int scanf(const char *restrict format, ...);
int getchar(void);
typedef struct _FILE FILE;
extern FILE *stdin;
int fscanf(FILE *restrict stream, const char *restrict format, ...);
int sprintf(char *str, const char *format, ...);
void setproctitle(const char *fmt, ...);
typedef __typeof(sizeof(int)) size_t;
#define strcpy(dest, src) \
((__builtin_object_size(dest, 0) != -1ULL) \
? __builtin___strcpy_chk (dest, src, __builtin_object_size(dest, 1)) \
: __inline_strcpy_chk(dest, src))
static char *__inline_strcpy_chk (char *dest, const char *src) {
return __builtin___strcpy_chk(dest, src, __builtin_object_size(dest, 1));
}
char *stpcpy(char *restrict s1, const char *restrict s2);
char *strncpy( char * destination, const char * source, size_t num );
char *strndup(const char *s, size_t n);
char *strncat(char *restrict s1, const char *restrict s2, size_t n);
void *malloc(size_t);
void *calloc(size_t nmemb, size_t size);
void bcopy(void *s1, void *s2, size_t n);
#define BUFSIZE 10
int Buffer[BUFSIZE];
void bufferScanfDirect(void)
{
int n;
scanf("%d", &n);
Buffer[n] = 1; }
void bufferScanfArithmetic1(int x) {
int n;
scanf("%d", &n);
int m = (n - 3);
Buffer[m] = 1; }
void bufferScanfArithmetic2(int x) {
int n;
scanf("%d", &n);
int m = 100 - (n + 3) * x;
Buffer[m] = 1; }
void bufferScanfAssignment(int x) {
int n;
scanf("%d", &n);
int m;
if (x > 0) {
m = n;
Buffer[m] = 1; }
}
void scanfArg() {
int t = 0;
scanf("%d", t); }
void bufferGetchar(int x) {
int m = getchar();
Buffer[m] = 1; }
void testUncontrolledFormatString(char **p) {
char s[80];
fscanf(stdin, "%s", s);
char buf[128];
sprintf(buf,s); setproctitle(s, 3);
char scpy[80];
strcpy(scpy, s);
sprintf(buf,scpy);
stpcpy(*(++p), s); setproctitle(*(p), 3);
char spcpy[80];
stpcpy(spcpy, s);
setproctitle(spcpy, 3);
char *spcpyret;
spcpyret = stpcpy(spcpy, s);
setproctitle(spcpyret, 3);
char sncpy[80];
strncpy(sncpy, s, 20);
setproctitle(sncpy, 3);
char *dup;
dup = strndup(s, 20);
setproctitle(dup, 3);
}
int system(const char *command);
void testTaintSystemCall() {
char buffer[156];
char addr[128];
scanf("%s", addr);
system(addr);
sprintf(buffer, "/bin/mail %s < /tmp/email", addr);
system(buffer); }
void testTaintSystemCall2() {
char buffern[156];
char addr[128];
scanf("%s", addr);
__builtin_snprintf(buffern, 10, "/bin/mail %s < /tmp/email", addr);
system(buffern); }
void testTaintSystemCall3() {
char buffern2[156];
int numt;
char addr[128];
scanf("%s %d", addr, &numt);
__builtin_snprintf(buffern2, numt, "/bin/mail %s < /tmp/email", "abcd");
system(buffern2); }
void testTaintedBufferSize() {
size_t ts;
scanf("%zd", &ts);
int *buf1 = (int*)malloc(ts*sizeof(int)); char *dst = (char*)calloc(ts, sizeof(char)); bcopy(buf1, dst, ts); __builtin_memcpy(dst, buf1, (ts + 4)*sizeof(char));
char *dst2 = (char*)malloc(ts*sizeof(char)); strncat(dst2, dst, ts); }
#define AF_UNIX 1
#define AF_INET 2
#define AF_LOCAL AF_UNIX
#define SOCK_STREAM 1
int socket(int, int, int);
size_t read(int, void *, size_t);
int execl(const char *, const char *, ...);
void testSocket() {
int sock;
char buffer[100];
sock = socket(AF_INET, SOCK_STREAM, 0);
read(sock, buffer, 100);
execl(buffer, "filename", 0);
sock = socket(AF_LOCAL, SOCK_STREAM, 0);
read(sock, buffer, 100);
execl(buffer, "filename", 0); }
int testDivByZero() {
int x;
scanf("%d", &x);
return 5/x; }
void testTaintedVLASize() {
int x;
scanf("%d", &x);
int vla[x]; }
#define longcmp(a,b,c) { \
a -= c; a ^= c; c += b; b -= a; b ^= (a<<6) | (a >> (32-b)); a += c; c -= b; c ^= b; b += a; \
a -= c; a ^= c; c += b; b -= a; b ^= a; a += c; c -= b; c ^= b; b += a; }
unsigned radar11369570_hanging(const unsigned char *arr, int l) {
unsigned a, b, c;
a = b = c = 0x9899e3 + l;
while (l >= 6) {
unsigned t;
scanf("%d", &t);
a += b;
a ^= a;
a += (arr[3] + ((unsigned) arr[2] << 8) + ((unsigned) arr[1] << 16) + ((unsigned) arr[0] << 24));
longcmp(a, t, c);
l -= 12;
}
return 5/a; }
int SymSymExprWithDiffTypes(void* p) {
int i;
scanf("%d", &i);
int j = (i % (int)(long)p);
return 5/j; }