a27c3366d8
std::string/std::string_view size()/length() was cached only in the member cache, which assign() clears. So `char* p = malloc(s.size()+1); ...; p[s.size()]` encoded the two size() calls as DIFFERENT symbols, letting the solver find a spurious out-of-bounds (yams object_storage_adapter.cpp dup_cstr, plugin_host_services_shim). Route zero-arg const size()/length() through the assignment-surviving string-length cache (string_lengths_), so both calls resolve to one length symbol: the final write lands exactly at the end (in-bounds), while a genuine size()+1 write still fires. Adds positive/negative oob tests; full suite 137/137.
50 lines
1.3 KiB
JSON
50 lines
1.3 KiB
JSON
{
|
|
"schema_version": 2,
|
|
"new_file_max_lines": 1000,
|
|
"tracked_monoliths": [
|
|
{
|
|
"path": "src/detect/int_overflow.cpp",
|
|
"max_lines": 1100,
|
|
"target_lines": 1000
|
|
},
|
|
{
|
|
"path": "src/detect/oob_access.cpp",
|
|
"max_lines": 1100,
|
|
"target_lines": 1000
|
|
},
|
|
{
|
|
"path": "src/detect/int_overflow_analysis.cpp",
|
|
"max_lines": 1100,
|
|
"target_lines": 1000,
|
|
"next_extraction": "container-bounded callee-arithmetic helpers"
|
|
},
|
|
{
|
|
"path": "src/detect/null_deref.cpp",
|
|
"max_lines": 1100,
|
|
"target_lines": 1000,
|
|
"next_extraction": "shouldQuery alias-resolution chain"
|
|
},
|
|
{
|
|
"path": "src/symbolic/encoder_foundation.cpp",
|
|
"max_lines": 1100,
|
|
"target_lines": 1000,
|
|
"next_extraction": "identity-key + member-cache helpers"
|
|
}
|
|
],
|
|
"architecture": {
|
|
"forbidden_patterns": [
|
|
{
|
|
"name": "direct shell subprocess outside approved compatibility boundaries",
|
|
"regex": "\\b(popen|system)\\s*\\(",
|
|
"paths": ["src/**", "include/fold/**"],
|
|
"allow": ["src/frontend/comp_db.cpp"]
|
|
},
|
|
{
|
|
"name": "direct sh -c outside the radare2 session adapter",
|
|
"regex": "\"/bin/sh\", \"sh\", \"-c\"",
|
|
"paths": ["src/**", "include/fold/**"],
|
|
"allow": ["src/binary/r2_session.cpp"]
|
|
}
|
|
]
|
|
}
|
|
}
|