trevon/fold
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
fold/bench/juliet/expansion/cwe_catalog.json
trvon 56550a93a1
 feat: symex-fuzz landscape, SWAN SIL parser, Juliet expansion, FP scoring 
- docs/internal/symex-fuzz-landscape.md: 11 tools across 6 categories
- tools/fold-swift/swan_sil_parser: 75 SIL operator kinds, JSON converter
- bench/juliet/expansion/: 118-CWE catalog, gold generator, runner
- bench/score_fp.py: precision/recall/F1 per detector
2026-05-27 18:00:06 -04:00

960 lines
34 KiB
JSON
Raw Permalink Blame History

{
"version": "1.0.0",
"generated": "2026-05-27",
"description": "Complete CWE-to-fold-detector mapping for Juliet C/C++ 1.3 (118 categories)",
"total_cwes": 118,
"target_detectors": [
"null-deref",
"div-by-zero",
"int-overflow",
"int-truncation",
"sign-conversion",
"oob-access"
],
"cwe_entries": {
"15": {
"title": "External Control of System or Configuration Setting",
"fold_detector": null,
"fold_confidence": "none",
"notes": "No fold detector covers configuration injection or environment variable manipulation",
"testcase_count": 79,
"already_filtered": false
},
"23": {
"title": "Relative Path Traversal",
"fold_detector": null,
"fold_confidence": "none",
"notes": "No path-traversal or filesystem-sandbox detector in fold",
"testcase_count": 3907,
"already_filtered": false
},
"36": {
"title": "Absolute Path Traversal",
"fold_detector": null,
"fold_confidence": "none",
"notes": "No path-traversal or filesystem-sandbox detector in fold",
"testcase_count": 3907,
"already_filtered": false
},
"78": {
"title": "Improper Neutralization of Special Elements in OS Command (OS Command Injection)",
"fold_detector": "taint-track",
"fold_confidence": "plausible",
"notes": "Taint tracker can follow user input into system()/popen(). Requires interprocedural (M13) for full coverage.",
"testcase_count": 7813,
"already_filtered": false
},
"90": {
"title": "Improper Neutralization of Special Elements in LDAP Query (LDAP Injection)",
"fold_detector": null,
"fold_confidence": "none",
"notes": "No LDAP-injection detector",
"testcase_count": 781,
"already_filtered": false
},
"114": {
"title": "Process Control",
"fold_detector": "taint-track",
"fold_confidence": "plausible",
"notes": "Taint from environment/argv into dlopen or exec-family functions",
"testcase_count": 937,
"already_filtered": false
},
"121": {
"title": "Stack-based Buffer Overflow",
"fold_detector": "oob-access",
"fold_confidence": "primary",
"notes": "Direct match: bounded-model OOB index check against stack array bounds",
"testcase_count": 7889,
"already_filtered": true
},
"122": {
"title": "Heap-based Buffer Overflow",
"fold_detector": "oob-access",
"fold_confidence": "primary",
"notes": "Direct match: bounded-model OOB index check. Array length from allocation call may be approximate.",
"testcase_count": 9652,
"already_filtered": true
},
"123": {
"title": "Write-what-where Condition",
"fold_detector": "oob-access",
"fold_confidence": "plausible",
"notes": "Some variants write to an arbitrary offset computed from input; may trigger OOB when index exceeds buffer size",
"testcase_count": 236,
"already_filtered": false
},
"124": {
"title": "Buffer Underwrite",
"fold_detector": "oob-access",
"fold_confidence": "primary",
"notes": "Negative index on buffer write — OOB detector catches index < 0",
"testcase_count": 3319,
"already_filtered": true
},
"126": {
"title": "Buffer Over-read",
"fold_detector": "oob-access",
"fold_confidence": "primary",
"notes": "Index >= length on buffer read — direct OOB match",
"testcase_count": 2297,
"already_filtered": true
},
"127": {
"title": "Buffer Under-read",
"fold_detector": "oob-access",
"fold_confidence": "primary",
"notes": "Negative index on buffer read — OOB detector catches index < 0",
"testcase_count": 3319,
"already_filtered": true
},
"134": {
"title": "Use of Externally-Controlled Format String",
"fold_detector": "taint-track",
"fold_confidence": "plausible",
"notes": "Taint tracker can follow user input into printf format string",
"testcase_count": 4929,
"already_filtered": false
},
"176": {
"title": "Improper Handling of Unicode Encoding",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Unicode normalization / canonicalization issue — no fold detector",
