unsigned char *base64_encode (unsigned char *buffer, unsigned int len)
{                                                                         
unsigned char *ret = (unsigned char *) malloc ((((len+2)/3)*4)+1);
EVP_EncodeBlock (ret, buffer, len);
ret[(((len+2)/3)*4)] = 0;
return ret;
}
                                                                  
unsigned char *base64_decode (unsigned char *buffer, unsigned int *len)
{                                                                         
unsigned char *ret = (unsigned char *) malloc (((strlen(buffer)+3)/4)*3);
*len = EVP_DecodeBlock (ret, buffer, strlen(buffer));
return ret;
}

/**
* \file base64.h
*/
#ifndef _BASE64_H
#define _BASE64_H

#ifdef __cplusplus
extern "C" {
#endif

#define ERR_BASE64_BUFFER_TOO_SMALL             0x0010
#define ERR_BASE64_INVALID_CHARACTER            0x0012

/**
* \brief          Encode a buffer into base64 format
*
* \param dst      destination buffer
* \param dlen     size of the buffer (updated after call)
* \param src      source buffer
* \param slen     amount of data to be encoded
*
* \return         0 if successful, or ERR_BASE64_BUFFER_TOO_SMALL.
*                 *dlen is always updated to reflect to amount of
*                 data that was written (or would have been written)
*
* \note           Call this function with *dlen = 0 to obtain the
*                 required buffer size in *dlen
*/
int base64_encode( unsigned char *dst, int *dlen,
             unsigned char *src, int  slen );

/**
* \brief          Decode a base64-formatted buffer
*
* \param dst      destination buffer
* \param dlen     size of the buffer (updated after call)
* \param src      source buffer
* \param slen     amount of data to be decoded
*
* \return         0 if successful, ERR_BASE64_BUFFER_TOO_SMALL, or
*                 ERR_BASE64_INVALID_DATA if an invalid char is found.
*                 *dlen is always updated to reflect to amount of
*                 data that was written (or would have been written)
*
* \note           Call this function with *dlen = 0 to obtain the
*                 required buffer size in *dlen
*/
int base64_decode( unsigned char *dst, int *dlen,
             unsigned char *src, int  slen );

/**
* \brief          Checkup routine
*
* \return         0 if successful, or 1 if the test failed
*/
int base64_self_test( int verbose );

#ifdef __cplusplus
}
#endif






/*
*  RFC 1521 base64 encoding/decoding
*
*  Copyright (C) 2006-2007  Christophe Devine
*
*  This library is free software; you can redistribute it and/or
*  modify it under the terms of the GNU Lesser General Public
*  License, version 2.1 as published by the Free Software Foundation.
*
*  This library is distributed in the hope that it will be useful,
*  but WITHOUT ANY WARRANTY; without even the implied warranty of
*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
*  Lesser General Public License for more details.
*
*  You should have received a copy of the GNU Lesser General Public
*  License along with this library; if not, write to the Free Software
*  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
*  MA  02110-1301  USA
*/

#ifndef _CRT_SECURE_NO_DEPRECATE
#define _CRT_SECURE_NO_DEPRECATE 1
#endif

#include "xyssl/base64.h"

static const int base64_enc_map[64] =
{
'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J',
'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T',
'U', 'V', 'W', 'X', 'Y', 'Z', 'a', 'b', 'c', 'd',
'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n',
'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x',
'y', 'z', '0', '1', '2', '3', '4', '5', '6', '7',
'8', '9', '+', '/'
};

static const int base64_dec_map[128] =
{
127, 127, 127, 127, 127, 127, 127, 127, 127, 127,
127, 127, 127, 127, 127, 127, 127, 127, 127, 127,
127, 127, 127, 127, 127, 127, 127, 127, 127, 127,
127, 127, 127, 127, 127, 127, 127, 127, 127, 127,
127, 127, 127,  62, 127, 127, 127,  63,  52,  53,
54,  55,  56,  57,  58,  59,  60,  61, 127, 127,
127,  64, 127, 127, 127,   0,   1,   2,   3,   4,
5,   6,   7,   8,   9,  10,  11,  12,  13,  14,
15,  16,  17,  18,  19,  20,  21,  22,  23,  24,
25, 127, 127, 127, 127, 127, 127,  26,  27,  28,
29,  30,  31,  32,  33,  34,  35,  36,  37,  38,
39,  40,  41,  42,  43,  44,  45,  46,  47,  48,
49,  50,  51, 127, 127, 127, 127, 127
};

