(5*sizeof(int));
+
+        if(!data) {
+            return;
+        }
+
+        *data = 7698;
+        val += *data;
+    } else {
+        printf("%i\n", val);
+    }
+
+    if(i == 0 && data) {
+        i++;
+        free(data);
+        goto GOTO_LABEL;
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    mem_leak_goto(0);
+#else
+    mem_leak_goto(1);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/06_simple_pass_by_reference.c b/bench-moerman2018/memory/leak/06_simple_pass_by_reference.c
new file mode 100644
index 0000000000000000000000000000000000000000..f4a2611fe369abdef143e23a91d5adbe881dc109
--- /dev/null
+++ b/bench-moerman2018/memory/leak/06_simple_pass_by_reference.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "memory_leak.h"
+
+static void assign_possibly_freed(int** dest, bool free_data) {
+    int* data = malloc(5*sizeof(int));
+    *dest = data;
+    if(!data) {
+        return;
+    }
+    *data = 6;
+    if(free_data) {
+        free(data);
+    }
+}
+
+void mem_leak_pass_by_reference(bool a, bool b) {
+    int* data;
+    int val = -1;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    assign_possibly_freed(&data, a);
+    if(b && !a && data) {
+        val = *data;
+        free(data);
+    } else {
+        val = 687;
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    mem_leak_pass_by_reference(true, true);
+    mem_leak_pass_by_reference(true, false);
+    mem_leak_pass_by_reference(false, true);
+#else
+    mem_leak_pass_by_reference(true, true); /* OK */
+    mem_leak_pass_by_reference(false, false); /* DANGER */
+    mem_leak_pass_by_reference(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/07_cross_file.c b/bench-moerman2018/memory/leak/07_cross_file.c
new file mode 100644
index 0000000000000000000000000000000000000000..2a657165040484014e0f6053fb33cf572b9b13a9
--- /dev/null
+++ b/bench-moerman2018/memory/leak/07_cross_file.c
@@ -0,0 +1,47 @@
+#include "memory_leak.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+void mem_leak_cross_file(bool a, bool b) {
+    int val;
+    int* data;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    conditional_free((void*) data, !a, 0);
+
+    if(b & a) {
+        val = *data;
+        free(data);
+    } else {
+        val = 678;
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    mem_leak_cross_file(true, true);
+    mem_leak_cross_file(true, false);
+    mem_leak_cross_file(false, true);
+#else
+    mem_leak_cross_file(true, true); /* OK */
+    mem_leak_cross_file(false, false); /* DANGER */
+    mem_leak_cross_file(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/08_loop_for.c b/bench-moerman2018/memory/leak/08_loop_for.c
new file mode 100644
index 0000000000000000000000000000000000000000..1de98f5033239ec1a72eac6b013adc7088ecdecb
--- /dev/null
+++ b/bench-moerman2018/memory/leak/08_loop_for.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+void mem_leak_for(int x) {
+    int* data;
+    int val = 0;
+    bool do_free = false;
+    bool is_freed = true;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    for(i = 0; i < 20; i++) {
+        if(i > x && is_freed) {
+            data = malloc(5*sizeof(int));
+            if(!data) {
+                return;
+            }
+            *data = i;
+            val += *data * 2;
+            if(do_free) {
+                free(data);
+                is_freed = true;
+            } else {
+                is_freed = false;
+            }
+        } else {
+            if(!is_freed) {
+                val += *data;
+            } else {
+                val += 37;
+            }
+        }
+        if(i == 10) {
+            do_free = true;
+        }
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    mem_leak_for(10);
+#else
+    mem_leak_for(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/09_loop_for_complex.c b/bench-moerman2018/memory/leak/09_loop_for_complex.c
new file mode 100644
index 0000000000000000000000000000000000000000..4e4e066b7b0e31236df413f2c098b480483e88af
--- /dev/null
+++ b/bench-moerman2018/memory/leak/09_loop_for_complex.c
@@ -0,0 +1,61 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+void mem_leak_for_complex(int x) {
+    int* data;
+    int val = 0;
+    bool do_free = false;
+    bool is_freed = true;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    for(;;) {
+        if(i > x && is_freed) {
+            data = malloc(5*sizeof(int));
+            if(!data) {
+                return;
+            }
+            *data = i;
+            val += *data * 2;
+            if(do_free) {
+                free(data);
+                is_freed = true;
+            } else {
+                is_freed = false;
+            }
+        } else {
+            if(!is_freed) {
+                val += *data;
+            } else {
+                val += 37;
+            }
+        }
+        if(i == 10) {
+            do_free = true;
+        }
+        i++;
+        if(i >= 20) {
+            break;
+        }
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    mem_leak_for_complex(10);
+#else
+    mem_leak_for_complex(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/10_loop_while_continue.c b/bench-moerman2018/memory/leak/10_loop_while_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..97f6e9ad79c3745ce46f2d33a2ca297323d9bee8
--- /dev/null
+++ b/bench-moerman2018/memory/leak/10_loop_while_continue.c
@@ -0,0 +1,62 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+void mem_leak_while_continue(int x) {
+    int* data;
+    int val = 0;
+    bool do_free = false;
+    bool is_freed = true;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    while(i < 30) {
+        if(i == 9) {
+            i++;
+            continue;
+        }
+        if(i > x && is_freed) {
+            data = malloc(5*sizeof(int));
+            if(!data) {
+                return;
+            }
+            *data = i;
+            val += *data * 2;
+            if(do_free) {
+                free(data);
+                is_freed = true;
+            } else {
+                is_freed = false;
+            }
+        } else {
+            if(!is_freed) {
+                val += *data;
+            } else {
+                val += 37;
+            }
+        }
+        if(i == 10) {
+            do_free = true;
+        }
+        i++;
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    mem_leak_while_continue(10);
+#else
+    mem_leak_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/11_loop_while_do_continue.c b/bench-moerman2018/memory/leak/11_loop_while_do_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..36e74d49af0c94cc28ffb36776672c1dd9c050f8
--- /dev/null
+++ b/bench-moerman2018/memory/leak/11_loop_while_do_continue.c
@@ -0,0 +1,62 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+void mem_leak_do_while_continue(int x) {
+    int* data;
+    int val = 0;
+    bool do_free = false;
+    bool is_freed = true;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    do {
+        if(i == 8) {
+            i++;
+            continue;
+        }
+        if(i > x && is_freed) {
+            data = malloc(5*sizeof(int));
+            if(!data) {
+                return;
+            }
+            *data = i;
+            val += *data * 2;
+            if(do_free) {
+                free(data);
+                is_freed = true;
+            } else {
+                is_freed = false;
+            }
+        } else {
+            if(!is_freed) {
+                val += *data;
+            } else {
+                val += 37;
+            }
+        }
+        if(i == 10) {
+            do_free = true;
+        }
+        i++;
+    } while(i < 30);
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    mem_leak_do_while_continue(10);
+#else
+    mem_leak_do_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/12_loop_for_array_branching.c b/bench-moerman2018/memory/leak/12_loop_for_array_branching.c
new file mode 100644
index 0000000000000000000000000000000000000000..f40bf926f8ecfbfe835b4d3582d292d0a66a4532
--- /dev/null
+++ b/bench-moerman2018/memory/leak/12_loop_for_array_branching.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "memory_leak.h"
+
+void mem_leak_for_array(int x) {
+    int* data = 0;
+    int p[20];
+    int val = 0;
+    bool do_free = true;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 19) {
+        return;
+    }
+#endif
+
+    for(i = 0; i < 20; i++) {
+        p[i] = 0;
+    }
+    p[x] = 1;
+
+    for(i = 0; i < 20; i++) {
+        if(p[i] == 1) {
+            do_free = false;
+        } else {
+            if(!data) data = malloc(sizeof(int));
+
+            if(!data) {
+                return;
+            }
+
+            *data = 27;
+            val += *data + i;
+            if(do_free) {
+                free(data);
+                data = 0;
+            }
+        }
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    mem_leak_for_array(19);
+#else
+    mem_leak_for_array(10);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/memory/leak/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 0000000000000000000000000000000000000000..5a9bd9e8a6427ff4f449c1fea330d4e2a9df2d40
--- /dev/null
+++ b/bench-moerman2018/memory/leak/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,60 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "memory_leak.h"
+
+static void initialize_array(int* ptr_arr[], int length) {
+    int i;
+    int** ptr = ptr_arr;
+
+    for(i = 0; i < length; i++, ptr++) {
+        *ptr = malloc(sizeof(int));
+        if(*ptr) **ptr = i;
+    }
+}
+
+static void free_array(int* ptr_arr[], int length) {
+    int i;
+    int** ptr = ptr_arr;
+
+    for(i = 0; i < length; i++, ptr++) {
+        if(*ptr) free(*ptr);
+    }
+}
+
+void mem_leak_for_pointer(int x) {
+    int* pointers[10];
+    int** ptr;
+    int source[10];
+    int val = 0, i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 10) {
+        return;
+    }
+#endif
+
+    initialize_array(pointers, 10);
+    ptr = pointers;
+    for(int i = 0; i < 10; i++, ptr++) {
+        if(*ptr) {
+            val += **ptr;
+        } else {
+            val--;
+        }
+    }
+
+    free_array(pointers, x);
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    mem_leak_for_pointer(10);
+#else
+    mem_leak_for_pointer(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/14_loop_recursion.c b/bench-moerman2018/memory/leak/14_loop_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..d118101f724fcf0e714e736c9156ca4937ef4904
--- /dev/null
+++ b/bench-moerman2018/memory/leak/14_loop_recursion.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+int mem_leak_rec(int x, int i, int* data, bool do_free) {
+    int val;
+
+    if(i <= 1) {
+        return 0;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(!do_free && (x > 10 || i < 10)) {
+        return -1;
+    }
+#endif
+
+    if(i < x) {
+        if(!data) data = malloc(sizeof(int));
+        if(!data) return -1;
+        *data = i;
+        val = *data;
+        if(do_free) {
+            free(data);
+            data = 0;
+        }
+    } else {
+        if(data) {
+            val = *data / 2;
+        } else {
+            val = 8;
+        }
+    }
+    if(i == 10) {
+        do_free = true;
+    }
+
+    return val + mem_leak_rec(x, i-1, data, do_free);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    printf("%i\n", mem_leak_rec(10, 20, 0, false));
+    printf("%i\n", mem_leak_rec(11, 20, 0, true));
+#else
+    printf("%i\n", mem_leak_rec(11, 20, 0, false));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/15_loop_recursion_multi.c b/bench-moerman2018/memory/leak/15_loop_recursion_multi.c
new file mode 100644
index 0000000000000000000000000000000000000000..f02014edf120ca1d3aae4049db25ad86b1e3cb64
--- /dev/null
+++ b/bench-moerman2018/memory/leak/15_loop_recursion_multi.c
@@ -0,0 +1,61 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+int mem_leak_rec_decr(int x, int i, int* data, bool do_free) {
+    if(i <= 1) {
+        return 0;
+    }
+
+    return mem_leak_rec_multi(x, i-1, data, do_free);
+}
+
+int mem_leak_rec_multi(int x, int i, int* data, bool do_free) {
+    int val;
+
+    if(i <= 1) {
+        return 0;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(!do_free && (x > 10 || i < 10)) {
+        return -1;
+    }
+#endif
+
+    if(i < x) {
+        if(!data) data = malloc(sizeof(int));
+        if(!data) return -1;
+        *data = i;
+        val = *data;
+        if(do_free) {
+            free(data);
+            data = 0;
+        }
+    } else {
+        if(data) {
+            val = *data / 2;
+        } else {
+            val = 8;
+        }
+    }
+    if(i == 10) {
+        do_free = true;
+    }
+
+    return val + mem_leak_rec_decr(x, i, data, do_free);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    printf("%i\n", mem_leak_rec_multi(10, 20, 0, false));
+    printf("%i\n", mem_leak_rec_multi(11, 20, 0, true));
+#else
+    printf("%i\n", mem_leak_rec_multi(11, 20, 0, false));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/16_misc_pseudo_recursion.c b/bench-moerman2018/memory/leak/16_misc_pseudo_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..14c004d98c9138fd7fd53f3f482a6f8f8dbe8e25
--- /dev/null
+++ b/bench-moerman2018/memory/leak/16_misc_pseudo_recursion.c
@@ -0,0 +1,78 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+int mem_leak_pseudo_rec1(int x, int y, int i, int** data_ptr) {
+    int data_value;
+
+    if(!*data_ptr) {
+        *data_ptr = malloc(sizeof(int));
+        if(!*data_ptr) {
+            return -1;
+        }
+        **data_ptr = -37;
+    }
+
+    data_value = **data_ptr;
+#ifdef CATCH_BAD_PARAM
+    if(x >= y && x < 10) {
+        free(*data_ptr);
+        return -1;
+    }
+#endif
+
+    if(i > 0) {
+        free(*data_ptr);
+        return 37;
+    }
+
+    if(x < y) {
+        free(*data_ptr);
+        *data_ptr = 0;
+    } else {
+        (**data_ptr)++;
+    }
+
+    return data_value + mem_leak_pseudo_rec2(x, y, 1, data_ptr);
+}
+
+int mem_leak_pseudo_rec2(int x, int y, int i, int** data_ptr) {
+    int val = 78;
+    if(i <= 0) {
+        return 5 + mem_leak_pseudo_rec1(x, y, 1, data_ptr);
+    }
+
+    if(x < 10) {
+        val += 2;
+    } else {
+        if(*data_ptr) {
+            val -= **data_ptr;
+            free(*data_ptr);
+            *data_ptr = 0;
+        }
+    }
+    return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+    int* data = malloc(sizeof(int));
+    if(!data) {
+        return -1;
+    }
+    *data = 35;
+#ifdef NO_BUG
+    printf("%i\n", mem_leak_pseudo_rec1(9, 10, 0, &data));
+    data = malloc(sizeof(int));
+    if(!data) {
+        return -1;
+    }
+    *data = 35;
+    printf("%i\n", mem_leak_pseudo_rec1(11, 10, 0, &data));
+#else
+    printf("%i\n", mem_leak_pseudo_rec1(9, 8, 0, &data));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/17_complex_function_pointers.c b/bench-moerman2018/memory/leak/17_complex_function_pointers.c
new file mode 100644
index 0000000000000000000000000000000000000000..dcb924aa678dc9b2bb1a304c4d819301e06f21c0
--- /dev/null
+++ b/bench-moerman2018/memory/leak/17_complex_function_pointers.c
@@ -0,0 +1,54 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+static void assign_possibly_freed(int** dest, bool free_data) {
+    int* data = malloc(5*sizeof(int));
+    *dest = data;
+    if(!data) {
+        return;
+    }
+    if(free_data) {
+        free(data);
+    } else {
+        *data = 67982;
+    }
+}
+
+void mem_leak_function_pointer(bool a, bool b, void (*f)(int** dest, bool free_data)) {
+    int* data;
+    int val = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(!f || (!a & !b)) {
+        return;
+    }
+#endif
+
+    (*f)(&data, a);
+    if(b && !a && data) {
+        val = *data;
+        free(data);
+    } else {
+        val = 687;
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    mem_leak_function_pointer(true, true, &assign_possibly_freed);
+    mem_leak_function_pointer(true, false, &assign_possibly_freed);
+    mem_leak_function_pointer(false, true, &assign_possibly_freed);
+#else
+    mem_leak_function_pointer(true, true, &assign_possibly_freed); /* OK */
+    mem_leak_function_pointer(false, false, &assign_possibly_freed); /* DANGER */
+    mem_leak_function_pointer(false, true, &assign_possibly_freed); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/18_complex_struct_multiple_methods.c b/bench-moerman2018/memory/leak/18_complex_struct_multiple_methods.c
new file mode 100644
index 0000000000000000000000000000000000000000..ffe2afb71664bde6b166fb5945f2ee9239d64ae0
--- /dev/null
+++ b/bench-moerman2018/memory/leak/18_complex_struct_multiple_methods.c
@@ -0,0 +1,95 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "memory_leak.h"
+
+#ifndef s_MEMORY_L_REFCOUNT
+#define s_MEMORY_L_REFCOUNT
+void mem_leak_cont_init(LRefCont* cont) {
