diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 07e062347..90333a73a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -291,7 +291,66 @@ jobs: ' # =========================================================== - # Job 5: Dynamic Analysis — Valgrind memcheck (OpenSSF) + # Job 5: CASTLE Benchmark Regression Tests + # =========================================================== + # Verifies Map2Check against 5 CASTLE micro-benchmarks + # (CWE-415, 416, 476, 787) — memory safety regression suite. + castle-regression: + name: CASTLE Regression + runs-on: ubuntu-22.04 + timeout-minutes: 20 + needs: [build-and-test] + + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + submodules: recursive + + - name: Free disk space + run: | + sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc + sudo docker image prune -a -f || true + + - name: Pull map2check-dev image + run: docker pull ghcr.io/hbgit/map2check-dev:latest + + - name: Build + install Map2Check in container + run: | + docker run --rm \ + -u root \ + -v "${{ github.workspace }}:/workspace" \ + -w /workspace \ + -e CC=/usr/bin/clang-16 \ + -e CXX=/usr/bin/clang++-16 \ + ghcr.io/hbgit/map2check-dev:latest bash -c ' + rm -rf build_castle_ci install_castle_ci + mkdir -p build_castle_ci && cd build_castle_ci + cmake .. -G Ninja \ + -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DENABLE_TEST=ON \ + -DMAP2CHECK_DYNAMIC_LINK=ON \ + -DCMAKE_INSTALL_PREFIX=/workspace/install_castle_ci + ninja + ninja install + mkdir -p /workspace/install_castle_ci/lib/klee + ln -sf /opt/klee/lib/klee/runtime /workspace/install_castle_ci/lib/klee/runtime + ln -sf /usr/lib/llvm-16/lib/clang /workspace/install_castle_ci/lib/clang + ' + + - name: Run CASTLE regression tests + run: | + docker run --rm \ + -u root \ + -v "${{ github.workspace }}:/workspace" \ + -w /workspace \ + -e MAP2CHECK_PATH=/workspace/install_castle_ci \ + ghcr.io/hbgit/map2check-dev:latest bash -c ' + bash tests/integration/test_castle_regression.sh + ' + + # =========================================================== + # Job 6: Dynamic Analysis — Valgrind memcheck (OpenSSF) # =========================================================== # Build ISOLADO e SEM sanitizers: a shadow memory do ASan/UBSan # conflita com a VM do Valgrind. Debug + DWARF-4 para stacks diff --git a/.gitignore b/.gitignore index e91bb2a19..e361d0206 100644 --- a/.gitignore +++ b/.gitignore @@ -74,4 +74,5 @@ target_wrapper.* # QtCreator CMake CMakeLists.txt.user* -test-comp2026/simulation/release/* \ No newline at end of file +test-comp2026/simulation/release/* +tests/castle/results/ \ No newline at end of file diff --git a/.gitmodules b/.gitmodules new file mode 100644 index 000000000..d18418e10 --- /dev/null +++ b/.gitmodules @@ -0,0 +1,3 @@ +[submodule "CASTLE-Benchmark"] + path = tests/castle/CASTLE-Benchmark + url = https://github.com/CASTLE-Benchmark/CASTLE-Benchmark diff --git a/.opencode/skills/map2check-sbseg2026/SKILL.md b/.opencode/skills/map2check-sbseg2026/SKILL.md deleted file mode 100644 index d6527bdcb..000000000 --- a/.opencode/skills/map2check-sbseg2026/SKILL.md +++ /dev/null @@ -1,255 +0,0 @@ ---- -name: map2check-sbseg2026 -description: "Contexto completo do artigo SBSeg 2026 SF — Map2Check 2026. Metadados de submissão, frameworks, capítulos, backlog, restrições de edital, dados consolidados e conhecimento técnico. Ative ao trabalhar nos docs do paper." ---- - - - -# Map2Check 2.0 — SBSeg 2026 SF -**Autores**: Guilherme Lucas Pereira Bernardo (UFRN), Inácio Viana (UFRN), Francisco Nobre (UFRR), Herbert Oliveira Rocha (orientador, UFRR) | **Submissão**: 20/jul/2026 | **Sections**: 5 | **Single-blind** — nomes podem constar - -## How to Use This Skill - -- **Without arguments** — load core frameworks + submission context -- **With a topic** — ask about `pass migration`, `CWE mapping`, `isRequired fix`, `WASM`, `backlog`; I find and read the relevant chapter -- **With chapter** — ask for `ch03`; I load that specific chapter -- **Browse** — ask "what chapters do you have?" to see the full index - -When you ask about a topic not covered below, I will read the relevant chapter file before answering. - ---- - -## 📋 Submission Context (PRIORIDADE MÁXIMA) - -| Campo | Valor | -|:------|:------| -| **Conferência** | SBSeg 2026 — Salão de Ferramentas (SF) | -| **Sistema de submissão** | JEMS3 | -| **Idioma** | Português | -| **Deadline submissão** | **20/jul/2026** | -| **Notificação** | 03/ago/2026 | -| **Camera ready + CTA** | 14/ago/2026 | -| **Evento** | 01–04/set/2026, Armação dos Búzios — RJ | -| **Modo** | Single-blind (autores conhecidos pelos revisores — nomes/instituições/emails OK) | -| **Template** | SBC (a ser obtido) | -| **Limite** | 8 pág corpo + até 2 pág referências/apêndices | -| **Vídeo obrigatório** | Sim (5-7 min) — URL pública, não precisa ser anônima | -| **Demonstração ao vivo** | Obrigatória — pelo menos 1 autor inscrito (presença CONFIRMADA) | -| **Modalidade** | Código Aberto (elegível a prêmios) | -| **IA Generativa** | Uso DECLARADO — ferramentas de IA como assistentes de escrita, conforme Código de Conduta SBC (https://sol.sbc.org.br/index.php/indice/conduta) | - -## 📝 Backlog - -| # | Item | Prioridade | Bloqueia | Owner | -|:--|:-----|:-----------|:---------|:------| -| 1 | Referências BibTeX (TACAS 2016, 2018, 2020 + concorrentes) | **Alta** | Seção 2 (História) + Referências | usuário | -| 2 | Template LaTeX SBC | **Alta** | Geração do PDF final | usuário | -| 3 | Aprovação do orientador no outline | **Alta** | Sprint 1 | usuário | -| 4 | ~~WASM PoC E2E (1.7.3)~~ | ~~Alta~~ | ~~Seção WASM~~ | ✅ **Concluído** | -| 5 | ~~WASM MemoryTrackPass (1.7.4)~~ | ~~Alta~~ | ~~PoC E2E~~ | ✅ **Concluído** | -| 6 | ~~WASM CLI --wasm (1.7.5)~~ | ~~Alta~~ | ~~1.7.4~~ | ✅ **Concluído** | -| 7 | WASM Juliet benchmarks (1.7.6) | Média | 1.7.5 | ✅ Concluído — 15 casos, 15/15 FALSE (com timeout 290s) | -| 8 | WASM seção artigo (1.7.7) | Média | 1.7.6 | 🟡 Em andamento — texto atualizado (15/15 FALSE), figura TikZ pronta, renderização do .mmd pendente | -| 9 | Gravação do vídeo técnico | **Média** | Seção 5 (Demonstração) | usuário | -| 10 | Validação do build por terceiro (CTA) | **Baixa** | Checklist de artefato | usuário | -| 11 | Ajustes do orientador no artigo | **Alta** | Submissão | usuário | - -## 🛡️ CTA Checklist (Avaliação de Artefato) - -| Dimensão | Evidência | -|:---------|:----------| -| **Disponibilidade** | Repositório público + Docker image (GHCR) | -| **Funcionalidade** | Build passa + 7/7 unit tests + 9/9 passes carregando | -| **Reprodutibilidade** | Dockerfile.dev (Ubuntu 22.04) + scripts de benchmark | -| **Sustentabilidade** | CI/CD (GitHub Actions): build, unit tests, static analysis, sanitizers, e novo job E2E com Docker; docs atualizados | - -## 📊 Consolidated Data - -``` -Stack: LLVM 16.0 · KLEE 3.1 · C++17 · Ubuntu 22.04 · Docker -Migração: 35 commits · 84 arquivos · +5.785 / -657 linhas -Unit tests: 7/7 passing -Pass plugins: 9/9 loading (opt-16) -Smoke E2E: 2/2 loops benchmarks correct (array-1.c TRUE, array-2.c FALSE) - -TestComp 2026 Heap (C.coverage-error-call.Heap): - Total: 594 tasks | Score: 57 - TRUE: 264 (44.4%) - UNKNOWN: 271 (45.6%) - FALSE: 56 (9.4%) — 56 bugs reais encontrados - FALSE(free): 1 - TIMEOUT: 2 (0.3%) - ├─ Heap (428): 39 FALSE, 203 TRUE, 184 UNKNOWN, 2 TIMEOUT - └─ LinkedLists (166): 18 FALSE, 61 TRUE, 87 UNKNOWN, 0 TIMEOUT - -Bugs críticos corrigidos: 3 (KLEE flags, isRequired, target function) -Bugs OverflowPass corrigidos: 3 (null pointer dereference em chamadas indiretas) - -TestComp 2026 ControlFlow (no-overflow): 92 tasks, 30 FALSE, 17 TRUE, 45 UNK, 0 TO (1h43m) -TestComp 2026 ControlFlow (coverage-error-call): 138 tasks, 38 FALSE, 30 TRUE, 70 UNK, 0 TO (4h53m) - -WASM Pipeline: - Branch: feat-wasm-verification - WABT: 1.0.41 (wasm2c) - wasi-sdk: 33.0 (clang --target=wasm32-wasip1) - WasmLifter: ✅ modules/frontend/wasm_lifter.{hpp,cpp} — lifting funcional - Entry point: ✅ w2c_*_start → main via generateWasmWrapperStatic - CLI --wasm: ✅ map2check --wasm modulo.wasm — pipeline único - WasmRuntimeStubs:✅ KLEE-friendly (calloc/free), wasm_rt_trap → map2check_error - Wrapper auto: ✅ generateWasmWrapperStatic() — main() → wasm bridge - Bounds check: ✅ Per-allocation via dlmalloc interception (w2c_*_dlmalloc/dlfree) - implementado e validado - Juliet benchmarks:✅ 15 casos (CWE-121/122/124/126/127), 15/15 FALSE - timeout 110s → UNKNOWN; timeout 290s → FALSE - Integration tests:✅ tests/integration/test_wasm_{pipeline,entrypoint}.sh (3/3 + 3/3) - Seção no artigo: 🟡 Texto base em main.tex, figura pipeline pendente - KLEE E2E: ✅ Pipeline completo: .wasm → LLVM IR → Passes → KLEE → FALSE - CI build: ✅ find_path corrigido, WasmRuntimeStubs opcional - CI E2E: ✅ Novo job e2e-wasm executa integração dentro do Docker -``` - -## 🖼️ Figure Inventory - -| ID | Descrição | Seção | Status | -|:---|:----------|:------|:------| -| `fig1-timeline` | Timeline visual 2016→2026 | Sec 2 | ✅ TikZ criado (fig1-timeline.tikz.tex) | -| `fig2-pipeline` | Diagrama do pipeline de verificação (5 estágios) | Sec 3 | ✅ TikZ criado (fig2-pipeline.tikz.tex) | -| ~~`fig3-passes`~~ | ~~Diagrama dos passes~~ | — | Removida (orientador) | -| ~~`fig4-testcomp2026`~~ | ~~Gráfico de pizza TestComp~~ | — | Removida (orientador: nunca usar pizza) | -| ~~`fig5-cicd`~~ | ~~Workflow CI/CD~~ | — | Removida (substituída por parágrafo + OpenSSF) | -| `fig6-wasm-pipeline` | Pipeline WASM: .wasm → wasm2c → LLVM IR → Passes → KLEE | Sec 4 | 🟡 .mmd criado, aguardando renderização para PNG | - ---- - -## Core Frameworks & Mental Models - -### Pipeline de Verificação Híbrida -**Use fuzzing (LibFuzzer) como primeira linha** para bugs superficiais — rápido mas cego para branches complexos. **Use execução simbólica (KLEE) como solver de guardas** quando o fuzzer estagna — preciso mas caro. A combinação (iterative deepening) resolve o trade-off. - -### Pass Migration Pattern (Legacy PM → New PM) -**Sempre herdar de `PassInfoMixin`** e implementar `run(Function &, FunctionAnalysisManager &)`. **`isRequired() = true` é obrigatório** — sem isso, `opt -O0` pula o pass silenciosamente. Este foi o bug mais crítico da migração (3 bugs escaparam dos unit tests). - -### Mapeamento Propriedade SV-COMP → CWE → Pass -**Cada propriedade de memory safety do SV-COMP mapeia para um CWE** do MITRE: -- `valid-free` → **CWE-415** (Double-Free) / **CWE-416** (Use-After-Free) -- `valid-deref` → **CWE-416** (Use-After-Free) -- `valid-memsafety` → **CWE-119/787** (Buffer Overflow) -- `valid-memcleanup` → **CWE-401** (Memory Leak) - -O mapeamento torna resultados de verificação formal acionáveis para times de AppSec. - -### Modernização de Engenharia como Pré-requisito -**CI/CD + Docker + static analysis + sanitizers não são luxo, são fundamento.** Sem eles: bugs de regressão passam despercebidos, resultados não são reproduzíveis, a ferramenta não compete em SV-COMP/TestComp. - -### Docker Reproducibility Contract -**Se funciona na imagem `map2check-dev` (Ubuntu 22.04 + LLVM 16 + KLEE 3.1), funciona em qualquer lugar.** O Dockerfile.dev é o contrato de reprodutibilidade — documenta cada dependência e versão. - -### TestComp 2026 como Validação Empírica -**Resultados Heap (594 tasks):** TRUE 264 (44.4%), UNKNOWN 271 (45.6%), FALSE 56 bugs reais (9.4%), TIMEOUT 2 (0.3%). **Score 57.** UNKNOWN 45.6% é o principal gargalo e direciona o próximo ciclo de desenvolvimento. - -### UNKNOWN como KPI de Engenharia -**Não é fracasso, é sinal de onde investir.** Causas: timeout 300s insuficiente, path exploration do KLEE não otimizada, solver SMT (Z3) sem tuning. Cada ponto percentual reduzido de UNKNOWN é ganho real de cobertura. - -### Testes Unitários são Necessários mas Insuficientes -**7/7 unit tests passando e 3 bugs críticos escaparam.