Language: Go
Label: vulnerable
CWE: CWE-1284 \u2014 Improper Validation of Specified Quantity in Input
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Code:
func TestExhaustive24(t *testing.T) {
	bf := NewBitfield(24)
	max := 1 << 24

	bint := new(big.Int)

	bts := make([]byte, 4)
	for j := 0; j < max; j++ {
		binary.BigEndian.PutUint32(bts, uint32(j))
		bint.SetBytes(bts[1:])
		bf.SetBytes(nil)
		for i := 0; i < 24; i++ {
			if bf.Bit(i) {
				t.Fatalf("bit %d should have been false", i)
			}
			if bint.Bit(i) == 1 {
				bf.SetBit(i)
				bf.SetBit(i)
			} else {
				bf.UnsetBit(i)
				bf.UnsetBit(i)
			}
			if bf.Bit(i) != (bint.Bit(i) == 1) {
				t.Fatalf("bit %d should have been true", i)
			}
		}
		if !bytes.Equal(bint.Bytes(), bf.Bytes()) {
			t.Logf("%v %v", bint.Bytes(), bf.Bytes())
			t.Fatal("big int and bitfield not equal")
		}
		for i := 0; i < 24; i++ {
			if (bint.Bit(i) == 1) != bf.Bit(i) {
				t.Fatalf("bit %d wrong", i)
			}
		}
		for i := 0; i < 24; i++ {
			if bf.OnesBefore(i) != bits.OnesCount32(uint32(j)<<(32-uint(i))) {
				t.Fatalf("wrong bit count")
			}
			if bf.OnesAfter(i) != bits.OnesCount32(uint32(j)>>uint(i)) {
				t.Fatalf("wrong bit count")
			}
			if bf.Ones() != bits.OnesCount32(uint32(j)) {
				t.Fatalf("wrong bit count")
			}
		}
	}
}