feat(real-world-vfc-slice): add labeled OpenSSL/Firefox/Chromium/curl pair corpus

Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows) into benchmarks/pairs/vfc with provenance and a JSONL training manifest. Score the slice as an honesty dashboard (ousast pairs --slice vfc); keep the pair gate on the local fixtures only.
2026-10-20 21:49:28 +00:00 · 2026-09-04 16:45:38 +02:00
parent e9f185da59
commit 0116f9bea6
372 changed files with 49209 additions and 49 deletions
@@ -0,0 +1,55 @@
+/* Provenance: openssl/openssl buf2hexstr_sep (fixed).
+ * repo: openssl/openssl
+ * commit: a91e537d16d74050dbde50bb0dfb1fe9930f0521
+ * parent: b7ae7a093997b5cd549bc21cccd715510fef86c0
+ * commit_url: https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521
+ * cve: CVE-2026-31789
+ * license: Apache-2.0
+ * function: buf2hexstr_sep
+ * relpath: crypto/o_str.c
+ */
+
+static int buf2hexstr_sep(char *str, size_t str_n, size_t *strlength,
+    const unsigned char *buf, size_t buflen,
+    const char sep)
+{
+    static const char hexdig[] = "0123456789ABCDEF";
+    const unsigned char *p;
+    char *q;
+    size_t i;
+    int has_sep = (sep != CH_ZERO);
+    size_t len = has_sep ? buflen * 3 : 1 + buflen * 2;
+
+    if (buflen > (has_sep ? SIZE_MAX / 3 : (SIZE_MAX - 1) / 2)) {
+        ERR_raise(ERR_LIB_CRYPTO, CRYPTO_R_TOO_MANY_BYTES);
+        return 0;
+    }
+
+    if (len == 0)
+        ++len;
+    if (strlength != NULL)
+        *strlength = len;
+    if (str == NULL)
+        return 1;
+
+    if (str_n < len) {
+        ERR_raise(ERR_LIB_CRYPTO, CRYPTO_R_TOO_SMALL_BUFFER);
+        return 0;
+    }
+
+    q = str;
+    for (i = 0, p = buf; i < buflen; i++, p++) {
+        *q++ = hexdig[(*p >> 4) & 0xf];
+        *q++ = hexdig[*p & 0xf];
+        if (has_sep)
+            *q++ = sep;
+    }
+    if (has_sep && buflen > 0)
+        --q;
+    *q = CH_ZERO;
+
+#ifdef CHARSET_EBCDIC
+    ebcdic2ascii(str, str, q - str);
+#endif
+    return 1;
+}
@@ -0,0 +1,50 @@
+/* Provenance: openssl/openssl buf2hexstr_sep (vuln).
+ * repo: openssl/openssl
+ * commit: b7ae7a093997b5cd549bc21cccd715510fef86c0
+ * parent: b7ae7a093997b5cd549bc21cccd715510fef86c0
+ * commit_url: https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521
+ * cve: CVE-2026-31789
+ * license: Apache-2.0
+ * function: buf2hexstr_sep
+ * relpath: crypto/o_str.c
+ */
+
+static int buf2hexstr_sep(char *str, size_t str_n, size_t *strlength,
+    const unsigned char *buf, size_t buflen,
+    const char sep)
+{
+    static const char hexdig[] = "0123456789ABCDEF";
+    const unsigned char *p;
+    char *q;
+    size_t i;
+    int has_sep = (sep != CH_ZERO);
+    size_t len = has_sep ? buflen * 3 : 1 + buflen * 2;
+
+    if (len == 0)
+        ++len;
+    if (strlength != NULL)
+        *strlength = len;
+    if (str == NULL)
+        return 1;
+
+    if (str_n < len) {
+        ERR_raise(ERR_LIB_CRYPTO, CRYPTO_R_TOO_SMALL_BUFFER);
+        return 0;
+    }
+
+    q = str;
+    for (i = 0, p = buf; i < buflen; i++, p++) {
+        *q++ = hexdig[(*p >> 4) & 0xf];
+        *q++ = hexdig[*p & 0xf];
+        if (has_sep)
+            *q++ = sep;
+    }
+    if (has_sep && buflen > 0)
+        --q;
+    *q = CH_ZERO;
+
+#ifdef CHARSET_EBCDIC
+    ebcdic2ascii(str, str, q - str);
+#endif
+    return 1;
+}