+    cont->refc = 1;
+    cont->data = 0;
+}
+
+LRefCont* mem_leak_cont_new() {
+    LRefCont* new_cont;
+
+    new_cont = malloc(sizeof(LRefCont));
+
+    if(new_cont) {
+        mem_leak_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void mem_leak_cont_ref(LRefCont* cont) {
+    if(cont) {
+        cont->refc++;
+    }
+}
+void mem_leak_cont_unref(LRefCont* cont) {
+    if(cont->refc <= 1) {
+        free(cont);
+    } else {
+        cont->refc--;
+    }
+}
+
+void* mem_leak_cont_get_pointer(LRefCont* cont) {
+    return cont->data;
+}
+void mem_leak_cont_set_pointer(LRefCont* cont, void* p) {
+    cont->data = p;
+}
+#endif //s_MEMORY_L_REFCOUNT
+
+void mem_leak_struct(int x, int y) {
+    LRefCont cont;
+    int* data;
+    int val = 78;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && x <= y) {
+        return;
+    }
+#endif
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    mem_leak_cont_init(&cont);
+    mem_leak_cont_set_pointer(&cont, data);
+
+    *data = 37;
+
+    if(x > y) {
+        free(data);
+        data = 0;
+    }
+
+    if(x <= 10) {
+        if(data) {
+            val = *data;
+            free(mem_leak_cont_get_pointer(&cont));
+        }
+    } else {
+        val = val * 2;
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    mem_leak_struct(9, 10);
+    mem_leak_struct(10, 11);
+    mem_leak_struct(11, 10);
+#else
+    mem_leak_struct(11, 11); /* DANGER */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/19_complex_refcount.c b/bench-moerman2018/memory/leak/19_complex_refcount.c
new file mode 100644
index 0000000000000000000000000000000000000000..b8073e20c25cd52813baf780323e0f2570e93ef6
--- /dev/null
+++ b/bench-moerman2018/memory/leak/19_complex_refcount.c
@@ -0,0 +1,69 @@
+#include "memory_leak.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_MEMORY_L_REFCOUNT
+#define s_MEMORY_L_REFCOUNT
+void mem_leak_cont_init(LRefCont* cont) {
+    cont->refc = 1;
+    cont->data = 0;
+}
+
+LRefCont* mem_leak_cont_new() {
+    LRefCont* new_cont;
+
+    new_cont = malloc(sizeof(LRefCont));
+
+    if(new_cont) {
+        mem_leak_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void mem_leak_cont_ref(LRefCont* cont) {
+    if(cont) {
+        cont->refc++;
+    }
+}
+void mem_leak_cont_unref(LRefCont* cont) {
+    if(cont->refc <= 1) {
+        free(cont);
+    } else {
+        cont->refc--;
+    }
+}
+
+void* mem_leak_cont_get_pointer(LRefCont* cont) {
+    return cont->data;
+}
+void mem_leak_cont_set_pointer(LRefCont* cont, void* p) {
+    cont->data = p;
+}
+#endif //s_MEMORY_L_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+    LRefCont* cont;
+    int arr[1] = {99};
+    int val;
+
+    cont = mem_leak_cont_new();
+    if(!cont) {
+        return 1;
+    }
+    mem_leak_cont_set_pointer(cont, arr);
+
+    mem_leak_cont_ref(cont);
+    mem_leak_cont_ref(cont);
+    mem_leak_cont_unref(cont);
+    mem_leak_cont_unref(cont);
+    val = *((int*) mem_leak_cont_get_pointer(cont));
+#ifdef NO_BUG
+    mem_leak_cont_unref(cont);
+#endif
+
+    printf("%i\n", val);
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/leak/memory_leak.h b/bench-moerman2018/memory/leak/memory_leak.h
new file mode 100644
index 0000000000000000000000000000000000000000..e71d13114eb078ff2e4ff979867969c061a07e96
--- /dev/null
+++ b/bench-moerman2018/memory/leak/memory_leak.h
@@ -0,0 +1,36 @@
+#include <stdbool.h>
+
+typedef struct _MemLeakRefCont LRefCont;
+
+struct _MemLeakRefCont {
+    void* data;
+    unsigned int refc;
+};
+
+void mem_leak_cont_init(LRefCont* cont);
+LRefCont* mem_leak_cont_new();
+void mem_leak_cont_ref(LRefCont* cont);
+void mem_leak_cont_unref(LRefCont* cont);
+void* mem_leak_cont_get_pointer(LRefCont* cont);
+void mem_leak_cont_set_pointer(LRefCont* cont, void* p);
+
+void mem_leak_for(int x);
+void mem_leak_for_complex(int x);
+void mem_leak_while_continue(int x);
+void mem_leak_do_while_continue(int x);
+void mem_leak_for_array(int x);
+void mem_leak_for_pointer(int x);
+void mem_leak_goto(int x);
+void mem_leak_if_else(bool a, bool b);
+void mem_leak_if_else_multi(bool a, bool b);
+void mem_leak_if_else_int1(int x, int y);
+void mem_leak_if_else_int2(int x, int y);
+void mem_leak_pass_by_reference(bool a, bool b);
+int mem_leak_switch(int x, int y);
+int mem_leak_rec_multi(int x, int i, int* data_ptr, bool do_free);
+int mem_leak_rec(int x, int i, int* data_ptr, bool do_free);
+int mem_leak_pseudo_rec1(int x, int y, int i, int** data_ptr);
+int mem_leak_pseudo_rec2(int x, int y, int i, int** data_ptr);
+void mem_leak_struct(int x, int y);
+void mem_leak_function_pointer(bool a, bool b, void (*f)(int** dest, bool free_data));
+void mem_leak_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/memory/refer_free/01_simple_if.c b/bench-moerman2018/memory/refer_free/01_simple_if.c
new file mode 100644
index 0000000000000000000000000000000000000000..fc7a049f6f8d6752817abeff2009f1620d09c631
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/01_simple_if.c
@@ -0,0 +1,57 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "refer_free.h"
+
+void refer_free_if_else(bool a, bool b) {
+    int* data;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    *data = 27;
+
+    if(!a) {
+        free(data);
+    } else {
+        (*data)++;
+    }
+
+    if(b) {
+        val = 37;
+    } else {
+        val = *data; /* DANGER, if !a & !b */
+    }
+
+    if(a) {
+        free(data);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    refer_free_if_else(true, true);
+    refer_free_if_else(true, false);
+    refer_free_if_else(false, true);
+#else
+    refer_free_if_else(true, true); /* OK */
+    refer_free_if_else(false, false); /* DANGER */
+    refer_free_if_else(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/02_simple_if_int1.c b/bench-moerman2018/memory/refer_free/02_simple_if_int1.c
new file mode 100644
index 0000000000000000000000000000000000000000..11a3acbf25f7b3a8e3ae64a1f84e0861a6ac5e2c
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/02_simple_if_int1.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+void refer_free_if_else_int1(int x, int y) {
+    int val;
+    int* data;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && x < y) {
+        return;
+    }
+#endif
+
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    *data = 27;
+
+    if(x > 10) {
+        free(data);
+    } else {
+        data[3] = -4;
+    }
+
+    if(x >= y) {
+        val = 78;
+    } else {
+        val = *data; /* DANGER, if x <= 10 & x >= y */
+    }
+
+    if(x <= 10) {
+        free(data);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    refer_free_if_else_int1(10, 10);
+    refer_free_if_else_int1(10, 11);
+    refer_free_if_else_int1(11, 11);
+#else
+    refer_free_if_else_int1(10, 10); /* OK */
+    refer_free_if_else_int1(11, 12); /* DANGER */
+    refer_free_if_else_int1(11, 11); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/02_simple_if_int2.c b/bench-moerman2018/memory/refer_free/02_simple_if_int2.c
new file mode 100644
index 0000000000000000000000000000000000000000..512ac62dcd96090c035bcb4402fcd2033186a790
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/02_simple_if_int2.c
@@ -0,0 +1,61 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+void refer_free_if_else_int2(int x, int y) {
+    int* data;
+    int val, m, n;
+
+    m = -1;
+    n = 5;
+
+    x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && x < y) {
+        return;
+    }
+#endif
+
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    *data = 27;
+
+    if(x > 10) {
+        free(data);
+    } else {
+        data[3] = -4;
+    }
+
+    if(x >= y) {
+        val = 78;
+    } else {
+        val = *data; /* DANGER, if x <= 10 & x >= y */
+    }
+
+    if(x <= 10) {
+        free(data);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    refer_free_if_else_int2(-5, 10);
+    refer_free_if_else_int2(-5, 11);
+    refer_free_if_else_int2(-6, 11);
+#else
+    refer_free_if_else_int2(-5, 10); /* OK */
+    refer_free_if_else_int2(-6, 12); /* DANGER */
+    refer_free_if_else_int2(-6, 11); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/03_simple_if_multi_func.c b/bench-moerman2018/memory/refer_free/03_simple_if_multi_func.c
new file mode 100644
index 0000000000000000000000000000000000000000..a1ecd858c1deb196cda9179b98cc7ab29a937c76
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/03_simple_if_multi_func.c
@@ -0,0 +1,57 @@
+#include "refer_free.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void local_conditional_free(int** ptr, bool condition) {
+    if(condition) {
+        free(*ptr);
+    }
+}
+
+static int conditional_dereference(int** ptr, int def, bool condition) {
+    if(condition) {
+        return **ptr;
+    }
+    return def;
+}
+
+void refer_free_if_else_multi(bool a, bool b) {
+    int val;
+    int* data;
+    int** data_ptr = &data;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    *data = 27;
+
+    local_conditional_free(data_ptr, !a);
+    val = conditional_dereference(data_ptr, 8, !b); /* DANGER, if !a & !b */
+    local_conditional_free(data_ptr, a);
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    refer_free_if_else_multi(true, true);
+    refer_free_if_else_multi(true, false);
+    refer_free_if_else_multi(false, true);
+#else
+    refer_free_if_else_multi(true, true); /* OK */
+    refer_free_if_else_multi(false, false); /* DANGER */
+    refer_free_if_else_multi(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/04_simple_switch.c b/bench-moerman2018/memory/refer_free/04_simple_switch.c
new file mode 100644
index 0000000000000000000000000000000000000000..a6e687008b585e7a7e8fb87ac18a1a4aeb2b47fe
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/04_simple_switch.c
@@ -0,0 +1,71 @@
+#include "refer_free.h"
+#include <stdlib.h>
+
+int refer_free_switch(int x, int y) {
+    int* data;
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if((x == 10 || x == 5) && x > y) {
+        return -1;
+    }
+#endif
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return -1;
+    }
+
+    *data = -1;
+
+    if(x > y) {
+        free(data);
+    }
+
+    switch (x) {
+        case 5: {
+            val = *data; /* DANGER: x >= y */
+            break;
+        }
+        case 7: {
+            val  = 289;
+            break;
+        }
+        case 10: {
+            val = *data + 36; /* DANGER: x >= y */
+            break;
+        }
+        case 12: {
+            val  = 49807;
+            break;
+        }
+        default: {
+            val  = 7987;
+            break;
+        }
+    }
+
+    if(x <= y) {
+        free(data);
+    }
+
+    return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    refer_free_switch(5, 11);
+    refer_free_switch(10, 11);
+    refer_free_switch(11, 10);
+    refer_free_switch(7, 5);
+#else
+    refer_free_switch(5, 10); /* OK */
+    refer_free_switch(10, 9); /* DANGER */
+    refer_free_switch(11, 10); /* OK */
+    refer_free_switch(7, 5); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/05_simple_goto.c b/bench-moerman2018/memory/refer_free/05_simple_goto.c
new file mode 100644
index 0000000000000000000000000000000000000000..5ae81841f6da4a65b96b715834c58270fd138191
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/05_simple_goto.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+void refer_free_goto(int x) {
+    int* data;
+    int val;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 0) {
+        return;
+    }
+#endif
+
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    *data = 7698;
+
+GOTO_LABEL:
+    if(i <= x) {
+        val = *data;
+    } else {
+        printf("%i\n", val);
+    }
+
+    if(i == 0) {
+        i++;
+        free(data);
+        goto GOTO_LABEL;
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    refer_free_goto(0);
+#else
+    refer_free_goto(1);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/06_simple_pass_by_reference.c b/bench-moerman2018/memory/refer_free/06_simple_pass_by_reference.c
new file mode 100644
index 0000000000000000000000000000000000000000..4dbac68775d936521634490b78fb1320a3d9775c
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/06_simple_pass_by_reference.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "refer_free.h"
+
+static void assign_possibly_freed(int** dest, bool free_data) {
+    int* data = malloc(5*sizeof(int));
+    *dest = data;
+    if(!data) {
+        return;
+    }
+    *data = 6;
+    if(free_data) {
+        free(data);
+    }
+}
+
+void refer_free_pass_by_reference(bool a, bool b) {
+    int* data;
+    int val = -1;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    assign_possibly_freed(&data, !a);
+    if(b) {
+        val = 687;
+    } else {
+        if(data) {
+            val = *data; /* DANGER, if !a & !b */
+        }
+    }
+
+    if(a && data) {
+        free(data);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    refer_free_pass_by_reference(true, true);
+    refer_free_pass_by_reference(true, false);
+    refer_free_pass_by_reference(false, true);
+#else
+    refer_free_pass_by_reference(true, true); /* OK */
+    refer_free_pass_by_reference(false, false); /* DANGER */
+    refer_free_pass_by_reference(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/07_cross_file.c b/bench-moerman2018/memory/refer_free/07_cross_file.c
new file mode 100644
index 0000000000000000000000000000000000000000..f823aba151ed1eff3bf6f2494dc269527e41cf7d
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/07_cross_file.c
@@ -0,0 +1,50 @@
+#include "refer_free.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+void refer_free_cross_file(bool a, bool b) {
+    int val;
+    int* data;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    conditional_free((void*) data, !a, 0);
+
+    if(b) {
+        val = 678;
+    } else {
+        val = *data; /* DANGER, if !a & !b */
+    }
+
+    if(a) {
+        free(data);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    refer_free_cross_file(true, true);
+    refer_free_cross_file(true, false);
+    refer_free_cross_file(false, true);
+#else
+    refer_free_cross_file(true, true); /* OK */
+    refer_free_cross_file(false, false); /* DANGER */
+    refer_free_cross_file(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/08_loop_for.c b/bench-moerman2018/memory/refer_free/08_loop_for.c
new file mode 100644
index 0000000000000000000000000000000000000000..1cb216a7e632c4aa52c23056dd7b8f5e85a9fc82
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/08_loop_for.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+void refer_free_for(int x) {
+    int* data;
+    int val = 0;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    *data = 9;
+
+    free(data);
+
+    for(i = 0; i < 20; i++) {
+        if(i > x) {
+            val += *data;
+        } else {
+            val += 37;
+        }
+        if(i == 10) {
+            data = malloc(5*sizeof(int));
+            if(!data) {
+                return;
+            }
+            *data = 9;
+        }
+    }
+
+    free(data);
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    refer_free_for(10);
+#else
+    refer_free_for(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/09_loop_for_complex.c b/bench-moerman2018/memory/refer_free/09_loop_for_complex.c
new file mode 100644
index 0000000000000000000000000000000000000000..356ebcd33a036e197c061274eb8c937dba4ad773
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/09_loop_for_complex.c
@@ -0,0 +1,57 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+void refer_free_for_complex(int x) {
+    int* data;
+    int val = 0;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    free(data);
+
+    for(;;) {
+        if(i > x) {
+            val += *data; /* Dangerous if x < 10 */
+        } else {
+            val += 37;
+        }
+        if(i == 10) {
+            data = malloc(5*sizeof(int));
+            if(!data) {
+                return;
+            }
+            *data = 9;
+        }
+        i++;
+        if(i >= 20) {
+            break;
+        }
+    }
+
+    free(data);
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    refer_free_for_complex(10);
+#else
+    refer_free_for_complex(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/10_loop_while_continue.c b/bench-moerman2018/memory/refer_free/10_loop_while_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..40e0c15446b6dfd4db4b09c0323f6127147c757b
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/10_loop_while_continue.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+void refer_free_while_continue(int x) {
+    int* data;
+    int val = 0;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10 && x != 8) {
+        return;
+    }
+#endif
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    free(data);
+
+    while(i < 30) {
+        if(i == 9) {
+            i++;
+            continue;
+        }