/*
* Encode a buffer into base64 format
*/
int base64_encode( unsigned char *dst, int *dlen,
             unsigned char *src, int  slen )
{
int i, n;
int C1, C2, C3;
unsigned char *p;

if( slen == 0 )
  return( 0 );

n = ( slen << dlen =" n" n =" (" i =" 0," p =" dst;" c1 =" *src++;" c2 =" *src++;" c3 =" *src++;">> 2 ) & 0x3F];
  *p++ = base64_enc_map[((( C1 &  3 ) <<>> 4 )) &amp;amp;amp;amp;amp; 0x3F];
  *p++ = base64_enc_map[((( C2 & 15 ) <<>> 6 )) &amp;amp;amp;amp;amp; 0x3F];
  *p++ = base64_enc_map[C3 & 0x3F];
}

if( i < c1 =" *src++;" c2 =" ((i">> 2 ) & 0x3F];
  *p++ = base64_enc_map[((( C1 & 3 ) <<>> 4 )) &amp;amp;amp;amp;amp; 0x3F];
  *p++ = ((i + 1) < dlen =" p" p =" 0" i =" j" n =" 0;">= 2 &&
      src[i] == '\r' && src[i + 1] == '\n' )
      continue;

  if( src[i] == '\n' )
      continue;

  if( src[i] == '=' && ++j > 2 )
      return( ERR_BASE64_INVALID_CHARACTER );

  if( src[i] > 127 || base64_dec_map[src[i]] == 127 )
      return( ERR_BASE64_INVALID_CHARACTER );

  if( base64_dec_map[src[i]] < n ="=" n =" (">> 3;

if( *dlen < dlen =" n;" j =" 3," n =" x" p =" dst;"> 0; i--, src++ )
{
  if( *src == '\r' || *src == '\n' )
      continue;

  j -= ( base64_dec_map[*src] == 64 );
  x  = ( x << n ="=" n =" 0;">> 16 );
      if( j > 1 ) *p++ = (unsigned char) ( x >> 8 );
      if( j > 2 ) *p++ = (unsigned char )  x;
  }
}

*dlen = p - dst;

return( 0 );
}

static const char _base64_src[] = "_base64_src";

#if defined(SELF_TEST)

#include 
#include 

static const unsigned char base64_test_dec[64] =
{
0x24, 0x48, 0x6E, 0x56, 0x87, 0x62, 0x5A, 0xBD,
0xBF, 0x17, 0xD9, 0xA2, 0xC4, 0x17, 0x1A, 0x01,
0x94, 0xED, 0x8F, 0x1E, 0x11, 0xB3, 0xD7, 0x09,
0x0C, 0xB6, 0xE9, 0x10, 0x6F, 0x22, 0xEE, 0x13,
0xCA, 0xB3, 0x07, 0x05, 0x76, 0xC9, 0xFA, 0x31,
0x6C, 0x08, 0x34, 0xFF, 0x8D, 0xC2, 0x6C, 0x38,
0x00, 0x43, 0xE9, 0x54, 0x97, 0xAF, 0x50, 0x4B,
0xD1, 0x41, 0xBA, 0x95, 0x31, 0x5A, 0x0B, 0x97
};

static const unsigned char base64_test_enc[] =
"JEhuVodiWr2/F9mixBcaAZTtjx4Rs9cJDLbpEG8i7hPK"
"swcFdsn6MWwINP+Nwmw4AEPpVJevUEvRQbqVMVoLlw==";