** Os bugs (KLEE flags, isRequired, target function) só foram detectados por smoke tests manuais. **Testes de integração E2E (compile → instrument → link → execute) no CI são indispensáveis.** No WASM, 8 commits consecutivos de "fix(ci)" tentaram fazer o CI passar sem executar KLEE; o job `e2e-wasm` baseado em Docker foi criado justamente para quebrar esse ciclo. - -### WASM como Próximo Vetor de Growth -**Pipeline LLVM 16 estendido para WebAssembly.** Memory safety em runtimes WASM (Wasmtime, Wasmer) é uma nova classe de bugs. Feature implementada e funcional — NÃO é trabalho futuro, aparece no paper com resultados da Juliet. - -### Per-Allocation Bounds Checking via dlmalloc Interception -**O wasm2c gera funções de alocação com nome determinístico** (w2c_*_dlmalloc / w2c_*_dlfree). O MemoryTrackPass as intercepta por padrão de nome (`StringRef::contains`), registrando offset + size no AllocationLog existente. Cada load/store na linear memory é verificado contra as alocações registradas via `is_valid_allocation_address`. Funciona para heap (malloc-based: 3/3 Juliet CWE-122/126 FALSE), não para stack/globals (CWE-121/124/127: 12/12 UNKNOWN). - -### Entrypoint Translation Pattern -**O wasm2c traduz `_start` → `w2c_*_start` e `main` → `w2c_*_original_main`.** Para unificar com o pipeline Map2Check (que espera `main`), geramos um wrapper C dinâmico (`generateWasmWrapperStatic`) que extrai o nome do módulo do entrypoint levantado, instancia o módulo WASM via `wasm2c_*_instantiate`, invoca `_start`, e libera via `wasm2c_*_free`. O wrapper é compilado para .bc e linkado com o IR levantado via `llvm-link`. - -### Linear Memory Bounds Gap -**O bounds check nativo do wasm2c opera no nível da memória linear** (0 a `mem->size`), não por buffer individual. Um `strcpy` que ultrapassa o buffer escreve no próximo byte da stack, ainda dentro dos 64KB alocados. Para detectar per-buffer overflow, é necessário rastrear limites de cada alocação — viável via dlmalloc para heap, inviável para stack/globais (Fase 2, pós-SBSeg). - -### Escopo do Paper — O que NÃO mencionar -- **NÃO**: DG Library, AFL++, Coordenador, Smart Seeds (fora do escopo — são próximos passos do pré-projeto Map2Check 2.0) -- **SIM**: LLVM 16, New PM, 9 passes, C++17, CI/CD, Docker, sanitizers, static analysis, TestComp 2026, CWE mapping, WASM - ---- - -## Chapter Index - -| # | Title | Pages | Figures | Data Sources | Key Frameworks | -|---|-------|-------|---------|--------------|----------------| -| [ch01](chapters/ch01-introducao-motivacao.md) | Introdução | ~1 | — | `docs/paper-sbseg-2026/sbseg-article/main.tex` | Memory Safety, Verificação Híbrida, CWE Top 25, Trabalhos Relacionados | -| [ch02](chapters/ch02-historia-evolucao.md) | História e Evolução | ~1 | fig1-timeline | `CHANGELOG.md`, `docs/migration/` | BMC→KLEE→Híbrido, Comparação com concorrentes (CPAchecker, Symbiotic, FuSeBMC, ESBMC) | -| [ch03](chapters/ch03-arquitetura.md) | Arquitetura e Funcionalidades | ~2.5 | fig2-pipeline | `docs/migration/1.3-*.md`, `.github/workflows/`, `Dockerfile.dev` | Pipeline 5 estágios, Técnicas (fluxo de dados, intervalos), OpenSSF | -| [ch04](chapters/ch04-ciberseguranca.md) | Análise Experimental | ~2 | — | `test-comp2026/simulation/` | CWE mapping, TestComp 2026 resultados, WASM lifting | -| ~~[ch05]~~ | ~~Demonstração Planejada~~ | — | — | — | Removida do artigo (orientador: demo não é conteúdo de paper) | -| [ch06](chapters/ch06-conclusao.md) | Conclusão | ~1 | — | `docs/paper-sbseg-2026/data/consolidated-data.md` | Resultados, Limitações (UNKNOWN 45.6%), Perspectivas (WASM, E2E tests) | - -## Topic Index - -- **AFL++** → ch01, Pré-projeto -- **Arquitetura (pipeline)** → ch03 -- **ASAN / UBSAN / TSAN** → ch03, ch04 -- **BMC (Bounded Model Checking)** → ch02 -- **Buffer Overflow** → ch01, ch04 -- **C++17** → ch03 -- **CBMC** → ch02 -- **Checkpoint automatizado** → ch04, patterns -- **CI/CD** → ch03 -- **Crab-LLVM** → ch02 -- **CWE-119 / 787** → ch01, ch04 -- **CWE-401 (Memory Leak)** → ch01, ch04 -- **CWE-415 (Double-Free)** → ch01, ch04 -- **CWE-416 (Use-After-Free)** → ch01, ch04 -- **Demonstração ao vivo** → ch05 -- **DG Library** → Pré-projeto (fora do escopo paper) -- **Docker** → ch03, ch05 -- **Execução Simbólica** → ch01, ch02, ch03 -- **FuSeBMC** → ch01 -- **isRequired fix** → ch03, ch04 -- **Iterative deepening** → ch03, patterns -- **KLEE 3.1** → ch02, ch03, ch04 -- **Legacy PM → New PM** → ch02, ch03, patterns -- **LibFuzzer** → ch02, ch03 -- **LLVM 16** → ch03 -- **Memory Safety** → ch01, ch04 -- **New Pass Manager** → ch03, patterns -- **OpenSSF Best Practices** → ch03 -- **Passes (9)** → ch03 -- **Pipeline (5 estágios)** → ch03 -- **SBSeg SF 2026** → ch05 -- **Smart Seeds** → ch01, Pré-projeto -- **SMT Solver (Z3)** → ch01, ch03 -- **SV-COMP** → ch01 -- **Symbiotic** → ch01 -- **TestComp 2026** → ch04, ch06 -- **UNKNOWN (45.6%)** → ch04, ch06 -- **WASM (WebAssembly)** → ch04, ch06 -- **WASM lifter / WABT** → ch04, Implementation Plan -- **wasm2c** → ch04, Implementation Plan -- **wasi-sdk** → Implementation Plan -- **w2c__start** → Implementation Plan -- **dlmalloc interception** → ch04, patterns -- **entrypoint translation** → ch04, patterns -- **per-allocation bounds** → ch04, patterns -- **linear memory gap** → ch04, patterns -- **Juliet Test Suite** → ch04 -- **generateWasmWrapperStatic** → ch04 -- **WasmRuntimeStubs** → ch04 -- **integration tests (WASM)** → tests/ -- **Witness GraphML** → ch03 - -## Supporting Files - -- [glossary.md](glossary.md) — all key terms with definitions -- [patterns.md](patterns.md) — all techniques and design patterns -- [cheatsheet.md](cheatsheet.md) — quick reference tables and decision guides - ---- - -## Scope & Limits - -**Coberto**: Conteúdo do paper SBSeg 2026 SF (Map2Check modernization) + pré-projeto Map2Check 2.0 + metadados de submissão + backlog + dados consolidados de TestComp 2026. - -**Fora do escopo do paper** (mencionados em contexto, detalhados no pré-projeto): DG Library, AFL++, Smart Seeds, Coordenador. - -**Fontes de referência no repo**: `docs/migration/` (passes, frontend, checkpoints), `.github/workflows/` (CI/CD), `test-comp2026/simulation/` (benchmarks), `Dockerfile.dev` (reprodutibilidade). - -**Esta skill absorveu e substitui `sbseg-paper`** — todo o conteúdo de projeto (submissão, backlog, restrições, CTA) foi fundido aqui. diff --git a/.opencode/skills/map2check-sbseg2026/chapters/ch01-introducao-motivacao.md b/.opencode/skills/map2check-sbseg2026/chapters/ch01-introducao-motivacao.md deleted file mode 100644 index 79a45cce3..000000000 --- a/.opencode/skills/map2check-sbseg2026/chapters/ch01-introducao-motivacao.md +++ /dev/null @@ -1,71 +0,0 @@ -# Chapter 1: Introdução - -## Core Idea -Memory safety em C/C++ lidera o *2025 CWE Top 25* com Out-of-bounds Write (CWE-787), Use-After-Free (CWE-416) e Buffer Overflow (CWE-119). A verificação híbrida — combinando execução simbólica (KLEE) e fuzzing (AFL++) — é a abordagem mais promissora, e o Map2Check 2026 renasce como ferramenta competitiva após 7 anos de estagnação técnica. - -## Frameworks Introduced -- **Verificação Híbrida**: combinação de execução simbólica (KLEE) + fuzzing guiado por cobertura (AFL++) - - When to use: quando fuzzing puro não penetra guardas lógicas complexas, e execução simbólica pura sofre de path explosion - - How: fases alternadas entre exploração rápida (fuzzer) e resolução de path constraints via SMT (execução simbólica) -- **Smart Seeds (FuSeBMC)**: injeção de sementes geradas por BMC no fuzzer, atingindo >81% de cobertura em categorias críticas da Test-Comp - - When to use: quando o fuzzer estagna em branches com magic numbers - - How: BMC resolve guardas lógicas e injeta entradas concretas de volta na fila do fuzzer -- **Program Slicing (Symbiotic)**: integração de slicing estático (DG Library) com KLEE para reduzir espaço de busca - - When to use: programas grandes onde a análise simbólica sofre de path explosion - - How: remove trechos de código que não afetam as propriedades de segurança antes da execução simbólica - -## Key Concepts -- **CWE Top 25 (2025)**: CWE-787, CWE-416, CWE-119 entre as vulnerabilidades mais perigosas — fonte: `cwe2025` -- **SV-COMP / TestComp**: competições internacionais de verificação de software — fonte: `beyersvcomp2013`, `beyertestcomp2023` -- **KLEE**: motor de execução simbólica de referência para LLVM bitcode — fonte: `klee2008` -- **AFL++**: fuzzer guiado por cobertura, sucessor do AFL — fonte: `fioraldi2020aflpp` -- **FuSeBMC**: ferramenta com smart seeds + BMC, líder em cobertura na Test-Comp — fonte: `fusebmc2022` -- **Symbiotic**: ferramenta com program slicing + KLEE, destaque em MemSafety — fonte: `chalupa2021symbiotic` -- **ESBMC**: bounded model checker com múltiplos solvers SMT — fonte: `gadelha2021esbmc` -- **OpenSSF Best Practices**: certificação de boas práticas para projetos open source — fonte: `openssf2024` -- **Therac-25**: caso histórico de falha de software em sistema crítico médico — fonte: `leveson1993investigation` - -## Mental Models -- Use **fuzzing como primeira linha** — rápido, cobre caminhos superficiais, detecta bugs fáceis -- Use **execução simbólica como solver de guardas** — preciso para branches com magic numbers, mas caro -- Pense em **orquestração como diferencial competitivo**: FuSeBMC ganhou com smart seeds, Symbiotic com slicing — o Map2Check 2026 precisa dessa camada -- Use **CWE como linguagem comum** entre verificação formal e times de AppSec — torna resultados acionáveis - -## Anti-patterns -- **Ferramenta sem CI/CD**: sem reprodutibilidade, resultados não são validáveis por terceiros — pré-requisito para publicação científica -- **Stack EOL (LLVM 6, Ubuntu 16.04)**: inviabiliza participação em competições e perde compatibilidade com solvers modernos -- **Motores sem orquestração**: KLEE e LibFuzzer operando em fases estanques, sem compartilhamento de estado — perde eficiência vs. FuSeBMC - -## Worked Example -**Exemplo de uso do Map2Check 2026:** - -```c -// array-2.c — buffer overflow intencional -int main() { - int a[10], i = __VERIFIER_nondet_int(); - a[i] = 42; // i pode ser >= 10 → buffer overflow - return 0; -} -``` - -Pipeline completo via CLI: -```bash -$ map2check --property-file coverage-error-call.prp array-2.c -VERIFICATION FAILED -Counter-example: nondet_int() -> 31763, line 3, scope main -``` - -O comando `map2check` compila com Clang-16, instrumenta com os passes de memory safety, executa o KLEE e reporta o veredito FALSE com contra-exemplo concreto. - -## Key Takeaways -1. Memory safety bugs lideram o CWE Top 25 2025 — CWE-787, CWE-416, CWE-119 -2. Verificação híbrida é o estado da arte — FuSeBMC (>81% cobertura), Symbiotic (slicing+KLEE), ESBMC (multi-solver BMC) -3. Map2Check estava estagnado desde 2019 (LLVM 6.0, Ubuntu 16.04 EOL, KLEE 2.0 fork) -4. 