mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 19:59:26 +00:00
Marius Ciepluch
0116f9bea6
Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows) into benchmarks/pairs/vfc with provenance and a JSONL training manifest. Score the slice as an honesty dashboard (ousast pairs --slice vfc); keep the pair gate on the local fixtures only.
60 lines
1.5 KiB
C
60 lines
1.5 KiB
C
/* Provenance: mozilla-firefox/firefox mar_read_index (fixed).
|
|
* repo: mozilla-firefox/firefox
|
|
* commit: e46f28da1cd3a5d46a2680b3d87361e9e8de4ae6
|
|
* parent: eed0931f85474d0db6e2326dfd9718c6bf1cd418
|
|
* commit_url: https://github.com/mozilla-firefox/firefox/commit/e46f28da1cd3a5d46a2680b3d87361e9e8de4ae6
|
|
* cve: BUG-2058173
|
|
* license: MPL-2.0
|
|
* function: mar_read_index
|
|
* relpath: modules/libmar/src/mar_read.c
|
|
*/
|
|
|
|
static int mar_read_index(MarFile* mar) {
|
|
char id[MAR_ID_SIZE], *buf, *bufptr, *bufend;
|
|
uint32_t offset_to_index, size_of_index;
|
|
size_t mar_position = 0;
|
|
|
|
/* verify MAR ID */
|
|
if (mar_read_buffer(mar, id, &mar_position, MAR_ID_SIZE) != 0) {
|
|
return -1;
|
|
}
|
|
if (memcmp(id, MAR_ID, MAR_ID_SIZE) != 0) {
|
|
return -1;
|
|
}
|
|
|
|
if (mar_read_buffer(mar, &offset_to_index, &mar_position, sizeof(uint32_t)) !=
|
|
0) {
|
|
return -1;
|
|
}
|
|
offset_to_index = ntohl(offset_to_index);
|
|
|
|
mar_position = 0;
|
|
if (mar_buffer_seek(mar, &mar_position, offset_to_index) != 0) {
|
|
return -1;
|
|
}
|
|
if (mar_read_buffer(mar, &size_of_index, &mar_position, sizeof(uint32_t)) !=
|
|
0) {
|
|
return -1;
|
|
}
|
|
size_of_index = ntohl(size_of_index);
|
|
|
|
if (size_of_index > mar->data_len) {
|
|
return -1;
|
|
}
|
|
buf = (char*)malloc(size_of_index);
|
|
if (!buf) {
|
|
return -1;
|
|
}
|
|
if (mar_read_buffer(mar, buf, &mar_position, size_of_index) != 0) {
|
|
free(buf);
|
|
return -1;
|
|
}
|
|
|
|
bufptr = buf;
|
|
bufend = buf + size_of_index;
|
|
while (bufptr < bufend && mar_consume_index(mar, &bufptr, bufend) == 0);
|
|
|
|
free(buf);
|
|
return (bufptr == bufend) ? 0 : -1;
|
|
}
|