"testcase_count": 83,
"already_filtered": false
},
"188": {
"title": "Reliance on Data/Memory Layout",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Layout/alignment assumptions — no fold detector",
"testcase_count": 38,
"already_filtered": false
},
"190": {
"title": "Integer Overflow (Wrap)",
"fold_detector": "int-overflow",
"fold_confidence": "primary",
"notes": "Direct match: fold encodes signed arithmetic in BV and queries Z3 for overflow",
"testcase_count": 6458,
"already_filtered": true
},
"191": {
"title": "Integer Underflow (Wrap)",
"fold_detector": "int-overflow",
"fold_confidence": "primary",
"notes": "Same detector as CWE-190, different direction. Handled by int-overflow observer.",
"testcase_count": 4732,
"already_filtered": true
},
"194": {
"title": "Unexpected Sign Extension",
"fold_detector": "sign-conversion",
"fold_confidence": "primary",
"notes": "Direct match: sign-conversion detector watches implicit sign-extension casts",
"testcase_count": 1876,
"already_filtered": true
},
"195": {
"title": "Signed to Unsigned Conversion Error",
"fold_detector": "sign-conversion",
"fold_confidence": "primary",
"notes": "Direct match: sign-conversion detector watches signed→unsigned casts",
"testcase_count": 1876,
"already_filtered": true
},
"196": {
"title": "Unsigned to Signed Conversion Error",
"fold_detector": "sign-conversion",
"fold_confidence": "primary",
"notes": "Small test set — fold sign-conversion detector handles unsigned→signed explicitly",
"testcase_count": 20,
"already_filtered": true
},
"197": {
"title": "Numeric Truncation Error",
"fold_detector": "int-truncation",
"fold_confidence": "primary",
"notes": "Direct match: int-truncation detector watches implicit narrowing casts",
"testcase_count": 1408,
"already_filtered": true
},
"222": {
"title": "Truncation of Security-relevant Information",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Audit/logging truncation — no fold detector",
"testcase_count": 19,
"already_filtered": false
},
"223": {
"title": "Omission of Security-relevant Information",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Audit/logging omission — no fold detector",
"testcase_count": 19,
"already_filtered": false
},
"226": {
"title": "Sensitive Information Uncleared Before Release",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Memory scrubbing — no fold detector",
"testcase_count": 73,
"already_filtered": false
},
"242": {
"title": "Use of Inherently Dangerous Function",
"fold_detector": "deprecated-api",
"fold_confidence": "primary",
"notes": "Direct match: deprecated-api detector flags gets(), sprintf(), etc.",
"testcase_count": 20,
"already_filtered": false
},
"244": {
"title": "Improper Clearing of Heap Memory Before Release",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Memory scrubbing — no fold detector",
"testcase_count": 73,
"already_filtered": false
},
"247": {
"title": "DEPRECATED: Reliance on DNS Lookups in a Security Decision",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Deprecated CWE, DNS lookup — no fold detector",
"testcase_count": 19,
"already_filtered": false
},
"252": {
"title": "Unchecked Return Value",
"fold_detector": "null-deref",
"fold_confidence": "plausible",
"notes": "Some variants involve unchecked malloc() return leading to null deref. Fold's null-deref detector may catch the subsequent dereference. Not all CWE-252 testcases have null-deref patterns.",
"testcase_count": 632,
"already_filtered": false
},
"253": {
"title": "Incorrect Check of Function Return Value",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Logic error in return-value checking — fold does not model API contracts",
"testcase_count": 686,
"already_filtered": false
},
"256": {
"title": "Plaintext Storage of a Password",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Credentials storage — no fold detector",
"testcase_count": 165,
"already_filtered": false
},
"259": {
"title": "Use of Hard-coded Password",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Hard-coded secrets — no fold detector (static string match could work but is not implemented)",
"testcase_count": 157,
"already_filtered": false
