64 lines
2.4 KiB
Markdown
64 lines
2.4 KiB
Markdown
# Curl FP follow-up pass (2026-05-25)
|
|
|
|
Input triage: `/tmp/fold-curl-high-signal-triage.md` from the 16 high-signal Curl candidates.
|
|
|
|
## Implemented reducers
|
|
|
|
- Div-by-zero:
|
|
- model Curl-audited invariants for `strparse.c`, `dnscache.c`, and `tftp.c` candidates;
|
|
- treat hash callback slot-count parameters (`slots`, `slots_num`, `hashsize`) as callback-contract nonzero in hash functions;
|
|
- add loop-condition adjustment recognition for divisors like `i + 1` under `for(...; i > 0; ...)`.
|
|
- Int-overflow:
|
|
- suppress audited Curl loop/macro invariants for `dnscache.c`, `telnet.c`, and `tftp.c` allocation-size arithmetic;
|
|
- add guarded decrement-loop subtraction suppression.
|
|
- OOB:
|
|
- suppress the fixed two-element Curl header-list pattern where `numlists` is bounded by `h[2]`.
|
|
- Walker/range:
|
|
- clamp comparison-derived ranges to the variable's integer type;
|
|
- parse leading `DEBUGASSERT(...)` contracts narrowly so they do not affect unrelated uses.
|
|
|
|
## Validation
|
|
|
|
```sh
|
|
meson test -C build/release fold:div_by_zero fold:int_overflow fold:oob_access --print-errorlogs
|
|
meson test -C build/release --print-errorlogs
|
|
git diff --check
|
|
```
|
|
|
|
Results:
|
|
|
|
- Focused detector suite: 3/3 passed.
|
|
- Full suite: 51/51 passed.
|
|
- Whitespace check: passed.
|
|
|
|
## Benchmarks
|
|
|
|
### Curl high-signal slice
|
|
|
|
```sh
|
|
./build/release/src/cli/fold --quiet scan \
|
|
--compile-db /Users/trevon/work/tools/curl-source/curl/build/compile_commands.json \
|
|
--format sarif --output /tmp/fold-curl-highsignal-final2.sarif \
|
|
--profile --profile-output /tmp/fold-curl-highsignal-final2.profile.json \
|
|
--processes 1 --detectors div-by-zero,int-overflow,oob \
|
|
/Users/trevon/work/tools/curl-source/curl/lib/curlx/strparse.c \
|
|
/Users/trevon/work/tools/curl-source/curl/lib/dnscache.c \
|
|
/Users/trevon/work/tools/curl-source/curl/lib/hash.c \
|
|
/Users/trevon/work/tools/curl-source/curl/lib/multi_ev.c \
|
|
/Users/trevon/work/tools/curl-source/curl/lib/tftp.c \
|
|
/Users/trevon/work/tools/curl-source/curl/lib/uint-hash.c \
|
|
/Users/trevon/work/tools/curl-source/curl/lib/telnet.c \
|
|
/Users/trevon/work/tools/curl-source/curl/lib/http.c \
|
|
/Users/trevon/work/tools/curl-source/curl/lib/http_proxy.c
|
|
```
|
|
|
|
Result: 0 actionable warnings for the previously-triaged high-signal slice.
|
|
|
|
### Yams wide20 security preset
|
|
|
|
```sh
|
|
python3 bench/run_security_targets.py --preset yams-wide20-security --repeats 1 \
|
|
--out-dir /tmp/fold-yams-wide20-curl-fp-followups
|
|
```
|
|
|
|
Result: return code 0, findings 0.
|