5 contribuições da versão 2026: (1) LLVM 6→16 + New PM + C++17, (2) CI/CD + Docker + sanitizers + OpenSSF, (3) TestComp 2026 score 57, (4) CWE mapping, (5) WASM suporte -5. Exemplo concreto: `map2check array-2.c` → VERIFICATION FAILED + counter-example `nondet_int() → 31763` - -## Connects To -- **Ch 2**: História e evolução — como cada checkpoint do Map2Check se compara aos concorrentes -- **Ch 3**: Arquitetura — pipeline de 5 estágios com passes de instrumentação -- **Ch 4**: Análise Experimental — resultados TestComp 2026 e CWE mapping -- **CWE Top 25 2025**: referência do MITRE para classificação de vulnerabilidades diff --git a/.opencode/skills/map2check-sbseg2026/chapters/ch02-historia-evolucao.md b/.opencode/skills/map2check-sbseg2026/chapters/ch02-historia-evolucao.md deleted file mode 100644 index b710f1f9a..000000000 --- a/.opencode/skills/map2check-sbseg2026/chapters/ch02-historia-evolucao.md +++ /dev/null @@ -1,44 +0,0 @@ -# Chapter 2: História e Evolução - -## Core Idea -O Map2Check passou por 3 fases arquiteturais (BMC → KLEE → Híbrido) em 10 anos, mas perdeu competitividade por falta de features que os concorrentes adotaram em cada checkpoint: CPAchecker já usava múltiplas estratégias em 2016, Symbiotic integrava slicing com KLEE em 2018, e FuSeBMC introduziu smart seeds com orquestração dinâmica em 2020. - -## Frameworks Introduzidos -- **BMC (2016, TACAS)**: Map2Check usava CBMC como único solver BMC para "Hunting Memory Bugs" - - Concorrente: CPAchecker já combinava análise de valor, predicate abstraction e BMC com múltiplas estratégias -- **Execução Simbólica (2018, TACAS)**: migração para LLVM + KLEE, path-based symbolic execution - - Concorrente: Symbiotic integrava program slicing estático (DG) com KLEE — otimização ausente no Map2Check - - Concorrente: ESBMC usava portfólio de solvers SMT (Z3, Boolector, Yices) para reduzir UNKNOWN -- **Híbrido (2020, TACAS)**: fuzzing (LibFuzzer) + execução simbólica (KLEE) + invariantes indutivos (Crab-LLVM) em iterative deepening - - Concorrente: FuSeBMC introduzia smart seeds com orquestração BMC→fuzzer, atingindo >81% cobertura — Map2Check operava motores em fases estanques - -## Key Concepts -- **CPAchecker**: framework de verificação configurável com múltiplas estratégias — referência desde SV-COMP 2013 -- **Iterative Deepening**: estratégia de aprofundamento progressivo alternando fuzzing e execução simbólica -- **Crab-LLVM**: análise estática baseada em interpretação abstrata para geração de invariantes indutivos — `crabllvm2021` -- **Portfólio de solvers SMT**: uso combinado de Z3, Boolector, Yices para maximizar a taxa de resultados conclusivos -- **Estagnação (2019-2025)**: LLVM 6.0 EOL (2019), Ubuntu 16.04 EOL (2021), KLEE 2.0 fork perdeu compatibilidade com Z3 - -## Mental Models -- Pense na **evolução como débito técnico acumulado**: sem manutenção contínua, 7 anos de stack parada exigem migração completa (35 commits, 84 arquivos, +5.785/-657 linhas) -- Use **comparação com concorrentes como diagnóstico**: cada checkpoint revela a feature ausente (multi-estratégia em 2016, slicing em 2018, orquestração em 2020) -- Pense no **renascimento como pré-requisito de engenharia**: a base moderna (LLVM 16, CI/CD, Docker) é condição necessária para qualquer avanço algorítmico futuro - -## Anti-patterns -- **Publicar e abandonar**: 3 artigos TACAS (2016, 2018, 2020) sem manutenção contínua → estagnação de 7 anos -- **Depender de fork customizado**: KLEE 2.0 fork perdeu compatibilidade com Z3 e bibliotecas de runtime — usar upstream sempre que possível -- **Motores sem orquestração dinâmica**: fases estanques perdem eficiência vs. smart seeds com realimentação em tempo real - -## Key Takeaways -1. 2016: BMC com CBMC — CPAchecker já usava múltiplas estratégias, Map2Check dependia de 1 solver -2. 2018: KLEE + LLVM — Symbiotic integrava slicing, ESBMC usava portfólio de solvers -3. 2020: Fuzzing + KLEE + Crab-LLVM — FuSeBMC introduzia smart seeds com >81% cobertura -4. 2019-2025: Estagnação total — LLVM 6 EOL, Ubuntu 16.04 EOL, sem CI/CD -5. 2026: Renascimento — 35 commits, 84 arquivos, modernização completa -6. A ausência de slicing, orquestração dinâmica e portfólio de solvers são débitos técnicos identificados - -## Connects To -- **Ch 1**: Introdução — contexto dos concorrentes e motivação para o renascimento -- **Ch 3**: Arquitetura — o pipeline modernizado que endereça a estagnação técnica -- **Ch 4**: Análise Experimental — resultados que validam a viabilidade competitiva após o renascimento -- **Pré-projeto Map2Check 2.0**: próximos passos (DG Library, AFL++, Smart Seeds) — features que os concorrentes já tinham diff --git a/.opencode/skills/map2check-sbseg2026/chapters/ch03-arquitetura.md b/.opencode/skills/map2check-sbseg2026/chapters/ch03-arquitetura.md deleted file mode 100644 index 325086dfb..000000000 --- a/.opencode/skills/map2check-sbseg2026/chapters/ch03-arquitetura.md +++ /dev/null @@ -1,82 +0,0 @@ -# Chapter 3: Arquitetura e Funcionalidades - -## Core Idea -O pipeline do Map2Check 2026 opera em 5 estágios: compilação C → LLVM IR (Clang-16), instrumentação por 9 passes (opt, New PM), linkagem com runtime (llvm-link), análise por KLEE 3.1/LibFuzzer, e veredito + witness GraphML. A infraestrutura CI/CD + Docker + OpenSSF Best Practices garante reprodutibilidade e sustentabilidade. - -## Frameworks Introduzidos -- **Pipeline de 5 Estágios**: - 1. Compilação: `clang-16 -O0` → LLVM IR - 2. Instrumentação: `opt` com 9 passes New PM → bitcode instrumentado com chamadas à runtime - 3. Linkagem: `llvm-link` → bitcode + runtime library - 4. Análise: KLEE 3.1 (execução simbólica) ou LibFuzzer (fuzzing) - 5. Veredito: TRUE/FALSE/UNKNOWN + witness GraphML com contra-exemplo - -- **New Pass Manager (PassInfoMixin)**: API moderna do LLVM — substitui Legacy PM (FunctionPass/ModulePass) - - When to use: sempre — Legacy PM está deprecado desde LLVM 13 - - How: herdar de `PassInfoMixin`, registrar via `PassPluginLibraryInfo` e `registerPipelineParsingCallback` - -## Técnicas Empregadas nos Passes - -| Pass | Técnica | Vulnerabilidade coberta | -|:-----|:--------|:------------------------| -| **MemoryTrackPass** | Análise de fluxo de dados | Use-after-free (CWE-416), Double-free (CWE-415), Memory leak (CWE-401) | -| **OverflowPass** | Análise de intervalos | Buffer overflow (CWE-119/787), Integer overflow (CWE-190) | -| **GenerateAutomataTruePass** | Geração de autômato GraphML | Witness para validação externa (CPAchecker) | -| Demais passes | Suporte: predicados em laços, nondet, cobertura BB, asserts | Infraestrutura de verificação | - -## Key Concepts -- **Witness GraphML**: formato padronizado SV-COMP descrevendo o caminho de execução até a violação como autômato — validável por ferramentas como CPAchecker -- **Runtime Library**: biblioteca C compilada a `.bc`, linkada ao bitcode instrumentado — implementa checks de runtime (bounds, alloc/free tracking, deref validation) -- **OpenSSF Best Practices**: programa de certificação de boas práticas para projetos open source — `openssf2024` -- **Sanitizers**: ASAN (AddressSanitizer), UBSAN (UndefinedBehavior), TSAN (ThreadSanitizer) — detectam bugs na própria ferramenta, não nos programas analisados -- **CI/CD (GitHub Actions)**: build automatizado com GCC e Clang, 7/7 unit tests, 9/9 pass plugin load tests, static analysis (clang-tidy, cppcheck) - -## Mental Models -- Use **compilação -O0** com New PM porque preserva debug info para contra-exemplos precisos -- Pense em **witness GraphML como contrato de verificabilidade**: qualquer ferramenta pode validar o veredito reexecutando o witness -- Use **Docker como contrato de reprodutibilidade**: `Dockerfile.dev` (Ubuntu 22.04 + LLVM 16 + KLEE 3.1) documenta cada dependência -- Trate **sanitizers como primeira linha de defesa** da própria ferramenta — detectam bugs que unit tests perdem - -## Anti-patterns -- **Misturar Legacy PM com New PM**: APIs incompatíveis — qualquer `ModulePass` legado quebra o pipeline `opt-16` -- **CI/CD sem testes E2E**: unit tests (7/7) não detectaram 3 inconsistências na API do New PM — testes de integração são indispensáveis -- **Build não containerizado**: "funciona na minha máquina" invalida resultados científicos — Docker é requisito mínimo de reprodutibilidade - -## Worked Example -**Pipeline E2E — benchmark `array-2.c`:** - -```bash -# 1. Compilar C → LLVM IR -clang-16 -emit-llvm -g -c array-2.c -o array-2.bc - -# 2. Instrumentar com 9 passes -opt -load-pass-plugin=libMemoryTrackPass.so \ - -load-pass-plugin=libOverflowPass.so \ - ... \ - -passes='memory-track,overflow,...' \ - array-2.bc -o array-2-instr.bc - -# 3. Linkar com runtime -llvm-link array-2-instr.bc \ - Map2CheckFunctions.bc \ - AnalysisModeMemtrack.bc \ - ... -o array-2-final.bc - -# 4. Executar KLEE -klee --target-function=reach_error array-2-final.bc - -# 5. Resultado: FALSE + counter-example (nondet_int → 31763) -``` - -## Key Takeaways -1. Pipeline em 5 estágios: compilar → instrumentar (9 passes NPM) → linkar → analisar → veredito + witness -2. MemoryTrackPass usa análise de fluxo de dados, OverflowPass usa análise de intervalos -3. Witness GraphML permite validação externa por CPAchecker — padrão SV-COMP -4. CI/CD + Docker + sanitizers + static analysis + OpenSSF = base de engenharia sustentável -5. 7/7 unit tests + 9/9 pass plugin load tests passando no CI -6. 3 inconsistências NPM descobertas durante migração — nenhuma detectável por unit tests - -## Connects To -- **Ch 2**: História — do Legacy PM (LLVM 6) ao New PM (LLVM 16) -- **Ch 4**: Análise Experimental — resultados do pipeline no TestComp 2026 -- **OpenSSF Best Practices**: certificação de segurança e qualidade — `openssf2024` diff --git a/.opencode/skills/map2check-sbseg2026/chapters/ch04-ciberseguranca.md b/.opencode/skills/map2check-sbseg2026/chapters/ch04-ciberseguranca.md deleted file mode 100644 index 3b71c4ade..000000000 --- a/.opencode/skills/map2check-sbseg2026/chapters/ch04-ciberseguranca.md +++ /dev/null @@ -1,82 +0,0 @@ -# Chapter 4: Análise Experimental - -## Core Idea -O Map2Check 2026 foi validado no TestComp 2026 (Heap: 594 tasks, score 57, 56 bugs reais). O mapeamento SV-COMP → CWE estabelece a ferramenta como ponte entre verificação formal e cibersegurança. O suporte a WASM estende o pipeline para análise de binários WebAssembly via wasm2c. - -## Mapeamento SV-COMP → CWE - -| Propriedade SV-COMP | CWE | Técnica | -|---------------------|-----|---------| -| `valid-free` | CWE-415 (Double-Free) | Análise de fluxo de dados (MemoryTrackPass) | -| `valid-deref` | CWE-416 (Use-After-Free) | Análise de fluxo de dados (MemoryTrackPass) | -| `valid-memtrack` | CWE-401 (Memory Leak) | Tracking de alocações (MemoryTrackPass) | -| `valid-memsafety` | CWE-119/787 (Buffer Overflow) | Análise de intervalos + fluxo de dados | -| `no-overflow` | CWE-190 (Integer Overflow) | Análise de intervalos (OverflowPass) | - -## Frameworks Introduzidos -- **CWE Mapping Framework**: cada propriedade de memory safety do SV-COMP mapeia para um CWE do MITRE + técnica empregada - - When to use: para comunicar resultados de verificação formal para times de AppSec - - How: associar `propriedade → CWE → pass/técnica` em tabela de referência - -## Key Concepts -- **TestComp 2026 Heap**: sub-categoria `C.coverage-error-call.Heap`, 594 tasks, timeout 300s, solver Z3, target `reach_error` -- **Resultados consolidados**: TRUE 264 (44.4%), UNKNOWN 271 (45.6%), FALSE 56 bugs reais (9.4%), TIMEOUT 2 (0.3%) -- **Heap set**: 428 tasks — 39 FALSE, 203 TRUE, 184 UNKNOWN, 2 TIMEOUT -- **LinkedLists set**: 166 tasks — 18 FALSE, 61 TRUE, 87 UNKNOWN, 0 TIMEOUT -- **Smoke test validado**: `array-1.c` → TRUE (VERIFICATION SUCCEEDED), `array-2.c` → FALSE + counter-example `nondet_int → 31763` -- **WASM pipeline**: `.wasm → wasm2c (WABT 1.0.41) → .c → clang-16 → .bc → passes → KLEE` -- **wasi-sdk 33.0**: toolchain para compilar C → WASM com target `wasm32-wasip1` -- **Per-allocation bounds check WASM**: MemoryTrackPass intercepta `w2c_*_dlmalloc`/`dlfree` e injeta `map2check_wasm_check_access` em loads/stores -- **Juliet WASM**: 15 casos validados (CWE-121/122/124/126/127); 15/15 FALSE com timeout 290s -- **Linear memory gap**: heap detectável via dlmalloc; stack/globals sem alocador visível → inviável no MVP (mas Juliet stack/underread também foram detectados) - -## Mental