File: string-injection.m

package info (click to toggle)
rumur 2025.08.31-1
  • links: PTS, VCS
  • area: main
  • in suites: forky, sid
  • size: 3,644 kB
  • sloc: cpp: 18,711; ansic: 3,825; python: 1,578; objc: 1,542; yacc: 568; sh: 331; lex: 241; lisp: 15; makefile: 5
file content (22 lines) | stat: -rw-r--r-- 418 bytes parent folder | download | duplicates (4) 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
 
/* A more generalised version of error-string-injection.m, where we try printf
 * format codes in several potentially vulnerable locations.
 */

var
  x: boolean

startstate "hello %s world 1" begin
  x := true;
end

rule "hello %s world 2" begin
  if false then
    error "hello %s world 3";
  end;
  assert "hello %s world 4" x | !x;
  x := !x;
end

assume "hello %s world 5" x | x;

cover "hello %s world 6" x | x;