{
  "schema_version": 1,
  "case_id": "organic-cve-vulnerable-fixed-pairs",
  "case_type": "vulnerable-fixed",
  "origin": "organic",
  "backend": "source",
  "name": "organic_cve_vulnerable_fixed_pairs",
  "description": "Pinned, dependency-minimized semantic slices of upstream vulnerable/fixed C and C++ security patches.",
  "expect": {
    "vulnerable_detected": 1,
    "fixed_reported": 0
  },
  "lineage": {
    "vulnerable_revision": "per-pair:corpus.entries",
    "fixed_revision": "per-pair:corpus.entries"
  },
  "corpus": {
    "kind": "adapted-upstream-vulnerable-fixed",
    "integrity": "The local sources are compileable semantic slices, not pristine upstream files; hashes pin the exact evaluated adaptations.",
    "entries": [
      {
        "name": "gstreamer-cve-2024-47835",
        "cve": "CVE-2024-47835",
        "project": "GStreamer",
        "repository": "https://gitlab.freedesktop.org/gstreamer/gstreamer",
        "reference": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/1a5fdba14a1ccfe473bc4429f22ee5bbaee034eb",
        "vulnerable_revision": "a8f8bbef99e28bbf62aeaa774814b5c3a665e9d6",
        "fixed_revision": "1a5fdba14a1ccfe473bc4429f22ee5bbaee034eb",
        "upstream_path": "subprojects/gst-plugins-base/gst/subparse/samiparse.c",
        "license": "LGPL-2.1-or-later",
        "adaptation": "Preserves strchr(line, ']') followed by use of start + 1; removes GStreamer types and allocation machinery. The fixed slice adds the upstream null guard.",
        "known_gap": "Fold does not yet model a nullable return contract for strchr across this dereference.",
        "expected": {
          "vulnerable_detected": false,
          "fixed_reported": false
        },
        "hazard": "null-deref",
        "detector": "null-deref",
        "rule_id": "fold.null-deref",
        "vulnerable_source": "../../fixtures/organic/gstreamer_cve_2024_47835_vulnerable.cpp",
        "vulnerable_sha256": "fb2c64622a7fa605cee031d8193b36b5312142517faa3aa8733ba410ce48c72b",
        "fixed_source": "../../fixtures/organic/gstreamer_cve_2024_47835_fixed.cpp",
        "fixed_sha256": "9e18a60ee692978a3578ede6e0e789b7d0b1ba5f26ee21148dfe6d4f0f01c461"
      },
      {
        "name": "libssh2-cve-2019-17498",
        "cve": "CVE-2019-17498",
        "project": "libssh2",
        "repository": "https://github.com/libssh2/libssh2",
        "reference": "https://github.com/libssh2/libssh2/commit/1c6fa92b77e34d089493fe6d3e2c6c8775858b94",
        "vulnerable_revision": "8b3cf0b17c1b84a138bed9423a9e0743452b4de9",
        "fixed_revision": "1c6fa92b77e34d089493fe6d3e2c6c8775858b94",
        "upstream_path": "src/packet.c",
        "license": "BSD-3-Clause",
        "adaptation": "Preserves the unsigned datalen - 13 predicate. The fixed slice expresses the length precondition enforced by the checked parsing helpers introduced upstream.",
        "expected": {
          "vulnerable_detected": true,
          "fixed_reported": false
        },
        "hazard": "integer-overflow",
        "detector": "int-overflow",
        "rule_id": "fold.unsigned-wrap",
        "vulnerable_source": "../../fixtures/organic/libssh2_cve_2019_17498_vulnerable.cpp",
        "vulnerable_sha256": "c209347ad7bbfb26916bb734011e0ff535c6e16a29485d2e4b10e82a5ce0fa22",
        "fixed_source": "../../fixtures/organic/libssh2_cve_2019_17498_fixed.cpp",
        "fixed_sha256": "f81594c4ec33bfbfd0bac31cc417a4d049450b40a2c0d7302ab0f58d9b90cefa"
      },
      {
        "name": "openssl-cve-2015-0288",
        "cve": "CVE-2015-0288",
        "project": "OpenSSL",
        "repository": "https://github.com/openssl/openssl",
        "reference": "https://github.com/openssl/openssl/commit/28a00bcd8e318da18031b2ac8778c64147cd54f9",
        "vulnerable_revision": "437b14b533fe7f7408e3ebca6d5569f1d3347b1a",
        "fixed_revision": "28a00bcd8e318da18031b2ac8778c64147cd54f9",
        "upstream_path": "apps/req.c",
        "license": "OpenSSL",
        "adaptation": "Preserves a nullable X509_get_pubkey result reaching a dereference-equivalent downstream use; removes OpenSSL object dependencies. The fixed slice adds the upstream null guard.",
        "known_gap": "Fold does not yet propagate this nullable struct-field value into the downstream member dereference.",
        "expected": {
          "vulnerable_detected": false,
          "fixed_reported": false
        },
        "hazard": "null-deref",
        "detector": "null-deref",
        "rule_id": "fold.null-deref",
        "vulnerable_source": "../../fixtures/organic/openssl_cve_2015_0288_vulnerable.cpp",
        "vulnerable_sha256": "392a5d560467f921c29df40729a47a89923d62e4cf176d15cd8434018e7d7afd",
        "fixed_source": "../../fixtures/organic/openssl_cve_2015_0288_fixed.cpp",
        "fixed_sha256": "97070682628ff474777016776280521583d51d5657fa65d03627d847d84c61e0"
      }
    ]
  }
}