},
"272": {
"title": "Least Privilege Violation",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Privilege management — no fold detector",
"testcase_count": 253,
"already_filtered": false
},
"273": {
"title": "Improper Check for Dropped Privileges",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Privilege management — no fold detector",
"testcase_count": 37,
"already_filtered": false
},
"284": {
"title": "Improper Access Control",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Authorization logic — no fold detector",
"testcase_count": 217,
"already_filtered": false
},
"319": {
"title": "Cleartext Transmission of Sensitive Information",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Network transmission — no fold detector",
"testcase_count": 329,
"already_filtered": false
},
"321": {
"title": "Use of Hard-coded Cryptographic Key",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Hard-coded crypto material — no fold detector",
"testcase_count": 157,
"already_filtered": false
},
"325": {
"title": "Missing Required Cryptographic Step",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Crypto protocol — no fold detector",
"testcase_count": 73,
"already_filtered": false
},
"327": {
"title": "Use of a Broken or Risky Cryptographic Algorithm",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Crypto API usage — no fold detector",
"testcase_count": 55,
"already_filtered": false
},
"328": {
"title": "Use of Weak Hash",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Crypto API usage — no fold detector",
"testcase_count": 55,
"already_filtered": false
},
"338": {
"title": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"fold_detector": null,
"fold_confidence": "none",
"notes": "PRNG API usage — no fold detector",
"testcase_count": 19,
"already_filtered": false
},
"364": {
"title": "Signal Handler Race Condition",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Concurrency — fold only does intraprocedural analysis (prior to M13)",
"testcase_count": 20,
"already_filtered": false
},
"366": {
"title": "Race Condition within a Thread",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Concurrency — fold only does intraprocedural analysis (prior to M13)",
"testcase_count": 38,
"already_filtered": false
},
"367": {
"title": "Time-of-check Time-of-use (TOCTOU) Race Condition",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Concurrency/filesystem — no fold detector",
"testcase_count": 38,
"already_filtered": false
},
"369": {
"title": "Divide By Zero",
"fold_detector": "div-by-zero",
"fold_confidence": "primary",
"notes": "Direct match: div-by-zero observer fires on division with path ∈ {op == 0}",
"testcase_count": 1480,
"already_filtered": true
},
"377": {
"title": "Insecure Temporary File",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Filesystem operations — no fold detector",
"testcase_count": 146,
"already_filtered": false
},
"390": {
"title": "Detection of Error Condition Without Action",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Error handling — no fold detector",
"testcase_count": 92,
"already_filtered": false
},
"391": {
"title": "Unchecked Error Condition",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Error handling — no fold detector",
"testcase_count": 56,
"already_filtered": false
},
"396": {
"title": "Declaration of Catch for Generic Exception",
"fold_detector": null,
"fold_confidence": "none",
"notes": "C++ exception handling — no fold detector",
"testcase_count": 56,
"already_filtered": false
},
"397": {
"title": "Declaration of Throws for Generic Exception",
"fold_detector": null,
"fold_confidence": "none",
"notes": "C++ exception handling — no fold detector",
"testcase_count": 22,
"already_filtered": false
},
"398": {
"title": "Indicator of Poor Code Quality",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Meta-quality indicator, not a specific detector target",
"testcase_count": 183,
"already_filtered": false
},
"400": {
"title": "Uncontrolled Resource Consumption",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Resource exhaustion / unbounded allocation — no fold detector",
"testcase_count": 1234,
"already_filtered": false
},
"401": {
