// Based on MITRE's CWE-416, demonstrative example 1 // https://cwe.mitre.org/data/definitions/416.html // Run with "-eva-precision 1" to obtain a "Red Alarm". #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #define BUFSIZER1 512 #define BUFSIZER2 ((BUFSIZER1/2) - 8) int main(int argc, char **argv) { char *buf1R1; char *buf2R1; char *buf2R2; char *buf3R2; buf1R1 = (char *) malloc(BUFSIZER1); if (!buf1R1) exit(1); buf2R1 = (char *) malloc(BUFSIZER1); if (!buf2R1) exit(1); free(buf2R1); buf2R2 = (char *) malloc(BUFSIZER2); if (!buf2R2) exit(1); buf3R2 = (char *) malloc(BUFSIZER2); if (!buf3R2) exit(1); strncpy(buf2R1, argv[1], BUFSIZER1-1); free(buf1R1); free(buf2R2); free(buf3R2); return 0; }