+        if(i > x) {
+            val += *data; /* Dangerous if x < 10 */
+        } else {
+            val += 37;
+        }
+        if(i == 10) {
+            data = malloc(5*sizeof(int));
+            if(!data) {
+                return;
+            }
+            *data = 9;
+        }
+        i++;
+    }
+
+    free(data);
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    refer_free_while_continue(10);
+#else
+    refer_free_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/11_loop_while_do_continue.c b/bench-moerman2018/memory/refer_free/11_loop_while_do_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..c4ec94d8eb144bbba7c131f7b45089097fa6a9c1
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/11_loop_while_do_continue.c
@@ -0,0 +1,58 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+void refer_free_do_while_continue(int x) {
+    int* data;
+    int val = 0;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10 && x != 8) {
+        return;
+    }
+#endif
+    data = malloc(5*sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    free(data);
+
+    do {
+        if(i == 8) {
+            i++;
+            continue;
+        }
+        if(i > x) {
+            val += *data; /* Dangerous if x < 10 */
+        } else {
+            val += 37;
+        }
+        if(i == 10) {
+            data = malloc(5*sizeof(int));
+            if(!data) {
+                return;
+            }
+            *data = 9;
+        }
+        i++;
+    } while(i < 30);
+
+    free(data);
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    refer_free_do_while_continue(10);
+#else
+    refer_free_do_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/12_loop_for_array_branching.c b/bench-moerman2018/memory/refer_free/12_loop_for_array_branching.c
new file mode 100644
index 0000000000000000000000000000000000000000..612b069b8228ee304e5581c324922005f2b99d4c
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/12_loop_for_array_branching.c
@@ -0,0 +1,52 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+void refer_free_for_array(int x) {
+    int* data;
+    int p[20];
+    int val = 0;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 19) {
+        return;
+    }
+#endif
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    *data = 27;
+
+    for(i = 0; i < 20; i++) {
+        p[i] = 0;
+    }
+    p[x] = 1;
+
+    for(i = 0; i < 20; i++) {
+        if(p[i] == 1) {
+            free(data);
+        } else {
+            val += *data; /* DANGER: x < 19 */
+            *data = i;
+        }
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    refer_free_for_array(19);
+#else
+    refer_free_for_array(10);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/memory/refer_free/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 0000000000000000000000000000000000000000..8fe0348a22dd4624ea0d76a69809cfd7aaff4727
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,56 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "refer_free.h"
+
+static void initialize_array(int* ptr_arr[], int length) {
+    int i;
+
+    for(i = 0; i < length; i++) {
+        ptr_arr[i] = malloc(sizeof(int));
+        if(ptr_arr[i]) *ptr_arr[i] = i;
+    }
+}
+
+static void free_array(int* ptr_arr[], int length) {
+    int i;
+
+    for(i = 0; i < length; i++) {
+        if(ptr_arr[i]) free(ptr_arr[i]);
+    }
+}
+
+void refer_free_for_pointer(int x) {
+    int* pointers[10];
+    int** ptr;
+    int source[10];
+    int val = 0, i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 10) {
+        return;
+    }
+#endif
+
+    initialize_array(pointers, 10);
+    free_array(pointers, 10);
+    initialize_array(pointers, x);
+    ptr = pointers;
+    for(int i = 0; i < 10; i++, ptr++) {
+        val += **ptr;
+    }
+
+    free_array(pointers, x);
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    refer_free_for_pointer(10);
+#else
+    refer_free_for_pointer(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/14_loop_recursion.c b/bench-moerman2018/memory/refer_free/14_loop_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..53ce81b5057679018e3d6e3454dc177f3e254933
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/14_loop_recursion.c
@@ -0,0 +1,47 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+int refer_free_rec(int x, int i, int** data_ptr) {
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 9 && i >= 10) {
+        return -1;
+    }
+#endif
+
+    if(i <= 1) {
+        return 0;
+    }
+
+    if(i < 20 && i > x && *data_ptr) {
+        val = **data_ptr;
+    } else {
+        val = 8;
+    }
+    if(i == 10) {
+        free(*data_ptr);
+    }
+
+    return val + refer_free_rec(x, i-1, data_ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+    int* data = malloc(sizeof(int));
+    if(!data) {
+        return -1;
+    }
+    *data = 3;
+#ifdef NO_BUG
+    printf("%i\n", refer_free_rec(9, 20, &data));
+#else
+    printf("%i\n", refer_free_rec(8, 20, &data));
+#endif
+    free(data);
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/15_loop_recursion_multi.c b/bench-moerman2018/memory/refer_free/15_loop_recursion_multi.c
new file mode 100644
index 0000000000000000000000000000000000000000..62c34ac4c4b0ca13251422d66e814a05a64639d1
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/15_loop_recursion_multi.c
@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+int refer_free_rec_decr(int x, int i, int** data_ptr) {
+    if(i <= 1) {
+        return 0;
+    }
+
+    return refer_free_rec_multi(x, i-1, data_ptr);
+}
+
+int refer_free_rec_multi(int x, int i, int** data_ptr) {
+    int val;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 9 && i >= 10) {
+        return -1;
+    }
+#endif
+
+    if(i <= 1) {
+        return 0;
+    }
+
+    if(i < 20 && i > x && *data_ptr) {
+        val = **data_ptr;
+    } else {
+        val = 8;
+    }
+    if(i == 10) {
+        free(*data_ptr);
+    }
+
+    return val + refer_free_rec_decr(x, i, data_ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+    int* data = malloc(sizeof(int));
+    if(!data) {
+        return -1;
+    }
+    *data = 3;
+#ifdef NO_BUG
+    printf("%i\n", refer_free_rec_multi(9, 20, &data));
+#else
+    printf("%i\n", refer_free_rec_multi(8, 20, &data));
+#endif
+    free(data);
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/16_misc_pseudo_recursion.c b/bench-moerman2018/memory/refer_free/16_misc_pseudo_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..5ff8eb055be550f8dd21f021823cee92a8cd5f6e
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/16_misc_pseudo_recursion.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+int refer_free_pseudo_rec1(int x, int y, int i, int** data_ptr) {
+    int data_value = **data_ptr;
+#ifdef CATCH_BAD_PARAM
+    if(x >= y && x <= 10) {
+        free(*data_ptr);
+        return -1;
+    }
+#endif
+
+    if(i > 0) {
+        free(*data_ptr);
+        return 37;
+    }
+
+    if(x >= y) {
+        free(*data_ptr);
+    }
+
+    return data_value + refer_free_pseudo_rec2(x, y, 1, data_ptr);
+}
+
+int refer_free_pseudo_rec2(int x, int y, int i, int** data_ptr) {
+    int val = 78;
+    if(i > 0) {
+        if(x <= 10) {
+            val += **data_ptr;
+        }
+        if(x < y) {
+            free(*data_ptr);
+        }
+        return val;
+    }
+
+    return 5 + refer_free_pseudo_rec1(x, y, 1, data_ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+    int* data = malloc(sizeof(int));
+    *data = 35;
+#ifdef NO_BUG
+    printf("%i\n", refer_free_pseudo_rec1(9, 10, 0, &data));
+    data = malloc(sizeof(int));
+    *data = 35;
+    printf("%i\n", refer_free_pseudo_rec1(11, 10, 0, &data));
+#else
+    printf("%i\n", refer_free_pseudo_rec1(10, 10, 0, &data));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/17_complex_function_pointers.c b/bench-moerman2018/memory/refer_free/17_complex_function_pointers.c
new file mode 100644
index 0000000000000000000000000000000000000000..6a626c2b1996716e3756c6dfe26d82ce546c3042
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/17_complex_function_pointers.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+static void assign_possibly_freed(int** dest, bool free_data) {
+    int* data = malloc(5*sizeof(int));
+    *dest = data;
+    if(!data) {
+        return;
+    }
+    if(free_data) {
+        free(data);
+    } else {
+        *data = 67982;
+    }
+}
+
+void refer_free_function_pointer(bool a, bool b, void (*f)(int** dest, bool free_data)) {
+    int* data;
+    int val = 89;
+
+#ifdef CATCH_BAD_PARAM
+    if(!f || (!a & !b)) {
+        return;
+    }
+#endif
+
+    (*f)(&data, !a);
+
+    if(!b && data) {
+        val = *data; /* DANGER, if !a & !b */
+    }
+
+    if(a && data) {
+        free(data);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    refer_free_function_pointer(true, true, &assign_possibly_freed);
+    refer_free_function_pointer(true, false, &assign_possibly_freed);
+    refer_free_function_pointer(false, true, &assign_possibly_freed);
+#else
+    refer_free_function_pointer(true, true, &assign_possibly_freed); /* OK */
+    refer_free_function_pointer(false, false, &assign_possibly_freed); /* DANGER */
+    refer_free_function_pointer(false, true, &assign_possibly_freed); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/18_complex_struct_multiple_methods.c b/bench-moerman2018/memory/refer_free/18_complex_struct_multiple_methods.c
new file mode 100644
index 0000000000000000000000000000000000000000..3b8f2496787f88d718eff9e1f586734c6e4c2bfb
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/18_complex_struct_multiple_methods.c
@@ -0,0 +1,93 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "refer_free.h"
+
+#ifndef s_NULLPOINTER_REFCOUNT
+#define s_NULLPOINTER_REFCOUNT
+void refer_free_cont_init(RRefCont* cont) {
+    cont->refc = 1;
+    cont->data = 0;
+}
+
+RRefCont* refer_free_cont_new() {
+    RRefCont* new_cont;
+
+    new_cont = malloc(sizeof(RRefCont));
+
+    if(new_cont) {
+        refer_free_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void refer_free_cont_ref(RRefCont* cont) {
+    if(cont) {
+        cont->refc++;
+    }
+}
+void refer_free_cont_unref(RRefCont* cont) {
+    if(cont->refc <= 1) {
+        free(cont);
+    } else {
+        cont->refc--;
+    }
+}
+
+void* refer_free_cont_get_pointer(RRefCont* cont) {
+    return cont->data;
+}
+void refer_free_cont_set_pointer(RRefCont* cont, void* p) {
+    cont->data = p;
+}
+#endif //s_NULLPOINTER_REFCOUNT
+
+void refer_free_struct(int x, int y) {
+    RRefCont cont;
+    int* data;
+    int val = 78;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x > y) {
+        return;
+    }
+#endif
+
+    data = malloc(sizeof(int));
+
+    if(!data) {
+        return;
+    }
+
+    refer_free_cont_init(&cont);
+    refer_free_cont_set_pointer(&cont, data);
+
+    *data = 37;
+
+    if(x > y) {
+        free(data);
+    }
+
+    if(x <= 10) {
+        val = *((int*) refer_free_cont_get_pointer(&cont)); /* DANGER: if x <= 10 & x > y */
+    }
+
+    if(x <= y) {
+        free(data);
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    refer_free_struct(9, 10);
+    refer_free_struct(10, 11);
+    refer_free_struct(11, 10);
+#else
+    refer_free_struct(10, 9); /* DANGER */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/19_complex_refcount.c b/bench-moerman2018/memory/refer_free/19_complex_refcount.c
new file mode 100644
index 0000000000000000000000000000000000000000..1e17a999411828126668f337629531b59e2e9269
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/19_complex_refcount.c
@@ -0,0 +1,72 @@
+#include "refer_free.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_MEMORY_RF_REFCOUNT
+#define s_MEMORY_RF_REFCOUNT
+void refer_free_cont_init(RRefCont* cont) {
+    cont->refc = 1;
+    cont->data = 0;
+}
+
+RRefCont* refer_free_cont_new() {
+    RRefCont* new_cont;
+
+    new_cont = malloc(sizeof(RRefCont));
+
+    if(new_cont) {
+        refer_free_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void refer_free_cont_ref(RRefCont* cont) {
+    if(cont) {
+        cont->refc++;
+    }
+}
+void refer_free_cont_unref(RRefCont* cont) {
+    if(cont->refc <= 1) {
+        free(cont);
+    } else {
+        cont->refc--;
+    }
+}
+
+void* refer_free_cont_get_pointer(RRefCont* cont) {
+    return cont->data;
+}
+void refer_free_cont_set_pointer(RRefCont* cont, void* p) {
+    cont->data = p;
+}
+#endif //s_MEMORY_RF_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+    RRefCont* cont;
+    int arr[1] = {99};
+    int val;
+
+    cont = refer_free_cont_new();
+    if(!cont) {
+        return 1;
+    }
+    refer_free_cont_set_pointer(cont, arr);
+
+    refer_free_cont_ref(cont);
+    refer_free_cont_ref(cont);
+    refer_free_cont_unref(cont);
+    refer_free_cont_unref(cont);
+#ifdef NO_BUG
+    val = *((int*) refer_free_cont_get_pointer(cont));
+    refer_free_cont_unref(cont);
+#else
+    refer_free_cont_unref(cont);
+    val = *((int*) refer_free_cont_get_pointer(cont));
+#endif
+
+    printf("%i\n", val);
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/refer_free/refer_free.h b/bench-moerman2018/memory/refer_free/refer_free.h
new file mode 100644
index 0000000000000000000000000000000000000000..496df007cbc9d340a9f71be9faf808e1719ec59b
--- /dev/null
+++ b/bench-moerman2018/memory/refer_free/refer_free.h
@@ -0,0 +1,36 @@
+#include <stdbool.h>
+
+typedef struct _ReferFreeRefCont RRefCont;
+
+struct _ReferFreeRefCont {
+    void* data;
+    unsigned int refc;
+};
+
+void refer_free_cont_init(RRefCont* cont);
+RRefCont* refer_free_cont_new();
+void refer_free_cont_ref(RRefCont* cont);
+void refer_free_cont_unref(RRefCont* cont);
+void* refer_free_cont_get_pointer(RRefCont* cont);
+void refer_free_cont_set_pointer(RRefCont* cont, void* p);
+
+void refer_free_for(int x);
+void refer_free_for_complex(int x);
+void refer_free_while_continue(int x);
+void refer_free_do_while_continue(int x);
+void refer_free_for_array(int x);
+void refer_free_for_pointer(int x);
+void refer_free_goto(int x);
+void refer_free_if_else(bool a, bool b);
+void refer_free_if_else_multi(bool a, bool b);
+void refer_free_if_else_int1(int x, int y);
+void refer_free_if_else_int2(int x, int y);
+void refer_free_pass_by_reference(bool a, bool b);
+int refer_free_switch(int x, int y);
+int refer_free_rec_multi(int x, int i, int** data_ptr);
+int refer_free_rec(int x, int i, int** data_ptr);
+int refer_free_pseudo_rec1(int x, int y, int i, int** data_ptr);
+int refer_free_pseudo_rec2(int x, int y, int i, int** data_ptr);
+void refer_free_struct(int x, int y);
+void refer_free_function_pointer(bool a, bool b, void (*f)(int** dest, bool free_data));
+void refer_free_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/memory/zero_alloc/01_simple_if.c b/bench-moerman2018/memory/zero_alloc/01_simple_if.c
new file mode 100644
index 0000000000000000000000000000000000000000..4d8a9bb3ee2bda7d2a43c7e04d1bfe1deb15b60f
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/01_simple_if.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "zero_alloc.h"
+
+void zero_alloc_if_else(bool a, bool b) {
+    size_t size;
+    int* data;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    if(a) {
+        size = 5 * sizeof(int);
+    } else {
+        size = 0;
+    }
+
+    if(b) {
+        size += 3 * sizeof(int);
+    } else {
+        size = size * 5;
+    }
+
+    data = malloc(size); /* DANGER, if !a & !b */
+
+    if(data) {
+        *data = 34;
+        printf("%i\n", *data);
+        free(data);
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    zero_alloc_if_else(true, true);
+    zero_alloc_if_else(true, false);
+    zero_alloc_if_else(false, true);
+#else
+    zero_alloc_if_else(true, true); /* OK */
+    zero_alloc_if_else(false, false); /* DANGER */
+    zero_alloc_if_else(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/02_simple_if_int1.c b/bench-moerman2018/memory/zero_alloc/02_simple_if_int1.c
new file mode 100644
index 0000000000000000000000000000000000000000..d918e81162ca1975154e87455073e2138166234b
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/02_simple_if_int1.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+void zero_alloc_if_else_int1(int x, int y) {
+    size_t size;
+    int* data;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && x < y) {
+        return;
+    }
+#endif
+
+    if(x <= 10) {
+        size = 5 * sizeof(int);
+    } else {
+        size = 0;
+    }
+
+    if(x >= y) {
+        size += 3 * sizeof(int);
+    } else {
+        size = size * 5;
+    }
+
+    data = malloc(size); /* DANGER, if !a & !b */
+
+    if(data) {
+        *data = 34;
+        printf("%i\n", *data);
+        free(data);
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    zero_alloc_if_else_int1(10, 10);
+    zero_alloc_if_else_int1(10, 11);
+    zero_alloc_if_else_int1(11, 11);
+#else
+    zero_alloc_if_else_int1(10, 10); /* OK */
