STR30-C: DO NOT TRY TO MODIFY STRING LITERAL.

VULNERABILITY:
//Str30-c : Don’t try to modify string literal.
 #include<stdio.h>

int main ()
{
    char *p = "hii iam good";
    p [0] = 'U';
    return 0;
}
MITIGATION: WE CAN STORE STRING AS AN ARRAY SO, IT IS POSSIBLE TO MODIFY STRING.
#include <stdio.h>
int main()
{
char name[20];
printf("Enter name: ");
scanf("%s", name);
name[0] = 'U';
printf("Your name is %s.", name);
return 0;
}
STR36-C. Do not specify the bound of a character array initialized with a string literal.”
VULNERABILITY:
#include<stdio.h>
int main()
{
    char a[5] = "this is good one";
    printf("%s",a);
    return 0 ;

}
MITIGATION:
#include <stdio.h>
       int main()
     {
        char a[] = “iam good”;
         gets(a);
         puts(a);
         return 0;
    }
STR31-C. Guarantee that storage for strings has sufficient space for character data and the null terminator


VULNERABILITY:
#include <stdio.h>
int main() {
    char s1[4], s2[2], i;
    printf("Enter string s1: ");
    fgets(s1, sizeof(s1), stdin);

    for (i = 0; s1[i] != '\0'; ++i) {
        s2[i] = s1[i];
    }
    s2[i] = '\0';
    printf("String s2: %s", s2);
    return 0;
}
MITIGATION:
#include <stdio.h>
int main() {
    char s1[5], s2[5], i;
    printf("Enter string s1: ");
    fgets(s1, sizeof(s1), stdin);
for (i = 0; i <= 4; ++i) {
        s2[i] = s1[i];
    }
    s2[i] = '\0';
    printf("String s2: %s", s2);
return 0;
}
MSC34-C. Do not use deprecated or obsolescent functions
VULNERABILITY:
#include <stdio.h>
#include<string.h>
int main()
{
    char a[8] ;
    printf("enter name:");
    gets(a);
    printf("%d",a);

    return 0;
}

MITIGATION:
It is not possible to mention the size of the array in prior as we don’t know how much length the user will enter. We can use linked list.
#include<stdio.h>
#include<stdlib.h>

struct node
{
    char data;
    struct node *next;
};


void addLast(struct node **head, char val)
{
    //create a new node
    struct node *newNode = malloc(sizeof(struct node));
    newNode->data = val;
    newNode->next     = NULL;

    //if head is NULL, it is an empty list
    if(*head == NULL)
         *head = newNode;
    //Otherwise, find the last node and add the newNode
    else
    {
        struct node *lastNode = *head;

        //last node's next address will be NULL.
        while(lastNode->next != NULL)
        {
            lastNode = lastNode->next;
        }

        //add the newNode at the end of the linked list
        lastNode->next = newNode;
    }

}

void printList(struct node *head)
{
    struct node *temp = head;

    //iterate the entire linked list and print the data
    while(temp != NULL)
    {
         printf("%c", temp->data);
         temp = temp->next;
    }
}

int main()
{
     struct node *head = NULL;

     addLast(&head,'i');
     addLast(&head,'a');
     addLast(&head,'m');
     addLast(&head,'g');
     addLast(&head,'o');
     addLast(&head,'o');
     addLast(&head,'d');
     printList(head);

