{"repo":"0xdea/weggli-patterns","free":true,"listed":false,"github":"https://github.com/0xdea/weggli-patterns","clone":"git clone https://github.com/0xdea/weggli-patterns.git","description":"A collection of my weggli patterns to facilitate vulnerability research.","language":null,"stars":161,"topics":["code-review","static-analysis","vulnerability-research","weggli","weggli-patterns"],"license":"MIT","category":"dev-tools","readme_excerpt":"weggli-patterns \"No one cares about the old scene people anymore, I’m sure, bunch of old people grepping for the last of the memcpy.\" -- Bas Alberts A collection of my weggli patterns to facilitate vulnerability research. Article See also [!IMPORTANT] By default, weggli scans .c and .h files. To enable C++ mode and thus scan .cc , .cpp , .cxx , .h , and .hpp files, you must specify the -X command-line flag. Alternative file endings can be specified using the -e flag. Please refer to weggli's usage documentation for additional information. Compatibility Tested with weggli 0.2.4 Patterns buffer overflows call to unbounded copy functions (CWE-120, CWE-242, CWE-676) And so on... There are many possible unbounded copy functions. incorrect use of strncat (CWE-193, CWE-787) The last pattern won't work with integer literals due to known limitations. destination buffer access using size of source buffer (CWE-806) The last pattern won't work with integer literals due to known limitations. use of sizeof on a pointer type (CWE-467) Apparently, global variables are not supported so this won't work: use of sizeof on a character constant In C (but not in C++) character constants have type int. lack of explicit NUL-termination after strncpy , etc. (CWE-170, CWE-126) Some possible variants: memcpy , read , readlink , fread , etc. off-by-one error (CWE-193, CWE-787) The second pattern won't work with integer literals due to known limitations. and = ; however, let's keep all variants just to be","default_branch":null,"files":null,"tree":[],"storefront":"/r/0xdea","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/0xdea/weggli-patterns/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}