feat(real-world-vfc-slice): add labeled OpenSSL/Firefox/Chromium/curl pair corpus

Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows)
into benchmarks/pairs/vfc with provenance and a JSONL training manifest.
Score the slice as an honesty dashboard (ousast pairs --slice vfc);
keep the pair gate on the local fixtures only.

benchmarks/pairs/vfc/openssl-cve-2021-3711/fixed.c

@@ -0,0 +1,27 @@
+/* Provenance: openssl/openssl sm2_plaintext_size (fixed).
+ * repo: openssl/openssl
+ * commit: 59f5e75f3bced8fc0e130d72a3f582cf7b480b46
+ * parent: 8c74c9d1ade0fbdab5b815ddb747351b8b839641
+ * commit_url: https://github.com/openssl/openssl/commit/59f5e75f3bced8fc0e130d72a3f582cf7b480b46
+ * cve: CVE-2021-3711
+ * license: OpenSSL License
+ * function: sm2_plaintext_size
+ * relpath: crypto/sm2/sm2_crypt.c
+ */
+
+int sm2_plaintext_size(const unsigned char *ct, size_t ct_size, size_t *pt_size)
+{
+    struct SM2_Ciphertext_st *sm2_ctext = NULL;
+
+    sm2_ctext = d2i_SM2_Ciphertext(NULL, &ct, ct_size);
+
+    if (sm2_ctext == NULL) {
+        SM2err(SM2_F_SM2_PLAINTEXT_SIZE, SM2_R_INVALID_ENCODING);
+        return 0;
+    }
+
+    *pt_size = sm2_ctext->C2->length;
+    SM2_Ciphertext_free(sm2_ctext);
+
+    return 1;
+}

benchmarks/pairs/vfc/openssl-cve-2021-3711/vuln.c

@@ -0,0 +1,36 @@
+/* Provenance: openssl/openssl sm2_plaintext_size (vuln).
+ * repo: openssl/openssl
+ * commit: 8c74c9d1ade0fbdab5b815ddb747351b8b839641
+ * parent: 8c74c9d1ade0fbdab5b815ddb747351b8b839641
+ * commit_url: https://github.com/openssl/openssl/commit/59f5e75f3bced8fc0e130d72a3f582cf7b480b46
+ * cve: CVE-2021-3711
+ * license: OpenSSL License
+ * function: sm2_plaintext_size
+ * relpath: crypto/sm2/sm2_crypt.c
+ */
+
+int sm2_plaintext_size(const EC_KEY *key, const EVP_MD *digest, size_t msg_len,
+                       size_t *pt_size)
+{
+    const size_t field_size = ec_field_size(EC_KEY_get0_group(key));
+    const int md_size = EVP_MD_size(digest);
+    size_t overhead;
+
+    if (md_size < 0) {
+        SM2err(SM2_F_SM2_PLAINTEXT_SIZE, SM2_R_INVALID_DIGEST);
+        return 0;
+    }
+    if (field_size == 0) {
+        SM2err(SM2_F_SM2_PLAINTEXT_SIZE, SM2_R_INVALID_FIELD);
+        return 0;
+    }
+
+    overhead = 10 + 2 * field_size + (size_t)md_size;
+    if (msg_len <= overhead) {
+        SM2err(SM2_F_SM2_PLAINTEXT_SIZE, SM2_R_INVALID_ENCODING);
+        return 0;
+    }
+
+    *pt_size = msg_len - overhead;
+    return 1;
+}