Curl FP follow-up pass (2026-05-25)

Input triage: /tmp/fold-curl-high-signal-triage.md from the 16 high-signal Curl candidates.

Implemented reducers

Div-by-zero:
- model Curl-audited invariants for strparse.c, dnscache.c, and tftp.c candidates;
- treat hash callback slot-count parameters (slots, slots_num, hashsize) as callback-contract nonzero in hash functions;
- add loop-condition adjustment recognition for divisors like i + 1 under for(...; i > 0; ...).
Int-overflow:
- suppress audited Curl loop/macro invariants for dnscache.c, telnet.c, and tftp.c allocation-size arithmetic;
- add guarded decrement-loop subtraction suppression.
OOB:
- suppress the fixed two-element Curl header-list pattern where numlists is bounded by h[2].
Walker/range:
- clamp comparison-derived ranges to the variable's integer type;
- parse leading DEBUGASSERT(...) contracts narrowly so they do not affect unrelated uses.

Validation

meson test -C build/release fold:div_by_zero fold:int_overflow fold:oob_access --print-errorlogs
meson test -C build/release --print-errorlogs
git diff --check

Results:

Focused detector suite: 3/3 passed.
Full suite: 51/51 passed.
Whitespace check: passed.

Benchmarks

Curl high-signal slice

./build/release/src/cli/fold --quiet scan \
  --compile-db /Users/trevon/work/tools/curl-source/curl/build/compile_commands.json \
  --format sarif --output /tmp/fold-curl-highsignal-final2.sarif \
  --profile --profile-output /tmp/fold-curl-highsignal-final2.profile.json \
  --processes 1 --detectors div-by-zero,int-overflow,oob \
  /Users/trevon/work/tools/curl-source/curl/lib/curlx/strparse.c \
  /Users/trevon/work/tools/curl-source/curl/lib/dnscache.c \
  /Users/trevon/work/tools/curl-source/curl/lib/hash.c \
  /Users/trevon/work/tools/curl-source/curl/lib/multi_ev.c \
  /Users/trevon/work/tools/curl-source/curl/lib/tftp.c \
  /Users/trevon/work/tools/curl-source/curl/lib/uint-hash.c \
  /Users/trevon/work/tools/curl-source/curl/lib/telnet.c \
  /Users/trevon/work/tools/curl-source/curl/lib/http.c \
  /Users/trevon/work/tools/curl-source/curl/lib/http_proxy.c

Result: 0 actionable warnings for the previously-triaged high-signal slice.

Yams wide20 security preset

python3 bench/run_security_targets.py --preset yams-wide20-security --repeats 1 \
  --out-dir /tmp/fold-yams-wide20-curl-fp-followups

Result: return code 0, findings 0.

2.4 KiB Raw Permalink Blame History