marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-21 14:09:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(real-world-vfc-slice): add labeled OpenSSL/Firefox/Chromium/curl pair corpus

Browse Source 
Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows)
into benchmarks/pairs/vfc with provenance and a JSONL training manifest.
Score the slice as an honesty dashboard (ousast pairs --slice vfc);
keep the pair gate on the local fixtures only.
This commit is contained in:
Marius Ciepluch
2026-09-04 16:45:38 +02:00
parent e9f185da59
commit 0116f9bea6
372 changed files with 49209 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
benchmarks/pairs/vfc/curl-cve-2021-22925/fixed.c
+91
View File
@@ -0,0 +1,91 @@
/* Provenance: curl/curl suboption (fixed).
* repo: curl/curl
* commit: 894f6ec730597eb243618d33cc84d71add8d6a8a
* parent: 12284e008bad5156b67d0ac253331a96d77201d1
* commit_url: https://github.com/curl/curl/commit/894f6ec730597eb243618d33cc84d71add8d6a8a
* cve: CVE-2021-22925
* license: curl
* function: suboption
* relpath: lib/telnet.c
*/
* suboption()
*
* Look at the sub-option buffer, and try to be helpful to the other
* side.
*/
static void suboption(struct Curl_easy *data)
{
struct curl_slist *v;
unsigned char temp[2048];
ssize_t bytes_written;
size_t len;
int err;
char varname[128] = "";
char varval[128] = "";
struct TELNET *tn = data->req.p.telnet;
struct connectdata *conn = data->conn;
printsub(data, '<', (unsigned char *)tn->subbuffer, CURL_SB_LEN(tn) + 2);
switch(CURL_SB_GET(tn)) {
case CURL_TELOPT_TTYPE:
len = strlen(tn->subopt_ttype) + 4 + 2;
msnprintf((char *)temp, sizeof(temp),
"%c%c%c%c%s%c%c", CURL_IAC, CURL_SB, CURL_TELOPT_TTYPE,
CURL_TELQUAL_IS, tn->subopt_ttype, CURL_IAC, CURL_SE);
bytes_written = swrite(conn->sock[FIRSTSOCKET], temp, len);
if(bytes_written < 0) {
err = SOCKERRNO;
failf(data,"Sending data failed (%d)",err);
}
printsub(data, '>', &temp[2], len-2);
break;
case CURL_TELOPT_XDISPLOC:
len = strlen(tn->subopt_xdisploc) + 4 + 2;
msnprintf((char *)temp, sizeof(temp),
"%c%c%c%c%s%c%c", CURL_IAC, CURL_SB, CURL_TELOPT_XDISPLOC,
CURL_TELQUAL_IS, tn->subopt_xdisploc, CURL_IAC, CURL_SE);
bytes_written = swrite(conn->sock[FIRSTSOCKET], temp, len);
if(bytes_written < 0) {
err = SOCKERRNO;
failf(data,"Sending data failed (%d)",err);
}
printsub(data, '>', &temp[2], len-2);
break;
case CURL_TELOPT_NEW_ENVIRON:
msnprintf((char *)temp, sizeof(temp),
"%c%c%c%c", CURL_IAC, CURL_SB, CURL_TELOPT_NEW_ENVIRON,
CURL_TELQUAL_IS);
len = 4;
for(v = tn->telnet_vars; v; v = v->next) {
size_t tmplen = (strlen(v->data) + 1);
/* Add the variable only if it fits */
if(len + tmplen < (int)sizeof(temp)-6) {
int rv;
char sep[2] = "";
varval[0] = 0;
rv = sscanf(v->data, "%127[^,]%1[,]%127s", varname, sep, varval);
if(rv == 1)
len += msnprintf((char *)&temp[len], sizeof(temp) - len,
"%c%s", CURL_NEW_ENV_VAR, varname);
else if(rv >= 2)
len += msnprintf((char *)&temp[len], sizeof(temp) - len,
"%c%s%c%s", CURL_NEW_ENV_VAR, varname,
CURL_NEW_ENV_VALUE, varval);
}
}
msnprintf((char *)&temp[len], sizeof(temp) - len,
"%c%c", CURL_IAC, CURL_SE);
len += 2;
bytes_written = swrite(conn->sock[FIRSTSOCKET], temp, len);
if(bytes_written < 0) {
err = SOCKERRNO;
failf(data,"Sending data failed (%d)",err);
}
printsub(data, '>', &temp[2], len-2);
break;
}
return;
}
benchmarks/pairs/vfc/curl-cve-2021-22925/vuln.c
+86
View File
@@ -0,0 +1,86 @@
/* Provenance: curl/curl suboption (vuln).