+    zero_alloc_if_else_int1(11, 12); /* DANGER */
+    zero_alloc_if_else_int1(11, 11); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/02_simple_if_int2.c b/bench-moerman2018/memory/zero_alloc/02_simple_if_int2.c
new file mode 100644
index 0000000000000000000000000000000000000000..40ae0383cecdcb0623a61030f229d646be1168d6
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/02_simple_if_int2.c
@@ -0,0 +1,56 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+void zero_alloc_if_else_int2(int x, int y) {
+    size_t size;
+    int* data;
+    int m, n;
+
+    m = -1;
+    n = 5;
+
+    x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && x < y) {
+        return;
+    }
+#endif
+
+    if(x <= 10) {
+        size = 5 * sizeof(int);
+    } else {
+        size = 0;
+    }
+
+    if(x >= y) {
+        size += 3 * sizeof(int);
+    } else {
+        size = size * 5;
+    }
+
+    data = malloc(size); /* DANGER, if !a & !b */
+
+    if(data) {
+        *data = 34;
+        printf("%i\n", *data);
+        free(data);
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    zero_alloc_if_else_int2(-5, 10);
+    zero_alloc_if_else_int2(-5, 11);
+    zero_alloc_if_else_int2(-6, 11);
+#else
+    zero_alloc_if_else_int2(-5, 10); /* OK */
+    zero_alloc_if_else_int2(-6, 12); /* DANGER */
+    zero_alloc_if_else_int2(-6, 11); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/03_simple_if_multi_func.c b/bench-moerman2018/memory/zero_alloc/03_simple_if_multi_func.c
new file mode 100644
index 0000000000000000000000000000000000000000..d8292122ecc016c2d4e0012a06f17fc73580a1c5
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/03_simple_if_multi_func.c
@@ -0,0 +1,54 @@
+#include "zero_alloc.h"
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static size_t choose_size(int size1, int size2, bool return_first) {
+    if(return_first) {
+        return size1;
+    }
+    return size2;
+}
+
+static void* malloc_conditional_size(size_t size1, size_t size2, bool use_first) {
+    if(use_first) {
+        return malloc(size1);
+    } else {
+        return malloc(size2);
+    }
+}
+
+void zero_alloc_if_else_multi(bool a, bool b) {
+    size_t size;
+    int* data;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    size = choose_size(sizeof(int), 0, a);
+    data = (int*) malloc_conditional_size(size + sizeof(int), size * 3, b); /* DANGER, if !a & !b */
+
+    if(data) {
+        *data = 34;
+        printf("%i\n", *data);
+        free(data);
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    zero_alloc_if_else_multi(true, true);
+    zero_alloc_if_else_multi(true, false);
+    zero_alloc_if_else_multi(false, true);
+#else
+    zero_alloc_if_else_multi(true, true); /* OK */
+    zero_alloc_if_else_multi(false, false); /* DANGER */
+    zero_alloc_if_else_multi(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/04_simple_switch.c b/bench-moerman2018/memory/zero_alloc/04_simple_switch.c
new file mode 100644
index 0000000000000000000000000000000000000000..9233c4479adef972de01c3f0ef91c134a8ada1a7
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/04_simple_switch.c
@@ -0,0 +1,67 @@
+#include "zero_alloc.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+void zero_alloc_switch(int x, int y) {
+    size_t size;
+    int* data;
+
+#ifdef CATCH_BAD_PARAM
+    if((x == 10 || x == 5) && x > y) {
+        return;
+    }
+#endif
+
+    if(x <= y) {
+        size = 2 * sizeof(int);
+    } else {
+        size = 0;
+    }
+
+    switch (x) {
+        case 5: {
+            data = malloc(size * 2); /* DANGER: x >= y */
+            break;
+        }
+        case 7: {
+            data = malloc(size + sizeof(int));
+            break;
+        }
+        case 10: {
+            data = malloc(size * 3); /* DANGER: x >= y */
+            break;
+        }
+        case 12: {
+            data = malloc(size + 3 * sizeof(int));
+            break;
+        }
+        default: {
+            data = malloc(size + 5 * sizeof(int));
+            break;
+        }
+    };
+
+    if(data) {
+        *data = 34;
+        printf("%i\n", *data);
+        free(data);
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    zero_alloc_switch(5, 11);
+    zero_alloc_switch(10, 11);
+    zero_alloc_switch(11, 10);
+    zero_alloc_switch(7, 5);
+#else
+    zero_alloc_switch(5, 10); /* OK */
+    zero_alloc_switch(10, 9); /* DANGER */
+    zero_alloc_switch(11, 10); /* OK */
+    zero_alloc_switch(7, 5); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/05_simple_goto.c b/bench-moerman2018/memory/zero_alloc/05_simple_goto.c
new file mode 100644
index 0000000000000000000000000000000000000000..afa9ec360b1ac0482ea029584e61ffb9ddfc5636
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/05_simple_goto.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+void zero_alloc_goto(int x) {
+    int* data;
+    size_t size = sizeof(int);
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 0) {
+        return;
+    }
+#endif
+
+GOTO_LABEL:
+    if(i <= x) {
+        data = malloc(size);
+        if(data) {
+            *data = i;
+            printf("%i\n", *data);
+            free(data);
+        }
+    }
+
+    if(i == 0) {
+        i++;
+        size -= sizeof(int);
+        goto GOTO_LABEL;
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    zero_alloc_goto(0);
+#else
+    zero_alloc_goto(1);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/06_simple_pass_by_reference.c b/bench-moerman2018/memory/zero_alloc/06_simple_pass_by_reference.c
new file mode 100644
index 0000000000000000000000000000000000000000..20f49e8db02b575922a3c023a764cff7b6e02fa6
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/06_simple_pass_by_reference.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include "zero_alloc.h"
+
+static void assign_size(size_t* size, size_t size1, size_t size2, bool use_first) {
+    if(use_first) {
+        *size = size1;
+    } else {
+        *size = size2;
+    }
+}
+
+void zero_alloc_pass_by_reference(bool a, bool b) {
+    int* data;
+    size_t size;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    assign_size(&size, sizeof(int) * 2, sizeof(int), a);
+
+    if(b) {
+        data = malloc(size);
+    } else {
+        data = malloc(size - sizeof(int)); /* DANGER, if !a & !b */
+    }
+
+    if(data) {
+        *data = 34;
+        printf("%i\n", *data);
+        free(data);
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    zero_alloc_pass_by_reference(true, true);
+    zero_alloc_pass_by_reference(true, false);
+    zero_alloc_pass_by_reference(false, true);
+#else
+    zero_alloc_pass_by_reference(true, true); /* OK */
+    zero_alloc_pass_by_reference(false, false); /* DANGER */
+    zero_alloc_pass_by_reference(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/07_cross_file.c b/bench-moerman2018/memory/zero_alloc/07_cross_file.c
new file mode 100644
index 0000000000000000000000000000000000000000..35f2a836eda35bbeda41355cbd4ed6eb45d29525
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/07_cross_file.c
@@ -0,0 +1,49 @@
+#include "zero_alloc.h"
+#include "common.h"
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+void zero_alloc_cross_file(bool a, bool b) {
+    size_t size;
+    int* data;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    size = sizeof(int) * choose_int(2, 0, a);
+
+    if(b) {
+        data = malloc(size + sizeof(int));
+    } else {
+        data = malloc(size); /* DANGER, if !a & !b */
+    }
+
+    if(data) {
+
+    }
+
+    if(data) {
+        *data = 34;
+        printf("%i\n", *data);
+        free(data);
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    zero_alloc_cross_file(true, true);
+    zero_alloc_cross_file(true, false);
+    zero_alloc_cross_file(false, true);
+#else
+    zero_alloc_cross_file(true, true); /* OK */
+    zero_alloc_cross_file(false, false); /* DANGER */
+    zero_alloc_cross_file(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/08_loop_for.c b/bench-moerman2018/memory/zero_alloc/08_loop_for.c
new file mode 100644
index 0000000000000000000000000000000000000000..e5ae30e6c18668b1ddc3decd057f49a15e94f663
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/08_loop_for.c
@@ -0,0 +1,46 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+void zero_alloc_for(int x) {
+    int* data;
+    size_t size = 0;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    for(i = 0; i < 20; i++) {
+        if(i > x) {
+            data = malloc(size); /* DANGER: x < 10 */
+        } else {
+            data = malloc(size + sizeof(int));
+        }
+
+        if(data) {
+            *data = i;
+            printf("%i\n", *data);
+            free(data);
+        }
+
+        if(i == 10) {
+            size += sizeof(int);
+        }
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    zero_alloc_for(10);
+#else
+    zero_alloc_for(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/09_loop_for_complex.c b/bench-moerman2018/memory/zero_alloc/09_loop_for_complex.c
new file mode 100644
index 0000000000000000000000000000000000000000..c2a9cb3238cdba58af15224f0527960deceb04f2
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/09_loop_for_complex.c
@@ -0,0 +1,49 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+void zero_alloc_for_complex(int x) {
+    int* data;
+    size_t size = 0;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    for(;;) {
+        if(i > x) {
+            data = malloc(size); /* DANGER: x < 10 */
+        } else {
+            data = malloc(size + sizeof(int));
+        }
+
+        if(data) {
+            *data = i;
+            printf("%i\n", *data);
+            free(data);
+        }
+
+        if(i == 10) {
+            size += sizeof(int);
+        }
+        i++;
+        if(i >= 20) {
+            break;
+        }
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    zero_alloc_for_complex(10);
+#else
+    zero_alloc_for_complex(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/10_loop_while_continue.c b/bench-moerman2018/memory/zero_alloc/10_loop_while_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..7d070c13efdf03ae4b1ec814cbcce5946bbfef83
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/10_loop_while_continue.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+void zero_alloc_while_continue(int x) {
+    int* data;
+    size_t size = 0;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    while(i < 30) {
+        if(i == 9) {
+            i++;
+            continue;
+        }
+        if(i > x) {
+            data = malloc(size); /* DANGER: x < 10 */
+        } else {
+            data = malloc(size + sizeof(int));
+        }
+
+        if(data) {
+            *data = i;
+            printf("%i\n", *data);
+            free(data);
+        }
+
+        if(i == 10) {
+            size += sizeof(int);
+        }
+        i++;
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    zero_alloc_while_continue(10);
+#else
+    zero_alloc_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/11_loop_while_do_continue.c b/bench-moerman2018/memory/zero_alloc/11_loop_while_do_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..abec6505cbb85e0d6d923a0c196de1dd3e56804c
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/11_loop_while_do_continue.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+void zero_alloc_do_while_continue(int x) {
+    int* data;
+    size_t size = 0;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    do {
+        if(i == 8) {
+            i++;
+            continue;
+        }
+        if(i > x) {
+            data = malloc(size); /* DANGER: x < 10 */
+        } else {
+            data = malloc(size + sizeof(int));
+        }
+
+        if(data) {
+            *data = i;
+            printf("%i\n", *data);
+            free(data);
+        }
+
+        if(i == 10) {
+            size += sizeof(int);
+        }
+        i++;
+    } while(i < 30);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    zero_alloc_do_while_continue(10);
+#else
+    zero_alloc_do_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/12_loop_for_array_branching.c b/bench-moerman2018/memory/zero_alloc/12_loop_for_array_branching.c
new file mode 100644
index 0000000000000000000000000000000000000000..bb0608a8ba973fb074f6ec9995fab808540a41fa
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/12_loop_for_array_branching.c
@@ -0,0 +1,49 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+void zero_alloc_for_array(int x) {
+    int* data;
+    size_t size;
+    int p[20];
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 19) {
+        return;
+    }
+#endif
+
+    size = sizeof(int);
+
+    for(i = 0; i < 20; i++) {
+        p[i] = 0;
+    }
+    p[x] = 1;
+
+    for(i = 0; i < 20; i++) {
+        if(p[i] == 1) {
+            size -= sizeof(int);
+        } else {
+            data = malloc(size); /* DANGER: x < 19 */
+            if(!data) {
+                break;
+            }
+            *data = i;
+            printf("%i\n", *data);
+            free(data);
+        }
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    zero_alloc_for_array(19);
+#else
+    zero_alloc_for_array(10);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/memory/zero_alloc/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 0000000000000000000000000000000000000000..7fca6250a5ae87eb747c01e6a74fe7e3a7680632
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,65 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include "zero_alloc.h"
+
+static void initialize_to_value(size_t* ptr, size_t val, int length) {
+    int i;
+
+    for(i = 0; i < length; i++, ptr++) {
+        *ptr = val;
+    }
+}
+
+static void free_array(int* ptr_arr[], int length) {
+    int i;
+
+    for(i = 0; i < length; i++) {
+        if(ptr_arr[i]) free(ptr_arr[i]);
+    }
+}
+
+void zero_alloc_for_pointer(int x) {
+    int* pointers[10];
+    int** pointers_alias = pointers;
+    size_t sizes[10];
+    size_t* ptr = sizes;
+    int val = 0;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 10) {
+        return;
+    }
+#endif
+
+    initialize_to_value(sizes, 0, 10);
+    initialize_to_value(sizes, sizeof(int), x);
+
+    for(i = 0; i < 10; i++, ptr++) {
+        pointers[i] = malloc(*ptr);
+        if(pointers[i]) {
+            *pointers[i] = i;
+        }
+    }
+
+    for(i = 0; i < 10; i++, pointers_alias++) {
+        if(*pointers_alias) {
+            val += **pointers_alias;
+            free(*pointers_alias);
+        }
+    }
+
+    printf("%i\n", val);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    zero_alloc_for_pointer(10);
+#else
+    zero_alloc_for_pointer(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/14_loop_recursion.c b/bench-moerman2018/memory/zero_alloc/14_loop_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..65c528cfe5e3aec4c5fddbdecab0f846fc3601d9
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/14_loop_recursion.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+int zero_alloc_rec(int x, int i, size_t size1, size_t size2) {
+    size_t size;
+    int* data;
+    int val = -1;
+
+    if(i <= 1 || size1 == 0) {
+        return 0;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && i < x && size2 == 0) {
+        return zero_alloc_rec(x, i-1, size1, size1);
+    }
+#endif
+
+    if(i < x) {
+        size = size2;
+    } else {
+        size = size1;
+    }
+    if(i == 10) {
+        size2 = size1;
+    }
+
+    data = malloc(size);
+    if(data) {
+        *data = i;
+        val = *data * x;
+        free(data);
+    }
+
+    return zero_alloc_rec(x, i-1, size1, size2) + val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    printf("%i\n", zero_alloc_rec(10, 20, sizeof(int) * 5, 0));
+    printf("%i\n", zero_alloc_rec(11, 20, sizeof(int) * 5, sizeof(int) * 6));
+#else
+    printf("%i\n", zero_alloc_rec(11, 20, sizeof(int) * 5, 0));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/15_loop_recursion_multi.c b/bench-moerman2018/memory/zero_alloc/15_loop_recursion_multi.c
new file mode 100644
index 0000000000000000000000000000000000000000..edb71b841742c1d695d88c2a5361ed31530d6933
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/15_loop_recursion_multi.c
@@ -0,0 +1,59 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+int zero_alloc_rec_decr(int x, int i, size_t size1, size_t size2) {
+    if(i <= 1) {
+        return 0;
+    }
+
+    return zero_alloc_rec_multi(x, i-1, size1, size2);
+}
+
+int zero_alloc_rec_multi(int x, int i, size_t size1, size_t size2) {
+    size_t size;
+    int* data;
+    int val = -1;
+
+    if(size1 == 0) {
+        return 0;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 10 && i < x && size2 == 0) {
+        return zero_alloc_rec_multi(x, i-1, size1, size1);
+    }
+#endif
+
+    if(i < x) {
+        size = size2;
+    } else {
+        size = size1;
+    }
+    if(i == 10) {