/*
* Checkup routine
*/
int base64_self_test( int verbose )
{
int len;
unsigned char *src, buffer[128];

if( verbose != 0 )
  printf( "  Base64 encoding test: " );

len = sizeof( buffer );
src = (unsigned char *) base64_test_dec;

if( base64_encode( buffer, &len, src, 64 ) != 0 ||
  memcmp( base64_test_enc,  buffer, 88 ) != 0 )
{
  if( verbose != 0 )
      printf( "failed\n" );

  return( 1 );
}

if( verbose != 0 )
  printf( "passed\n  Base64 decoding test: " );

len = sizeof( buffer );
src = (unsigned char *) base64_test_enc;

if( base64_decode( buffer, &len, src, 88 ) != 0 ||
  memcmp( base64_test_dec,  buffer, 64 ) != 0 )
{
  if( verbose != 0 )
      printf( "failed\n" );

  return( 1 );
}

if( verbose != 0 )
  printf( "passed\n\n" );

return( 0 );
}
#else
int base64_self_test( int verbose )
{
return( 0 );
}
#endif


#endif /* base64.h */

$ echo test > test.txt
$ openssl md5 test.txt
MD5(test.txt)= d8e8fca2dc0f896fd7cb4cb0031ba249

openssl sha1 test.txt
SHA1(test.txt)= 4e1243bd22c66e76c2ba9eddc1f91394e57f9f83

unsigned char *simple_digest(char *alg, char *buffer, 
                             unsigned int len, int *olen)
{
   EVP_MD *m;
   EVP_MD_CTX ctx;
   unsigned char *ret;
                                                                                
   OpenSSL_add_all_digests ();
   if (!(m = (EVP_MD*) EVP_get_digestbyname(alg)))
      return NULL;

   if (!(ret = (unsigned char *) malloc(EVP_MAX_MD_SIZE)))
      return NULL;

   EVP_DigestInit(&ctx, m);
   EVP_DigestUpdate(&ctx, buffer, len);
   EVP_DigestFinal(&ctx, ret, olen);

   return ret;
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <openssl/evp.h>

#define READSIZE 1024

unsigned char *
simple_digest(char *alg, unsigned char *buffer, size_t len, size_t * olen)
{
   EVP_MD *m;
   EVP_MD_CTX ctx;
   unsigned char *ret;

   OpenSSL_add_all_digests();
   if(!(m = (EVP_MD *) EVP_get_digestbyname(alg)))
      return NULL;

   if(!(ret = (unsigned char *)malloc(EVP_MAX_MD_SIZE)))
      return NULL;

   EVP_DigestInit(&ctx, m);
   EVP_DigestUpdate(&ctx, buffer, len);
   EVP_DigestFinal(&ctx, ret, olen);
   return ret;
}

void
print_hex(unsigned char *bs, size_t n)
{
   int i;

   for(i = 0; i < n; i++)
      printf("%02x", bs[i]);
}

unsigned char *
read_file(FILE * f, size_t *len)
{
   unsigned char *buffer = NULL, *last = NULL;
   unsigned char inbuffer[READSIZE];
   int tot, n;

   tot = 0;
   for(;;)
   {
      n = fread(inbuffer, sizeof(unsigned char), READSIZE, f);
      if(n > 0)
      {
         last = buffer;
         buffer = (unsigned char *)malloc(tot + n);
         memcpy(buffer, last, tot);
         memcpy(&buffer[tot], inbuffer, n);

         if(last)
            free(last);
         tot += n;

         if(feof(f) > 0)
         {
            *len = tot;
            return buffer;
         }
      }
      else
      {
         if(buffer)
            free(buffer);
         break;
      }
   }
   return NULL;
}

unsigned char *
process_file(char *algorithm, FILE * f, size_t *olen)
{
   size_t filelen;
   unsigned char *ret, *contents = read_file(f, &filelen);