     return 0;
}
MSC00-C. Compile cleanly at high warning levels
VULNERABILITY:
#include <stdio.h>
#include<string.h>
int main(){
    size_t len;
 char cstr[] = "harley";
 signed char scstr[] = "signed harley";
 unsigned char ucstr[] = "unsigned harley";
 len = strlen(cstr);
 len = strlen(scstr);
 len = strlen(ucstr);
    return 0;
}
TO EXECUTE AND MITIGATE HEAPOVERFLOW
VULNERABILITY:
#include<stdio.h>
int main()
{
    for (int i=0; i<10000000; i++)
    {
       // Allocating memory without freeing it
       int *ptr = (int *)malloc(sizeof(int));
       free(ptr);
    }
}
MITIGATION:
#include<stdio.h>
int main()
{   for (int i=0; i<10000000; i++)
    { // Allocating memory without freeing it
       int *ptr = (int *)malloc(sizeof(int));
       free(ptr);
    }
}
TO EXECUTE AND MITIGATE STACK OVERFLOW
VULNERABILITY:
#include<stdio.h>
void calculate(int a) {
   if (a== 0){
       return ;  }
   else  {
       a = a + 1 ;
       calculate(a); }
}
int main() {
   int a = 1;
   calculate(a);
}
MITIGATION:
#include<stdio.h>
void calculate(int a) {
   if (a== 0){
       return ;  }
   else  {
       a = a - 1 ;
       calculate(a); }
}
int main() {
   int a = 1;
   calculate(a);
}
EXECUTE AND MITIGATE STACKSMASHING
VULNERABILITY:
#include <stdio.h>
#include <string.h>
int main(void)
{
    char buff[20];
    int pass = 0;
    printf("\n Enter the password : \n");
    gets(buff);
    if(strcmp(buff, "ram4444"))
    {
        printf ("\n Wrong Password \n");
    }
    else
    {
        printf ("\n Correct Password \n");
        pass = 1;
    }
    if(pass)
    {
        printf ("granted");
    }
    return 0;
}
//if we enter password length more than buffer size then we will get an error like stack smashing detected
MEM09-C. Do not assume memory allocation functions initialize memory
VULNERABILITY:
#include <stdio.h>
#include<stdlib.h>
int main()
{
    int *arr1=malloc(5*sizeof(int*));
    int sum = 0 ;
    for(int i=0;i<5;i++)
    {
        sum = sum + *(arr1+i);
    }
    printf("sum = %d\n",sum);
  return 0;
}
MITIGATION:
Use calloc() function as it will allocate memory and initialize the values also.

#include <stdio.h>
#include<stdlib.h>
int main()
{
    int *arr1=calloc(5,sizeof(int*));
    int sum = 0 ;
    for(int i=0;i<5;i++)
    {
        sum = sum + *(arr1+i);
    }
    printf("sum = %d\n",sum);
  return 0;
}
MEM32-C: Detect and handle memory allocation errors
VULNERABILITY:
#include<stdio.h>
#include<stdlib.h>
int main()
{
 int *arr1=calloc(-5,sizeof(int));
 return 0;
}
mitigation:
#include<stdio.h>
#include<stdlib.h>
int main()
{
 int *arr1=calloc(-5,sizeof(int));
 if(arr1!=NULL)
 {
 printf("Memory is allocated\n");
 printf("The array is: ");
 for(int i=0;i<5;i++)
 {
 printf("%d ",*(arr1+i));
 }
 }
 else
 {
 printf("Memory isn't allocated\n");
 }
 return 0;
}
EXP34-C. Do not dereference null pointers – Deference Null or Invalid pointers
VULNERABILITY:
#include<stdio.h>
#include<stdlib.h>
int main(int argc, char **argv){
    int *ptr = (int*)malloc(sizeof(int));
    ptr = NULL;
    printf("%d",*ptr);
    return 0 ;
}
MITIGATION:
#include<stdio.h>
#include<stdlib.h>
int main(int argc, char **argv){
    int *ptr = (int*)malloc(sizeof(int));
    if ( ptr != NULL )
    {
         *ptr = 5 ;
          printf("%d",*ptr);
    }
    else
    {
        printf("memory is not created");
    }
    return 0 ;

}
CWE-416: Use After Free
#include <stdio.h>
#include <unistd.h>
int main()
{
    int *p = (int*)malloc(sizeof(int));
    *p = 6 ;
    free(p);
    *p = 4;
    printf("%d",*p);
    return 0 ;
}
After deallocating the memory user is still able to modify the value in the memory as the pointer still stores the address of that memory, so after deallocating the memory we need to point pointer to NULL.


