14aedf7417
- int-overflow: unsigned wrap is defined, not UB — split to fold.unsigned-wrap so signed-UB findings aren't drowned; on by default (--report-unsigned-wrap=false opts out) - use-after-free: model return/throw as path-terminating so `delete p; return;` in an error branch can't poison the fall-through - oob-access: real sizeof for complete structs (was 1); recognize std::min/clamp/modulo index bounds - memory-leak: static-storage singletons + return-to-caller are caller-owned, not leaks YAMS scan: UAF 4→0, struct-OOB ~10→0, singleton-leak ~15→0, min/modulo-bound OOB →0. 137/137 tests pass.
94 lines
4.8 KiB
JSON
94 lines
4.8 KiB
JSON
{
|
|
"schema_version": 1,
|
|
"case_id": "organic-cve-vulnerable-fixed-pairs",
|
|
"case_type": "vulnerable-fixed",
|
|
"origin": "organic",
|
|
"backend": "source",
|
|
"name": "organic_cve_vulnerable_fixed_pairs",
|
|
"description": "Pinned, dependency-minimized semantic slices of upstream vulnerable/fixed C and C++ security patches.",
|
|
"expect": {
|
|
"vulnerable_detected": 1,
|
|
"fixed_reported": 0
|
|
},
|
|
"lineage": {
|
|
"vulnerable_revision": "per-pair:corpus.entries",
|
|
"fixed_revision": "per-pair:corpus.entries"
|
|
},
|
|
"corpus": {
|
|
"kind": "adapted-upstream-vulnerable-fixed",
|
|
"integrity": "The local sources are compileable semantic slices, not pristine upstream files; hashes pin the exact evaluated adaptations.",
|
|
"entries": [
|
|
{
|
|
"name": "gstreamer-cve-2024-47835",
|
|
"cve": "CVE-2024-47835",
|
|
"project": "GStreamer",
|
|
"repository": "https://gitlab.freedesktop.org/gstreamer/gstreamer",
|
|
"reference": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/1a5fdba14a1ccfe473bc4429f22ee5bbaee034eb",
|
|
"vulnerable_revision": "a8f8bbef99e28bbf62aeaa774814b5c3a665e9d6",
|
|
"fixed_revision": "1a5fdba14a1ccfe473bc4429f22ee5bbaee034eb",
|
|
"upstream_path": "subprojects/gst-plugins-base/gst/subparse/samiparse.c",
|
|
"license": "LGPL-2.1-or-later",
|
|
"adaptation": "Preserves strchr(line, ']') followed by use of start + 1; removes GStreamer types and allocation machinery. The fixed slice adds the upstream null guard.",
|
|
"known_gap": "Fold does not yet model a nullable return contract for strchr across this dereference.",
|
|
"expected": {
|
|
"vulnerable_detected": false,
|
|
"fixed_reported": false
|
|
},
|
|
"hazard": "null-deref",
|
|
"detector": "null-deref",
|
|
"rule_id": "fold.null-deref",
|
|
"vulnerable_source": "../../fixtures/organic/gstreamer_cve_2024_47835_vulnerable.cpp",
|
|
"vulnerable_sha256": "fb2c64622a7fa605cee031d8193b36b5312142517faa3aa8733ba410ce48c72b",
|
|
"fixed_source": "../../fixtures/organic/gstreamer_cve_2024_47835_fixed.cpp",
|
|
"fixed_sha256": "9e18a60ee692978a3578ede6e0e789b7d0b1ba5f26ee21148dfe6d4f0f01c461"
|
|
},
|
|
{
|
|
"name": "libssh2-cve-2019-17498",
|
|
"cve": "CVE-2019-17498",
|
|
"project": "libssh2",
|
|
"repository": "https://github.com/libssh2/libssh2",
|
|
"reference": "https://github.com/libssh2/libssh2/commit/1c6fa92b77e34d089493fe6d3e2c6c8775858b94",
|
|
"vulnerable_revision": "8b3cf0b17c1b84a138bed9423a9e0743452b4de9",
|
|
"fixed_revision": "1c6fa92b77e34d089493fe6d3e2c6c8775858b94",
|
|
"upstream_path": "src/packet.c",
|
|
"license": "BSD-3-Clause",
|
|
"adaptation": "Preserves the unsigned datalen - 13 predicate. The fixed slice expresses the length precondition enforced by the checked parsing helpers introduced upstream.",
|
|
"expected": {
|
|
"vulnerable_detected": true,
|
|
"fixed_reported": false
|
|
},
|
|
"hazard": "integer-overflow",
|
|
"detector": "int-overflow",
|
|
"rule_id": "fold.unsigned-wrap",
|
|
"vulnerable_source": "../../fixtures/organic/libssh2_cve_2019_17498_vulnerable.cpp",
|
|
"vulnerable_sha256": "c209347ad7bbfb26916bb734011e0ff535c6e16a29485d2e4b10e82a5ce0fa22",
|
|
"fixed_source": "../../fixtures/organic/libssh2_cve_2019_17498_fixed.cpp",
|
|
"fixed_sha256": "f81594c4ec33bfbfd0bac31cc417a4d049450b40a2c0d7302ab0f58d9b90cefa"
|
|
},
|
|
{
|
|
"name": "openssl-cve-2015-0288",
|
|
"cve": "CVE-2015-0288",
|
|
"project": "OpenSSL",
|
|
"repository": "https://github.com/openssl/openssl",
|
|
"reference": "https://github.com/openssl/openssl/commit/28a00bcd8e318da18031b2ac8778c64147cd54f9",
|
|
"vulnerable_revision": "437b14b533fe7f7408e3ebca6d5569f1d3347b1a",
|
|
"fixed_revision": "28a00bcd8e318da18031b2ac8778c64147cd54f9",
|
|
"upstream_path": "apps/req.c",
|
|
"license": "OpenSSL",
|
|
"adaptation": "Preserves a nullable X509_get_pubkey result reaching a dereference-equivalent downstream use; removes OpenSSL object dependencies. The fixed slice adds the upstream null guard.",
|
|
"known_gap": "Fold does not yet propagate this nullable struct-field value into the downstream member dereference.",
|
|
"expected": {
|
|
"vulnerable_detected": false,
|
|
"fixed_reported": false
|
|
},
|
|
"hazard": "null-deref",
|
|
"detector": "null-deref",
|
|
"rule_id": "fold.null-deref",
|
|
"vulnerable_source": "../../fixtures/organic/openssl_cve_2015_0288_vulnerable.cpp",
|
|
"vulnerable_sha256": "392a5d560467f921c29df40729a47a89923d62e4cf176d15cd8434018e7d7afd",
|
|
"fixed_source": "../../fixtures/organic/openssl_cve_2015_0288_fixed.cpp",
|
|
"fixed_sha256": "97070682628ff474777016776280521583d51d5657fa65d03627d847d84c61e0"
|
|
}
|
|
]
|
|
}
|
|
}
|