   if(!contents)
      return NULL;

   ret = simple_digest(algorithm, contents, filelen, olen);
   free(contents);
   return ret;
}

int
process_stdin(char *algorithm)
{
   size_t olen;
   unsigned char *digest = process_file(algorithm, stdin, &olen);

   if(!digest)
      return 0;

   print_hex(digest, olen);
   printf("\n");
   free(digest);
   return 1;
}

void
usage(char *progname)
{

   printf("Usage: %s [ md2 | md4 | md5 | sha | sha1 ] [ Files ] \n\n",
          progname);
   exit(0);
}

int
main(int argc, char *argv[])
{
   int i;

   /* Sin parametros */
   if(argc < 2)
      usage(argv[0]);

   /* Verificamos los algoritmos */
   if((strcmp(argv[1], "md2") != 0) &&
      (strcmp(argv[1], "md4") != 0) &&
      (strcmp(argv[1], "md5") != 0) &&
      (strcmp(argv[1], "sha") != 0) && (strcmp(argv[1], "sha1") != 0))
      usage(argv[0]);


   /* Un solo parametro, entrada estandar */
   if(argc == 2)
   {
      if(!process_stdin(argv[1]))
         perror("stdin");
   }

   /* Lee y procesa todos los parametros recibidos */
   else
   {
      for(i = 2; i < argc; i++)
      {

         FILE *file = fopen(argv[i], "rb");
         size_t olen;
         unsigned char *digest;

         if(!file)
         {
            perror(argv[i]);
            return -1;
         }

         digest = process_file(argv[1], file, &olen);

         if(!digest)
         {
            fclose(file);
            return -1;
         }

         fclose(file);
         print_hex(digest, olen);
         printf("  %s\n", argv[i]);
         free(digest);
      }
   }
   return 1;
}

$ gcc -lssl myhash.c -o myhash

$ ./myhash md5 test.txt
d8e8fca2dc0f896fd7cb4cb0031ba249  test.txt

$ openssl md5 test.txt
MD5(test.txt)= d8e8fca2dc0f896fd7cb4cb0031ba249

$ ./myhash sha1 test.txt
4e1243bd22c66e76c2ba9eddc1f91394e57f9f83  test.txt

$ openssl sha1 test.txt
SHA1(test.txt)= 4e1243bd22c66e76c2ba9eddc1f91394e57f9f83

public class ShortOverflow
{
  public static void main(String args[])
  {
     if(args.length<1)         
        return;       
       
     short num = Integer.valueOf(args[0]).shortValue();       
     System.out.println("num: "+num);       

     if(num>100)
        System.out.println("num > 100");
     else
        System.out.println("num < 100");    
  }
} 

$ java -version
java version "1.5.0_07"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_07-b03)
Java HotSpot(TM) Client VM (build 1.5.0_07-b03, mixed mode, sharing)

$ javac ShortOverflow.java
$ java ShortOverflow 100
num: 100
num < 100

$ java ShortOverflow 101
num: 101
num > 100

$java ShortOverflow 100000
num: -31072
num < 100

public class ByteOverflow
{
  public static void main(String args[])
  {
     if(args.length<1)         
        return;       
       
     byte num = Integer.valueOf(args[0]).byteValue();       
     System.out.println("num: "+num);       

     if(num>100)
        System.out.println("num > 100");
     else
        System.out.println("num < 100");    
  }
}

$ javac ByteOverflow.java
$ java ByteOverflow 100
num: 100
num < 100

$ java ByteOverflow 101
num: 101
num > 100

$ java ByteOverflow 1000
num: -24
num < 100

public class IntegerOverflow
{
   public static void main(String args[])
   {
      if(args.length<1)
         return;

      int num = Integer.valueOf(args[0]).intValue();

      System.out.println("num: "+num);

      if(num>100)
         System.out.println("num > 100");
      else
         System.out.println("num < 100");