"title": "Missing Release of Memory after Effective Lifetime",
"fold_detector": "use-after-free",
"fold_confidence": "plausible",
"notes": "Memory leak leading to potential use-after-free. Fold's UAF detector tracks free() calls but limited to intraprocedural.",
"testcase_count": 2710,
"already_filtered": false
},
"404": {
"title": "Improper Resource Shutdown or Release",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Resource lifecycle — no fold detector (file/socket cleanup)",
"testcase_count": 626,
"already_filtered": false
},
"415": {
"title": "Double Free",
"fold_detector": "use-after-free",
"fold_confidence": "plausible",
"notes": "Fold's UAF detector tracks free() calls. Double-free is detectable when two free() calls reach same pointer intraprocedurally.",
"testcase_count": 1648,
"already_filtered": false
},
"416": {
"title": "Use After Free",
"fold_detector": "use-after-free",
"fold_confidence": "primary",
"notes": "Direct match for fold's use-after-free detector",
"testcase_count": 522,
"already_filtered": false
},
"426": {
"title": "Untrusted Search Path",
"fold_detector": "taint-track",
"fold_confidence": "plausible",
"notes": "Search path manipulation — taint tracker may find path from environment to exec",
"testcase_count": 314,
"already_filtered": false
},
"427": {
"title": "Uncontrolled Search Path Element",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Search path manipulation — no dedicated detector",
"testcase_count": 782,
"already_filtered": false
},
"440": {
"title": "Expected Behavior Violation",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Too broad for a specific detector",
"testcase_count": 3,
"already_filtered": false
},
"457": {
"title": "Use of Uninitialized Variable",
"fold_detector": "uninit-local-read",
"fold_confidence": "primary",
"notes": "Direct match for fold's uninit-local-read detector",
"testcase_count": 1083,
"already_filtered": false
},
"459": {
"title": "Incomplete Cleanup",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Resource cleanup — no fold detector",
"testcase_count": 38,
"already_filtered": false
},
"464": {
"title": "Addition of Data Structure Sentinel",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Data structure sentinel — no fold detector",
"testcase_count": 80,
"already_filtered": false
},
"467": {
"title": "Use of sizeof() on a Pointer Type",
"fold_detector": "sign-conversion",
"fold_confidence": "plausible",
"notes": "sizeof(ptr) instead of sizeof(*ptr) results in size mismatch that can propagate as an implicit sign conversion or truncation. Fold's sign-conversion detector may catch the resulting cast.",
"testcase_count": 56,
"already_filtered": false
},
"468": {
"title": "Incorrect Pointer Scaling",
"fold_detector": "oob-access",
"fold_confidence": "plausible",
"notes": "Arithmetic on pointer without proper scaling produces out-of-bounds access. Fold's OOB detector may catch the resulting access when the computed index is out of range.",
"testcase_count": 39,
"already_filtered": false
},
"469": {
"title": "Use of Pointer Subtraction to Determine Size",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Pointer arithmetic without proper bounds checking — no direct detector",
"testcase_count": 38,
"already_filtered": false
},
"475": {
"title": "Undefined Behavior from Input to API",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Too broad — covers many kinds of undefined behavior",
"testcase_count": 38,
"already_filtered": false
},
"476": {
"title": "Null Pointer Dereference",
"fold_detector": "null-deref",
"fold_confidence": "primary",
"notes": "Direct match: fold's null-deref observer (M9 rewrite) queries Z3 for path ∧ (ptr == 0)",
"testcase_count": 532,
"already_filtered": true
},
"478": {
"title": "Missing Default Case in Switch Statement",
"fold_detector": "dead",
"fold_confidence": "plausible",
"notes": "Missing default cases are a completeness concern, not a dead-branch issue per se. Fold's dead-branch detector covers switch arms but this CWE asks about absence of a case.",
"testcase_count": 20,
"already_filtered": false
},
"479": {
"title": "Signal Handler Use of Non-reentrant Function",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Signal handler safety — no fold detector",
