As part of a Security Workshop course I did last semester (im in Australia) we had to learn about Code Auditing on our own by reading "The Art of Software Security Assessment".

In our final exam we had to audit this code. I only managed to find two vulnerabilities:

Vulnerability 1:

Line 290, format string is from user input string “inputString”. This is the format string vulnerability that can be exploited to run arbitrary code.

While there is a valid character filter, this check does not prevent the printf from running with unsanitized string, so there is no “security” filter.

Vulnerability 2: Line 344. If new array is created and show is immediately called (without the array being initialised), the contents of stack is printed instead.

This could be garbage or information leakage.

Could you guys give practical examples of what other vulnerabilities are in this code and how you went about finding them (thought process)?

Thanks!

Edit:

Thanks everyone for their replies! I will think about them and use them to review more code (for practice).

As part of a Security Workshop course I did last semester (im in Australia) we had to learn about Code Auditing on our own by reading "The Art of Software Security Assessment".

In our final exam we had to audit this code. I only managed to find two vulnerabilities:

Vulnerability 1:

Line 290, format string is from user input string “inputString”. This is the format string vulnerability that can be exploited to run arbitrary code.

While there is a valid character filter, this check does not prevent the printf from running with unsanitized string, so there is no “security” filter.

Vulnerability 2: Line 344. If new array is created and show is immediately called (without the array being initialised), the contents of stack is printed instead.

This could be garbage or information leakage.

Could you guys give practical examples of what other vulnerabilities are in this code and how you went about finding them (thought process)?

As part of a Security Workshop course I did last semester (im in Australia) we had to learn about Code Auditing on our own by reading "The Art of Software Security Assessment".

In our final exam we had to audit this code. I only managed to find two vulnerabilities:

Vulnerability 1:

Line 290, format string is from user input string “inputString”. This is the format string vulnerability that can be exploited to run arbitrary code.

While there is a valid character filter, this check does not prevent the printf from running with unsanitized string, so there is no “security” filter.

Vulnerability 2: Line 344. If new array is created and show is immediately called (without the array being initialised), the contents of stack is printed instead.

This could be garbage or information leakage.

Could you guys give practical examples of what other vulnerabilities are in this code and how you went about finding them (thought process)?

Thanks!

As part of a Security Workshop course I did last semester (im in Australia) we had to learn about Code Auditing on our own by reading "The Art of Software Security Assessment".

In our final exam we had to audit this code. I only managed to find two vulnerabilities:

Vulnerability 1:

Line 290, format string is from user input string “inputString”. This is the format string vulnerability that can be exploited to run arbitrary code.

While there is a valid character filter, this check does not prevent the printf from running with unsanitized string, so there is no “security” filter.

Vulnerability 2: Line 344. If new array is created and show is immediately called (without the array being initialised), the contents of stack is printed instead.

This could be garbage or information leakage.

Could you guys give practical examples of what other vulnerabilities are in this code and how you went about finding them (thought process)?

Thanks!

Edit:

Thanks everyone for their replies! I will think about them and use them to review more code (for practice).