   }
}

$ javac IntegerOverflow.java
$ java IntegerOverflow 10
num: 10
num < 100

$ java IntegerOverflow 100000
num: 100000
num > 100

$ java IntegerOverflow 1000000000000000
Exception in thread "main" java.lang.NumberFormatException: For input string: "1000000000000000"
        at java.lang.NumberFormatException.forInputString(NumberFormatException.java:48)
        at java.lang.Integer.parseInt(Integer.java:459)
        at java.lang.Integer.valueOf(Integer.java:553)
        at IntegerOverflow.main(IntegerOverflow.java:9)

public class RecargaMovil
{
   public static void main(String args[])
   {
      if(args.length!=2)
      {
         System.out.println("Uso: prog [telefono] [importe]");
         return;
      }

      // Aqui se encuentra el error del programador (o vulnerabilidad)
      short importe = Integer.valueOf(args[1]).shortValue();
      if(importe < = 10)
      {
         // Quitamos 1 euro de comision;)
         importe -= 1;

         if(importe<3)
         {
            System.out.println("Importe demasiado pequeño");
            return;
         }

         System.out.println("Realizando recarga de "+importe+
            " euros a "+args[0]);
         // Realizar recarga ...
      }
      else
      {
         System.out.println("No se permite hacer recargas de mas de 10 euros");
      }
   }
}

$ java RecargaMovil 93123123 9
Realizando recarga de 8 euros a 93123123

$ java RecargaMovil 93123123 15
No se permite hacer recargas de mas de 10 euros

$ java RecargaMovil 98234948 -98302
Importe demasiado pequeño

$ java RecargaMovil 98234948 -98303
Importe demasiado pequeño

$ java RecargaMovil 98234948 -98304
Realizando recarga de 32767 euros a 98234948

int main()
{
   unsigned short c = 65535;
   printf("%d\n", c);
   c++;
   printf("%d\n", c);
   return 0;
}

$ gcc ex1.c
$ ./a.out
65535
0

int main()
{
   printf("size of char: %d bytes\n", sizeof(char));
   printf("size of short: %d bytes\n", sizeof(short));
   printf("size of int: %d bytes\n", sizeof(int));
   printf("size of float: %d bytes\n", sizeof(float));
   return 0;
}

$ gcc ex2.c
$ ./a.out
size of char: 1 bytes
size of short: 2 bytes
size of int: 4 bytes
size of float: 4 bytes

int main()
{
   unsigned short c = -1;
   printf("%d\n", c);
   c++;
   printf("%d\n", c);
   return 0;
}

$ gcc ex3.c
$ ./a.out
65535
0

int main(int argc, char *argv[])
{
   if(argc != 2)
   {
      printf("Usage: %s num\n", argv[0]);
      return -1;
   }

   size_t num = atoi(argv[1]);

   if(num>100)
      printf("num > 100\n");
   else
      printf("num < 100\n);

   return 0;
}

$ gcc ex4.c
$ ./a.out 1
num < 100
$ ./a.out 101
num > 101
$ ./a.out -1
num > 100

int main(int argc, char *argv[])
{
   if(argc<=1)      
      return -1;   
   char *ptr = malloc(strlen(argv[1]));  
   int *login_ok = malloc(sizeof(int));  
   *login_ok=0;    
   printf("size: %d\n", strlen(argv[1]));  
   uint8_t len = strlen(argv[1]) -1;   
   memcpy(ptr, argv[1], len+1);  
   printf("Login: %d\n", *login_ok);   

  if(*login_ok)  
  {     
     printf("Access Accept\n");  
  }  
  else  
  {     
     printf("Access Denied\n");  
  }  
  return 1;
}  

$ gcc ex5.c
$ ./a.out hola
size: 4
Login: 0
Access Denied

$ ./a.out adiossssssssssssssssssssss
size: 26
Login: 0
Access Denied

$ ./a.out ""
size: 0
Login: 3618355
Access Accept