mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 19:59:26 +00:00
Marius CiepluchandClaude Opus 5
8c387306be
The pair corpus scores excerpts: a vulnerable function and its fixed twin, handed to the engine with the answer already narrowed down. Nothing in it exercises a repository -- region ranking, the budget, one CPG over thousands of files, or whether a verdict that holds on fifteen lines still holds when the source, the sink and the guard live in three modules. benchmarks/repos/<name>.toml names a real checkout: url, a full 40-char commit SHA, licence, and every known vulnerability with its file, function and line. `ousast repos` lists them; `--fetch` materialises one; CI does neither, and conftest clears the switch and redirects the cache so a developer with warm checkouts cannot read them by accident. Three rules the loader enforces rather than documents: - A branch or tag is rejected. Either would make the same recipe mean different code next month while the baseline it produced kept the old numbers. - `in_scope` must be stated per vulnerability, never defaulted. It decides whether "not found" is a miss or a non-question, which is the most important thing about the result. - A recipe that declares `detection` must name something in scope to detect. `ousast repos` does not trust a recipe either: against a materialised checkout it checks HEAD against the pin, that the licence file is there, and that each declared function appears above its declared line. That earned its place immediately -- the first libpng recipe named LICENSE.md, which is the filename at HEAD today and not at the pinned commit, where it is still LICENSE. Two checkouts, verified against the real repositories: - vampi (MIT, 520 lines) is the DETECTION checkout. Excerpts of it are already in the pair corpus, including the update_password miss diagnosed earlier, so a whole-repository run says directly whether a verdict survives the move off the excerpt. Its routes register through an OpenAPI operationId, so it exercises registration-based entry-point mapping rather than the decorator path. - libpng (libpng-2.0, 91k lines of C) is the ENVELOPE checkout, pinned at the parent of the commit that added the missing clamp. Its CVE is marked out of scope: an out-of-bounds read is not a family this engine arbitrates, and recording "not found" against it as a miss is the easiest way to make a measurement lie. Nothing is vendored; the recipe records the licence so an artifact can say what it ran against. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
35 lines
1.6 KiB
TOML
35 lines
1.6 KiB
TOML
# libpng -- 91k lines of C across 101 files.
|
|
#
|
|
# This is the ENVELOPE checkout, and the only question it answers is whether one CPG over a real C library
|
|
# is affordable: build time, query time, peak memory, and whether the region ranker produces a sane number
|
|
# of regions rather than thousands.
|
|
#
|
|
# Its known CVE is deliberately marked out of scope. An out-of-bounds read is not a family this engine
|
|
# arbitrates -- there is no taint sanitizer lattice, guard dominance or constant abstraction that decides
|
|
# it -- so "not found" here is not a miss, and recording it as one would be the easiest way to make a
|
|
# measurement lie.
|
|
|
|
name = "libpng"
|
|
url = "https://github.com/glennrp/libpng.git"
|
|
commit = "cf53e54ccf631d8de68a30ebb3b8eeed1d6f1a08"
|
|
language = "c"
|
|
license = "libpng-2.0"
|
|
license_file = "LICENSE"
|
|
measures = ["envelope"]
|
|
note = """
|
|
The pinned commit is the parent of 788a624d7387a758ffd5c7ab010f1870dea753a1, the commit that added the
|
|
missing clamp; `git describe` calls it v1.6.51-1-gcf53e54cc. The licence file is `LICENSE` at this commit; it was renamed
|
|
to `LICENSE.md` later, which is why the recipe names the file and the verifier checks it. Nothing is vendored from this repository -- the
|
|
recipe fetches it on request and CI never does.
|
|
"""
|
|
|
|
[[known]]
|
|
id = "CVE-2025-66293"
|
|
family = "memory_safety"
|
|
weakness = "out-of-bounds read: an unclamped composited component indexes the sRGB conversion table"
|
|
file = "pngread.c"
|
|
function = "png_image_read_composite"
|
|
line = 3279
|
|
reference = "fixed in 788a624d7387a758ffd5c7ab010f1870dea753a1; the CVE is named in the code comment added by d1ec15266204deb4102d2b5e40216bb7637261c8"
|
|
in_scope = false
|