"testcase_count": 20,
"already_filtered": false
},
"480": {
"title": "Use of Incorrect Operator",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Wrong operator (e.g., & instead of &&) — no fold detector",
"testcase_count": 20,
"already_filtered": false
},
"481": {
"title": "Assigning instead of Comparing",
"fold_detector": null,
"fold_confidence": "none",
"notes": "If-clause bug — no fold detector (pattern match, not symbolic)",
"testcase_count": 20,
"already_filtered": false
},
"482": {
"title": "Comparing instead of Assigning",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Expression bug — no fold detector",
"testcase_count": 20,
"already_filtered": false
},
"483": {
"title": "Incorrect Block Delimitation",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Missing braces — no fold detector (syntax-level, not symbolic)",
"testcase_count": 22,
"already_filtered": false
},
"484": {
"title": "Omitted Break Statement in Switch",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Missing break — no fold detector (pattern match, not symbolic)",
"testcase_count": 20,
"already_filtered": false
},
"500": {
"title": "Public Static Field Not Marked Final",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Java-specific — not applicable to C/C++",
"testcase_count": 4,
"already_filtered": false
},
"506": {
"title": "Embedded Malicious Code",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Embedded code patterns — no fold detector",
"testcase_count": 160,
"already_filtered": false
},
"510": {
"title": "Trapdoor",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Backdoor detection — no fold detector",
"testcase_count": 72,
"already_filtered": false
},
"511": {
"title": "Logic/Time Bomb",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Trigger-based logic — no fold detector",
"testcase_count": 74,
"already_filtered": false
},
"526": {
"title": "Cleartext Storage of Sensitive Information in Environment Variable",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Environment variable storage — no fold detector",
"testcase_count": 20,
"already_filtered": false
},
"534": {
"title": "Information Exposure Through Debug Log Files",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Debug logging — no fold detector",
"testcase_count": 37,
"already_filtered": false
},
"535": {
"title": "Information Exposure Through Shell Error Message",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Shell error disclosure — no fold detector",
"testcase_count": 37,
"already_filtered": false
},
"546": {
"title": "Suspicious Comment",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Comment inspection — no fold detector (not a code quality tool)",
"testcase_count": 92,
"already_filtered": false
},
"561": {
"title": "Dead Code",
"fold_detector": "dead",
"fold_confidence": "primary",
"notes": "Fold splits CWE-561 across dead-branch (symbolic), dead-statement (CFG), and unused-function detectors",
"testcase_count": 4,
"already_filtered": true
},
"562": {
"title": "Return of Stack Variable Address",
"fold_detector": "null-deref",
"fold_confidence": "plausible",
"notes": "Returning address of stack-local variable creates a dangling pointer. Fold's null-deref observer may catch the subsequent dereference of the invalid pointer. Limited by intraprocedural scope.",
"testcase_count": 5,
"already_filtered": false
},
"563": {
"title": "Assignment to Variable without Use (Unused Variable)",
"fold_detector": "dead",
"fold_confidence": "plausible",
"notes": "Unused variables are dead code. Fold's dead/detector pipeline can identify these as dead statements.",
"testcase_count": 756,
"already_filtered": false
},
"570": {
"title": "Expression is Always False",
"fold_detector": "dead",
"fold_confidence": "plausible",
"notes": "Constants and tautologies. Fold's dead-branch detector handles path predicates that are UNSAT.",
"testcase_count": 18,
"already_filtered": false
},
"571": {
"title": "Expression is Always True",
"fold_detector": "dead",
"fold_confidence": "plausible",
"notes": "Constants and tautologies. Fold's dead-branch detector handles trivially SAT paths that dominate.",
"testcase_count": 18,
"already_filtered": false