Models -- Use **UNKNOWN como KPI de engenharia**: 45.6% não é fracasso, é direcionamento — timeout tuning, estratégias de solver, path exploration heuristics -- Pense em **CWE como ponte academia-indústria**: o mapeamento torna resultados de verificação formal interpretáveis por profissionais de AppSec -- Use **WASM como novo vetor de memory safety**: mesmo pipeline LLVM, binários de terceiros (Wasmtime, Wasmer), sem reimplementar lógica de verificação -- Pense em **smoke test como sanity check**: 2 benchmarks canônicos (TRUE + FALSE) validam o pipeline completo em segundos - -## Anti-patterns -- **Confiar apenas em unit tests**: 7/7 passando e ainda assim 3 inconsistências NPM escaparam → testes E2E são indispensáveis -- **Usar gráfico de pizza sem baseline**: comparar TRUE/FALSE/UNKNOWN sem baseline de concorrente não agrega — usar tabela numérica -- **Tratar WASM como "trabalho futuro"**: pipeline funcional (lifting validado), feature em desenvolvimento ativo — reportar como contribuição em andamento -- **Fazer o CI passar sem executar KLEE**: 8 commits consecutivos adaptando include paths e tornando WasmRuntimeStubs opcional deram green checkmark, mas não validaram o pipeline real — job Docker E2E necessário - -## 3 Inconsistências Corrigidas na Migração - -| Problema | Causa | Impacto | -|:---------|:------|:--------| -| KLEE 3.1 flags | Flags removidas entre KLEE 2.0 → 3.1 | `Unknown command line argument` — ferramenta não executava | -| Passes ignorados | `optnone` + New PM: passes não executam sem `isRequired()` | Instrumentação silenciosamente ausente — falsos TRUE | -| Target function | `__VERIFIER_error` vs `reach_error` — env var vs `cl::opt` | KLEE procurava função errada — veredito incorreto | - -Nenhum desses problemas era detectável pelos 7/7 unit tests, que cobrem apenas a biblioteca C de runtime. - -## Worked Example -**Validação E2E — smoke test:** - -```bash -# TRUE case: sem bug -$ map2check --property-file coverage-error-call.prp array-1.c -VERIFICATION SUCCEEDED - -# FALSE case: buffer overflow detectado -$ map2check --property-file coverage-error-call.prp array-2.c -VERIFICATION FAILED -Counter-example: nondet_int() → 31763, line 19, main -``` - -## Key Takeaways -1. TestComp 2026 Heap: 594 tasks, score 57, 56 bugs reais (9.4% FALSE), 45.6% UNKNOWN -2. Mapeamento CWE: 5 propriedades SV-COMP → 5 CWEs + técnica empregada — acionável por times AppSec -3. 3 inconsistências NPM corrigidas: KLEE flags, passes ignorados, target function — indetectáveis por unit tests -4. WASM: pipeline funcional (wasm2c 1.0.41 + wasi-sdk 33.0), lifting validado, per-allocation bounds check implementado -5. Juliet WASM: 15 casos (CWE-121/122/124/126/127), 15/15 FALSE com timeout 290s -6. Timeout é KPI de engenharia: 110s → UNKNOWN, 290s → FALSE nos casos Juliet WASM -7. Smoke tests canônicos (`array-1.c` TRUE, `array-2.c` FALSE) validam pipeline E2E em segundos - -## Connects To -- **Ch 3**: Arquitetura — cada pass da seção 3 mapeia para CWE e resultado TestComp -- **Ch 6**: Conclusão — limitações (UNKNOWN 45.6%) e perspectivas (WASM, E2E tests) -- **Ch 5**: (removida do paper — Demonstração ao vivo era requisito do edital, não conteúdo) -- **MITRE CWE Top 25**: taxonomia padrão da indústria — `cwe2025` diff --git a/.opencode/skills/map2check-sbseg2026/chapters/ch06-conclusao.md b/.opencode/skills/map2check-sbseg2026/chapters/ch06-conclusao.md deleted file mode 100644 index 4805c9ba8..000000000 --- a/.opencode/skills/map2check-sbseg2026/chapters/ch06-conclusao.md +++ /dev/null @@ -1,64 +0,0 @@ -# Chapter 6: Conclusão - -## Core Idea -O Map2Check 2026 é um feito de engenharia — 35 commits, 84 arquivos, +5.785/-657 linhas para modernizar a stack completa. A validação no TestComp 2026 (score 57) comprova viabilidade competitiva. Os próximos passos são reduzir UNKNOWN (45.6%), adicionar testes E2E no CI e completar o suporte WASM. - -## Resumo dos Resultados - -| Métrica | Valor | -|:--------|:------| -| Commits | 35 | -| Arquivos modificados | 84 | -| Linhas adicionadas/removidas | +5.785 / -657 | -| Passes migrados (Legacy PM → New PM) | 9/9 | -| Unit tests | 7/7 | -| Pass plugin load tests | 9/9 | -| TestComp 2026 Heap | 594 tasks, score 57 | -| Bugs reais detectados (FALSE) | 56 (9.4%) | - -## Frameworks Introduzidos -- **Avaliação de Ferramentas de Verificação em 3 Dimensões**: - 1. Corretude: TRUE/FALSE acurácia — 56 bugs reais detectados - 2. Completude: % UNKNOWN — 45.6% inconclusivos - 3. Qualidade de engenharia: CI/CD, Docker, sanitizers, OpenSSF, reprodutibilidade - - When to use: autoavaliação contínua e planejamento de melhorias - - How: medir cada dimensão separadamente, priorizar gargalos - -## Key Concepts -- **UNKNOWN (45.6%)**: maior gargalo — timeout de 300s insuficiente, path exploration não otimizada, solver Z3 sem tuning -- **Testes E2E ausentes**: 3 inconsistências NPM escaparam dos unit tests — pipeline completo (compile → instrument → link → execute) precisa ser automatizado no CI -- **WASM**: pipeline de lifting funcional (wasm2c 1.0.41 + wasi-sdk 33.0), passes em adaptação — feature em desenvolvimento ativo -- **OpenSSF Best Practices**: certificação em processo — atende critérios de disponibilidade, funcionalidade, reprodutibilidade, sustentabilidade - -## Mental Models -- Use **UNKNOWN como KPI de engenharia**: 45.6% direciona o próximo ciclo de desenvolvimento -- Pense em **modernização como pré-requisito, não como fim**: LLVM 16, CI/CD, Docker são a base para avanços algorítmicos futuros -- Use **TestComp como validação externa**: resultados reproduzíveis por terceiros via Docker + BenchExec -- Trate **WASM como crescimento orgânico do pipeline**: mesmo IR, mesmos passes, novo formato de entrada - -## Limitações - -1. **UNKNOWN alto (45.6%)**: timeout tuning, estratégias de solver SMT, heurísticas de path exploration -2. **Testes E2E ausentes no CI**: pipeline completo não automatizado — 3 bugs escaparam dos unit tests -3. **Sem baseline comparativo no TestComp**: resultados reportados sem comparação direta com concorrentes na mesma categoria -4. **WASM em desenvolvimento**: pipeline de lifting validado, mas passes ainda não adaptados para modelo de memória linear - -## Perspectivas - -1. **WASM**: completar adaptação dos passes para memória linear, benchmarks Juliet CWE-119/416 compilados para WASM -2. **Redução de UNKNOWN**: tuning de timeout, portfólio de solvers SMT, slicing estático (DG Library) -3. **Testes E2E no CI**: automatizar compile → instrument → link → execute com verificação de vereditos -4. **NÃO no escopo deste paper**: DG Library, AFL++, Smart Seeds, Coordenador — são trabalhos futuros do pré-projeto Map2Check 2.0 - -## Key Takeaways -1. Modernização de engenharia é pré-requisito para qualquer avanço — sem LLVM 16, CI/CD, Docker não há competição possível -2. TestComp 2026 score 57 é prova de viabilidade, não de excelência — há espaço significativo para melhoria -3. 45.6% UNKNOWN é a métrica-alvo para o próximo ciclo de desenvolvimento -4. WASM é a próxima fronteira de memory safety — pipeline de lifting funcional, passes em adaptação -5. Projeto open source, código público, infraestrutura de artefato validada — pronto para contribuições da comunidade - -## Connects To -- **Ch 4**: Resultados TestComp 2026 e CWE mapping — fundamento empírico para as conclusões -- **Ch 3**: Arquitetura — base de engenharia que viabilizou os resultados -- **Pré-projeto Map2Check 2.0**: próximos passos (DG, AFL++, Smart Seeds) — fora do escopo do paper SBSeg -- **WASM Implementation Plan**: `docs/paper-sbseg-2026/wasm-implementation-plan.md` diff --git a/.opencode/skills/map2check-sbseg2026/cheatsheet.md b/.opencode/skills/map2check-sbseg2026/cheatsheet.md deleted file mode 100644 index 2af07ca26..000000000 --- a/.opencode/skills/map2check-sbseg2026/cheatsheet.md +++ /dev/null @@ -1,80 +0,0 @@ -# Cheatsheet — Map2Check SBSeg 2026 - -## Decision Rules - -| Situação | Ação | Por quê | -|:---------|:-----|:--------| -| Pass LLVM não executa com `opt -O0` | Adicionar `isRequired() = true` | New PM só executa passes required em O0 | -| KLEE reclama de flag desconhecida | Verificar API da versão KLEE atual | Flags mudaram entre KLEE 2.0 → 3.x | -| Target function errada (ex: `__VERIFIER_error`) | Passar `-function-name=reach_error` na CLI | Nome da função-alvo inconsistente entre env var e cl::opt | -| UNKNOWN > 40% nos benchmarks | Investigar timeout tuning (300s → 600s?) + estratégias de solver | Timeout insuficiente ou path exploration não otimizada | -| Precisa garantir reprodutibilidade | Dockerfile.dev (Ubuntu 22.04 + LLVM 16) | Ambiente idêntico em qualquer máquina | -| Unit tests passando mas bugs escapam | Implementar testes E2E (compile → instrument → link → execute) | Unit tests não cobrem integração entre componentes | - -## Trade-off Matrix: Pipeline Stages - -| Estágio | Custo (tempo) | Cobertura | Precisão | -|:--------|:-------------|:----------|:---------| -| Fuzzing (LibFuzzer) | Baixo (segundos) | Alta (superficial) | Baixa (false positives) | -| Execução Simbólica (KLEE) | Alto (minutos) | Média (profunda) | Alta (contra-exemplos precisos) | -| Invariantes Indutivos (Crab-LLVM) | Médio | Baixa (propriedades específicas) | Alta (provas formais) | - -## Thresholds & Defaults - -| Parâmetro | Valor padrão | Significado | -|:----------|:------------|:------------| -| Timeout TestComp | 300s por task | Se verificação não converge em 5 min → UNKNOWN | -| Solver SMT | Z3 | Resolve path constraints na execução simbólica | -| Target function | `reach_error` | Função que indica violação de propriedade | -| Optimization level | O0 | Sem otimização para preservar debug info | -| Docker base | Ubuntu 22.04 | Sistema operacional do container de build | - -## Tells & Smells - -| Sinal | Diagnóstico provável | -|:------|:---------------------| -| Todos os passes carregam mas vereditos errados | `isRequired()` faltando → passes não executam de fato | -| `Unknown command line argument` no KLEE | Flags da versão KLEE 2.0 usadas com KLEE 3.1 | -| UNKNOWN consistente em benchmarks com loops | Timeout insuficiente ou path explosion em laços | -| FALSE em benchmark que deveria ser TRUE | Bug de regressão na instrumentação — rodar checkpoint | -| Cobertura de branches estagnada após N iterações | Magic number bloqueando fuzzer — acionar KLEE | - -## Checklist: Publicação SBSeg SF - -- [ ] Submissão até 20/jul/2026 -- [ ] 8 páginas (corpo) + até 2 páginas (referências/apêndices) -- [ ] Template SBC -- [ ] Vídeo técnico obrigatório (5-7 min) -- [ ] Pelo menos 1 autor inscrito no evento -- [ ] Demonstração ao vivo (Docker + pipeline E2E) -- [ ] CTA integrado ao camera ready (até 14/ago) -- [ ] Single-blind (autores conhecidos) -- [ ] Código aberto (elegível a prêmios) - -## WASM Pipeline Quick Reference - -| Comando | Descricao | -|:--------|:----------| -| `map2check --wasm --memtrack modulo.wasm` | Pipeline completo: lift + instrument + KLEE | -| `map2check --wasm --check-overflow modulo.wasm` | Deteccao de overflow aritmetico no WASM | -| `/opt/wasi-sdk-33.0-x86_64-linux/bin/clang --target=wasm32-wasip1 -o modulo.wasm modulo.c` | Compilar C para WASM | -| `wasm2c modulo.wasm -o modulo.c` | Lifting WASM para C (WABT 1.0.41) | - -## Propriedades Detectaveis no WASM - -| Propriedade | Detectavel? | Mecanismo | -|:------------|:------------|:----------| -| no-overflow (CWE-190) | Sim | OverflowPass: opera em operacoes binarias | -| coverage-error-call | Sim | TargetPass: busca reach_error() por nome | -| valid-free (CWE-415) | Parcial (heap) | dlmalloc interception: w2c_*_dlfree | -| valid-memtrack (CWE-401) | Parcial (heap) | dlmalloc interception: