Language: C
Label: safe
CWE: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Code:
escape(unsigned char ch, char *buf)
{
    const int len = ch < 0100 ? (ch < 010 ? 3 : 4) : 5;

    /* Work backwards from the least significant digit to most significant. */
    switch (len) {
    case 5:
	buf[4] = (ch & 7) + '0';
	ch >>= 3;
	FALLTHROUGH;
    case 4:
	buf[3] = (ch & 7) + '0';
	ch >>= 3;
	FALLTHROUGH;
    case 3:
	buf[2] = (ch & 7) + '0';
	buf[1] = '0';
	buf[0] = '#';
	break;
    }
    buf[len] = '\0';

    return len;
}