// This C function has an error. Click to uncover.
 
23int main() {
24    int x = 0;
25    return (x = 1) + (x = 2);
Unsequenced side effect on scalar object with side effect of same object:
      > in main at 1-unsequenced-side-effect.c:25:5

    Undefined behavior (UB-EIO8):
        see C11 section 6.5:2 http://rvdoc.org/C11/6.5
        see C11 section J.2:1 item 35 http://rvdoc.org/C11/J.2
        see CERT-C section EXP30-C http://rvdoc.org/CERT-C/EXP30-C
        see MISRA-C section 8.1:3 http://rvdoc.org/MISRA-C/8.1
26}
        

  // This Java program has an error. Click to uncover.
  
10public class Account {         
11    // Total balance as recorded in bank.
12    public static int Bank_Total = 0;
     ...
32    public void go() {
         ...
44        // start all accounts
45        for (int i = 0; i < NUM_ACCOUNTS; i++){
46            accounts[i].start();
47        }
         ...
59    }
     ...
96    public static void Service(int id, int sum){
97        accounts[id].Balance += sum;
98        Bank_Total += sum;
Data race on field account.Account.Bank_Total:
    Write in thread 12
      > at account.Account.Service(Account.java:98)
        at account.BankAccount.Action(BankAccount.java:41)
        at account.BankAccount.run(BankAccount.java:56)
    Thread 12 created by thread 1
        at account.Account.go(Account.java:46)

    Read in thread 13
      > at account.Account.Service(Account.java:98)
        at account.BankAccount.Action(BankAccount.java:41)
        at account.BankAccount.run(BankAccount.java:56)
    Thread 13 created by thread 1
        at account.Account.go(Account.java:46)

99    }
100}

 // This Solidity function has an error. Click to uncover.
 
10function transferFrom(address from, address to, uint256 value)
11     returns (bool success) {
12        if (balances[from] >= value &&
13            allowed[from][msg.sender] >= value &&
14            value > 0) {
15
16            // do the transfer
17            balances[from] -= value;
18            balances[to]   += value;
ERC20 compliance failure:
Overflow when balance[to] + value larger than or equal to 2^256.
19
20            // addjust senders allowed spending
21            allowed[from][msg.sender] -= value;
22
23            // raise a Transfer
24            Transfer(from, to, value);
25
26            // success!
27            return true;
28
29        } else {
30            return false;
31        }
32    }
        

  // This C function has an error. Click to uncover.
  
25int main() {
26    short int a = 1;
27    int i;
28    for (i = 0; i < 15; i++) {
29        a *= 2;
Conversion to signed integer outside the range that can be represented:
      > in main at 6-int-overflow.c:29:9

    Implementation defined behavior (IMPL-CCV2):
        see C11 section 6.3.1.3:3 http://rvdoc.org/C11/6.3.1.3
        see C11 section J.3.5:1 item 4 http://rvdoc.org/C11/J.3.5
        see CERT-C section INT31-C http://rvdoc.org/CERT-C/INT31-C
30    }
31    return a;
32}
        

  // This C function has an error. Click to uncover.
  
 9long accum = 0;
10static void *square(void *param) {
11    int x = *(int *)param;
12    accum += x * x;
Data race on accum at square-sum.c:
    Write in thread 3
      > in square at .../square-sum.c:12
    Thread 3 created by thread 1
      > in main at .../square-sum.c:23

    Write in thread 2
      > in square at .../square-sum.c:12
    Thread 2 created by thread 1
      > in main at .../square-sum.c:23

    Undefined behavior (UB-CEER4):
        see C11 section 5.1.2.4:25 http://rvdoc.org/C11/5.1.2.4
        see C11 section J.2:1 item 5 http://rvdoc.org/C11/J.2
        see CERT-C section MSC15-C http://rvdoc.org/CERT-C/MSC15-C
        see MISRA-C section 8.1:3 http://rvdoc.org/MISRA-C/8.1

13    return NULL;
14}
15
16int main() {
17    pthread_t threads[NUM_THREADS];
18    int *params[NUM_THREADS];
19
20    for (long t = 0; t < NUM_THREADS; t++) {
21        params[t] = malloc(sizeof(int));
22        *params[t] = t + 1;
23        pthread_create(&threads[t], NULL, square, (void *)params[t]);
24    }
25
26    for (long t = 0; t < NUM_THREADS; t++) {
27        pthread_join(threads[t], NULL);
28        free(params[t]);
29    }
30
31    return accum & 0377U;
32}
        

  // This C function has an error. Click to uncover.
  
 9 struct foo {
10     char buffer[32];
11     int secret;
12 };
13 
14 int idx = 0;
15 
16 void setIdx() {
17     idx = 32;
18 }
19 
20 int main() {
21     setIdx();
22     struct foo x = {0};
23     x.secret = 5;
24     return x.buffer[idx];
Dereferencing a pointer past the end of an array:
      > in main at 3-array-in-struct.c:24:5

    Undefined behavior (UB-CER4):
        see C11 section 6.5.6:8 http://rvdoc.org/C11/6.5.6
        see C11 section J.2:1 items 47 and 49 http://rvdoc.org/C11/J.2
        see CERT-C section ARR30-C http://rvdoc.org/CERT-C/ARR30-C
        see CERT-C section ARR37-C http://rvdoc.org/CERT-C/ARR37-C
        see CERT-C section STR31-C http://rvdoc.org/CERT-C/STR31-C
        see MISRA-C section 8.18:1 http://rvdoc.org/MISRA-C/8.18
        see MISRA-C section 8.1:3 http://rvdoc.org/MISRA-C/8.1

25 }