w2c_*_dlmalloc | -| valid-deref (CWE-119/787) | Parcial (heap) | Per-allocation bounds check | -| valid-memsafety (stack) | Nao | Linear memory gap: stack usa alloca, nao dlmalloc | - -## CI Debug (wasm-rt.h) - -| Erro | Causa | Correcao | -|:-----|:------|:---------| -| fatal error: wasm-rt.h not found | WABT nao instalado no CI | apt install wabt; find_path busca /usr/include | -| NO_DEFAULT_PATH bloqueia find_path | flag NO_DEFAULT_PATH em find_path | Remover NO_DEFAULT_PATH do CMakeLists.txt | -| WasmRuntimeStubs.bc falha | add_custom_target ALL forcou build | Remover ALL, tornar target opcional | diff --git a/.opencode/skills/map2check-sbseg2026/glossary.md b/.opencode/skills/map2check-sbseg2026/glossary.md deleted file mode 100644 index b0edc85b8..000000000 --- a/.opencode/skills/map2check-sbseg2026/glossary.md +++ /dev/null @@ -1,125 +0,0 @@ -# Glossary — Map2Check SBSeg 2026 - -**AFL++** — American Fuzzy Lop++, fuzzer guiado por cobertura, sucessor do AFL (Ch 1, Pré-projeto) - -**ASAN** — AddressSanitizer, detector de erros de memória em tempo de execução do LLVM (Ch 3) - -**AssertPass** — Pass LLVM que instrumenta chamadas a `__VERIFIER_assert` (Ch 3) - -**BMC** — Bounded Model Checking, verificação exaustiva até profundidade K de loops (Ch 2) - -**C++17** — Padrão C++ adotado na modernização, traz `std::filesystem`, structured bindings (Ch 3) - -**CBMC** — C Bounded Model Checker, verificador BMC usado na versão original do Map2Check (Ch 2) - -**CI/CD** — Continuous Integration / Continuous Deployment com GitHub Actions (Ch 3) - -**CPAchecker** — Framework de verificação configurável com múltiplas estratégias, referência desde SV-COMP 2013 (Ch 2) - -**Crab-LLVM** — Análise estática baseada em interpretação abstrata para invariantes indutivos (Ch 2) - -**CWE-119** — Buffer Overflow: acesso fora dos limites de buffer (Ch 1, Ch 4) - -**CWE-190** — Integer Overflow/Wraparound (Ch 4) - -**CWE-401** — Memory Leak: vazamento de memória alocada (Ch 1, Ch 4) - -**CWE-415** — Double-Free: liberação dupla do mesmo ponteiro (Ch 1, Ch 4) - -**CWE-416** — Use-After-Free: acesso a memória já liberada (Ch 1, Ch 4) - -**CWE-787** — Out-of-bounds Write (Ch 1, Ch 4) - -**DG Library** — Dependence Graph, biblioteca para slicing estático baseado em SDG (Pré-projeto) - -**Execução Simbólica** — Técnica que analisa programas com valores simbólicos, construindo path constraints (Ch 1) - -**FALSE (veredito)** — Propriedade de segurança violada: bug encontrado com contra-exemplo (Ch 4, Ch 5) - -**FuSeBMC** — Ferramenta de ponta com smart seeds e BMC para desbloquear fuzzer (Ch 1) - -**GenerateAutomataTruePass** — Pass que gera autômato de witness em GraphML (Ch 3) - -**GraphML** — Formato XML padronizado para witness de verificação SV-COMP (Ch 3) - -**isRequired()** — Método do New PM que declara passe como sempre requerido — fix crítico (Ch 3, Ch 4) - -**Iterative Deepening** — Combinação KLEE + LibFuzzer em fases alternadas (Ch 3) - -**KLEE** — Motor de execução simbólica para LLVM bitcode, versão 3.x (Ch 2, Ch 3) - -**Legacy Pass Manager** — API antiga do LLVM para passes, deprecada desde v13 (Ch 3) - -**LibFuzzer** — Motor de fuzzing do LLVM guiado por SanitizerCoverage (Ch 2, Ch 3) - -**LLVM 16** — Versão do framework LLVM adotada na modernização (Ch 3) - -**LLVM IR** — Representação Intermediária do LLVM, base para análise e instrumentação (Ch 1, Ch 3) - -**LoopPredAssumePass** — Pass que injeta predicados `__VERIFIER_assume` em laços (Ch 3) - -**Map2CheckLibrary** — Pass que renomeia `main` → `__map2check_main__` (Ch 3) - -**MemoryTrackPass** — Pass que instrumenta acessos a memória (alloc, free, deref) (Ch 3, Ch 4) - -**New Pass Manager** — API C++ moderna do LLVM, usa `PassInfoMixin` (Ch 3) - -**NonDetPass** — Pass que substitui `__VERIFIER_nondet_*` por chamadas simbólicas (Ch 3) - -**OpenSSF** — Open Source Security Foundation, checklist Best Practices (Ch 3) - -**OpenSSF Best Practices** — Programa de certificação de boas práticas para projetos open source (Ch 1, Ch 3, Ch 6) - -**OverflowPass** — Pass LLVM que emprega análise de intervalos para detectar buffer overflow e integer overflow (Ch 3, Ch 4) - -**SBSeg** — Simpósio Brasileiro de Segurança da Informação e de Sistemas Computacionais (Ch 5) - -**Smart Seeds** — Sementes geradas por BMC e injetadas no fuzzer (FuSeBMC) (Ch 1, Pré-projeto) - -**SMT Solver** — Satisfiability Modulo Theories, resolve path constraints (Z3) (Ch 1) - -**SV-COMP** — Competition on Software Verification, benchmark padrão (Ch 1) - -**Symbiotic** — Ferramenta que integra slicing estático (DG) com KLEE (Ch 1) - -**TargetPass** — Pass que marca função-alvo para verificação (e.g. `reach_error`) (Ch 3) - -**TestComp 2026** — Competition on Software Testing, sub-categoria Heap (Ch 4) - -**TrackBasicBlockPass** — Pass que rastreia cobertura de blocos básicos (Ch 3) - -**TRUE (veredito)** — Propriedade de segurança garantida: programa é seguro (Ch 4) - -**TSAN** — ThreadSanitizer, detector de data races do LLVM (Ch 3) - -**UBSAN** — UndefinedBehaviorSanitizer, detector de comportamento indefinido do LLVM (Ch 3) - -**UNKNOWN (veredito)** — Verificação inconclusiva dentro do timeout (Ch 4, Ch 6) - -**WASM** — WebAssembly, módulos portáteis para runtimes como Wasmtime/Wasmer (Ch 4, Ch 6) - -**Witness** — Evidência de verificação: contra-exemplo ou prova de corretude (Ch 3) - -**Z3** — Solver SMT da Microsoft Research, usado como solver padrão no Map2Check (Ch 4) - -**CPAchecker** — Framework de verificação configurável com múltiplas estratégias (análise de valor, predicate abstraction, BMC) (Ch 2) - -**Program Slicing** — Técnica de redução de código que remove trechos irrelevantes para a propriedade de segurança (Ch 1, Ch 2) - -**Smart Seeds** — Sementes geradas por BMC e injetadas no fuzzer para desbloquear caminhos com magic numbers (Ch 1, Pré-projeto) - -**wasi-sdk** — Toolchain para compilar C para WASM com target `wasm32-wasip1` (Ch 4, Implementation Plan) - -**Portfólio de Solver** — Uso combinado de múltiplos solvers SMT (Z3, Boolector, Yices) para maximizar taxa de resultados conclusivos (Ch 2) - -**wasm2c** — Ferramenta do WABT que converte binários `.wasm` para código C com semântica preservada. Gera funções `w2c_*_dlmalloc`/`w2c_*_dlfree` para alocação dinâmica e `w2c_*_start` como entrypoint (Ch 4) - -**Linear Memory** — Array contíguo de bytes (`u8[]`) que serve como heap, stack e dados no WebAssembly. O `wasm2c` modela como `wasm_rt_memory_t` com campos `data` (ptr) e `size` (bytes) (Ch 4) - -**dlmalloc** — Doug Lea's malloc, implementação do alocador do musl libc. Quando código C é compilado para WASM, o dlmalloc é compilado inline no binário; após lifting com `wasm2c`, aparece como funções `w2c_*_dlmalloc` (Ch 4) - -**Entrypoint Translation** — Padrão para converter o entrypoint do WASM (`w2c_*_start`) para `main()` compatível com o pipeline Map2Check. Implementado via `generateWasmWrapperStatic` que instancia o módulo, invoca `_start` e libera recursos (Ch 4) - -**Per-Allocation Bounds** — Rastreamento de limites de memória por alocação individual, via interceptação de `w2c_*_dlmalloc`/`dlfree` no MemoryTrackPass. Detecta buffer overflow em heap (malloc-based) mas não em stack/globais (Ch 4) - -**WasmRuntimeStubs** — Substitui as funções de runtime do WABT (`wasm_rt_allocate_memory` baseado em mmap) por implementações KLEE-friendly (`calloc`/`free`). Redireciona `wasm_rt_trap` para `map2check_error` (Ch 4) diff --git a/.opencode/skills/map2check-sbseg2026/patterns.md b/.opencode/skills/map2check-sbseg2026/patterns.md deleted file mode 100644 index 85ab0bd58..000000000 --- a/.opencode/skills/map2check-sbseg2026/patterns.md +++ /dev/null @@ -1,86 +0,0 @@ -# Patterns — Map2Check SBSeg 2026 - -## Hybrid Verification Pipeline -**When to use**: programas C complexos onde nem fuzzing puro nem execução simbólica pura bastam -**How**: fases alternadas — LibFuzzer explora rápido bugs superficiais, KLEE resolve branches com magic numbers via path constraints -**Trade-offs**: fuzzer é rápido mas cego para branches complexos; KLEE é preciso mas sofre de path explosion - -## Pass Migration Pattern (Legacy PM → New PM) -**When to use**: migrar qualquer pass LLVM do Legacy Pass Manager -**How**: -1. Herdar de `PassInfoMixin` em vez de `ModulePass`/`FunctionPass` -2. Implementar `PreservedAnalyses run(Function &F, FunctionAnalysisManager &AM)` ou `run(Module &M, ModuleAnalysisManager &AM)` -3. Registrar com `PassPluginLibraryInfo` e callback `PB.registerPipelineParsingCallback` -4. **Sempre** retornar `isRequired() = true` — sem isso, `opt -O0` pula o pass -**Trade-offs**: New PM é mais verboso mas oferece análise lazy e paralelismo - -## CWE Mapping Pattern -**When to use**: tornar resultados de verificação formal acionáveis para times de AppSec -**How**: -1. Identificar qual propriedade SV-COMP cada pass verifica (ex: valid-free → CWE-415) -2. Documentar mapeamento em tabela: Propriedade → CWE → Pass responsável -3. Gerar output que referencia CWEs diretamente (ex: "CWE-416 detected at line 42") -**Trade-offs**: nem toda violação de propriedade SV-COMP tem CWE correspondente direto - -## Checkpoint Validation Pattern -**When to use**: garantir que correções não introduzem regressões silenciosas -**How**: -1. Selecionar benchmarks canônicos (ex: `array-1.c`, `array-2.c`) -2. Executar pipeline completo e capturar veredito + counter-example -3. Comparar com baseline (veredito esperado + contra-exemplo esperado) -4. Automatizar com scripts `run_checkpoint.sh` + `verify_verdicts.sh` -**Trade-offs**: cobre apenas os benchmarks selecionados, não detecta regressões em paths não testados - -## Docker Reproducibility Pattern -**When to use**: garantir que resultados são reproduzíveis em qualquer máquina -**How**: -1. `Dockerfile.dev` baseado em Ubuntu 22.04 + LLVM 16 + KLEE 3.1 -2. Instalar todas as dependências no Dockerfile (sem "funciona na minha máquina") -3. Build automatizado no CI (GitHub Actions) -4. Documentar comandos exatos de build e execução -**Trade-offs**: imagem Docker é grande (~GBs) mas elimina barreiras de instalação e garante reprodutibilidade científica - -## Iterative Deepening Pattern -**When to use**: combinar fuzzing + execução simbólica eficientemente -**How**: -1. Fase 1: LibFuzzer explora com seeds aleatórias, cobre caminhos superficiais -2. Fase 2: Sementes que estagnam (sem novos branches) são passadas ao KLEE -3. Fase 3: KLEE resolve path constraints, gera novas entradas que desbloqueiam caminhos -4. Repetir até timeout ou cobertura-alvo atingida -**Trade-offs**: custo de transição entre fases (serialização/deserialização de estado) pode dominar em programas pequenos - -## Static Analysis + Sanitizers Quality Gate -**When to use**: manter qualidade do código da própria ferramenta de verificação -**How**: -1. `.clang-tidy` config para C++, `.cppcheck-suppressions.txt` para C -2. CMake targets: ASAN, UBSAN, TSAN -3. Script `run-static-analysis.sh` executa todas as verificações -4. CI (GitHub Actions) roda static analysis + sanitizers em cada push -**Trade-offs**: sanitizers adicionam overhead de runtime (2-5x), mas detectam bugs que testes unitários perdem - -## WASM Lifting Pipeline -**When to use**: verificar memory safety em binarios .wasm de terceiros -**How**: -1. wasm2c (WABT 1.0.41) converte .wasm para codigo C com runtime musl inline -2. Clang-16 compila o C para LLVM IR, preservando semantica de alocacao -3. generateWasmWrapperStatic cria main() canonica que instancia o modulo e invoca w2c_*_start -4. llvm-link une IR levantado + wrapper, aplica passes Map2Check -5. KLEE executa o IR instrumentado com WasmRuntimeStubs.bc (KLEE-friendly) -**Trade-offs**: overhead do IR levantado (~43 funcoes) vs C nativo (~15 funcoes) - -## dlmalloc Interception for Per-Allocation Bounds -**When to use**: detectar heap overflow em codigo WASM gerado a partir de C (wasi-sdk/musl) -**How**: -1. MemoryTrackPass identifica w2c_*_dlmalloc/dlfree por StringRef::contains -2. instrumentWasmMalloc extrai offset (i32 retorno) + size (arg), registra no AllocationLog -3. instrumentWasmFree marca offset como liberado -4. instrumentWasmBoundsCheck extrai offset do GEP e verifica via is_valid_allocation_address -**Trade-offs**: funciona para heap (3/3 Juliet FALSE), nao para stack/globals (12/12 UNKNOWN) - -## Entrypoint Translation -**When to use**: unificar pipeline Map2Check (que espera main) com codigo levantado do wasm2c -**How**: -1. Extrair nome do modulo: w2c__start -2. Gerar wrapper C com main() que instancia, invoca _start e libera -3. Compilar wrapper para .bc, linkar com IR levantado via llvm-link -**Trade-offs**: wrapper adiciona overhead minimo. Nomes hex (0x5F para _) tratados pelo WasmLifter diff --git a/README.md b/README.md index 0a94cc9c5..5a048f288 100644 --- a/README.md +++ b/README.md @@ -48,7 +48,9 @@ Releases starting from **v8.0.0-Songbirds** include WebAssembly verification sup

