Dynamic (#77)

tests/dynamic_fixtures/cpp/free_fn/benign.cpp

@@ -0,0 +1,12 @@
+// Phase 16 — free function with (const char *, size_t), benign.
+
+#include <cstddef>
+#include <cstdio>
+#include <cstdlib>
+
+void run(const char *payload, std::size_t len) {
+    (void)payload; (void)len;
+    std::printf("__NYX_SINK_HIT__\n");
+    std::fflush(stdout);
+    std::system("echo hello");
+}

tests/dynamic_fixtures/cpp/free_fn/vuln.cpp

@@ -0,0 +1,15 @@
+// Phase 16 — free function with (const char *, size_t), vulnerable.
+// Cap: CODE_EXEC.
+
+#include <cstddef>
+#include <cstdio>
+#include <cstdlib>
+#include <string>
+
+void run(const char *payload, std::size_t len) {
+    std::printf("__NYX_SINK_HIT__\n");
+    std::fflush(stdout);
+    if (!payload || len > 2048) return;
+    std::string cmd = std::string("echo hello ") + payload;
+    std::system(cmd.c_str());
+}

tests/dynamic_fixtures/cpp/libfuzzer/benign.cpp

@@ -0,0 +1,14 @@
+// Phase 16 — libFuzzer entry, benign.
+
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    (void)data; (void)size;
+    std::printf("__NYX_SINK_HIT__\n");
+    std::fflush(stdout);
+    std::system("echo hello");
+    return 0;
+}

tests/dynamic_fixtures/cpp/libfuzzer/vuln.cpp

@@ -0,0 +1,17 @@
+// Phase 16 — libFuzzer entry, vulnerable. Cap: CODE_EXEC.
+
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <string>
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    std::printf("__NYX_SINK_HIT__\n");
+    std::fflush(stdout);
+    if (size == 0 || size > 2048) return 0;
+    std::string payload(reinterpret_cast<const char*>(data), size);
+    std::string cmd = std::string("echo hello ") + payload;
+    std::system(cmd.c_str());
+    return 0;
+}

tests/dynamic_fixtures/cpp/main_argv/benign.cpp

@@ -0,0 +1,13 @@
+// Phase 16 — main(argc, argv), benign.
+// Shape marker: int main(int argc, char *argv[])
+
+#include <cstdio>
+#include <cstdlib>
+
+int nyx_entry_main(int argc, char *argv[]) {
+    (void)argc; (void)argv;
+    std::printf("__NYX_SINK_HIT__\n");
+    std::fflush(stdout);
+    std::system("echo hello");
+    return 0;
+}

tests/dynamic_fixtures/cpp/main_argv/vuln.cpp

@@ -0,0 +1,18 @@
+// Phase 16 — main(argc, argv), vulnerable.
+//
+// Renamed away from `main` so the harness `main` symbol does not collide.
+// Shape marker: int main(int argc, char *argv[])
+// Cap: CODE_EXEC.
+
+#include <cstdio>
+#include <cstdlib>
+#include <string>
+
+int nyx_entry_main(int argc, char *argv[]) {
+    std::printf("__NYX_SINK_HIT__\n");
+    std::fflush(stdout);
+    if (argc < 2) return 0;
+    std::string cmd = std::string("echo hello ") + argv[argc - 1];
+    std::system(cmd.c_str());
+    return 0;
+}