* repo: curl/curl
* commit: 12284e008bad5156b67d0ac253331a96d77201d1
* parent: 12284e008bad5156b67d0ac253331a96d77201d1
* commit_url: https://github.com/curl/curl/commit/894f6ec730597eb243618d33cc84d71add8d6a8a
* cve: CVE-2021-22925
* license: curl
* function: suboption
* relpath: lib/telnet.c
*/
* suboption()
*
* Look at the sub-option buffer, and try to be helpful to the other
* side.
*/
static void suboption(struct Curl_easy *data)
{
struct curl_slist *v;
unsigned char temp[2048];
ssize_t bytes_written;
size_t len;
int err;
char varname[128] = "";
char varval[128] = "";
struct TELNET *tn = data->req.p.telnet;
struct connectdata *conn = data->conn;
printsub(data, '<', (unsigned char *)tn->subbuffer, CURL_SB_LEN(tn) + 2);
switch(CURL_SB_GET(tn)) {
case CURL_TELOPT_TTYPE:
len = strlen(tn->subopt_ttype) + 4 + 2;
msnprintf((char *)temp, sizeof(temp),
"%c%c%c%c%s%c%c", CURL_IAC, CURL_SB, CURL_TELOPT_TTYPE,
CURL_TELQUAL_IS, tn->subopt_ttype, CURL_IAC, CURL_SE);
bytes_written = swrite(conn->sock[FIRSTSOCKET], temp, len);
if(bytes_written < 0) {
err = SOCKERRNO;
failf(data,"Sending data failed (%d)",err);
}
printsub(data, '>', &temp[2], len-2);
break;
case CURL_TELOPT_XDISPLOC:
len = strlen(tn->subopt_xdisploc) + 4 + 2;
msnprintf((char *)temp, sizeof(temp),
"%c%c%c%c%s%c%c", CURL_IAC, CURL_SB, CURL_TELOPT_XDISPLOC,
CURL_TELQUAL_IS, tn->subopt_xdisploc, CURL_IAC, CURL_SE);
bytes_written = swrite(conn->sock[FIRSTSOCKET], temp, len);
if(bytes_written < 0) {
err = SOCKERRNO;
failf(data,"Sending data failed (%d)",err);
}
printsub(data, '>', &temp[2], len-2);
break;
case CURL_TELOPT_NEW_ENVIRON:
msnprintf((char *)temp, sizeof(temp),
"%c%c%c%c", CURL_IAC, CURL_SB, CURL_TELOPT_NEW_ENVIRON,
CURL_TELQUAL_IS);
len = 4;
for(v = tn->telnet_vars; v; v = v->next) {
size_t tmplen = (strlen(v->data) + 1);
/* Add the variable only if it fits */
if(len + tmplen < (int)sizeof(temp)-6) {
if(sscanf(v->data, "%127[^,],%127s", varname, varval) == 2) {
msnprintf((char *)&temp[len], sizeof(temp) - len,
"%c%s%c%s", CURL_NEW_ENV_VAR, varname,
CURL_NEW_ENV_VALUE, varval);
len += tmplen;
}
}
}
msnprintf((char *)&temp[len], sizeof(temp) - len,
"%c%c", CURL_IAC, CURL_SE);
len += 2;
bytes_written = swrite(conn->sock[FIRSTSOCKET], temp, len);
if(bytes_written < 0) {
err = SOCKERRNO;
failf(data,"Sending data failed (%d)",err);
}
printsub(data, '>', &temp[2], len-2);
break;
}
return;
}