+        size2 = size1;
+    }
+
+    data = malloc(size);
+    if(data) {
+        *data = i;
+        val = *data * x;
+        free(data);
+    }
+
+    return zero_alloc_rec_decr(x, i, size1, size2) + val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    printf("%i\n", zero_alloc_rec_multi(10, 20, sizeof(int) * 5, 0));
+    printf("%i\n", zero_alloc_rec_multi(11, 20, sizeof(int) * 5, sizeof(int) * 6));
+#else
+    printf("%i\n", zero_alloc_rec_multi(11, 20, sizeof(int) * 5, 0));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/16_misc_pseudo_recursion.c b/bench-moerman2018/memory/zero_alloc/16_misc_pseudo_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..3238486ab378c7b518ddf2d28e0c90ebd2c60668
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/16_misc_pseudo_recursion.c
@@ -0,0 +1,61 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+int zero_alloc_pseudo_rec1(int x, int y, int i, size_t size1, size_t size2) {
+#ifdef CATCH_BAD_PARAM
+    if(x >= y && x <= 10) {
+        return -1;
+    }
+#endif
+
+    if(i > 0) {
+        return 37;
+    }
+
+    if(x < y) {
+        size2 += sizeof(int);
+    } else {
+        size1 += sizeof(int);
+    }
+
+    return zero_alloc_pseudo_rec2(x, y, 1, size1, size2);
+}
+
+int zero_alloc_pseudo_rec2(int x, int y, int i, size_t size1, size_t size2) {
+    size_t size;
+    int* data;
+    int val = -1;
+
+    if(i <= 0) {
+        return 5 + zero_alloc_pseudo_rec1(x, y, 1, size1, size2);
+    }
+
+    if(x > 10) {
+        size = size1 + sizeof(int);
+    } else {
+        size = size2;
+    }
+
+    data = malloc(size);
+    if(data) {
+        *data = x;
+        val = *data * y;
+        free(data);
+    }
+    return val;
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    printf("%i\n", zero_alloc_pseudo_rec1(9, 10, 0, sizeof(int), 0));
+    printf("%i\n", zero_alloc_pseudo_rec1(10, 10, 0, 0, sizeof(int)));
+    printf("%i\n", zero_alloc_pseudo_rec1(11, 10, 0, sizeof(int), 0));
+#else
+    printf("%i\n", zero_alloc_pseudo_rec1(10, 10, 0, sizeof(int), 0));
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/17_complex_function_pointers.c b/bench-moerman2018/memory/zero_alloc/17_complex_function_pointers.c
new file mode 100644
index 0000000000000000000000000000000000000000..b7134069702a033f6846630316fd08963eaf8581
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/17_complex_function_pointers.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+static void assign_size(size_t* size, size_t size1, size_t size2, bool use_first) {
+    if(use_first) {
+        *size = size1;
+    } else {
+        *size = size2;
+    }
+}
+
+void zero_alloc_function_pointer(bool a, bool b, void (*f)(size_t* size, size_t size1, size_t size2, bool use_first)) {
+    int* data;
+    size_t size;
+
+#ifdef CATCH_BAD_PARAM
+    if(!f || (!a & !b)) {
+        return;
+    }
+#endif
+
+    (*f)(&size, sizeof(int) * 2, sizeof(int), a);
+
+    if(b) {
+        data = malloc(size);
+    } else {
+        data = malloc(size - sizeof(int)); /* DANGER, if !a & !b */
+    }
+
+    if(data) {
+        *data = 34;
+        printf("%i\n", *data);
+        free(data);
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    zero_alloc_function_pointer(true, true, &assign_size);
+    zero_alloc_function_pointer(true, false, &assign_size);
+    zero_alloc_function_pointer(false, true, &assign_size);
+#else
+    zero_alloc_function_pointer(true, true, &assign_size); /* OK */
+    zero_alloc_function_pointer(false, false, &assign_size); /* DANGER */
+    zero_alloc_function_pointer(false, true, &assign_size); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/18_complex_struct_multiple_methods.c b/bench-moerman2018/memory/zero_alloc/18_complex_struct_multiple_methods.c
new file mode 100644
index 0000000000000000000000000000000000000000..2e09c2f358ae92a8354b57d12366e0c29924a209
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/18_complex_struct_multiple_methods.c
@@ -0,0 +1,87 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "zero_alloc.h"
+
+#ifndef s_MEMORY_ZA_REFCOUNT
+#define s_MEMORY_ZA_REFCOUNT
+void zero_alloc_cont_init(SizeCont* cont) {
+    cont->refc = 1;
+    cont->size = 0;
+}
+
+SizeCont* zero_alloc_cont_new() {
+    SizeCont* new_cont;
+
+    new_cont = malloc(sizeof(SizeCont));
+
+    if(new_cont) {
+        zero_alloc_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void zero_alloc_cont_ref(SizeCont* cont) {
+    if(cont) {
+        cont->refc++;
+    }
+}
+void zero_alloc_cont_unref(SizeCont* cont) {
+    if(cont->refc <= 1) {
+        cont->size = 0;
+    } else {
+        cont->refc--;
+    }
+}
+
+size_t zero_alloc_cont_get_size(SizeCont* cont) {
+    return cont->size;
+}
+void zero_alloc_cont_set_size(SizeCont* cont, size_t size) {
+    cont->size = size;
+}
+#endif //s_MEMORY_ZA_REFCOUNT
+
+void zero_alloc_struct(int x, int y) {
+    SizeCont cont;
+    int* data;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x > y) {
+        return;
+    }
+#endif
+
+    zero_alloc_cont_init(&cont);
+    if(x > y) {
+        zero_alloc_cont_set_size(&cont, sizeof(int));
+    } else {
+        zero_alloc_cont_set_size(&cont, 2 * sizeof(int));
+    }
+
+
+    if(x > 10) {
+        data = malloc(zero_alloc_cont_get_size(&cont));
+    } else {
+        data = malloc(zero_alloc_cont_get_size(&cont) - sizeof(int)); /* DANGER: if x <= 10 & x > y */
+    }
+
+    if(data) {
+        *data = 37;
+        printf("%i\n", *data);
+        free(data);
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    zero_alloc_struct(9, 10);
+    zero_alloc_struct(10, 11);
+    zero_alloc_struct(11, 10);
+#else
+    zero_alloc_struct(10, 9); /* DANGER */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/19_complex_refcount.c b/bench-moerman2018/memory/zero_alloc/19_complex_refcount.c
new file mode 100644
index 0000000000000000000000000000000000000000..887c7e91ecfc966d13fda4d41c7e9efc0616b971
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/19_complex_refcount.c
@@ -0,0 +1,76 @@
+#include "zero_alloc.h"
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef s_MEMORY_ZA_REFCOUNT
+#define s_MEMORY_ZA_REFCOUNT
+void zero_alloc_cont_init(SizeCont* cont) {
+    cont->refc = 1;
+    cont->size = 0;
+}
+
+SizeCont* zero_alloc_cont_new() {
+    SizeCont* new_cont;
+
+    new_cont = malloc(sizeof(SizeCont));
+
+    if(new_cont) {
+        zero_alloc_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void zero_alloc_cont_ref(SizeCont* cont) {
+    if(cont) {
+        cont->refc++;
+    }
+}
+void zero_alloc_cont_unref(SizeCont* cont) {
+    if(cont->refc <= 1) {
+        cont->size = 0;
+    } else {
+        cont->refc--;
+    }
+}
+
+size_t zero_alloc_cont_get_size(SizeCont* cont) {
+    return cont->size;
+}
+void zero_alloc_cont_set_size(SizeCont* cont, size_t size) {
+    cont->size = size;
+}
+#endif //s_MEMORY_ZA_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+    SizeCont* cont;
+    int* data;
+
+    cont = zero_alloc_cont_new();
+    if(!cont) {
+        return 1;
+    }
+    zero_alloc_cont_set_size(cont, 5 * sizeof(int));
+
+    zero_alloc_cont_ref(cont);
+    zero_alloc_cont_ref(cont);
+    zero_alloc_cont_unref(cont);
+    zero_alloc_cont_unref(cont);
+#ifdef NO_BUG
+    data = malloc(zero_alloc_cont_get_size(cont));
+    zero_alloc_cont_unref(cont);
+#else
+    zero_alloc_cont_unref(cont);
+    data = malloc(zero_alloc_cont_get_size(cont));
+#endif
+    free(cont);
+
+    if(data) {
+        *data = 1234;
+        printf("%i\n", *data);
+        free(data);
+    }
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/memory/zero_alloc/zero_alloc.h b/bench-moerman2018/memory/zero_alloc/zero_alloc.h
new file mode 100644
index 0000000000000000000000000000000000000000..9ae55b29bb45ae77a58e257344c4dbe02d47a2c7
--- /dev/null
+++ b/bench-moerman2018/memory/zero_alloc/zero_alloc.h
@@ -0,0 +1,37 @@
+#include <stdbool.h>
+#include <stddef.h>
+
+typedef struct _SizeRefCont SizeCont;
+
+struct _SizeRefCont {
+    size_t size;
+    unsigned int refc;
+};
+
+void zero_alloc_cont_init(SizeCont* cont);
+SizeCont* zero_alloc_cont_new();
+void zero_alloc_cont_ref(SizeCont* cont);
+void zero_alloc_cont_unref(SizeCont* cont);
+size_t zero_alloc_cont_get_size(SizeCont* cont);
+void zero_alloc_cont_set_size(SizeCont* cont, size_t size);
+
+void zero_alloc_for(int x);
+void zero_alloc_for_complex(int x);
+void zero_alloc_while_continue(int x);
+void zero_alloc_do_while_continue(int x);
+void zero_alloc_for_array(int x);
+void zero_alloc_for_pointer(int x);
+void zero_alloc_goto(int x);
+void zero_alloc_if_else(bool a, bool b);
+void zero_alloc_if_else_multi(bool a, bool b);
+void zero_alloc_if_else_int1(int x, int y);
+void zero_alloc_if_else_int2(int x, int y);
+void zero_alloc_pass_by_reference(bool a, bool b);
+void zero_alloc_switch(int x, int y);
+int zero_alloc_rec_multi(int x, int i, size_t size1, size_t size2);
+int zero_alloc_rec(int x, int i, size_t size1, size_t size2);
+int zero_alloc_pseudo_rec1(int x, int y, int i, size_t size1, size_t size2);
+int zero_alloc_pseudo_rec2(int x, int y, int i, size_t size1, size_t size2);
+void zero_alloc_struct(int x, int y);
+void zero_alloc_function_pointer(bool a, bool b, void (*f)(size_t* size, size_t size1, size_t size2, bool use_first));
+void zero_alloc_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/preprocess_files.sh b/bench-moerman2018/preprocess_files.sh
new file mode 100755
index 0000000000000000000000000000000000000000..f7391bc56d44f46602b869f794dd2b034af55cf8
--- /dev/null
+++ b/bench-moerman2018/preprocess_files.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+if [ $# != 1 ]; then
+    echo "incorrect number of arguments"
+fi
+
+WORK_DIR="$1"
+CORR_DIR="$WORK_DIR/test_correct"
+INCORR_DIR="$WORK_DIR/test_incorrect"
+WITH_MAIN_CATCH="$WORK_DIR/test_correct_catch_bad"
+NO_MAIN_C_DIR="$WORK_DIR/test_lib_correct"
+NO_MAIN_I_DIR="$WORK_DIR/test_lib_incorrect"
+
+if [ ! -d "$CORR_DIR" ]; then
+    mkdir "$CORR_DIR"
+fi
+
+if [ ! -d "$INCORR_DIR" ]; then
+    mkdir "$INCORR_DIR"
+fi
+
+if [ ! -d "$NO_MAIN_C_DIR" ]; then
+    mkdir "$NO_MAIN_C_DIR"
+fi
+
+if [ ! -d "$NO_MAIN_I_DIR" ]; then
+    mkdir "$NO_MAIN_I_DIR"
+fi
+
+if [ ! -d "$WITH_MAIN_CATCH" ]; then
+    mkdir "$WITH_MAIN_CATCH"
+fi
+
+temp_file=$(mktemp)
+
+for filename in "$WORK_DIR"/*.c; do
+    bname=${filename##*/}
+    echo "preprocessing $bname"
+    sed -e 's/#include/\/\/_#_include/g' -e 's/#ifndef s_/\/\/_#_ifndef s_/g' -e 's/#define s_/\/\/_#_define s_/g' -e 's/#endif \/\/s_/\/\/_#_endif \/\/s_/g' "$filename" > $temp_file
+    gpp +s "\"" "\"" "\\" +s "'" "'" "\\" -DNO_BUG $temp_file -o "$CORR_DIR/$bname"
+    gpp +s "\"" "\"" "\\" +s "'" "'" "\\" $temp_file -o "$INCORR_DIR/$bname"
+    gpp +s "\"" "\"" "\\" +s "'" "'" "\\" -DNO_MAIN $temp_file -o "$NO_MAIN_I_DIR/$bname" 
+    gpp +s "\"" "\"" "\\" +s "'" "'" "\\" -DNO_MAIN -DCATCH_BAD_PARAM $temp_file -o "$NO_MAIN_C_DIR/$bname"
+    gpp +s "\"" "\"" "\\" +s "'" "'" "\\" -DNO_BUG -DCATCH_BAD_PARAM $temp_file -o "$WITH_MAIN_CATCH/$bname"
+    sed -i -e 's/\/\/_#_include/#include/g' -e 's/\/\/_#_ifndef/#ifndef/g' -e 's/\/\/_#_define/#define/g' -e 's/\/\/_#_endif \/\/s_/#endif \/\/s_/g' "$INCORR_DIR/$bname" "$CORR_DIR/$bname" "$NO_MAIN_I_DIR/$bname" "$NO_MAIN_C_DIR/$bname" "$WITH_MAIN_CATCH/$bname"
+done
+
+rm -f temp_file
diff --git a/bench-moerman2018/strings/overflow/01_simple_if.c b/bench-moerman2018/strings/overflow/01_simple_if.c
new file mode 100644
index 0000000000000000000000000000000000000000..5b2e215147929b5a532dafe3cc70dcd90f2950d8
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/01_simple_if.c
@@ -0,0 +1,46 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <string.h>
+#include "string_overflow.h"
+
+void string_overflow_if_else(bool a, bool b) {
+    char long_string[] = "this is a long string";
+    char short_string[] = "short string";
+    char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    if(a) {
+        to_print = long_string;
+    } else {
+        to_print = short_string;
+    }
+
+    if(b) {
+        to_print[11] = '?';
+    } else {
+        to_print[13] = '?';
+    }
+
+    printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_overflow_if_else(true, true);
+    string_overflow_if_else(true, false);
+    string_overflow_if_else(false, true);
+#else
+    string_overflow_if_else(true, true); /* OK */
+    string_overflow_if_else(false, false); /* DANGER */
+    string_overflow_if_else(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/02_simple_if_int1.c b/bench-moerman2018/strings/overflow/02_simple_if_int1.c
new file mode 100644
index 0000000000000000000000000000000000000000..aac13ae1cda86fb8d6b4748b6f1e4e11597f5993
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/02_simple_if_int1.c
@@ -0,0 +1,45 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+void string_overflow_if_else_int1(int x, int y) {
+    char long_string[] = "this is a long string";
+    char short_string[] = "short string";
+    char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    if(x < y) {
+        to_print = long_string;
+    } else {
+        to_print = short_string;
+    }
+
+    if(x > 10) {
+        to_print[11] = '?';
+    } else {
+        to_print[13] = '?'; /* DANGER if x <= 10 & x >= y */
+    }
+
+    printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_overflow_if_else_int1(9, 10);
+    string_overflow_if_else_int1(10, 11);
+    string_overflow_if_else_int1(11, 10);
+#else
+    string_overflow_if_else_int1(9, 10); /* OK */
+    string_overflow_if_else_int1(10, 10); /* DANGER */
+    string_overflow_if_else_int1(11, 10); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/02_simple_if_int2.c b/bench-moerman2018/strings/overflow/02_simple_if_int2.c
new file mode 100644
index 0000000000000000000000000000000000000000..518f1a394a913898de7a63e049a2f9ae53ea08e8
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/02_simple_if_int2.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+void string_overflow_if_else_int2(int x, int y) {
+    char long_string[] = "this is a long string";
+    char short_string[] = "short string";
+    char* to_print;
+    int m, n;
+
+    m = -1;
+    n = 5;
+
+    x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    if(x < y) {
+        to_print = long_string;
+    } else {
+        to_print = short_string;
+    }
+
+    if(x > 10) {
+        to_print[11] = '?';
+    } else {
+        to_print[13] = '?'; /* DANGER if x <= 10 & x >= y */
+    }
+
+    printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_overflow_if_else_int2(-4, 11);
+    string_overflow_if_else_int2(-5, 11);
+    string_overflow_if_else_int2(-6, 11);
+#else
+    string_overflow_if_else_int2(-4, 10); /* OK */
+    string_overflow_if_else_int2(-5, 10); /* DANGER */
+    string_overflow_if_else_int2(-6, 10); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/03_simple_if_multi_func.c b/bench-moerman2018/strings/overflow/03_simple_if_multi_func.c
new file mode 100644
index 0000000000000000000000000000000000000000..9c0574ef818a7670d710176f6c447d4ecb44617e
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/03_simple_if_multi_func.c
@@ -0,0 +1,53 @@
+#include "string_overflow.h"
+#include <stdbool.h>
+#include <stdio.h>
+#include <string.h>
+
+static char* choose_string(char* string1, char* string2, bool condition) {
+    if(condition) {
+        return string1;
+    } else {
+        return string2;
+    }
+}
+
+static void overwrite_char(char* string, int pos1, int pos2, char replacement, bool condition) {
+    if(condition) {
+        string[pos1] = replacement;
+    } else {
+        string[pos2] = replacement;
+    }
+}
+
+void string_overflow_if_else_multi(bool a, bool b) {
+    char long_string[] = "this is a long string";
+    char short_string[] = "short string";
+    char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    to_print = choose_string(long_string, short_string, a);
+
+    overwrite_char(to_print, 11, 13, '?', b); /* DANGER, if !a & !b */
+
+    printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_overflow_if_else_multi(true, true);
+    string_overflow_if_else_multi(true, false);
+    string_overflow_if_else_multi(false, true);
+#else
+    string_overflow_if_else_multi(true, true); /* OK */
+    string_overflow_if_else_multi(false, false); /* DANGER */
+    string_overflow_if_else_multi(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/04_simple_switch.c b/bench-moerman2018/strings/overflow/04_simple_switch.c
new file mode 100644
index 0000000000000000000000000000000000000000..48de0c9e12ff21ff8a98190f73ce1b2075ccd67f
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/04_simple_switch.c
@@ -0,0 +1,64 @@
+#include "string_overflow.h"
+#include <string.h>
+#include <stdio.h>
+
+void string_overflow_switch(int x, int y) {
+    char long_string[22] = "this is a long string";
+    char short_string[13] = "short string";
