trvon
|
2dcbdbc75d
|
feat: harden Fold quality guard
Preserve source, binary, and runtime evidence boundaries while making precision and performance regressions reproducible.
- decompose analysis orchestration into bounded modules
- add differential, metamorphic, organic, and Yams change-time gates
- fix detector, P-Code, fuzz sanitizer, and report identity precision
|
2026-07-13 15:05:35 -04:00 |
|
trvon
|
ffc7917957
|
feat: symbolic IR, swift backend, binary-to-fuzz pipeline, SARIF fixes
- Rust IR encoder (encodeRustIr): walks HIR expr trees, fires SafetyObserver hooks
- Swift SIL frontend (fold-swift): swiftc -emit-sil parser, demangling, NDJSON output
- SwiftBackend: --mode swift CLI routing, shells out to fold-swift
- Binary-to-fuzz: Mach-O export discovery, ARM64 ABI param-count inference, dlopen harness generation
- Language-agnostic IR: json_keys canonical constants, Call/Member/ArraySubscript/Cast/HeapNew nodes
- Dogfood fixes: SARIF kind field, cross-detector dedup, harness_file in predictions, Swift stoi safety
- Corpuses: swift-sil-z3-corpus.md, binary-fuzz-corpus.md
- AGENTS.md: cross-language wire format rule
|
2026-05-27 15:29:14 -04:00 |
|
trvon
|
93eb1f09b2
|
feat(fuzz): M31 Phase 2 — closed-loop fuzz-run promotes to ConcreteWitness
End-to-end: fold scan → fuzz-prep emits Z3-derived seed → fuzz-run
compiles + libFuzzer + ASan → crash ingested → predicted Finding
promoted from Proved to ConcreteWitness in ~1s wall-clock.
P2.1 — Confidence::ConcreteWitness tier
* Strictly stronger than Proved: SMT-feasibility + observed runtime
failure. confidenceRank() gives explicit numeric ordering so the
enum integer values stay incidental.
* FindingKind::FuzzCrash for surprise crashes the SymEx side didn't
predict.
* FuzzWitness evidence sub-struct (seed_path, asan_kind, asan_file,
asan_line) + JSON round-trip.
P2.2 — ASan stderr parser
* include/fold/fuzz/asan_parser.{hpp,cpp} (~150 LOC)
* Parses the canonical SUMMARY tail line — stable across LLVM 15–22
for both ASan (heap-buffer-overflow, SEGV, …) and UBSan
(signed-integer-overflow, …)
* test_asan_parser.cpp: 6 cases / 27 assertions
P2.3 — FuzzRunner
* include/fold/fuzz/runner.{hpp,cpp}
* Synchronous: compile + posix_spawn + waitpid-with-deadline +
artifact-scan. SIGTERM + 1s grace + SIGKILL on parent timeout.
* Per-source `-x c` / `-x c++` pinning so C targets keep their
C linkage and the harness's extern "C" decl resolves.
* Drops -std= entirely — generated harnesses are pre-C++17.
P2.4 + P2.5 — fuzz-run CLI + crash ingestion
* src/cli/fuzz_run_runner.cpp: load findings.predicted.json, group
by function, runFuzzCampaign per harness, replay each crash under
ASan, parse SUMMARY, match (file, line) to predicted Finding.id.
* Matched crashes → augmented Finding with Confidence::ConcreteWitness
+ evidence.fuzz_witness. Unmatched → FindingKind::FuzzCrash.
* Subcommand: --prep-dir, --target-source (rep), --time-budget,
--compiler, --report, --clang-flag.
P2.6 — integration test
* tests/integration/test_fuzz_run.cpp: probes for a clang++ that can
link -fsanitize=fuzzer, builds the null-deref-behind-guard fixture,
chains runFuzzPrep + runFuzzRun, asserts at least one
concrete-witness Finding whose id matches a predicted Finding.id.
* WARN+SUCCEED when no libFuzzer-capable compiler is found so CI
on stripped clang installs stays green.
Tests: 39 → 40 green.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
2026-05-21 15:21:05 -04:00 |
|