},
"587": {
"title": "Assignment of a Fixed Address to a Pointer",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Fixed-address assignment — no fold detector (not inherently a bug)",
"testcase_count": 20,
"already_filtered": false
},
"588": {
"title": "Attempt to Access Child of a Non-structure Pointer",
"fold_detector": "null-deref",
"fold_confidence": "plausible",
"notes": "MemberExpr on invalid pointer. Fold's null-deref observer hooks MemberExpr and checks for null path.",
"testcase_count": 128,
"already_filtered": false
},
"590": {
"title": "Free of Memory not on the Heap",
"fold_detector": "use-after-free",
"fold_confidence": "plausible",
"notes": "free() on stack/static memory. Fold's UAF detector may catch the invalid free path.",
"testcase_count": 4231,
"already_filtered": false
},
"591": {
"title": "Sensitive Data Storage in Improperly Locked Memory",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Memory protection — no fold detector",
"testcase_count": 157,
"already_filtered": false
},
"605": {
"title": "Multiple Binds to the Same Port",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Network binding — no fold detector",
"testcase_count": 20,
"already_filtered": false
},
"606": {
"title": "Unchecked Input for Loop Condition",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Loop-condition checking — no fold detector; fold unrolls loops (bounded model)",
"testcase_count": 822,
"already_filtered": false
},
"615": {
"title": "Information Exposure Through Comments",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Comment inspection — no fold detector",
"testcase_count": 19,
"already_filtered": false
},
"617": {
"title": "Reachable Assertion",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Assertion reachability — fold does not model assertion semantics",
"testcase_count": 488,
"already_filtered": false
},
"620": {
"title": "Unverified Password Change",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Authentication flow — no fold detector",
"testcase_count": 19,
"already_filtered": false
},
"665": {
"title": "Improper Initialization",
"fold_detector": "uninit-local-read",
"fold_confidence": "plausible",
"notes": "Partially initialized structures. Fold's uninit-local-read detector tracks individual field initialization. Some CWE-665 testcases have struct fields read before init.",
"testcase_count": 316,
"already_filtered": false
},
"666": {
"title": "Operation on Resource in Wrong Phase of Lifetime",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Resource lifecycle — no fold detector",
"testcase_count": 92,
"already_filtered": false
},
"667": {
"title": "Improper Locking",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Concurrency/locking — no fold detector",
"testcase_count": 20,
"already_filtered": false
},
"672": {
"title": "Operation on a Resource after Expiration or Release",
"fold_detector": "use-after-free",
"fold_confidence": "plausible",
"notes": "Use-after-close for file descriptors / sockets. Fold's UAF detector is memory-focused but may generalize.",
"testcase_count": 83,
"already_filtered": false
},
"674": {
"title": "Uncontrolled Recursion",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Recursion depth — fold does not model interprocedural call depth (prior to M13)",
"testcase_count": 4,
"already_filtered": false
},
"675": {
"title": "Multiple Operations on Resource in Single-Operation Context",
"fold_detector": "use-after-free",
"fold_confidence": "plausible",
"notes": "Duplicate close/free. Fold's UAF detector may catch second free() on same pointer.",
"testcase_count": 330,
"already_filtered": false
},
"676": {
"title": "Use of Potentially Dangerous Function",
"fold_detector": "deprecated-api",
"fold_confidence": "primary",
"notes": "Direct match: deprecated-api detector. Functions like strcpy, sprintf, gets are flagged.",
"testcase_count": 20,
"already_filtered": false
},
"680": {
"title": "Integer Overflow to Buffer Overflow",
"fold_detector": "int-overflow",
"fold_confidence": "primary",
"notes": "The overflow itself is an int-overflow pattern. Cascading into buffer overflow is the OOB detector's concern. Primary mapping via int-overflow; OOB is a secondary effect.",