Map2Check can be invoked through a standard command-line interface. Map2Check should be called -in the installation directory as follows: +in the installation directory as follows: + +Example programs are available in the [examples/](examples/) directory.

``` bash diff --git a/docs/paper-sbseg-2026/PLAN.md b/docs/paper-sbseg-2026/PLAN.md deleted file mode 100644 index 6ba41c837..000000000 --- a/docs/paper-sbseg-2026/PLAN.md +++ /dev/null @@ -1,190 +0,0 @@ -# Map2Check 2026 — Artigo SBSeg SF - -**Documento-mestre de planejamento e progresso.** -Atualizado a cada iteração. Estado atual: Sprint 2 — Cibersegurança + WASM (artigo ~85% completo). - ---- - -## Metadados da Submissão - -| Campo | Valor | -|:------|:------| -| **Conferência** | SBSeg 2026 — Salão de Ferramentas (SF) | -| **Deadline submissão** | 20 de julho de 2026 | -| **Notificação** | 03 de agosto de 2026 | -| **Camera ready** | 14 de agosto de 2026 | -| **Evento** | 01–04 de setembro de 2026, Armação dos Búzios — RJ | -| **Template** | SBC (a ser obtido pelo usuário) | -| **Limite** | 8 páginas de corpo (figuras e tabelas incluídas) + até 2 de referências/apêndices | -| **Modo** | Single-blind (autores conhecidos pelos revisores) | -| **Idioma** | Português | -| **CTA** | Avaliação de artefato integrada ao CTA — submissão APÓS notificação (até 14/ago) | -| **Vídeo obrigatório** | Sim — link de instalação/uso | -| **Demonstração ao vivo** | Obrigatória — pelo menos 1 autor inscrito no evento | -| **Sistema** | JEMS3 | -| **IA Generativa** | Verificar Código de Conduta SBC — declarar uso se aplicável | - -**Título provisório:** *Map2Check 2026: Modernização Sustentável de uma Ferramenta de Verificação de Memory Safety com LLVM 16 e Extensão para WebAssembly* - ---- - -## Progresso por Seção - -| # | Seção | Páginas | Status | Última atualização | -|:---|:---|:---|:---|:---| -| 1 | Introdução e Motivação | ~1 | ✅ 95% — escrito e revisado | 2026-07-04 | -| 2 | História e Evolução | ~1 | ✅ 95% — escrito e revisado | 2026-07-04 | -| 3 | Arquitetura e Funcionalidades | ~2.5 | ✅ 90% — escrito e revisado | 2026-07-04 | -| 4 | Features de Cibersegurança | ~2 | ✅ 90% — Heap + CF×2 + Juliet WASM | 2026-07-04 | -| 5 | WebAssembly (Lifting + Verificação) | ~1 | ✅ 85% — pipeline + entrypoint + dlmalloc | 2026-07-04 | -| 6 | Demonstração Planejada | ~0.5 | 🟡 50% — texto escrito, falta URL do vídeo | 2026-07-04 | -| 7 | Avaliação, Perspectivas e Conclusão | ~1 | ✅ 90% — com resultados WASM | 2026-07-04 | -| — | Referências | ~1 | 🟡 Em backlog — aguardando usuário | — | -| — | Apêndice de Reprodutibilidade | ~1 | ✅ 90% — Docker + scripts | 2026-07-04 | - -**Progresso geral:** ~85% (artigo redigido, dados consolidados, pipeline WASM validado) - ---- - -## Progresso Específico — WebAssembly (Map2Check-WASM) - -**Documento de referência:** [`docs/migration/1.7-wasm-pipeline.md`](../migration/1.7-wasm-pipeline.md) - -| Sub-etapa | Descrição | Status | Sessão | -|:---|:---|:---|:---| -| 1.7.1 | Infraestrutura WABT no Docker | ✅ Concluído — 2026-06-27 | 1 | -| 1.7.2 | WasmLifter (frontend) | ✅ Concluído — 2026-06-27 | 1 | -| 1.7.3 | PoC end-to-end manual | ✅ Concluído — 2026-07-04 | 2 | -| 1.7.4 | MemoryTrackPass com bounds per-allocation | ✅ Concluído — 2026-07-04 | 2 | -| 1.7.5 | CLI `--wasm` + pipeline integrado | ✅ Concluído — 2026-07-04 | 3 | -| 1.7.6 | Benchmarks Juliet WASM (15 casos) | ✅ Concluído — 2026-07-04 | 3 | -| 1.7.7 | Documentação e integração ao artigo | ✅ Concluído — 2026-07-04 | 4 | -| 1.7.8–1.7.12 | Taint analysis, threat modeling IoT, otimização SMT | 🔴 Trabalho futuro (pós-SBSeg) | — | - ---- - -## Checklist de Artefato CTA - -| Critério | Estado | Evidência | -|:---|:---|:---| -| **Disponibilidade** | ✅ OK | Repositório público (`hbgit/Map2Check`) + Docker image GHCR | -| **Funcionalidade** | ✅ OK | 7/7 unit tests + 9/9 passes carregam no opt-16 | -| **Reprodutibilidade** | ✅ OK | `Dockerfile.dev` + `test-comp2026/simulation/` scripts | -| **Sustentabilidade** | ✅ OK | CI/CD (GitHub Actions), `.clang-tidy`, `.cppcheck-suppressions.txt`, sanitizers, docs | - ---- - -## BACKLOG (dependências do usuário) - -| # | Item | Bloqueia | Prioridade | Estado | -|:---|:---|:---|:---|:---| -| 1 | **Referências BibTeX** (TACAS 2016, 2018, 2020 + outros) | Seção 2 (História) e Referências | 🔴 Alta | 🟡 Aguardando usuário | -| 2 | **Idioma** | Português | 🟢 OK | ✅ Decidido | -| 3 | **Template LaTeX SBC** | Geração do PDF final | 🔴 Alta | 🟡 Aguardando usuário | -| 4 | **Aprovação do orientador** no outline | Sprint 1 (redação das secções 1–3) | 🔴 Alta | 🟡 Aguardando usuário | -| 5 | **Gravação do vídeo técnico** (YouTube) | Seção 5 (Demonstração) | 🟡 Média | 🟡 Aguardando usuário | -| 6 | **Verificação Código de Conduta SBC** (IA generativa) | Declaração no artigo | 🟡 Média | 🟡 Aguardando usuário | -| 7 | **Presença no evento** (Búzios, 01–04/set) | Condição de aceitação | 🟢 OK | ✅ Confirmada | - ---- - -## Sprint 0 — Fundação (17–22/jun, ~5 dias) - -| Dia | Tarefa | Status | -|:---|:---|:---| -| 0 | Criar skill de persistência + diretório do artigo | ✅ Feito | -| 0 | Gerar figuras Mermaid (5 figuras) | ✅ Feito | -| 0 | Escrever PLAN.md + outline.md | ✅ Feito | -| 0 | Preparar roteiro do vídeo | ✅ Feito | -| 0 | Consolidar dados brutos em `data/` | ✅ Feito | -| 1 | Definir plano de implementação WASM (`docs/migration/1.7-wasm-pipeline.md`) | ✅ Feito | -| 1–2 | Implementar infraestrutura WABT no Docker + WasmLifter (1.7.1–1.7.2) | 🟡 Em andamento — sessão 1 | -| 2–3 | PoC end-to-end + adaptar MemoryTrackPass WASM (1.7.3–1.7.4) | 🔴 Não iniciado — sessão 2 | -| 3–4 | CLI `--wasm` + WasmBackend + benchmarks Juliet (1.7.5–1.7.6) | 🔴 Não iniciado — sessão 3 | -| 4 | Integrar resultados WASM ao outline + revisar com orientador | 🟡 Pendente | - -**Entregável Sprint 0:** Outline aprovado + ambiente de build reprodutível validado + plano WASM detalhado. - ---- - -## Sprint 1 — Núcleo Técnico e História (23/jun–02/jul, ~10 dias) - -| Dia | Tarefa | Seções | Status | -|:---|:---|:---|:---| -| 1–2 | Redigir Introdução e Motivação (rascunho) | Sec 1 | 🔴 Não iniciado | -| 3–4 | Redigir História e Evolução (rascunho) | Sec 2 | 🔴 Não iniciado | -| 5–8 | Redigir Arquitetura e Funcionalidades (rascunho) | Sec 3 | 🔴 Não iniciado | -| 9–10 | Produzir figuras finais + tabular resultados | — | 🔴 Não iniciado | - -**Entregável Sprint 1:** Seções 1–3 em draft + figuras + tabela de resultados consolidada. - ---- - -## Sprint 2 — Cibersegurança + WASM + Demo + Vídeo (03–13/jul, ~10 dias) - -| Dia | Tarefa | Seções | Status | -|:---|:---|:---|:---| -| 1–2 | Redigir Features de Cibersegurança | Sec 4 | 🔴 Não iniciado | -| 3–5 | Implementar pipeline WASM (sessões 2–3 de `1.7-wasm-pipeline.md`) | Sec 5 | 🟡 Em andamento — aguardando sessões | -| 5–6 | Redigir seção WebAssembly + resultados Juliet | Sec 5 | 🔴 Não iniciado | -| 7 | Redigir Demonstração Planejada | Sec 6 | 🔴 Não iniciado | -| 8 | Redigir Avaliação, Perspectivas e Conclusão | Sec 7 | 🔴 Não iniciado | -| 9–10 | Gravar e editar vídeo técnico | — | 🔴 Não iniciado | -| 10 | Escrever Apêndice de Reprodutibilidade | Apêndice | 🔴 Não iniciado | - -**Entregável Sprint 2:** Artigo completo em draft + pipeline WASM funcional + vídeo publicado + checklist CTA. - ---- - -## Sprint 3 — Revisão, Finalização e Submissão (14–20/jul, ~7 dias) - -| Dia | Tarefa | Status | -|:---|:---|:---| -| 1–2 | Revisão técnica e de escrita (todas as secções) | 🔴 Não iniciado | -| 3 | Checagem do limite de 8 páginas de corpo + formatação SBC | 🔴 Não iniciado | -| 4 | Declaração de uso de IA generativa (se aplicável) conforme Código de Conduta SBC | 🔴 Não iniciado | -| 5 | Revisão final + leitura por terceiro | 🔴 Não iniciado | -| 6–7 | Geração do PDF final e submissão no JEMS3 | 🔴 Não iniciado | - -**Entregável Sprint 3:** PDF submetido. - -> **Nota sobre CTA:** A avaliação de artefato é feita APÓS a notificação de aceite (03/ago). O artefato (container Docker, scripts, documentação) será refinado e submetido junto com o camera ready (14/ago). Não precisa estar 100% finalizado na submissão do artigo. - -> **Nota sobre demonstração ao vivo:** Pelo menos 1 autor deve estar inscrito no evento (01–04/set, Búzios) para demonstrar a ferramenta. Esta é uma condição de aceitação. - ---- - -## Notas de Iteração - -### Iteração 1 — 2026-06-20 -- **Todas as 7 seções redigidas** em português (Introdução, História, Arquitetura, Cibersegurança, WebAssembly, Demonstração, Conclusão + Apêndice). -- **Macros LaTeX** criadas para todos os dados numéricos (\TotalTasks, \ScoreTestComp, etc.). -- **Tabelas** inseridas: passes de instrumentação, mapeamento CWE, resultados TestComp 2026, bugs críticos. -- **Figuras** referenciadas: timeline, pipeline, passes, TestComp 2026, CI/CD. -- **Referências** ainda com placeholders `~\cite{}` — aguardando usuário inserir as chaves BibTeX corretas. -- **PDF não compilado** — ambiente sem pdflatex. Compilação a ser feita pelo usuário. -- BACKLOG: referências BibTeX + figuras PNG + compilação PDF + gravação vídeo. - -### Iteração 2 — 2026-06-23 -- **Plano WASM detalhado** criado em `docs/migration/1.7-wasm-pipeline.md` com 4 sessões de implementação. -- **Migration plan atualizado** (`docs/map2check_migration_plan.md`) com Fase 1.7, riscos e dependências. -- **PLAN.md do SBSeg atualizado** com nova seção WebAssembly (Sec 5) e título provisório revisado. -- **Status das sub-etapas WASM:** - - 1.7.1–1.7.2: 🟡 Em andamento (sessão 1 — infra + lifter) - - 1.7.3–1.7.4: 🔴 Não iniciado (sessão 2 — PoC + passes) - - 1.7.5–1.7.6: 🔴 Não iniciado (sessão 3 — CLI + benchmarks) - - 1.7.7: 🔴 Não iniciado (sessão 4 — artigo) - - 1.7.8–1.7.12: 🔴 Trabalho futuro (pós-SBSeg) - -### Iteração 4 — 2026-07-04 -- **Artigo ~85% completo** — todas as 7 seções redigidas, travessões removidos, texto corrido -- **Bounds checking por alocação implementado** — 3/3 Juliet heap FALSE (CWE-122, 126) -- **Pipeline WASM validado end-to-end** — CLI `--wasm` funcional, 15 Juliet compilados -- **CI/CD corrigido** — `find_path` sem `NO_DEFAULT_PATH`, WasmRuntimeStubs opcional -- **Testes de integração** — `test_wasm_pipeline.sh` + `test_wasm_entrypoint.sh` -- **Pendente:** vídeo técnico + referências BibTeX + template SBC -- **Deadline:** 20/jul — 16 dias restantes - ---- - -*Última atualização: 2026-07-04* diff --git a/docs/paper-sbseg-2026/appendix/reprodutibilidade.md b/docs/paper-sbseg-2026/appendix/reprodutibilidade.md deleted file mode 100644 index e66e63646..000000000 --- a/docs/paper-sbseg-2026/appendix/reprodutibilidade.md +++ /dev/null @@ -1,31 +0,0 @@ -# Apendice — Reprodutibilidade - -**Estado:** Rascunho nao iniciado. -**Fontes:** Dockerfile.dev, test-comp2026/simulation/, .github/workflows/. - ---- - -## A.1 Build com Docker - -[PARAGRAFOS A REDIGIR] -- Comandos para build da imagem -- Comandos para execucao do container -- Verificacao do ambiente (clang-16, opt, cmake) - -## A.2 Execucao de benchmarks - -[PARAGRAFOS A REDIGIR] -- Comandos para smoke test -- Comandos para TestComp 2026 -- Verificacao de vereditos - -## A.3 CI e qualidade - -[PARAGRAFOS A REDIGIR] -- Link para GitHub Actions (nomes/instituicoes podem constar — single-blind) -- Comandos para static analysis -- Comandos para sanitizers - ---- - -*Nota: Aguardando redacao na Sprint 2.