+    char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+    if((x == 10 || x == 5) && x >= y) {
+        return -1;
+    }
+#endif
+
+    if(x < y) {
+        to_print = long_string;
+    } else {
+        to_print = short_string;
+    }
+
+    switch (x) {
+        case 5: {
+            to_print[13] = '?'; /* DANGER: x >= y */
+            break;
+        }
+        case 7: {
+            to_print[11] = '?';
+            break;
+        }
+        case 10: {
+            to_print[15] = '?'; /* DANGER: x >= y */
+            break;
+        }
+        case 12: {
+            to_print[8] = '?';
+            break;
+        }
+        default: {
+            to_print[0] = '?';
+            break;
+        }
+    };
+
+    printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_overflow_switch(5, 11);
+    string_overflow_switch(10, 11);
+    string_overflow_switch(11, 11);
+    string_overflow_switch(7, 5);
+#else
+    string_overflow_switch(5, 10); /* OK */
+    string_overflow_switch(10, 10); /* DANGER */
+    string_overflow_switch(11, 10); /* OK */
+    string_overflow_switch(7, 5); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/05_simple_goto.c b/bench-moerman2018/strings/overflow/05_simple_goto.c
new file mode 100644
index 0000000000000000000000000000000000000000..8342449afe9fee679887bd0eb520cab13057718e
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/05_simple_goto.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+void string_overflow_goto(int x) {
+    char short_string[] = "Short string";
+    char to_print_text[] = "Default string content";
+    char* to_print = to_print_text;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 0) {
+        return;
+    }
+#endif
+
+    i = 0;
+
+GOTO_LABEL:
+    if(i <= x) {
+        to_print[15] = '?';
+    } else {
+        printf("%s\n", to_print);
+    }
+
+    to_print = short_string;
+
+    if(i == 0) {
+        i++;
+        goto GOTO_LABEL;
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_overflow_goto(0);
+#else
+    string_overflow_goto(1);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/06_simple_pass_by_reference.c b/bench-moerman2018/strings/overflow/06_simple_pass_by_reference.c
new file mode 100644
index 0000000000000000000000000000000000000000..0aab798da80bb77edf2a34f4ca7dd298b0bf1f86
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/06_simple_pass_by_reference.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <string.h>
+#include "string_overflow.h"
+
+static void choose_string(char** destination, char* string1, char* string2, bool condition) {
+    if(condition) {
+        *destination = string1;
+    } else {
+        *destination = string2;
+    }
+}
+
+void string_overflow_pass_by_reference(bool a, bool b) {
+    char long_string[22] = "this is a long string";
+    char short_string[13] = "short string";
+    char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    choose_string(&to_print, long_string, short_string, a);
+
+    if(b) {
+        to_print[11] = '?';
+    } else {
+        to_print[13] = '?'; /* DANGER if !a */
+    }
+
+    printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_overflow_pass_by_reference(true, true);
+    string_overflow_pass_by_reference(true, false);
+    string_overflow_pass_by_reference(false, true);
+#else
+    string_overflow_pass_by_reference(true, true); /* OK */
+    string_overflow_pass_by_reference(false, false); /* DANGER */
+    string_overflow_pass_by_reference(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/07_simple_cross_file.c b/bench-moerman2018/strings/overflow/07_simple_cross_file.c
new file mode 100644
index 0000000000000000000000000000000000000000..c7a6952ec5471f23d9efe49581268696432369ae
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/07_simple_cross_file.c
@@ -0,0 +1,42 @@
+#include "string_overflow.h"
+#include "common.h"
+#include <stdbool.h>
+#include <string.h>
+#include <stdio.h>
+
+void string_overflow_cross_file(bool a, bool b) {
+    char long_string[22] = "this is a long string";
+    char short_string[13] = "short string";
+    char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    to_print = (char*) choose_pointer((void*) long_string, (void*) short_string, a);
+
+    if(b) {
+        to_print[11] = '?';
+    } else {
+        to_print[13] = '?'; /* DANGER if !a */
+    }
+
+    printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_overflow_cross_file(true, true);
+    string_overflow_cross_file(true, false);
+    string_overflow_cross_file(false, true);
+#else
+    string_overflow_cross_file(true, true); /* OK */
+    string_overflow_cross_file(false, false); /* DANGER */
+    string_overflow_cross_file(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/08_loop_for.c b/bench-moerman2018/strings/overflow/08_loop_for.c
new file mode 100644
index 0000000000000000000000000000000000000000..008ad0cbf7194aa05762be474cbf542766504b6b
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/08_loop_for.c
@@ -0,0 +1,40 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+void string_overflow_for(int x) {
+    char long_string[22] = "this is a long string";
+    char short_string[5] = "1234";
+    char* to_print = short_string;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    for(i = 0; i < 20; i++) {
+        if(i > x) {
+             to_print[i] = '?';  /* DANGER: x < 10 */
+        } else {
+             to_print[3] = '?';
+        }
+        if(i == 10) {
+            to_print = long_string;
+        }
+        printf("val = %s\n", to_print);
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_overflow_for(10);
+#else
+    string_overflow_for(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/09_loop_for_complex.c b/bench-moerman2018/strings/overflow/09_loop_for_complex.c
new file mode 100644
index 0000000000000000000000000000000000000000..673a69b27bdf2a571adc6875422999415ed4cb31
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/09_loop_for_complex.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+void string_overflow_for_complex(int x) {
+    char long_string[22] = "this is a long string";
+    char short_string[13] = "short string";
+    char* to_print = short_string;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    for(;;) {
+        if(i > x) {
+             to_print[13] = '?';  /* DANGER: x < 10 */
+        } else {
+             to_print[11] = '?';
+        }
+        if(i == 10) {
+            to_print = long_string;
+        }
+        printf("val = %s\n", to_print);
+        i++;
+        if(i >= 20) {
+            break;
+        }
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_overflow_for_complex(10);
+#else
+    string_overflow_for_complex(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/10_loop_while_continue.c b/bench-moerman2018/strings/overflow/10_loop_while_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..31c12b6eb72f942168683e71b920b7cf361225ab
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/10_loop_while_continue.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+void string_overflow_while_continue(int x) {
+    char long_string[22] = "this is a long string";
+    char short_string[13] = "short string";
+    char* to_print = short_string;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    while(i < 30) {
+        if(i > x) {
+             to_print[13] = '?';  /* DANGER: x < 10 */
+        } else {
+             to_print[11] = '?';
+        }
+        if(i == 10) {
+            to_print = long_string;
+        }
+        printf("val = %s\n", to_print);
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_overflow_while_continue(10);
+#else
+    string_overflow_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/11_loop_while_do_continue.c b/bench-moerman2018/strings/overflow/11_loop_while_do_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..4dcf33636c55ab036f5bf8b6c3893a53e9f5c56d
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/11_loop_while_do_continue.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+void string_overflow_do_while_continue(int x) {
+    char long_string[22] = "this is a long string";
+    char short_string[13] = "short string";
+    char* to_print = short_string;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    do {
+        if(i > x) {
+             to_print[13] = '?';  /* DANGER: x < 10 */
+        } else {
+             to_print[11] = '?';
+        }
+        if(i == 10) {
+            to_print = long_string;
+        }
+        printf("val = %s\n", to_print);
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    } while(i < 30);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_overflow_do_while_continue(10);
+#else
+    string_overflow_do_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/12_loop_for_array_branching.c b/bench-moerman2018/strings/overflow/12_loop_for_array_branching.c
new file mode 100644
index 0000000000000000000000000000000000000000..d6f95428c6f6caeb28ec0e73a22bfeee2b7b6920
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/12_loop_for_array_branching.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+void string_overflow_for_array(int x) {
+    int p[20];
+    char long_string[22] = "this is a long string";
+    char short_string[13] = "short string";
+    char* to_print = long_string;
+    int i = 0;
+
+    if(x < 0 || x > 19) {
+        return;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 19) {
+        return;
+    }
+#endif
+
+    for(i = 0; i < 20; i++) {
+        p[i] = 0;
+    }
+    p[x] = 1;
+
+    for(i = 0; i < 20; i++) {
+        if(p[i] == 1) {
+            to_print = short_string;
+        } else {
+            to_print[13] = '?'; /* DANGER: x < 19 */
+        }
+    }
+
+    printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_overflow_for_array(19);
+#else
+    string_overflow_for_array(10);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/strings/overflow/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 0000000000000000000000000000000000000000..091c3ea11923a1f89899bc9787c8f7110be298d4
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,53 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+static void initialize_to_string(char* arr[], char* string, int length) {
+    int i;
+
+    for(i = 0; i < length; i++) {
+        arr[i] = string;
+    }
+}
+
+void string_overflow_for_pointer(int x) {
+    char* string_arr[10];
+    char** ptr;
+    char long_string[22] = "this is a long string";
+    char short_string[13] = "short string";
+    int val = 0, i;
+
+    if(x < 0 || x > 10) {
+        return;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 10) {
+        return;
+    }
+#endif
+
+    initialize_to_string(string_arr, short_string, 10);
+    initialize_to_string(string_arr, long_string, x);
+
+    ptr = string_arr;
+
+    for(i = 0; i < 10; i++, ptr++) {
+        (*string_arr)[13] = (char) i;
+    }
+
+    printf("%s\n", *ptr);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_overflow_for_pointer(10);
+#else
+    string_overflow_for_pointer(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/14_loop_recursion.c b/bench-moerman2018/strings/overflow/14_loop_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..f68204e91d362852bb6dc67dfbd7e4b33f0fce58
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/14_loop_recursion.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+static char long_string[22] = "";
+static char short_string[13] = "";
+
+void string_overflow_rec(int x, int i, char* to_print) {
+    if(i <= 1) {
+        printf("%s\n", to_print);
+        return;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        printf("%s\n", to_print);
+        return;
+    }
+#endif
+
+    if(i > x) {
+        to_print[13] = '?';
+    } else {
+        to_print[11] = '?';
+    }
+
+    if(i == 10) {
+        to_print = short_string;
+    }
+    string_overflow_rec(x, i-1, to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_overflow_rec(10, 20, long_string);
+#else
+    string_overflow_rec(9, 20, long_string);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/15_loop_recursion_multi.c b/bench-moerman2018/strings/overflow/15_loop_recursion_multi.c
new file mode 100644
index 0000000000000000000000000000000000000000..87dd23668ee820267c3911733b1337278587fb9c
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/15_loop_recursion_multi.c
@@ -0,0 +1,49 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+static char long_string[22] = "";
+static char short_string[13] = "";
+
+void string_overflow_rec_decr(int x, int i, char* to_print) {
+    if(i <= 1) {
+        printf("%s\n", to_print);
+        return;
+    }
+
+    string_overflow_rec_multi(x, i-1, to_print);
+}
+
+void string_overflow_rec_multi(int x, int i, char* to_print) {
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        printf("%s\n", to_print);
+        return;
+    }
+#endif
+
+    if(i > x) {
+        to_print[13] = '?';
+    } else {
+        to_print[11] = '?';
+    }
+
+    if(i == 10) {
+        to_print = short_string;
+    }
+    string_overflow_rec_decr(x, i, to_print);
+}
+
+
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_overflow_rec_multi(10, 20, long_string);
+#else
+    string_overflow_rec_multi(11, 20, long_string);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/16_misc_pseudo_recursion.c b/bench-moerman2018/strings/overflow/16_misc_pseudo_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..1f9e4ae1415a8bc8177de5e01f185f1cd3b461bb
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/16_misc_pseudo_recursion.c
@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_overflow.h"
+
+static char long_string[22] = "";
+static char short_string[13] = "";
+
+void string_overflow_pseudo_rec1(int x, int y, int i, char* to_print) {
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    if(i > 0) {
+        return;
+    }
+
+    if(x > 10) {
+        if(!to_print) {
+            to_print = long_string;
+        }
+    } else {
+        to_print = short_string;
+    }
+
+    string_overflow_pseudo_rec2(x, y, 1,to_print);
+}
+
+void string_overflow_pseudo_rec2(int x, int y, int i, char* to_print) {
+    if(i > 0) {
+        if(x < y) {
+            to_print[11] = '?';
+        } else {
+            to_print[13] = '?';
+        }
+        printf("%s\n", to_print);
+    } else {
+        string_overflow_pseudo_rec1(x, y, 1, to_print);
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_overflow_pseudo_rec1(9, 10, 0, 0);
+    string_overflow_pseudo_rec1(11, 10, 0, 0);
+#else
+    string_overflow_pseudo_rec1(10, 10, 0, 0);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/17_complex_function_pointers.c b/bench-moerman2018/strings/overflow/17_complex_function_pointers.c
new file mode 100644
index 0000000000000000000000000000000000000000..d7df7568784206f8752d07d89443717c1619ebbf
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/17_complex_function_pointers.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <string.h>
+#include "string_overflow.h"
+
+static char long_string[22] = "";
+static char short_string[13] = "";
+
+static void select_string(char** dest, bool condition) {
+    if(condition) {
+        *dest = long_string;
+    } else {
+        *dest = short_string;
+    }
+}
+
+void string_overflow_function_pointer(bool a, bool b, void (*f)(char**, bool)) {
+    char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+    if(!f || (!a & !b)) {
+        return;
+    }
+#endif
+
+    (*f)(&to_print, a);
+
+    if(b) {
+        to_print[11] = '?';
+    } else {
+        to_print[13] = '?'; /* DANGER, if !a & !b */
+    }
+
+    printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_overflow_function_pointer(true, true, &select_string);
+    string_overflow_function_pointer(true, false, &select_string);
+    string_overflow_function_pointer(false, true, &select_string);
+#else
+    string_overflow_function_pointer(true, true, &select_string); /* OK */
+    string_overflow_function_pointer(false, false, &select_string); /* DANGER */
+    string_overflow_function_pointer(false, true, &select_string); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/18_complex_struct_multiple_methods.c b/bench-moerman2018/strings/overflow/18_complex_struct_multiple_methods.c
new file mode 100644
index 0000000000000000000000000000000000000000..3d2000170dfda8025bd3854e11a2eb36a5134788
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/18_complex_struct_multiple_methods.c
@@ -0,0 +1,93 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "string_overflow.h"
+
+static char long_string[22] = "";
+static char short_string[13] = "";
+
+#ifndef s_STRINGS_O_REFCOUNT
+#define s_STRINGS_O_REFCOUNT
+static char small_string[15] = "";
+
+void string_overflow_cont_init(StringCont* cont) {
+    cont->counter = 1;
+    cont->small_string = small_string;
+    cont->normal_string = 0;
+    cont->selected_string = &(cont->normal_string);