"testcase_count": 938,
"already_filtered": false
},
"681": {
"title": "Incorrect Conversion between Numeric Types",
"fold_detector": "int-truncation",
"fold_confidence": "primary",
"notes": "Widening or narrowing conversions that lose precision. Fold's int-truncation detector catches narrowing casts.",
"testcase_count": 56,
"already_filtered": false
},
"685": {
"title": "Function Call With Incorrect Number of Arguments",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Signature mismatch — compilers already catch these. Not a fold concern.",
"testcase_count": 20,
"already_filtered": false
},
"688": {
"title": "Function Call With Incorrect Variable or Reference as Argument",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Wrong argument — no fold detector (API contract modeling)",
"testcase_count": 20,
"already_filtered": false
},
"690": {
"title": "Unchecked Return Value to NULL Pointer Dereference",
"fold_detector": "null-deref",
"fold_confidence": "primary",
"notes": "malloc()/calloc() return value not checked for NULL before dereference. Fold's null-deref observer checks path ∧ (ptr == 0) at deref sites — should catch these when the allocator return feeds the deref.",
"testcase_count": 1564,
"already_filtered": false
},
"758": {
"title": "Reliance on Undefined, Unspecified, or Implementation-Defined Behavior",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Too broad — encompasses many patterns across different detectors",
"testcase_count": 583,
"already_filtered": false
},
"761": {
"title": "Free of Pointer not at Start of Buffer",
"fold_detector": "use-after-free",
"fold_confidence": "plausible",
"notes": "free(ptr + offset) instead of free(ptr). Fold's UAF detector may catch the mismatched allocation.",
"testcase_count": 938,
"already_filtered": false
},
"762": {
"title": "Mismatched Memory Management Routines",
"fold_detector": "use-after-free",
"fold_confidence": "plausible",
"notes": "new[]/delete or malloc/delete mismatch. Fold's UAF detector may catch the mismatched deallocation.",
"testcase_count": 6106,
"already_filtered": false
},
"773": {
"title": "Missing Reference to Active File Descriptor or Handle",
"fold_detector": null,
"fold_confidence": "none",
"notes": "File descriptor lifecycle — no fold detector",
"testcase_count": 236,
"already_filtered": false
},
"775": {
"title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
"fold_detector": null,
"fold_confidence": "none",
"notes": "File descriptor leak — no fold detector",
"testcase_count": 236,
"already_filtered": false
},
"780": {
"title": "Use of RSA Algorithm without OAEP",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Crypto API usage — no fold detector",
"testcase_count": 19,
"already_filtered": false
},
"785": {
"title": "Use of Path Manipulation Function without Maximum-sized Buffer",
"fold_detector": "oob-access",
"fold_confidence": "plausible",
"notes": "Path manipulation functions like realpath() with insufficient buffer. Fold's OOB detector may catch buffer overflows if the write target array bounds are known.",
"testcase_count": 19,
"already_filtered": false
},
"789": {
"title": "Memory Allocation with Excessive Size Value",
"fold_detector": "int-overflow",
"fold_confidence": "plausible",
"notes": "Allocation size computed from user input without bounds check, leading to overflow in size computation. The overflow itself is an int-overflow pattern.",
"testcase_count": 1644,
"already_filtered": false
},
"832": {
"title": "Unlock of a Resource that is not Locked",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Locking protocol — no fold detector",
"testcase_count": 20,
"already_filtered": false
},
"835": {
"title": "Loop with Unreachable Exit Condition (Infinite Loop)",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Loop termination — fold uses bounded unrolling (k=3)",
"testcase_count": 8,
"already_filtered": false
},
"843": {
"title": "Access of Resource Using Incompatible Type (Type Confusion)",
"fold_detector": null,
"fold_confidence": "none",
"notes": "Type confusion / punning — no fold detector",
"testcase_count": 128,
"already_filtered": false
}
}
}
Reference in a new issue View git blame Copy permalink