// Test fixture: a deliberate stack buffer overflow for fold's binary P-Code
// pipeline (BOF detection -> ROP gadget discovery -> chain synthesis).
//
// `vuln` copies attacker-controlled input into a fixed 64-byte stack buffer via
// strcpy (a recognized unbounded sink) with no length check -> stack overflow.
// Built dynamically so the image stays small (a handful of functions -> the
// per-function symbolic scan is fast) while strcpy/execve resolve to recognized
// PLT imports the detector models.
//
// Built once with zig cc and committed as bof_x64 / bof_arm64 (see README.md).
// fold scans these statically (r2 + SLEIGH); they are never executed.
#include <string.h>
#include <unistd.h>

__attribute__((noinline)) void vuln(const char *src) {
    char buf[64];
    strcpy(buf, src); // no bound vs sizeof(buf) -> stack buffer overflow
    write(1, buf, sizeof(buf));
}

// A "win" target so chain synthesis has a callable shell primitive to consider.
__attribute__((noinline)) void win(void) {
    char *argv[] = {(char *)"/bin/sh", 0};
    execve("/bin/sh", argv, 0);
}

int main(int argc, char **argv) {
    if (argc > 1) {
        vuln(argv[1]);
    }
    return 0;
}