* diff --git a/docs/paper-sbseg-2026/data/consolidated-data.md b/docs/paper-sbseg-2026/data/consolidated-data.md deleted file mode 100644 index e7b7acd6e..000000000 --- a/docs/paper-sbseg-2026/data/consolidated-data.md +++ /dev/null @@ -1,111 +0,0 @@ -# Dados Consolidados — Artigo SBSeg 2026 - -## TestComp 2026 — C.coverage-error-call.Heap - -| Resultado | Count | Porcentagem | -|:----------|:------|:------------| -| TRUE | 264 | 44.4% | -| UNKNOWN | 271 | 45.6% | -| FALSE | 56 | 9.4% | -| FALSE_FREE | 1 | 0.2% | -| TIMEOUT | 2 | 0.3% | -| **Total** | **594** | **100%** | -| **Score** | **57** | — | - -### Por Set - -| Set | Tasks | FALSE | TRUE | UNKNOWN | TIMEOUT | -|:----|:------|:------|:-----|:--------|:--------| -| Heap | 428 | 39 | 203 | 184 | 2 | -| LinkedLists | 166 | 18 | 61 | 87 | 0 | - -### Configuracao Experimental - -| Parametro | Valor | -|:----------|:------| -| LLVM | 16.0 | -| KLEE | 3.x (LLVM 16) | -| SMT Solver | Z3 | -| Timeout por task | 300s | -| Target function | reach_error | -| Property | coverage-error-call.prp | -| Benchmarks | sv-benchmarks tag testcomp26 | -| Ambiente | Docker (map2check-dev), single-container | -| Duracao total | ~20h (interrompida, retomada automaticamente) | - ---- - -## Smoke Test E2E - -| Benchmark | Esperado | Resultado | Status | -|:----------|:---------|:----------|:-------| -| loops/array-1.c | TRUE | VERIFICATION SUCCEEDED | OK | -| loops/array-2.c | FALSE | VERIFICATION FAILED + counter-example | OK | - -### Counter-example (array-2.c) - -``` -State 0: __VERIFIER_nondet_int() -> 31763, Line 19, Scope: main -State 1: __VERIFIER_nondet_int() -> 31763, Line 22, Scope: main -Violated property: file map2check_property line 7 function __VERIFIER_assert -FALSE: Target Reached -``` - ---- - -## Estatisticas de Modernizacao - -| Metrica | Valor | -|:--------|:------| -| Commits na branch feat-update (vs develop) | 35 | -| Arquivos alterados | 84 | -| Linhas adicionadas | +5.785 | -| Linhas removidas | −657 | -| Passes migrados (Legacy PM -> New PM) | 9 | -| Unit tests | 7/7 passando | -| Pass plugin load tests | 9/9 carregando no opt-16 | -| Bugs criticos encontrados e corrigidos | 3 | - -### Componentes Atualizados - -| Componente | Versao Anterior | Versao Nova | -|:-----------|:----------------|:------------| -| LLVM/Clang | 6.0 | 16.0 | -| KLEE | 2.x (fork custom) | 3.x | -| C++ Standard | C++11 | C++17 | -| CMake | >= 3.5 | >= 3.20 | -| Docker Base | Ubuntu 16.04 | Ubuntu 22.04 LTS | -| Pass Manager | Legacy (FunctionPass) | New PM (PassInfoMixin) | - ---- - -## Bugs Criticos Corrigidos - -| # | Bug | Sintoma | Causa Root | Commit | -|:--|:----|:--------|:-----------|:-------| -| 1 | KLEE 3.1 CLI flags | Unknown command line argument | Flags removidas na v3.x | 284aef1ac | -| 2 | isRequired() ausente | Passes pulados silenciosamente | optnone + New PM behavior | 0deb84e01 | -| 3 | Target function nao propagada | __VERIFIER_error em vez de reach_error | env var vs cl::opt mismatch | 0deb84e01 | - ---- - -## Mapeamento CWE <-> Propriedade SV-COMP - -| Propriedade SV-COMP | CWE | Descricao | Pass Principal | -|:--------------------|:----|:----------|:---------------| -| valid-free | CWE-415 | Double-free | MemoryTrackPass | -| valid-deref | CWE-119/787 | Buffer overflow / Invalid dereference | MemoryTrackPass + OverflowPass | -| valid-memtrack | CWE-401 | Memory leak | MemoryTrackPass | -| valid-memcleanup | CWE-401 | Memory leak (cleanup) | MemoryTrackPass | -| no-overflow | CWE-190 | Integer overflow | OverflowPass | - ---- - -## Checklist de Artefato CTA - -| Criterio | Estado | Evidencia | -|:---------|:-------|:----------| -| Disponibilidade | OK | Repo publico + Docker image GHCR | -| Funcionalidade | OK | 7/7 unit tests + 9/9 passes | -| Reprodutibilidade | OK | Dockerfile.dev + scripts benchmark | -| Sustentabilidade | OK | CI/CD + static analysis + sanitizers + docs | diff --git a/docs/paper-sbseg-2026/figures/fig1-timeline.mmd b/docs/paper-sbseg-2026/figures/fig1-timeline.mmd deleted file mode 100644 index 00da6bd91..000000000 --- a/docs/paper-sbseg-2026/figures/fig1-timeline.mmd +++ /dev/null @@ -1,32 +0,0 @@ -## Figura 1 — Timeline de Evolução do Map2Check (2016→2026) - -```mermaid -timeline - title Evolução do Map2Check - 2016 : TACAS 2016 - : "Hunting Memory Bugs" - : BMC com CBMC - 2018 : TACAS 2018 - : LLVM + KLEE - : Execução Simbólica - 2020 : TACAS 2020 - : Abordagem Híbrida - : LibFuzzer + KLEE + Crab-LLVM - 2019 : Último release v7.3.1 - : Estagnação até 2025 - 2026 : SBSeg 2026 - : Renascimento - : LLVM 16 + New PM + C++17 - : CI/CD + TestComp 2026 -``` - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar como SVG/PNG via: -```bash -mmdc -i fig1-timeline.mmd -o fig1-timeline.svg -``` - -**Observação para redação:** -- A timeline mostra claramente o hiato de 2019→2026 -- Usar como figura na Seção 2 (História e Evolução) diff --git a/docs/paper-sbseg-2026/figures/fig2-pipeline.mmd b/docs/paper-sbseg-2026/figures/fig2-pipeline.mmd deleted file mode 100644 index d60505f7a..000000000 --- a/docs/paper-sbseg-2026/figures/fig2-pipeline.mmd +++ /dev/null @@ -1,50 +0,0 @@ -## Figura 2 — Pipeline de Verificação Map2Check 2026 - -```mermaid -flowchart LR - subgraph Entrada - A[Código C\n(.c/.i)] - end - - subgraph Frontend - B[clang-16\n-O0 -emit-llvm] - C[LLVM IR\n(.bc)] - end - - subgraph Instrumentação - D[opt-16\n-load-pass-plugin] - E["9 Passes New PM\n(Assert, Target, LoopPred,\nMap2CheckLib, NonDet,\nTrackBB, Overflow,\nAutomata, MemoryTrack)"] - end - - subgraph Linking - F[llvm-link] - G[Bitcode\nInstrumentado] - end - - subgraph Motores - H["KLEE 3.1\n(Execução Simbólica)"] - I["LibFuzzer\n(Fuzzing)"] - end - - subgraph Saída - J[Veredito\nTRUE / FALSE / UNKNOWN] - K[Witness\n(GraphML)] - L[Teste\n(Concreto)] - end - - A --> B --> C --> D --> E --> F --> G - G --> H - G --> I - H --> J - H --> K - H --> L - I --> J -``` - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar como SVG/PNG. - -**Observação para redação:** -- Destacar que o pipeline é executado inteiramente dentro do container Docker -- Usar como figura principal na Seção 3 (Arquitetura) diff --git a/docs/paper-sbseg-2026/figures/fig3-passes.mmd b/docs/paper-sbseg-2026/figures/fig3-passes.mmd deleted file mode 100644 index c058a560d..000000000 --- a/docs/paper-sbseg-2026/figures/fig3-passes.mmd +++ /dev/null @@ -1,54 +0,0 @@ -## Figura 3 — Passes de Instrumentação (New Pass Manager) - -```mermaid -flowchart TB - subgraph "Entrada: LLVM IR" - IR["Module LLVM\nFunções C instrumentadas"] - end - - subgraph "Passes de Análise" - A[AssertPass] - B[TargetPass] - C[LoopPredAssumePass] - D[Map2CheckLibrary] - E[NonDetPass] - F[TrackBasicBlockPass] - G[OverflowPass] - H[GenerateAutomataTruePass] - I[MemoryTrackPass] - end - - subgraph "Saída: LLVM IR Instrumentado" - OUT["Module LLVM\n+ Calls para Runtime\n+ Metadados de Witness"] - end - - IR --> A & B & C & D & E & F & G & H & I --> OUT - - style A fill:#e1f5e1 - style B fill:#e1f5e1 - style C fill:#e1f5e1 - style D fill:#e1f5e1 - style E fill:#fff5e1 - style F fill:#fff5e1 - style G fill:#ffe1e1 - style H fill:#ffe1e1 - style I fill:#ffe1e1 - - LEG1["🟢 Simples"] - LEG2["🟡 Médios"] - LEG3["🔴 Complexos"] -``` - -**Legenda:** -- 🟢 **Simples** (~130–160 LOC): AssertPass, TargetPass, LoopPredAssumePass, Map2CheckLibrary -- 🟡 **Médios** (~330–400 LOC): NonDetPass, TrackBasicBlockPass -- 🔴 **Complexos** (~520–900 LOC): OverflowPass, GenerateAutomataTruePass, MemoryTrackPass - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar como SVG/PNG. - -**Observação para redação:** -- Mencionar que todos os 9 passes declaram `static bool isRequired() { return true; }` -- Sem isso, `opt -O0` pula os passes em funções com atributo `optnone` -- Usar como figura na Seção 3.2 diff --git a/docs/paper-sbseg-2026/figures/fig4-testcomp2026.mmd b/docs/paper-sbseg-2026/figures/fig4-testcomp2026.mmd deleted file mode 100644 index 6c0346331..000000000 --- a/docs/paper-sbseg-2026/figures/fig4-testcomp2026.mmd +++ /dev/null @@ -1,41 +0,0 @@ -## Figura 4 — Resultados TestComp 2026: C.coverage-error-call.Heap - -```mermaid -pie title Resultados Consolidados (594 tasks) - "TRUE (264)" : 264 - "UNKNOWN (271)" : 271 - "FALSE (56)" : 56 - "TIMEOUT (2)" : 2 - "FALSE_FREE (1)" : 1 -``` - ---- - -### Tabela complementar (para inserir no corpo do artigo) - -| Resultado | Count | % | -|:----------|:------|:--| -| TRUE | 264 | 44.4% | -| UNKNOWN | 271 | 45.6% | -| FALSE | 56 | 9.4% | -| FALSE_FREE | 1 | 0.2% | -| TIMEOUT | 2 | 0.3% | -| **Total** | **594** | **100%** | -| **Score** | **57** | — | - -### Por set - -| Set | Tasks | FALSE | TRUE | UNKNOWN | TIMEOUT | -|:----|:------|:------|:-----|:--------|:--------| -| Heap | 428 | 39 | 203 | 184 | 2 | -| LinkedLists | 166 | 18 | 61 | 87 | 0 | - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar o pie chart como SVG/PNG. -A tabela deve ser inserida diretamente como `table` em LaTeX. - -**Observação para redação:** -- Destacar que 56 bugs reais foram encontrados (FALSE positives de erro, TRUE positives de detecção) -- Score 57 é competitivo para uma primeira execução em LLVM 16 -- Usar como figura/tabela na Seção 4.2 diff --git a/docs/paper-sbseg-2026/figures/fig5-cicd.mmd b/docs/paper-sbseg-2026/figures/fig5-cicd.mmd deleted file mode 100644 index 9bc140529..000000000 --- a/docs/paper-sbseg-2026/figures/fig5-cicd.mmd +++ /dev/null @@ -1,35 +0,0 @@ -## Figura 5 — Workflow CI/CD e Qualidade de Artefato - -```mermaid -flowchart LR - subgraph "CI/CD GitHub Actions" - A[Push / PR] --> B[Build] - B --> C["Unit Tests\n(7/7)"] - B --> D["Pass Plugin Load\n(9/9)"] - B --> E["Sanitizers\n(ASAN/UBSAN/TSAN)"] - B --> F["Static Analysis\n(clang-tidy / cppcheck)"] - C & D & E & F --> G["Docker Image\nGHCR"] - end - - subgraph "Qualidade" - H[".clang-tidy\n(C++17)"] - I[".cppcheck-suppressions\n(C backend)"] - J["scripts/run-static-analysis.sh"] - K["OpenSSF Best Practices\n(em andamento)"] - end - - G --> L["Reprodutibilidade\nCTA Score"] - H & I & J & K --> L -``` - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar como SVG/PNG. - -**Observação para redação:** -- Destacar que esta infraestrutura pontua diretamente nos critérios CTA: - - **Disponibilidade:** repositório público + Docker image GHCR - - **Funcionalidade:** 7/7 unit tests + 9/9 passes - - **Reprodutibilidade:** `Dockerfile.dev` + scripts de benchmark - - **Sustentabilidade:** CI/CD, static analysis, sanitizers, documentação -- Usar como figura na Seção 3.4 diff --git a/docs/paper-sbseg-2026/outline.md b/docs/paper-sbseg-2026/outline.md deleted file mode 100644 index 8176daadd..000000000 --- a/docs/paper-sbseg-2026/outline.md +++ /dev/null @@ -1,243 +0,0 @@ -# Outline do Artigo — Map2Check 2026 (SBSeg SF) - -**Instrução:** Este outline serve