Dynamic (#77)

tests/dynamic_fixtures/c/free_fn/benign.c

@@ -0,0 +1,11 @@
+/* Phase 16 — free function with (const char *, size_t), benign. */
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+void run(const char *payload, size_t len) {
+    (void)payload; (void)len;
+    printf("__NYX_SINK_HIT__\n");
+    fflush(stdout);
+    system("echo hello");
+}

tests/dynamic_fixtures/c/free_fn/setup_fault.c

@@ -0,0 +1,24 @@
+/* Phase 08 (b) acceptance fixture — crash outside the sink.
+ *
+ * Cap: FMT_STRING.  A global constructor (`__attribute__((constructor))`)
+ * runs before `main`, so the abort fires BEFORE the harness reaches
+ * `__nyx_install_crash_guard`.  No Crash probe is written, the
+ * `Oracle::SinkCrash` predicate sees `process_crashed &&
+ * !has_sink_crash_probe`, and the verifier routes to
+ * `Inconclusive(UnrelatedCrash)` instead of `Confirmed`.
+ *
+ * The `run` body is unreachable but must compile so the entry symbol
+ * resolves at link time. */
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+__attribute__((constructor)) static void nyx_fixture_crash_in_setup(void) {
+    abort();
+}
+
+void run(const char *payload, size_t len) {
+    (void)payload;
+    (void)len;
+    printf("__NYX_SINK_HIT__\n");
+}

tests/dynamic_fixtures/c/free_fn/sink_fault.c

@@ -0,0 +1,25 @@
+/* Phase 08 (a) acceptance fixture — crash at the sink.
+ *
+ * Cap: FMT_STRING.  Prints the `__NYX_SINK_HIT__` sentinel so the runner
+ * sees the in-harness sink-hit, then NULL-dereferences when handed the
+ * vuln payload.  The harness's `__nyx_install_crash_guard` was installed
+ * earlier in `main`, so SIGSEGV writes a Crash probe to `NYX_PROBE_PATH`,
+ * which lifts the `Oracle::SinkCrash` predicate to `Confirmed`.
+ *
+ * Differential confirmation: the paired benign payload carries the
+ * `NYX_BENIGN` marker.  The short-circuit below returns cleanly on the
+ * benign run so `benign_fired = false`, satisfying the §4.1 rule. */
+#include <stddef.h>
+#include <stdio.h>
+#include <string.h>
+
+void run(const char *payload, size_t len) {
+    (void)len;
+    printf("__NYX_SINK_HIT__\n");
+    fflush(stdout);
+    if (payload && strstr(payload, "NYX_BENIGN")) {
+        return;
+    }
+    volatile char *p = NULL;
+    *p = 1;
+}

tests/dynamic_fixtures/c/free_fn/vuln.c

@@ -0,0 +1,17 @@
+/* Phase 16 — free function with (const char *, size_t), vulnerable.
+ *
+ * Cap: CODE_EXEC. Concatenates payload into a shell command.
+ */
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+void run(const char *payload, size_t len) {
+    printf("__NYX_SINK_HIT__\n");
+    fflush(stdout);
+    if (!payload || len > 2048) return;
+    char cmd[4096];
+    snprintf(cmd, sizeof(cmd), "echo hello %s", payload);
+    system(cmd);
+}

tests/dynamic_fixtures/c/libfuzzer/benign.c

@@ -0,0 +1,13 @@
+/* Phase 16 — libFuzzer entry, benign. */
+#include <stddef.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    (void)data; (void)size;
+    printf("__NYX_SINK_HIT__\n");
+    fflush(stdout);
+    system("echo hello");
+    return 0;
+}

tests/dynamic_fixtures/c/libfuzzer/vuln.c

@@ -0,0 +1,20 @@
+/* Phase 16 — libFuzzer entry, vulnerable.
+ *
+ * Real libFuzzer entry: `int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)`.
+ * Cap: CODE_EXEC.
+ */
+#include <stddef.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    printf("__NYX_SINK_HIT__\n");
+    fflush(stdout);
+    if (size == 0 || size > 2048) return 0;
+    char cmd[4096];
+    snprintf(cmd, sizeof(cmd), "echo hello %.*s", (int)size, (const char*)data);
+    system(cmd);
+    return 0;
+}

tests/dynamic_fixtures/c/main_argv/benign.c

@@ -0,0 +1,15 @@
+/* Phase 16 — main(argc, argv), benign.
+ *
+ * Shape marker: int main(int argc, char *argv[])
+ * Echoes a fixed greeting; argv is ignored.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+
+int nyx_entry_main(int argc, char *argv[]) {
+    (void)argc; (void)argv;
+    printf("__NYX_SINK_HIT__\n");
+    fflush(stdout);
+    system("echo hello");
+    return 0;
+}

tests/dynamic_fixtures/c/main_argv/vuln.c

@@ -0,0 +1,25 @@
+/* Phase 16 — main(argc, argv), vulnerable.
+ *
+ * Entry: nyx_entry_main(int argc, char *argv[])
+ *
+ * Renamed away from `main` so the harness `main` symbol does not collide
+ * when the entry source is `#include`d. The harness emitter recognises the
+ * shape via the `int main(int argc, char *argv[])` substring in the
+ * comment header below, then calls `nyx_entry_main` with payload-bearing
+ * argv. Cap: CODE_EXEC.
+ *
+ * Shape marker: int main(int argc, char *argv[])
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+int nyx_entry_main(int argc, char *argv[]) {
+    printf("__NYX_SINK_HIT__\n");
+    fflush(stdout);
+    if (argc < 2) return 0;
+    char cmd[4096];
+    snprintf(cmd, sizeof(cmd), "echo hello %s", argv[argc - 1]);
+    system(cmd);
+    return 0;
+}