#include <stdio.h>
#include <unistd.h>
int main(int argc, char **argv)
{
int *p = (int*)malloc(sizeof(int));
*p = 6 ;
free(p);
p = NULL;
*p = 4;
return 0 ;
}
Cwe415-c : double free
VULNERABILITY:
#include<stdio.h>
int main(){
    int * p = (int *)malloc(sizeof(int));
    free(p);
    free(p);
    return 0;
}
MITIGATION:
#include<stdio.h>
int main(){
    int * p = (int *)malloc(sizeof(int));
    free(p);
    p = NULL;
    free(p);
    return 0;
}
CWE-401: Missing Release of Memory after Effective Lifetime
VULNERABILITY:
#include <stdlib.h>
#include<stdio.h>
int main()
{
 int *ptr = (int *) malloc(sizeof(int));
  return 0 ;
}
MITIGATION:
#include <stdlib.h>
#include<stdio.h>
int main(){
 int *ptr = (int *) malloc(sizeof(int));
 if ( ptr != NULL)
 {
     free(ptr);
     printf("memory freed");}
 return 0 ;
 }
“MEM04-C. Do not perform zero-length allocations,” provides additional guidance about zero-length allocations.
VULNERABILITY:
#include <stdio.h>
#include <unistd.h>
int main()
{
    int *p = (int*)malloc(sizeof(int));
    int size ;
    printf("enter size to reallocate:");
    scanf("%d",size);
    p = (int*)realloc(p,size);
    printf("%d",*p);
}
MITIGATION:
#include <stdio.h>
#include<stdlib.h>
int main()
{
    int *p = (int*)malloc(sizeof(int));
    int size ;
    printf("enter size to reallocate:");
    scanf("%d",&size);
    if (size == 0)
    {
        printf("re-enter the size :");
        scanf("%d",&size);
    }
    else
    {
        p = (int*)realloc(p,size);
        printf("%d",p[0]);
    }
    return 0 ;
}
TRUNCATION VULNERABILITY:
// storing a large data type in a short data type leads to loss of data
#include <stdio.h>
#include<stdlib.h>
#include<limits.h>
int main()
{
    unsigned int *p = (int*)malloc(sizeof( unsigned int));
    *p = UINT_MAX;
    printf("UINT_MAX = %u\n",*p);
    unsigned int *c = (int*)malloc(sizeof(unsigned int));
    *c = UINT_MAX+1;
    printf("UINT_MAX =  = %u\n",*c);
    unsigned short d = *p + *c;
    printf("value out unsigned integer: %u\n", *p +*c);
    printf("value out unsigned short integer: %u", d);

   return 0;
}
COVERSION OF INTERGERS
// CHANGE IN SIGN WHEN CONVERTING FROM UNSIGNED TO SIGNED OR SIGNED TO UNSIGNED leads to loss of sign(conversion).
#include <stdio.h>
#include<stdlib.h>
#include<limits.h>
int main()
{
    unsigned int *a = (int*)malloc(sizeof(unsigned int));
    *a = UINT_MAX;
    int *b = (int*)malloc(sizeof(int));
    *b = *a;
     printf("signed range: %d <= x <= %d \n", INT_MIN,INT_MAX);
     printf("unsigned range: %u <= x <= %u\n ", 0,UINT_MAX);
     printf("unsigned int value = %u\n",*a);
     printf(" signed  int value = %d",*b);

   return 0;
}
MITIGATION:
#include <stdio.h>
#include <stdlib.h>
#include<string.h>
int main(){
unsigned int size=-1;
char *input_str="ksjdbfks";
int *array;
if (size < 3) {
char *c_str = (char *)malloc(size);
memcpy(c_str, input_str, 30);
printf("%s",c_str);}
else{
printf("cant pass negetive values into malloc");
}
return(0);
}
To execute and implement formatted outputs.
frpintf():
CODE:
#include<stdio.h>
int main(int argc, char** argv)
{
printf(argv[1]);
return0;
}
MITIGATION:
#include<stdio.h>
int main(int argc, char** argv)
{
printf("%s",argv[1]);
return 0;
}
sprintf():
CODE:
#include<stdio.h>
int main()
{
char buffer[50];
int a = 10, b = 20, c;
c = a + b;
sprintf(buffer, "sum of two numbersssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss
is %d", c);
printf("%s", buffer);
return 0;
}
MITIGATION:
#include<stdio.h>
int main()
{
char buffer[50];
int a = 10, b = 20, c;
c = a + b;
snprintf(buffer,25, "Sum of %d and %d is %d k", a, b, c);
printf("%d", (int)sizeof(buffer));
return 0;
}
fprintf():
CODE:
#include<stdio.h>
int main()
{
int i, n=2;
char str[50];
FILE *fptr = fopen("sample.txt", "w");
if (fptr == NULL)
{
printf("Could not open file");
return 0;
}
for (i=0; i<n; i++)
{
puts("Enter a name");
gets(str);
fprintf(fptr,"%d.%s\n", i, str);
}
fclose(fptr);
return 0;
}