+}
+
+StringCont* string_overflow_cont_new() {
+    StringCont* new_cont;
+
+    new_cont = malloc(sizeof(StringCont));
+
+    if(new_cont) {
+        string_overflow_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void string_overflow_cont_incr(StringCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void string_overflow_cont_decr(StringCont* cont) {
+    if(cont->counter <= 1) {
+        cont->selected_string = &(cont->small_string);
+    } else {
+        cont->counter--;
+    }
+}
+
+char* string_overflow_cont_get_string(StringCont* cont) {
+    return *(cont->selected_string);
+}
+void string_overflow_cont_set_string(StringCont* cont, char* string) {
+    cont->normal_string = string;
+}
+#endif //s_STRINGS_O_REFCOUNT
+
+void string_overflow_struct(int x, int y) {
+    StringCont cont;
+    char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+    string_overflow_cont_init(&cont);
+
+    string_overflow_cont_set_string(&cont, short_string);
+
+    if(x < y) {
+        string_overflow_cont_set_string(&cont, long_string);
+    }
+
+    to_print = string_overflow_cont_get_string(&cont);
+
+    if(x > 10) {
+        to_print[11] = '?';
+    } else {
+        /* DANGER: if x <= 10 & x >= y */
+        to_print[13] = '?';
+    }
+
+    printf("%s\n", string_overflow_cont_get_string(&cont));
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_overflow_struct(9, 10);
+    string_overflow_struct(10, 11);
+    string_overflow_struct(11, 10);
+#else
+    string_overflow_struct(10, 10); /* DANGER */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/19_complex_refcount.c b/bench-moerman2018/strings/overflow/19_complex_refcount.c
new file mode 100644
index 0000000000000000000000000000000000000000..19c16a10f1903dd4f2597524067661863d5ce097
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/19_complex_refcount.c
@@ -0,0 +1,77 @@
+#include "string_overflow.h"
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+static char long_string[22] = "";
+
+#ifndef s_STRINGS_O_REFCOUNT
+#define s_STRINGS_O_REFCOUNT
+static char small_string[13] = "";
+
+void string_overflow_cont_init(StringCont* cont) {
+    cont->counter = 1;
+    cont->small_string = small_string;
+    cont->normal_string = 0;
+    cont->selected_string = &(cont->normal_string);
+}
+
+StringCont* string_overflow_cont_new() {
+    StringCont* new_cont;
+
+    new_cont = malloc(sizeof(StringCont));
+
+    if(new_cont) {
+        string_overflow_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void string_overflow_cont_incr(StringCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void string_overflow_cont_decr(StringCont* cont) {
+    if(cont->counter <= 1) {
+        cont->selected_string = (char**) &(cont->small_string);
+    } else {
+        cont->counter--;
+    }
+}
+
+char* string_overflow_cont_get_string(StringCont* cont) {
+    return *(cont->selected_string);
+}
+void string_overflow_cont_set_string(StringCont* cont, char* string) {
+    cont->normal_string = string;
+}
+#endif //s_STRINGS_O_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+    StringCont* cont;
+
+    cont = string_overflow_cont_new();
+    if(!cont) {
+        return 1;
+    }
+    string_overflow_cont_set_string(cont, long_string);
+
+    string_overflow_cont_incr(cont);
+    string_overflow_cont_incr(cont);
+    string_overflow_cont_decr(cont);
+    string_overflow_cont_decr(cont);
+#ifndef NO_BUG
+    string_overflow_cont_decr(cont);
+#endif
+
+    string_overflow_cont_get_string(cont)[13] = '?';
+
+    printf("%s\n", string_overflow_cont_get_string(cont));
+
+    free(cont);
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/overflow/string_overflow.h b/bench-moerman2018/strings/overflow/string_overflow.h
new file mode 100644
index 0000000000000000000000000000000000000000..76caf866c2519c4d576470100f78b53b7d3a1844
--- /dev/null
+++ b/bench-moerman2018/strings/overflow/string_overflow.h
@@ -0,0 +1,38 @@
+#include <stdbool.h>
+
+typedef struct _StringCont StringCont;
+
+struct _StringCont {
+    char** selected_string;
+    char* normal_string;
+    char* small_string;
+    unsigned int counter;
+};
+
+void string_overflow_cont_init(StringCont* cont);
+StringCont* string_overflow_cont_new();
+void string_overflow_cont_incr(StringCont* cont);
+void string_overflow_cont_decr(StringCont* cont);
+char* string_overflow_cont_get_string(StringCont* cont);
+void string_overflow_cont_set_string(StringCont* cont, char* string);
+
+void string_overflow_for(int x);
+void string_overflow_for_complex(int x);
+void string_overflow_while_continue(int x);
+void string_overflow_do_while_continue(int x);
+void string_overflow_for_array(int x);
+void string_overflow_for_pointer(int x);
+void string_overflow_goto(int x);
+void string_overflow_if_else(bool a, bool b);
+void string_overflow_if_else_multi(bool a, bool b);
+void string_overflow_if_else_int1(int x, int y);
+void string_overflow_if_else_int2(int x, int y);
+void string_overflow_pass_by_reference(bool a, bool b);
+void string_overflow_switch(int x, int y);
+void string_overflow_rec_multi(int x, int i, char* to_print);
+void string_overflow_rec(int x, int i, char* to_print);
+void string_overflow_pseudo_rec1(int x, int y, int i, char* to_print);
+void string_overflow_pseudo_rec2(int x, int y, int i, char* to_print);
+void string_overflow_struct(int x, int y);
+void string_overflow_function_pointer(bool a, bool b, void (*f)(char**, bool));
+void string_overflow_cross_file(bool a, bool b);
diff --git a/bench-moerman2018/strings/unbounded_copy/01_simple_if.c b/bench-moerman2018/strings/unbounded_copy/01_simple_if.c
new file mode 100644
index 0000000000000000000000000000000000000000..78a15c0701d35d2f25de66c14bdb372cb0b103e1
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/01_simple_if.c
@@ -0,0 +1,46 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <string.h>
+#include "string_copy.h"
+
+void string_copy_if_else(bool a, bool b) {
+    char long_string[22];
+    char short_string[13];
+    char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    if(a) {
+        to_print = long_string;
+    } else {
+        to_print = short_string;
+    }
+
+    if(b) {
+        strcpy(to_print, "short string");
+    } else {
+        strcpy(to_print, "this is a long string");
+    }
+
+    printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_copy_if_else(true, true);
+    string_copy_if_else(true, false);
+    string_copy_if_else(false, true);
+#else
+    string_copy_if_else(true, true); /* OK */
+    string_copy_if_else(false, false); /* DANGER */
+    string_copy_if_else(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/02_simple_if_int1.c b/bench-moerman2018/strings/unbounded_copy/02_simple_if_int1.c
new file mode 100644
index 0000000000000000000000000000000000000000..2ffbf2c9d644ef9987eca0802c4e58d1ae0c84c9
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/02_simple_if_int1.c
@@ -0,0 +1,45 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+void string_copy_if_else_int1(int x, int y) {
+    char long_string[22];
+    char short_string[13];
+    char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    if(x < y) {
+        to_print = long_string;
+    } else {
+        to_print = short_string;
+    }
+
+    if(x > 10) {
+        strcpy(to_print, "short string");
+    } else {
+        strcpy(to_print, "this is a long string"); /* DANGER if x <= 10 & x >= y */
+    }
+
+    printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_copy_if_else_int1(9, 10);
+    string_copy_if_else_int1(10, 11);
+    string_copy_if_else_int1(11, 10);
+#else
+    string_copy_if_else_int1(9, 10); /* OK */
+    string_copy_if_else_int1(10, 10); /* DANGER */
+    string_copy_if_else_int1(11, 10); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/02_simple_if_int2.c b/bench-moerman2018/strings/unbounded_copy/02_simple_if_int2.c
new file mode 100644
index 0000000000000000000000000000000000000000..4fb67d64227f77aa5217e3a5211cb7621001285c
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/02_simple_if_int2.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+void string_copy_if_else_int2(int x, int y) {
+    char long_string[22];
+    char short_string[13];
+    char* to_print;
+    int m, n;
+
+    m = -1;
+    n = 5;
+
+    x = x*m+n;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    if(x < y) {
+        to_print = long_string;
+    } else {
+        to_print = short_string;
+    }
+
+    if(x > 10) {
+        strcpy(to_print, "short string");
+    } else {
+        strcpy(to_print, "this is a long string"); /* DANGER if x <= 10 & x >= y */
+    }
+
+    printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_copy_if_else_int2(-4, 11);
+    string_copy_if_else_int2(-5, 11);
+    string_copy_if_else_int2(-6, 11);
+#else
+    string_copy_if_else_int2(-4, 10); /* OK */
+    string_copy_if_else_int2(-5, 10); /* DANGER */
+    string_copy_if_else_int2(-6, 10); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/03_simple_if_multi_func.c b/bench-moerman2018/strings/unbounded_copy/03_simple_if_multi_func.c
new file mode 100644
index 0000000000000000000000000000000000000000..6a8baba6ca3c230cc9bb1b02ed726856357210ad
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/03_simple_if_multi_func.c
@@ -0,0 +1,53 @@
+#include "string_copy.h"
+#include <stdbool.h>
+#include <stdio.h>
+#include <string.h>
+
+static char* choose_string(char* string1, char* string2, bool condition) {
+    if(condition) {
+        return string1;
+    } else {
+        return string2;
+    }
+}
+
+static void conditional_copy(char* destination, char* source1, char* source2, bool condition) {
+    if(condition) {
+        strcpy(destination, source1);
+    } else {
+        strcpy(destination, source2);
+    }
+}
+
+void string_copy_if_else_multi(bool a, bool b) {
+    char long_string[22];
+    char short_string[13];
+    char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    to_print = choose_string(long_string, short_string, a);
+
+    conditional_copy(to_print, "short string", "this is a long string", b); /* DANGER, if !a & !b */
+
+    printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_copy_if_else_multi(true, true);
+    string_copy_if_else_multi(true, false);
+    string_copy_if_else_multi(false, true);
+#else
+    string_copy_if_else_multi(true, true); /* OK */
+    string_copy_if_else_multi(false, false); /* DANGER */
+    string_copy_if_else_multi(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/04_simple_switch.c b/bench-moerman2018/strings/unbounded_copy/04_simple_switch.c
new file mode 100644
index 0000000000000000000000000000000000000000..2429fe3c0a091b8ed179e19f571456aeb4bc4e65
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/04_simple_switch.c
@@ -0,0 +1,66 @@
+#include "string_copy.h"
+#include <string.h>
+#include <stdio.h>
+
+void string_copy_switch(int x, int y) {
+    char long_string[22];
+    char short_string[13];
+    char long_string_input[] = "this is a long string";
+    char short_string_input[] = "short string";
+    char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+    if((x == 10 || x == 5) && x >= y) {
+        return;
+    }
+#endif
+
+    if(x < y) {
+        to_print = long_string;
+    } else {
+        to_print = short_string;
+    }
+
+    switch (x) {
+        case 5: {
+            strcpy(to_print, long_string_input); /* DANGER: x >= y */
+            break;
+        }
+        case 7: {
+            strcpy(to_print, short_string_input);
+            break;
+        }
+        case 10: {
+            strcpy(to_print, long_string_input); /* DANGER: x >= y */
+            break;
+        }
+        case 12: {
+            strcpy(to_print, short_string_input);
+            break;
+        }
+        default: {
+            strcpy(to_print, short_string_input);
+            break;
+        }
+    };
+
+    printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_copy_switch(5, 11);
+    string_copy_switch(10, 11);
+    string_copy_switch(11, 11);
+    string_copy_switch(7, 5);
+#else
+    string_copy_switch(5, 10); /* OK */
+    string_copy_switch(10, 10); /* DANGER */
+    string_copy_switch(11, 10); /* OK */
+    string_copy_switch(7, 5); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/05_simple_goto.c b/bench-moerman2018/strings/unbounded_copy/05_simple_goto.c
new file mode 100644
index 0000000000000000000000000000000000000000..63463950c7c7d94e7b7bc3faae6aa76d04bcd308
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/05_simple_goto.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+void string_copy_goto(int x) {
+    char short_string[] = "Short string";
+    char* to_print = "Default string content";
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x > 0) {
+        return;
+    }
+#endif
+
+    i = 0;
+
+GOTO_LABEL:
+    if(i <= x) {
+        strcpy(to_print, "this is a long string");
+    } else {
+        printf("%s\n", to_print);
+    }
+
+    to_print = short_string;
+
+    if(i == 0) {
+        i++;
+        goto GOTO_LABEL;
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_copy_goto(0);
+#else
+    string_copy_goto(1);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/06_simple_pass_by_reference.c b/bench-moerman2018/strings/unbounded_copy/06_simple_pass_by_reference.c
new file mode 100644
index 0000000000000000000000000000000000000000..f54879a8ca82e1c92646431585efee5df9d3e5fb
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/06_simple_pass_by_reference.c
@@ -0,0 +1,50 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <string.h>
+#include "string_copy.h"
+
+static void choose_string(char** destination, char* string1, char* string2, bool condition) {
+    if(condition) {
+        *destination = string1;
+    } else {
+        *destination = string2;
+    }
+}
+
+void string_copy_pass_by_reference(bool a, bool b) {
+    char long_string[22];
+    char short_string[13];
+    char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    choose_string(&to_print, long_string, short_string, a);
+
+    if(b) {
+        strcpy(to_print, "short string");
+    } else {
+        strcpy(to_print, "this is a long string");
+    }
+
+    printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_copy_pass_by_reference(true, true);
+    string_copy_pass_by_reference(true, false);
+    string_copy_pass_by_reference(false, true);
+#else
+    string_copy_pass_by_reference(true, true); /* OK */
+    string_copy_pass_by_reference(false, false); /* DANGER */
+    string_copy_pass_by_reference(false, true); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/07_simple_cross_file.c b/bench-moerman2018/strings/unbounded_copy/07_simple_cross_file.c
new file mode 100644
index 0000000000000000000000000000000000000000..50dea7bde6ac117e02baf091b850b10e98b16107
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/07_simple_cross_file.c
@@ -0,0 +1,42 @@
+#include "string_copy.h"
+#include "common.h"
+#include <stdbool.h>
+#include <string.h>
+#include <stdio.h>
+
+void string_copy_cross_file(bool a, bool b) {
+    char long_string[22];
+    char short_string[13];
+    char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+    if(!a & !b) {
+        return;
+    }
+#endif
+
+    to_print = (char*) choose_pointer((void*) long_string, (void*) short_string, a);
+
+    if(b) {
+        strcpy(to_print, "short string");
+    } else {
+        strcpy(to_print, "this is a long string");
+    }
+
+    printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_copy_cross_file(true, true);
+    string_copy_cross_file(true, false);
+    string_copy_cross_file(false, true);
+#else
+    string_copy_cross_file(true, true); /* OK */
+    string_copy_cross_file(false, false); /* DANGER */
+    string_copy_cross_file(false, true); /* OK */
+#endif
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/08_loop_for.c b/bench-moerman2018/strings/unbounded_copy/08_loop_for.c
new file mode 100644
index 0000000000000000000000000000000000000000..e80f50f70cdcd98076f9a4ef3aac8099452a7ed8
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/08_loop_for.c
@@ -0,0 +1,40 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+void string_copy_for(int x) {
+    char long_string[22];
+    char short_string[13];
+    char* to_print = short_string;
+    int i;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    for(i = 0; i < 20; i++) {
+        if(i > x) {
+            strcpy(to_print, "this is a long string"); /* DANGER: x < 10 */
+        } else {
+            strcpy(to_print, "short string");
+        }
+        if(i == 10) {
+            to_print = long_string;
+        }
+        printf("val = %s\n", to_print);
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_copy_for(10);
+#else
+    string_copy_for(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/09_loop_for_complex.c b/bench-moerman2018/strings/unbounded_copy/09_loop_for_complex.c
new file mode 100644
