feat(real-world-vfc-slice): add labeled OpenSSL/Firefox/Chromium/curl pair corpus

Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows) into benchmarks/pairs/vfc with provenance and a JSONL training manifest. Score the slice as an honesty dashboard (ousast pairs --slice vfc); keep the pair gate on the local fixtures only.
2026-10-20 21:49:28 +00:00 · 2026-09-04 16:45:38 +02:00
parent e9f185da59
commit 0116f9bea6
372 changed files with 49209 additions and 49 deletions
@@ -0,0 +1,55 @@
+/* Provenance: openssl/openssl validate_hostname_part (fixed).
+ * repo: openssl/openssl
+ * commit: b3a555a0a7aa0028887149f6f973af89a4937bea
+ * parent: 0f3fab2eccc7c3417093a8243dd15d95b6cb472d
+ * commit_url: https://github.com/openssl/openssl/commit/b3a555a0a7aa0028887149f6f973af89a4937bea
+ * cve: CVE-2026-42771
+ * license: Apache-2.0
+ * function: validate_hostname_part
+ * relpath: crypto/x509/x509_vpm.c
+ */
+
+static int validate_hostname_part(const char *name, size_t len,
+    ossl_charset_t charset)
+{
+    size_t i, part_len;
+    char c, prev;
+
+    if (len < 2 || len > 256)
+        return 0;
+
+    part_len = 0;
+    prev = '\0';
+    for (i = 0; i < len; i++) {
+        c = name[i];
+        if (c == '.') {
+            /*
+             * Can not start a label with a .
+             * unless it is the very first character.
+             */
+            if (part_len == 0 && i != 0)
+                return 0;
+            /* Can not end a label with a - */
+            if (prev == '-')
+                return 0;
+            part_len = 0;
+        } else {
+            /* Can not start a label with a - */
+            if (part_len == 0 && c == '-') {
+                return 0;
+            }
+            if (!is_label_ok(c, charset) && c != '-')
+                return 0;
+            part_len++;
+        }
+        if (part_len > 63)
+            return 0;
+
+        prev = c;
+    }
+    /* Can not end with a . or a _ */
+    if (prev == '.' || prev == '-')
+        return 0;
+
+    return 1;
+}
@@ -0,0 +1,55 @@
+/* Provenance: openssl/openssl validate_hostname_part (vuln).
+ * repo: openssl/openssl
+ * commit: 0f3fab2eccc7c3417093a8243dd15d95b6cb472d
+ * parent: 0f3fab2eccc7c3417093a8243dd15d95b6cb472d
+ * commit_url: https://github.com/openssl/openssl/commit/b3a555a0a7aa0028887149f6f973af89a4937bea
+ * cve: CVE-2026-42771
+ * license: Apache-2.0
+ * function: validate_hostname_part
+ * relpath: crypto/x509/x509_vpm.c
+ */
+
+static int validate_hostname_part(const char *name, size_t len,
+    ossl_charset_t charset)
+{
+    size_t i, part_len;
+    char c, prev;
+
+    if (len < 2 || len > 256)
+        return 0;
+
+    part_len = 0;
+    prev = '\0';
+    for (i = 0; i < len; i++) {
+        c = name[i];
+        if (c == '.') {
+            /*
+             * Can not start a label with a .
+             * unless it is the very first character.
+             */
+            if (part_len == 0 && i != 0)
+                return 0;
+            /* Can not end a label with a - */
+            if (prev == '-')
+                return 0;
+            part_len = 0;
+        } else {
+            /* Can not start a label with a - */
+            if (part_len == 0 && c == '-') {
+                return 0;
+            }
+            if (!is_label_ok(c, charset) && c != '-')
+                return 0;
+        }
+        part_len++;
+        if (part_len > 63)
+            return 0;
+
+        prev = c;
+    }
+    /* Can not end with a . or a _ */
+    if (prev == '.' || prev == '-')
+        return 0;
+
+    return 1;
+}