up

tests/reachability/fixtures/patch-oracles/cases/curl-CVE-2023-38545-socks5-heap/reachable.oracle.json

@@ -0,0 +1,56 @@
+{
+  "schema_version": "patch-oracle/v1",
+  "id": "curl-CVE-2023-38545-socks5-heap-reachable",
+  "case_ref": "curl-CVE-2023-38545-socks5-heap",
+  "variant": "reachable",
+  "description": "Validates that the SOCKS5 heap overflow vulnerability path is reachable from network handler to vulnerable sink",
+  "expected_functions": [
+    {
+      "symbol_id": "sym://net:handler#read",
+      "kind": "entrypoint",
+      "required": true,
+      "reason": "Network read handler is the entry point for external data"
+    },
+    {
+      "symbol_id": "sym://curl:curl.c#entry",
+      "kind": "function",
+      "required": true,
+      "reason": "SOCKS5 protocol handling entry point"
+    },
+    {
+      "symbol_id": "sym://curl:curl.c#sink",
+      "kind": "function",
+      "required": true,
+      "reason": "Vulnerable buffer handling function"
+    }
+  ],
+  "expected_edges": [
+    {
+      "from": "sym://net:handler#read",
+      "to": "sym://curl:curl.c#entry",
+      "kind": "call",
+      "min_confidence": 0.8,
+      "required": true,
+      "reason": "Data flows from network handler to SOCKS5 handler"
+    },
+    {
+      "from": "sym://curl:curl.c#entry",
+      "to": "sym://curl:curl.c#sink",
+      "kind": "call",
+      "min_confidence": 0.8,
+      "required": true,
+      "reason": "SOCKS5 handler invokes vulnerable buffer function"
+    }
+  ],
+  "expected_roots": [
+    {
+      "id": "sym://net:handler#read",
+      "phase": "runtime",
+      "required": true,
+      "reason": "Network handler is the runtime entry point"
+    }
+  ],
+  "min_confidence": 0.5,
+  "strict_mode": false,
+  "created_at": "2025-12-13T00:00:00Z"
+}

tests/reachability/fixtures/patch-oracles/cases/curl-CVE-2023-38545-socks5-heap/unreachable.oracle.json

@@ -0,0 +1,32 @@
+{
+  "schema_version": "patch-oracle/v1",
+  "id": "curl-CVE-2023-38545-socks5-heap-unreachable",
+  "case_ref": "curl-CVE-2023-38545-socks5-heap",
+  "variant": "unreachable",
+  "description": "Validates that the SOCKS5 heap overflow vulnerability path is NOT reachable when SOCKS5 is disabled",
+  "expected_functions": [
+    {
+      "symbol_id": "sym://net:handler#read",
+      "kind": "entrypoint",
+      "required": true,
+      "reason": "Network read handler still exists but cannot reach vulnerable code"
+    }
+  ],
+  "expected_edges": [],
+  "forbidden_functions": [
+    {
+      "symbol_id": "sym://curl:curl.c#sink",
+      "reason": "Vulnerable sink should not be in call graph when SOCKS5 disabled"
+    }
+  ],
+  "forbidden_edges": [
+    {
+      "from": "sym://curl:curl.c#entry",
+      "to": "sym://curl:curl.c#sink",
+      "reason": "This edge should not exist when SOCKS5 is disabled"
+    }
+  ],
+  "min_confidence": 0.5,
+  "strict_mode": false,
+  "created_at": "2025-12-13T00:00:00Z"
+}