fd4a68dfff
Unit + integration coverage for the session's work: incremental project graph/index, pcode encoder, unreachable/dead-branch, equiv/cross-TU, div-by-zero/sign-conversion/int-truncation, use-after-free, quality-precision, scan-router profile, source TU runner, detector plan, and the eval fixtures. |
||
|---|---|---|
| .. | ||
| clean.c | ||
| clean.elf | ||
| clean.findings.json | ||
| cwe121_bof.c | ||
| cwe121_bof.elf | ||
| cwe121_bof.findings.json | ||
| cwe190_overflow.c | ||
| cwe190_overflow.elf | ||
| cwe190_overflow.findings.json | ||
| cwe369_div0.c | ||
| cwe369_div0.elf | ||
| cwe416_uaf.c | ||
| cwe416_uaf.elf | ||
| cwe476_nullderef.c | ||
| cwe476_nullderef.elf | ||
| README.md | ||
Binary CWE testcase corpus
Small CWE-grounded binary fixtures for the binary-lane benchmark
(bench/score_binary.py). Each .c compiles to a stripped dynamic-glibc
x86-64 ELF (zig cc) so the sinks resolve via PLT imports — the shape the
P-Code security detectors key on.
| fixture | CWE | sink | expected finding |
|---|---|---|---|
cwe121_bof.c |
121 | strcpy into char[64] |
oob-access (stack BOF) |
cwe369_div0.c |
369 | 100 / d (argv-controlled) |
div-by-zero |
cwe190_overflow.c |
190 | a + INT_MAX (signed) |
int-overflow |
cwe476_nullderef.c |
476 | *p (possibly-null) |
null-deref |
cwe416_uaf.c |
416 | free(p); *p |
use-after-free |
clean.c |
— | bounded strncpy |
(clean negative) |
Regenerate (one-time, zig cc cross-compile)
cd tests/fixtures/binary/cwe
for c in cwe121_bof cwe369_div0 cwe190_overflow cwe476_nullderef cwe416_uaf clean; do
zig cc -target x86_64-linux-gnu -O0 -fno-stack-protector -s -o "$c.elf" "$c.c"
done
Score
python3 bench/score_binary.py --corpus tests/fixtures/binary/cwe \
--gold bench/gold/binary-security.json
NOTE: the fixtures are built at -O0 (the canonical recipe above) — the P-Code
div-by-zero and buffer-overflow detectors are exercised at -O0, and the
-O0 stack-spill is recovered by the raw-stream buffer-size recovery. clean.elf
(bounded strncpy) scores 0 findings as the clean negative; the earlier
clean.elf-hang note was resolved by bounding the ROP-synthesis gadget budget
(docs/research/vexa-binary-deobfuscation.md §17).