Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions Assignment-3/Tests/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,9 @@ The repository includes public examples for two marking levels:

These examples are not the complete marking suite. Additional hidden cases are
used for marking. Level 1 provides each public case as a flat `.c`/`.ll` pair.
Level 2 keeps the source, LLVM IR, bitcode, and notes for its single fixture
directly in the level directory. `GRADING.md` defines the score allocation.
Marking runs are subject to a timeout.
Level 2 keeps one self-contained C source, its LLVM IR and bitcode, and notes
for its single fixture directly in the level directory. `GRADING.md` defines
the score allocation. Marking runs are subject to a timeout.

## Level 1

Expand Down Expand Up @@ -51,5 +51,9 @@ python3 Assignment-3/Python/test-ae.py \
Assignment-3/Tests/level-2/repro.ll
```

Both reference implementations have been verified to complete in an 8 GiB
Docker cgroup with swap disabled. See `level-2/notes.md` for the validation
details.

Level 3 assesses large-program execution and report precision. No Level-3
fixture is published in this repository.
31 changes: 16 additions & 15 deletions Assignment-3/Tests/level-2/notes.md
Original file line number Diff line number Diff line change
@@ -1,32 +1,33 @@
# 42519094 curl active 1k fallback
# 42519094 curl active fixture

Source:

- Original target: `/src/curl/lib/curl_fnmatch.c`
- Linked C sources: `repro.c`, `target_min.c`
- Driver: `repro.c`, C-only.
- LOC: 2849
- Original target provenance: `/src/curl/lib/curl_fnmatch.c:389`
- Single self-contained C source: `repro.c`
- C source size: 707 lines
- Generated IR size: 3,315 lines and 71 function definitions

Driver policy:

- The active prelude exercises original container APIs before the final target
- The driver calls 66 active prelude functions before the final target
trigger.
- The final trigger uses an undersized output buffer to reproduce the ARVO
buffer-overflow statement.
- The final trigger writes one byte past a four-byte heap allocation.
- The C source and all generated artifacts are flat in this directory.

Validation:

- ASAN confirms the target at `curl_fnmatch.c:389`.
- ASAN confirms a heap-buffer-overflow in `trigger_42519094` in `repro.c`.
- C++ command:
`Release-build/bin/ass3 Assignment-3/Tests/level-2/repro.ll`
- Python command:
`python3 Assignment-3/Python/test-ae.py Assignment-3/Tests/level-2/repro.ll`
- ICFG coverage: 7938 / 7939 = 99.99%
- Function coverage: 285 / 285 = 100.00%
- Buffer-overflow reports: 1
- TP: 1
- FP: 0
- Docker image: `svftools/software-security-analysis:latest` (`linux/amd64`)
- Container limit: 8,589,934,592 bytes with swap disabled
- C++: exit status 0; sampled cgroup peak 4,174,487,552 bytes
- Python 3.12: exit status 0; sampled cgroup peak 3,921,240,064 bytes
- Expected result: exactly one buffer-overflow report in
`trigger_42519094` in `repro.c`

Status:

- `validated_expanded_min_active`
- `validated_8g`
Binary file modified Assignment-3/Tests/level-2/repro.bc
Binary file not shown.
Loading
Loading