index 0000000000000000000000000000000000000000..7fd9ddcf97d5bb471a91d7b886b58dcfd78cc542
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/09_loop_for_complex.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+void string_copy_for_complex(int x) {
+    char long_string[22];
+    char short_string[13];
+    char* to_print = short_string;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    for(;;) {
+        if(i > x) {
+            strcpy(to_print, "this is a long string"); /* DANGER: x < 10 */
+        } else {
+            strcpy(to_print, "short string");
+        }
+        if(i == 10) {
+            to_print = long_string;
+        }
+        printf("val = %s\n", to_print);
+        i++;
+        if(i >= 20) {
+            break;
+        }
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_copy_for_complex(10);
+#else
+    string_copy_for_complex(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/10_loop_while_continue.c b/bench-moerman2018/strings/unbounded_copy/10_loop_while_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..9c38cc90b92da0ce8c0a20396f1c8b1c20c509f4
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/10_loop_while_continue.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+void string_copy_while_continue(int x) {
+    char long_string[22];
+    char short_string[13];
+    char* to_print = short_string;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    while(i < 30) {
+        if(i > x) {
+            strcpy(to_print, "this is a long string"); /* DANGER: x < 10 */
+        } else {
+            strcpy(to_print, "short string");
+        }
+        if(i == 10) {
+            to_print = long_string;
+        }
+        printf("val = %s\n", to_print);
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_copy_while_continue(10);
+#else
+    string_copy_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/11_loop_while_do_continue.c b/bench-moerman2018/strings/unbounded_copy/11_loop_while_do_continue.c
new file mode 100644
index 0000000000000000000000000000000000000000..bf22312523b2833eb185337e0fe685764ae44651
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/11_loop_while_do_continue.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+void string_copy_do_while_continue(int x) {
+    char long_string[22];
+    char short_string[13];
+    char* to_print = short_string;
+    int i = 0;
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        return;
+    }
+#endif
+
+    do {
+        if(i > x) {
+            strcpy(to_print, "this is a long string"); /* DANGER: x < 10 */
+        } else {
+            strcpy(to_print, "short string");
+        }
+        if(i == 10) {
+            to_print = long_string;
+        }
+        printf("val = %s\n", to_print);
+        i++;
+        if(i < 20) {
+            continue;
+        }
+    } while(i < 30);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_copy_do_while_continue(10);
+#else
+    string_copy_do_while_continue(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/12_loop_for_array_branching.c b/bench-moerman2018/strings/unbounded_copy/12_loop_for_array_branching.c
new file mode 100644
index 0000000000000000000000000000000000000000..4bddae9e2d1a26612786b7a0f0ed89d4d64ea89f
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/12_loop_for_array_branching.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+void string_copy_for_array(int x) {
+    int p[20];
+    char long_string[22];
+    char short_string[13];
+    char* to_print = long_string;
+    int i = 0;
+
+    if(x < 0 || x > 19) {
+        return;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 19) {
+        return;
+    }
+#endif
+
+    for(i = 0; i < 20; i++) {
+        p[i] = 0;
+    }
+    p[x] = 1;
+
+    for(i = 0; i < 20; i++) {
+        if(p[i] == 1) {
+            to_print = short_string;
+        } else {
+            strcpy(to_print, "this is a long string"); /* DANGER: x < 19 */
+        }
+    }
+
+    printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_copy_for_array(19);
+#else
+    string_copy_for_array(10);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/13_loop_for_pointer_arithmetic.c b/bench-moerman2018/strings/unbounded_copy/13_loop_for_pointer_arithmetic.c
new file mode 100644
index 0000000000000000000000000000000000000000..54ea55e58e4fdcfc42aad839a0cbe0c3f07f153a
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/13_loop_for_pointer_arithmetic.c
@@ -0,0 +1,53 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+static void initialize_to_string(char* arr[], char* string, int length) {
+    int i;
+
+    for(i = 0; i < length; i++) {
+        arr[i] = string;
+    }
+}
+
+void string_copy_for_pointer(int x) {
+    char* string_arr[10];
+    char** ptr;
+    char long_string[22];
+    char short_string[13];
+    int val = 0, i;
+
+    if(x < 0 || x > 10) {
+        return;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x != 10) {
+        return;
+    }
+#endif
+
+    initialize_to_string(string_arr, short_string, 10);
+    initialize_to_string(string_arr, long_string, x);
+
+    ptr = string_arr;
+
+    for(i = 0; i < 10; i++, ptr++) {
+        strcpy(*string_arr, "this is a long string");
+    }
+
+    printf("%s\n", *(ptr - 1));
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_copy_for_pointer(10);
+#else
+    string_copy_for_pointer(9);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/14_loop_recursion.c b/bench-moerman2018/strings/unbounded_copy/14_loop_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..9a8cd3278d2811bc7a48e150a4485bd53147bce6
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/14_loop_recursion.c
@@ -0,0 +1,43 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+static char long_string[22] = "";
+static char short_string[13] = "";
+
+void string_copy_rec(int x, int i, char* to_print) {
+    if(i <= 1) {
+        printf("%s\n", to_print);
+        return;
+    }
+
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        printf("%s\n", to_print);
+        return;
+    }
+#endif
+
+    if(i > x) {
+        strcpy(to_print, "this is a long string");
+    } else {
+        strcpy(to_print, "short string");
+    }
+
+    if(i == 10) {
+        to_print = short_string;
+    }
+    string_copy_rec(x, i-1, to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_copy_rec(10, 20, long_string);
+#else
+    string_copy_rec(9, 20, long_string);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/15_loop_recursion_multi.c b/bench-moerman2018/strings/unbounded_copy/15_loop_recursion_multi.c
new file mode 100644
index 0000000000000000000000000000000000000000..70122ee79e3a2be724fc3d23093425845c75b679
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/15_loop_recursion_multi.c
@@ -0,0 +1,49 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+static char long_string[22] = "";
+static char short_string[13] = "";
+
+void string_copy_rec_decr(int x, int i, char* to_print) {
+    if(i <= 1) {
+        printf("%s\n", to_print);
+        return;
+    }
+
+    string_copy_rec_multi(x, i-1, to_print);
+}
+
+void string_copy_rec_multi(int x, int i, char* to_print) {
+#ifdef CATCH_BAD_PARAM
+    if(x < 10) {
+        printf("%s\n", to_print);
+        return;
+    }
+#endif
+
+    if(i > x) {
+        strcpy(to_print, "this is a long string");
+    } else {
+        strcpy(to_print, "short string");
+    }
+
+    if(i == 10) {
+        to_print = short_string;
+    }
+    string_copy_rec_decr(x, i, to_print);
+}
+
+
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_copy_rec_multi(10, 20, long_string);
+#else
+    string_copy_rec_multi(11, 20, long_string);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/16_misc_pseudo_recursion.c b/bench-moerman2018/strings/unbounded_copy/16_misc_pseudo_recursion.c
new file mode 100644
index 0000000000000000000000000000000000000000..02a8a0a984aa370245ed49f75428f847796d6e4f
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/16_misc_pseudo_recursion.c
@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include <string.h>
+#include "string_copy.h"
+
+static char long_string[22] = "";
+static char short_string[13] = "";
+
+void string_copy_pseudo_rec1(int x, int y, int i, char* to_print) {
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+
+    if(i > 0) {
+        return;
+    }
+
+    if(x > 10) {
+        if(!to_print) {
+            to_print = long_string;
+        }
+    } else {
+        to_print = short_string;
+    }
+
+    string_copy_pseudo_rec2(x, y, 1,to_print);
+}
+
+void string_copy_pseudo_rec2(int x, int y, int i, char* to_print) {
+    if(i > 0) {
+        if(x < y) {
+            strcpy(to_print, "short string");
+        } else {
+            strcpy(to_print, "this is a long string");
+        }
+        printf("%s\n", to_print);
+    } else {
+        string_copy_pseudo_rec1(x, y, 1, to_print);
+    }
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_copy_pseudo_rec1(9, 10, 0, 0);
+    string_copy_pseudo_rec1(11, 10, 0, 0);
+#else
+    string_copy_pseudo_rec1(10, 10, 0, 0);
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/17_complex_function_pointers.c b/bench-moerman2018/strings/unbounded_copy/17_complex_function_pointers.c
new file mode 100644
index 0000000000000000000000000000000000000000..84787c5b393107d06a88ed9bc968eec35f5774bc
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/17_complex_function_pointers.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include <stdbool.h>
+#include <string.h>
+#include "string_copy.h"
+
+static char long_string[22] = "";
+static char short_string[13] = "";
+
+static void select_string(char** dest, bool condition) {
+    if(condition) {
+        *dest = long_string;
+    } else {
+        *dest = short_string;
+    }
+}
+
+void string_copy_function_pointer(bool a, bool b, void (*f)(char**, bool)) {
+    char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+    /* To be used if NO_BUG is defined */
+    /* and tool warns about possible dangerous input */
+    if(!f || (!a & !b)) {
+        return;
+    }
+#endif
+
+    (*f)(&to_print, a);
+
+    if(b) {
+        strcpy(to_print, "short string");
+    } else {
+        strcpy(to_print, "this is a long string"); /* DANGER, if !a & !b */
+    }
+
+    printf("%s\n", to_print);
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_copy_function_pointer(true, true, &select_string);
+    string_copy_function_pointer(true, false, &select_string);
+    string_copy_function_pointer(false, true, &select_string);
+#else
+    string_copy_function_pointer(true, true, &select_string); /* OK */
+    string_copy_function_pointer(false, false, &select_string); /* DANGER */
+    string_copy_function_pointer(false, true, &select_string); /* OK */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/18_complex_struct_multiple_methods.c b/bench-moerman2018/strings/unbounded_copy/18_complex_struct_multiple_methods.c
new file mode 100644
index 0000000000000000000000000000000000000000..47f3a8ea49c04206790d9b066a2b1cf2b29b9250
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/18_complex_struct_multiple_methods.c
@@ -0,0 +1,93 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "string_copy.h"
+
+static char long_string[22] = "";
+static char short_string[13] = "";
+
+#ifndef s_NULLPOINTER_REFCOUNT
+#define s_NULLPOINTER_REFCOUNT
+static char small_string[15] = "";
+
+void string_copy_cont_init(StringCont* cont) {
+    cont->counter = 1;
+    cont->small_string = small_string;
+    cont->normal_string = 0;
+    cont->selected_string = &(cont->normal_string);
+}
+
+StringCont* string_copy_cont_new() {
+    StringCont* new_cont;
+
+    new_cont = malloc(sizeof(StringCont));
+
+    if(new_cont) {
+        string_copy_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void string_copy_cont_incr(StringCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void string_copy_cont_decr(StringCont* cont) {
+    if(cont->counter <= 1) {
+        cont->selected_string = &(cont->small_string);
+    } else {
+        cont->counter--;
+    }
+}
+
+char* string_copy_cont_get_string(StringCont* cont) {
+    return *(cont->selected_string);
+}
+void string_copy_cont_set_string(StringCont* cont, char* string) {
+    cont->normal_string = string;
+}
+#endif //s_NULLPOINTER_REFCOUNT
+
+void string_copy_struct(int x, int y) {
+    StringCont cont;
+    char* to_print;
+
+#ifdef CATCH_BAD_PARAM
+    if(x <= 10 && x >= y) {
+        return;
+    }
+#endif
+    string_copy_cont_init(&cont);
+
+    string_copy_cont_set_string(&cont, short_string);
+
+    if(x < y) {
+        string_copy_cont_set_string(&cont, long_string);
+    }
+
+    to_print = string_copy_cont_get_string(&cont);
+
+    if(x > 10) {
+        strcpy(to_print, "short string");
+    } else {
+        /* DANGER: if x <= 10 & x >= y */
+        strcpy(to_print, "this is a long string");
+    }
+
+    printf("%s\n", string_copy_cont_get_string(&cont));
+}
+
+#ifndef NO_MAIN
+int main() {
+#ifdef NO_BUG
+    string_copy_struct(9, 10);
+    string_copy_struct(10, 11);
+    string_copy_struct(11, 10);
+#else
+    string_copy_struct(10, 10); /* DANGER */
+#endif
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/19_complex_refcount.c b/bench-moerman2018/strings/unbounded_copy/19_complex_refcount.c
new file mode 100644
index 0000000000000000000000000000000000000000..6c7503fe97c36f5132c4cdd56fb90363c7d71a9b
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/19_complex_refcount.c
@@ -0,0 +1,77 @@
+#include "string_copy.h"
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+static char long_string[22] = "";
+
+#ifndef s_STRINGS_UC_REFCOUNT
+#define s_STRINGS_UC_REFCOUNT
+static char small_string[15] = "";
+
+void string_copy_cont_init(StringCont* cont) {
+    cont->counter = 1;
+    cont->small_string = small_string;
+    cont->normal_string = 0;
+    cont->selected_string = &(cont->normal_string);
+}
+
+StringCont* string_copy_cont_new() {
+    StringCont* new_cont;
+
+    new_cont = malloc(sizeof(StringCont));
+
+    if(new_cont) {
+        string_copy_cont_init(new_cont);
+    }
+    return new_cont;
+}
+
+void string_copy_cont_incr(StringCont* cont) {
+    if(cont) {
+        cont->counter++;
+    }
+}
+void string_copy_cont_decr(StringCont* cont) {
+    if(cont->counter <= 1) {
+        cont->selected_string = (char**) &(cont->small_string);
+    } else {
+        cont->counter--;
+    }
+}
+
+char* string_copy_cont_get_string(StringCont* cont) {
+    return *(cont->selected_string);
+}
+void string_copy_cont_set_string(StringCont* cont, char* string) {
+    cont->normal_string = string;
+}
+#endif //s_STRINGS_UC_REFCOUNT
+
+#ifndef NO_MAIN
+int main() {
+    StringCont* cont;
+
+    cont = string_copy_cont_new();
+    if(!cont) {
+        return 1;
+    }
+    string_copy_cont_set_string(cont, long_string);
+
+    string_copy_cont_incr(cont);
+    string_copy_cont_incr(cont);
+    string_copy_cont_decr(cont);
+    string_copy_cont_decr(cont);
+#ifndef NO_BUG
+    string_copy_cont_decr(cont);
+#endif
+
+    strcpy(string_copy_cont_get_string(cont), "this is a long string");
+
+    printf("%s\n", string_copy_cont_get_string(cont));
+
+    free(cont);
+
+    return 1;
+}
+#endif
diff --git a/bench-moerman2018/strings/unbounded_copy/string_copy.h b/bench-moerman2018/strings/unbounded_copy/string_copy.h
new file mode 100644
index 0000000000000000000000000000000000000000..c4b9c5499be1b420c1104a2b4ab6bb2dde4055c6
--- /dev/null
+++ b/bench-moerman2018/strings/unbounded_copy/string_copy.h
@@ -0,0 +1,38 @@
+#include <stdbool.h>
+
+typedef struct _StringCont StringCont;
+
+struct _StringCont {
+    char** selected_string;
+    char* normal_string;
+    char* small_string;
+    unsigned int counter;
+};
+
+void string_copy_cont_init(StringCont* cont);
+StringCont* string_copy_cont_new();
+void string_copy_cont_incr(StringCont* cont);
+void string_copy_cont_decr(StringCont* cont);
+char* string_copy_cont_get_string(StringCont* cont);
+void string_copy_cont_set_string(StringCont* cont, char* string);
+
+void string_copy_for(int x);
+void string_copy_for_complex(int x);
+void string_copy_while_continue(int x);
+void string_copy_do_while_continue(int x);
+void string_copy_for_array(int x);
+void string_copy_for_pointer(int x);
+void string_copy_goto(int x);
+void string_copy_if_else(bool a, bool b);
+void string_copy_if_else_multi(bool a, bool b);
+void string_copy_if_else_int1(int x, int y);
+void string_copy_if_else_int2(int x, int y);
+void string_copy_pass_by_reference(bool a, bool b);
+void string_copy_switch(int x, int y);
+void string_copy_rec_multi(int x, int i, char* to_print);
+void string_copy_rec(int x, int i, char* to_print);
+void string_copy_pseudo_rec1(int x, int y, int i, char* to_print);
+void string_copy_pseudo_rec2(int x, int y, int i, char* to_print);
+void string_copy_struct(int x, int y);
+void string_copy_function_pointer(bool a, bool b, void (*f)(char**, bool));
+void string_copy_cross_file(bool a, bool b);