feat(real-world-vfc-slice): add labeled OpenSSL/Firefox/Chromium/curl pair corpus

Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows) into benchmarks/pairs/vfc with provenance and a JSONL training manifest. Score the slice as an honesty dashboard (ousast pairs --slice vfc); keep the pair gate on the local fixtures only.
2026-10-21 05:59:29 +00:00 · 2026-09-04 16:45:38 +02:00
parent e9f185da59
commit 0116f9bea6
372 changed files with 49209 additions and 49 deletions
@@ -0,0 +1,62 @@
+/* Provenance: openssl/openssl cms_kek_cipher (fixed).
+ * repo: openssl/openssl
+ * commit: a0c8ec557d9cac078f032d76cdf684fe743eb382
+ * parent: d307f61f1b341b6eb7d5d07bd6902a939c709bc6
+ * commit_url: https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382
+ * cve: CVE-2026-63072
+ * license: Apache-2.0
+ * function: cms_kek_cipher
+ * relpath: crypto/cms/cms_kari.c
+ */
+
+static int cms_kek_cipher(unsigned char **pout, size_t *poutlen,
+    const unsigned char *in, size_t inlen,
+    CMS_KeyAgreeRecipientInfo *kari, int enc)
+{
+    /* Key encryption key */
+    unsigned char kek[EVP_MAX_KEY_LENGTH];
+    size_t keklen;
+    int rv = 0;
+    unsigned char *out = NULL;
+    size_t out_alloc_len = 0;
+    int outlen;
+    size_t outsize;
+
+    keklen = EVP_CIPHER_CTX_get_key_length(kari->ctx);
+    if (keklen > EVP_MAX_KEY_LENGTH)
+        return 0;
+    /* Derive KEK */
+    if (EVP_PKEY_derive(kari->pctx, kek, &keklen) <= 0)
+        goto err;
+    /* Set KEK in context */
+    if (!EVP_CipherInit_ex(kari->ctx, NULL, NULL, kek, NULL, enc))
+        goto err;
+    /* obtain output length of ciphered key */
+    if (!EVP_CipherUpdate(kari->ctx, NULL, &outlen, in, inlen))
+        goto err;
+    /*
+     * On its integrity-failure paths that primitive writes and cleanses up to
+     * inlen bytes of the output buffer. Size the buffer for that worst case so
+     * a failed unwrap cannot write past the allocation.
+     */
+    outsize = (size_t)outlen < inlen ? inlen : (size_t)outlen;
+    out = OPENSSL_malloc(outsize);
+    if (out == NULL)
+        goto err;
+    out_alloc_len = (size_t)outlen;
+    if (!EVP_CipherUpdate(kari->ctx, out, &outlen, in, (int)inlen))
+        goto err;
+    *pout = out;
+    *poutlen = (size_t)outlen;
+    rv = 1;
+
+err:
+    OPENSSL_cleanse(kek, keklen);
+    if (!rv)
+        OPENSSL_clear_free(out, out_alloc_len);
+    EVP_CIPHER_CTX_reset(kari->ctx);
+    /* FIXME: WHY IS kari->pctx freed here?  /RL */
+    EVP_PKEY_CTX_free(kari->pctx);
+    kari->pctx = NULL;
+    return rv;
+}
@@ -0,0 +1,55 @@
+/* Provenance: openssl/openssl cms_kek_cipher (vuln).
+ * repo: openssl/openssl
+ * commit: d307f61f1b341b6eb7d5d07bd6902a939c709bc6
+ * parent: d307f61f1b341b6eb7d5d07bd6902a939c709bc6
+ * commit_url: https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382
+ * cve: CVE-2026-63072
+ * license: Apache-2.0
+ * function: cms_kek_cipher
+ * relpath: crypto/cms/cms_kari.c
+ */
+
+static int cms_kek_cipher(unsigned char **pout, size_t *poutlen,
+    const unsigned char *in, size_t inlen,
+    CMS_KeyAgreeRecipientInfo *kari, int enc)
+{
+    /* Key encryption key */
+    unsigned char kek[EVP_MAX_KEY_LENGTH];
+    size_t keklen;
+    int rv = 0;
+    unsigned char *out = NULL;
+    size_t out_alloc_len = 0;
+    int outlen;
+
+    keklen = EVP_CIPHER_CTX_get_key_length(kari->ctx);
+    if (keklen > EVP_MAX_KEY_LENGTH)
+        return 0;
+    /* Derive KEK */
+    if (EVP_PKEY_derive(kari->pctx, kek, &keklen) <= 0)
+        goto err;
+    /* Set KEK in context */
+    if (!EVP_CipherInit_ex(kari->ctx, NULL, NULL, kek, NULL, enc))
+        goto err;
+    /* obtain output length of ciphered key */
+    if (!EVP_CipherUpdate(kari->ctx, NULL, &outlen, in, inlen))
+        goto err;
+    out = OPENSSL_malloc(outlen);
+    if (out == NULL)
+        goto err;
+    out_alloc_len = (size_t)outlen;
+    if (!EVP_CipherUpdate(kari->ctx, out, &outlen, in, (int)inlen))
+        goto err;
+    *pout = out;
+    *poutlen = (size_t)outlen;
+    rv = 1;
+
+err:
+    OPENSSL_cleanse(kek, keklen);
+    if (!rv)
+        OPENSSL_clear_free(out, out_alloc_len);
+    EVP_CIPHER_CTX_reset(kari->ctx);
+    /* FIXME: WHY IS kari->pctx freed here?  /RL */
+    EVP_PKEY_CTX_free(kari->pctx);
+    kari->pctx = NULL;
+    return rv;
+}