trvon
6134bb3c16
fix(detect): recognize power-of-two bitwise guard in div-by-zero
...
`(d & (d-1)) == 0 ? low & (d-1) : low % d` (simeon sketch_bucket) flagged
`low % d` as division-by-zero, but the guard `(0 & -1) == 0` is TRUE when
d==0, so the `%` arm is unreachable for a zero divisor. Teach
conditionProvesNonZero that `x & (x-1)` clears the lowest set bit (zero iff x
is 0 or a power of two):
* `(x & (x-1)) == 0` false arm -> x != 0
* `(x & (x-1)) != 0` true arm -> x != 0
Also route the same check through analyzeDivCallee so the callsite
precondition for the guarded divisor param is suppressed in the same TU.
Verified: simeon.cpp:48 `proved` finding gone; positive repro 1->0, bare
`a % d` still fires; 59 div-by-zero tests + full suite 137/137.
2026-08-23 15:36:36 -06:00
trvon
fd4a68dfff
test: add coverage for project graph, pcode encoder, and detector behaviors
...
Unit + integration coverage for the session's work: incremental project
graph/index, pcode encoder, unreachable/dead-branch, equiv/cross-TU,
div-by-zero/sign-conversion/int-truncation, use-after-free, quality-precision,
scan-router profile, source TU runner, detector plan, and the eval fixtures.
2026-08-16 16:46:07 -06:00
trvon
86b2f14a43
feat(analysis): harden project-wide scans
...
- persist TU-owned graphs and guarded configuration evidence
- add closed-world production reachability classification
- calibrate detector precision and reviewed self-scan policy
- terminate poisoned workers instead of longjmp recovery
2026-07-30 18:18:04 -04:00
trvon
2dcbdbc75d
feat: harden Fold quality guard
...
Preserve source, binary, and runtime evidence boundaries while making precision and performance regressions reproducible.
- decompose analysis orchestration into bounded modules
- add differential, metamorphic, organic, and Yams change-time gates
- fix detector, P-Code, fuzz sanitizer, and report identity precision
2026-07-13 15:05:35 -04:00
trvon
8d053f4727
feat: checkpoint. Bug fixes and good improvements
2026-07-10 09:59:49 -04:00
trvon
1914d8284e
feat: many improvements and bug fixes
2026-06-12 13:25:11 -04:00
trvon
50230c809b
checkpoint
2026-06-04 20:20:29 -04:00
trvon
c29a290be2
Reduce Curl high-signal false positives
2026-05-25 09:49:07 -04:00
trvon
6c38999e60
Honor validated divisors and bounded snprintf
2026-05-24 19:55:43 -04:00
trvon
2c8263fc1c
Recognize bounded divisor and index patterns
2026-05-24 19:41:27 -04:00
trvon
0a92540b63
Prove positive derived divisors
2026-05-24 13:03:45 -04:00
trvon
976b667e45
Improve Clang guard handling
2026-05-23 21:47:53 -04:00
trvon
9707b35872
Propagate positive divisor initializers
2026-05-23 21:23:17 -04:00
trvon
03d93c0830
Refine divisor guards with Clang AST patterns
2026-05-23 21:06:37 -04:00
trvon
106fc07fe7
Use AST guards for divisor precision
2026-05-23 20:50:13 -04:00
trvon
331a68467c
Optimize security detectors and add quality gates
2026-05-23 20:42:05 -04:00
trvon
c4e42cec0a
Add scan router and MCP job queue
...
Split source and binary scan routing with merge-only hybrid support, binary provenance, and router-backed MCP scan contexts.
Add async MCP scan jobs for long-running scans, detector precision fixes, benchmark scripts, docs, and integration coverage.
2026-05-19 00:24:12 -04:00
trvon
fba6861fd0
Remove broken abort() assume test (feature not implemented)
...
cross_tu_equiv hang is pre-existing (Phase 3 regression)
2026-05-15 23:09:21 -04:00
trvon
6edb31c3b8
Phase 4b+4d+4e: octagon domain, array memcpy/strcpy, heap arrays
2026-05-15 23:04:44 -04:00
trvon
f218af3d8b
Add githooks, clang-format all code, fix CI Z3 paths
2026-05-15 00:08:47 -04:00
trvon
3f1234f7bb
fold: bounded symbolic SAST for C++
...
Clang LibTooling + Z3 BV-64 encoding.
11 detectors: clone, equiv, class-dup, dead, null-deref,
div-by-zero, int-overflow, oob, int-truncation,
sign-conversion, taint-track.
Interfaces: CLI, MCP (JSON-RPC 2.0), LSP.
Output: SARIF 2.1.0, JSON, Markdown.
2026-05-14 23:14:54 -04:00
