# Binary CWE testcase corpus

Small CWE-grounded binary fixtures for the binary-lane benchmark
(`bench/score_binary.py`). Each `.c` compiles to a stripped dynamic-glibc
x86-64 ELF (`zig cc`) so the sinks resolve via PLT imports — the shape the
P-Code security detectors key on.

| fixture | CWE | sink | expected finding |
| --- | --- | --- | --- |
| `cwe121_bof.c`   | 121 | `strcpy` into `char[64]` | oob-access (stack BOF) |
| `cwe369_div0.c`  | 369 | `100 / d` (argv-controlled) | div-by-zero |
| `cwe190_overflow.c` | 190 | `a + INT_MAX` (signed) | int-overflow |
| `cwe476_nullderef.c` | 476 | `*p` (possibly-null) | null-deref |
| `cwe416_uaf.c`   | 416 | `free(p); *p` | use-after-free |
| `clean.c`        | —   | bounded `strncpy` | (clean negative) |

## Regenerate (one-time, zig cc cross-compile)

```sh
cd tests/fixtures/binary/cwe
for c in cwe121_bof cwe369_div0 cwe190_overflow cwe476_nullderef cwe416_uaf clean; do
  zig cc -target x86_64-linux-gnu -O0 -fno-stack-protector -s -o "$c.elf" "$c.c"
done
```

## Score

```sh
python3 bench/score_binary.py --corpus tests/fixtures/binary/cwe \
  --gold bench/gold/binary-security.json
```

NOTE: the fixtures are built at `-O0` (the canonical recipe above) — the P-Code
div-by-zero and buffer-overflow detectors are exercised at `-O0`, and the
`-O0` stack-spill is recovered by the raw-stream buffer-size recovery. `clean.elf`
(bounded `strncpy`) scores 0 findings as the clean negative; the earlier
`clean.elf`-hang note was resolved by bounding the ROP-synthesis gadget budget
(docs/research/vexa-binary-deobfuscation.md §17).