Language: C
Label: vulnerable
CWE: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Code:
wsemul_vt100_output_dcs(struct wsemul_vt100_emuldata *edp,
    struct wsemul_inputstate *instate)
{
	u_int newstate = VT100_EMUL_STATE_DCS;

	switch (instate->inchar) {
	case '0': case '1': case '2': case '3': case '4':
	case '5': case '6': case '7': case '8': case '9':
		/* argument digit */
		if (edp->nargs > VT100_EMUL_NARGS - 1)
			break;
		edp->args[edp->nargs] = (edp->args[edp->nargs] * 10) +
		    (instate->inchar - '0');
		break;
	case ';': /* argument terminator */
		edp->nargs++;
		break;
	default:
		edp->nargs++;
		if (edp->nargs > VT100_EMUL_NARGS) {
#ifdef VT100_DEBUG
			printf("vt100: too many arguments\n");
#endif
			edp->nargs = VT100_EMUL_NARGS;
		}
		newstate = VT100_EMUL_STATE_STRING;
		switch (instate->inchar) {
		case '$':
			newstate = VT100_EMUL_STATE_DCS_DOLLAR;
			break;
		case '{': /* DECDLD soft charset */	/* } */
		case '!': /* DECRQUPSS user preferred supplemental set */
			/* 'u' must follow - need another state */
		case '|': /* DECUDK program F6..F20 */
#ifdef VT100_PRINTNOTIMPL
			printf("DCS%c ignored\n", (char)instate->inchar);
#endif
			break;
		default:
#ifdef VT100_PRINTUNKNOWN
			printf("DCS %x (%d, %d) unknown\n", instate->inchar,
			    ARG(0), ARG(1));
#endif
			break;
		}
	}

	edp->state = newstate;
	return 0;
}