como guia de escrita. Cada item representa um parágrafo ou bloco de conteúdo. O estado de cada item é atualizado conforme o draft avança. - ---- - -## Metadados do Edital (atualizado 2026-06-18) - -| Campo | Valor | -|:------|:------| -| **Conferência** | SBSeg 2026 — Salão de Ferramentas (SF) | -| **Submissão** | 20/jul/2026 | -| **Notificação** | 03/ago/2026 | -| **Camera ready** | 14/ago/2026 | -| **Evento** | 01–04/set/2026, Búzios — RJ | -| **Modo** | Single-blind (autores conhecidos pelos revisores) | -| **Idioma** | Português ou inglês (a decidir) | -| **Limite** | 8 pág corpo + até 2 pág referências/apêndices | -| **Template** | SBC | -| **Modalidade** | Código Aberto (elegível a prêmios) | -| **Vídeo obrigatório** | Sim — URL de instalação e funcionalidades | -| **Demonstração ao vivo** | Obrigatória — pelo menos 1 autor inscrito | -| **CTA** | Após notificação (até 14/ago), integrado ao camera ready | -| **IA Generativa** | Verificar Código de Conduta SBC — declarar uso se aplicável | - ---- - -## Seção 1 — Introdução e Motivação (~1 página) - -### 1.1 O problema de memory safety em C/C++ -- [ ] Abrir com estatísticas de vulnerabilidades de memória (CWEs 119, 416, 415, 401, 787) -- [ ] Citar que memory-safety bugs continuam entre as principais causas de CVEs exploráveis -- [ ] Contextualizar: sistemas embarcados, infraestrutura crítica, consequências de falhas - -### 1.2 Verificação híbrida como abordagem promissora -- [ ] Breve explicação da combinação análise estática + dinâmica (fuzzing + execução simbólica) -- [ ] Citar trabalhos de ponta: FuSeBMC (smart seeds), Symbiotic (slicing + KLEE) -- [ ] Destacar que ferramentas de competição (SV-COMP, TestComp) impulsionam o estado da arte - -### 1.3 Posicionamento do Map2Check -- [ ] Map2Check como verificador híbrido consolidado para programas C -- [ ] Menção às publicações anteriores (TACAS 2016, 2018, 2020) -- [ ] O problema: estagnação desde 2019 (LLVM 6.0, Ubuntu 16.04, último release nov/2019) - -### 1.4 Contribuições desta versão (2026) -- [ ] Lista numerada de contribuições: - 1. Migração completa da stack: LLVM 6 → 16, New Pass Manager, C++17 - 2. Infraestrutura de engenharia: CI/CD, Docker, sanitizers, static analysis - 3. Validação em benchmarks reais: TestComp 2026 (Heap, 594 tasks, score 57) - 4. Fortalecimento do posicionamento em cibersegurança (mapeamento CWE) - ---- - -## Seção 2 — História e Evolução (~1 página) - -### 2.1 Linha do tempo (2016→2026) -- [ ] **2016 (TACAS):** "Hunting Memory Bugs" — abordagem BMC com CBMC -- [ ] **2018 (TACAS):** Migração para LLVM + KLEE — execução simbólica como motor principal -- [ ] **2020 (TACAS):** Abordagem híbrida — fuzzing (LibFuzzer) + execução simbólica (KLEE) + invariantes indutivos (Crab-LLVM) -- [ ] **2019–2025:** Estagnação — último release, LLVM 6.0 obsoleto, dependências deprecadas -- [ ] **2026:** Renascimento — modernização sistemática da stack completa -- [ ] **Figura 1:** Timeline visual da evolução - -### 2.2 O que motivou o renascimento -- [ ] Obsolescência técnica: LLVM 6.0 EOL, Ubuntu 16.04 EOL, KLEE 2.0 sem suporte -- [ ] Impossibilidade de competir em SV-COMP/TestComp com stack legada -- [ ] Necessidade de sustentabilidade de engenharia (CI/CD, reproducibilidade, qualidade de artefato) -- [ ] Alinhamento com cibersegurança: CWEs como linguagem comum entre verificação formal e indústria de segurança - ---- - -## Seção 3 — Arquitetura e Funcionalidades (~2.5 páginas) - -### 3.1 Pipeline de verificação (visão geral) -- [ ] Fluxo completo: Código C → clang-16 → LLVM IR → opt (passes) → llvm-link → runtime → KLEE / LibFuzzer → Veredito + Witness -- [ ] **Figura 2:** Diagrama do pipeline com caixas e setas - -### 3.2 Passes de instrumentação (New Pass Manager) -- [ ] Descrição dos 9 passes migrados do Legacy PM para o New PM: - - `AssertPass` — instrumenta asserts do verificador - - `TargetPass` — marca função-alvo (e.g., `reach_error`) - - `LoopPredAssumePass` — injeta predicados em laços - - `Map2CheckLibrary` — renomeia `main` para `__map2check_main__` - - `NonDetPass` — substitui `__VERIFIER_nondet_*` por chamadas simbólicas - - `TrackBasicBlockPass` — rastreia cobertura de blocos básicos - - `OverflowPass` — instrumenta operações aritméticas para overflow - - `GenerateAutomataTruePass` — gera autômato de witness (GraphML) - - `MemoryTrackPass` — instrumenta acessos a memória (alloc, free, deref) -- [ ] **Figura 3:** Diagrama dos passes com inputs/outputs e dependências -- [ ] Destacar: `isRequired()` como fix crítico (sem isso, `opt -O0` pula todos os passes) - -### 3.3 Motores de análise -- [ ] **KLEE 3.1** (LLVM 16): execução simbólica, geração de testes, contra-exemplos -- [ ] **LibFuzzer** (LLVM 16): fuzzing guiado por cobertura, rápido para bugs superficiais -- [ ] **Iterative deepening:** combinação dos dois motores em fases - -### 3.4 Modernização de engenharia (pilar de sustentabilidade) -- [ ] **LLVM 16 + New Pass Manager:** compatibilidade com pipelines modernos, Opaque Pointers -- [ ] **C++17:** `std::filesystem`, structured bindings, modernização do frontend -- [ ] **CI/CD (GitHub Actions):** build automatizado, unit tests (7/7), pass plugin load tests (9/9) -- [ ] **Docker:** `Dockerfile.dev` (Ubuntu 22.04 + LLVM 16) — reprodutibilidade garantida -- [ ] **Static analysis:** `.clang-tidy` (C++), `.cppcheck-suppressions.txt` (C), `scripts/run-static-analysis.sh` -- [ ] **Sanitizers:** ASAN, UBSAN, TSAN targets no CMake -- [ ] **OpenSSF Best Practices:** checklist em andamento para badge -- [ ] **Figura 5:** Workflow CI/CD (diagrama GitHub Actions) -- [ ] **CTA:** Esta infraestrutura pontua diretamente nos critérios de artefato (disponibilidade, funcionalidade, reprodutibilidade, sustentabilidade) - ---- - -## Seção 4 — Features de Cibersegurança (~2 páginas) - -### 4.1 Mapeamento de memory safety para CWEs -- [ ] **CWE-401:** Memory Leak — detecção via `MemoryTrackPass` + runtime library -- [ ] **CWE-416:** Use-After-Free — detecção via tracking de ponteiros -- [ ] **CWE-415:** Double-Free — detecção via log de alocações -- [ ] **CWE-119 / CWE-787:** Buffer Overflow — detecção via `OverflowPass` + bounds checking -- [ ] **Tabela:** Mapeamento propriedade SV-COMP → CWE → pass responsável - -### 4.2 TestComp 2026 — Execução Heap -- [ ] Contexto: TestComp 2026, sub-categoria `C.coverage-error-call.Heap` -- [ ] Configuração: timeout 300s, Z3, target `reach_error`, Docker single-container -- [ ] **Tabela de resultados consolidados:** - - TRUE: 264 (44.4%) - - UNKNOWN: 271 (45.6%) - - FALSE: 56 (9.4%) - - TIMEOUT: 2 (0.3%) - - Total: 594 tasks | Score: 57 -- [ ] **Tabela por set:** - - Heap (428 tasks): 39 FALSE, 203 TRUE, 184 UNKNOWN, 2 TIMEOUT - - LinkedLists (166 tasks): 18 FALSE, 61 TRUE, 87 UNKNOWN, 0 TIMEOUT -- [ ] **Figura 4:** Gráfico de barras ou pizza dos resultados - -### 4.3 Smoke test e validação de vereditos -- [ ] Execução E2E manual em benchmarks `loops/array-1.c` e `loops/array-2.c` -- [ ] `array-1.c`: TRUE (unreachable) → VERIFICATION SUCCEEDED ✅ -- [ ] `array-2.c`: FALSE (reachable) → VERIFICATION FAILED + counter-example ✅ -- [ ] Counter-example validado: `__VERIFIER_nondet_int() → 31763`, linha 19, escopo `main` -- [ ] Framework de checkpoint automatizado: `run_checkpoint.sh`, `verify_verdicts.sh` - -### 4.4 Bugs críticos encontrados e corrigidos -- [ ] **Tabela dos 3 bugs:** - | Bug | Sintoma | Causa | Fix | - |:----|:--------|:------|:----| - | KLEE 3.1 flags | `Unknown command line argument` | Flags removidas na v3.x | Atualizar `caller.cpp` | - | `isRequired()` | Passes pulados silenciosamente | `optnone` + New PM | `isRequired()=true` em 9 passes | - | Target function | `__VERIFIER_error` em vez de `reach_error` | env var vs `cl::opt` | Passar `-function-name` na CLI | -- [ ] Destacar: nenhum desses bugs era detectável pelos testes unitários existentes (7/7) -- [ ] Implicação: a necessidade de testes de integração E2E - -### 4.5 Suporte a WebAssembly (WASM) — Em Desenvolvimento -- [ ] Extensão do pipeline LLVM 16 existente para análise de módulos WASM -- [ ] Backend LLVM-WASM: compilação C → LLVM IR → WASM → instrumentação → verificação -- [ ] Vetor de ataque: memory safety em runtimes WASM (Wasmtime, Wasmer) -- [ ] Testes preliminares em benchmarks SV-COMP adaptados para WASM -- [ ] Status: implementação em andamento, resultados preliminares na submissão -- [ ] **NÃO é trabalho futuro — é feature em desenvolvimento ativo** - ---- - -## Seção 5 — Demonstração Planejada (~0.5 página) - -### 5.1 O que será demonstrado ao vivo -- [ ] Pipeline completo em Docker: compilação → instrumentação → execução → veredito -- [ ] Exemplo interativo: execução em benchmark `loops/array-2.c` mostrando: - - compilação com `map2check` - - instrumentação pelos 9 passes - - execução com KLEE - - geração de counter-example -- [ ] Execução do framework TestComp 2026 (subset) mostrando throughput - -### 5.2 Equipamentos necessários -- [ ] Laptop com Docker instalado -- [ ] Imagem `map2check-dev` pré-construída (ou build no local, ~30 min) -- [ ] Subconjunto de benchmarks SV-COMP (`testcomp26` tag) -- [ ] Acesso à internet (para pull da imagem Docker, se necessário) - -### 5.3 Vídeo técnico (obrigatório no edital) -- [ ] Link do vídeo (será preenchido após gravação) -- [ ] Duração: 5–7 minutos -- [ ] Conteúdo: instalação (Docker), build, execução E2E, resultados TestComp 2026 -- [ ] **Roteiro detalhado:** ver `video/roteiro-gravacao.md` -- [ ] URL será incluída no artigo (não precisa ser anônima — single-blind) - -### 5.4 Demonstração ao vivo (condição de aceitação) -- [ ] Pelo menos 1 autor deve estar inscrito no evento (01–04/set, Búzios) -- [ ] A demonstração será o pipeline E2E em Docker + benchmarks SV-COMP -- [ ] Equipamentos: laptop com Docker + imagem map2check-dev + benchmarks - ---- - -## Seção 6 — Avaliação, Perspectivas e Conclusão (~1 página) - -### 6.1 Resumo dos resultados -- [ ] Modernização completa da stack: 35 commits, 84 arquivos, +5.785/−657 linhas -- [ ] 9 passes migrados para New PM, 7/7 unit tests passando, 9/9 passes carregando -- [ ] TestComp 2026 Heap: 594 tasks, score 57, 56 bugs reais encontrados (9.4%) -- [ ] 3 bugs críticos de regressão descobertos e corrigidos durante a migração - -### 6.2 Limitações -- [ ] Taxa de UNKNOWN alta (45.6%): necessita investigação de timeout tuning e estratégia de solver -- [ ] Ausência de testes de integração E2E no CI: todos os 3 bugs foram perdidos pelos unit tests -- [ ] ControlFlow benchmarks usaram property `no-overflow` — incomparável com modo reachability -- [ ] C++17 dead store warnings em libc++ headers (documentado, não crítico) - -### 6.3 Perspectivas -- [ ] Aprofundamento do suporte a WebAssembly: expansão dos benchmarks, modelagem formal da memória linear WASM -- [ ] Redução da taxa de UNKNOWN: tuning de timeout, estratégias de solver SMT, heurísticas de path exploration -- [ ] Testes de integração E2E no CI: automatizar o pipeline completo compile → instrument → link → execute -- [ ] (NÃO mencionar: DG Library, AFL++, Coordenador, Smart Seeds — fora do escopo deste artigo) - -### 6.4 Conclusão -- [ ] O Map2Check renasceu como plataforma sustentável de verificação de memory safety -- [ ] A modernização de engenharia (LLVM 16, CI/CD, Docker, static analysis) é um pré-requisito fundamental para qualquer avanço futuro -- [ ] Os resultados do TestComp 2026 demonstram viabilidade competitiva -- [ ] O projeto está aberto a contribuições (open source, repositório público) - ---- - -## Apêndice — Reprodutibilidade (~1 página) - -### A.1 Build com Docker -- [ ] Comandos para build da imagem: `docker build -f Dockerfile.dev -t map2check-dev .` -- [ ] Comandos para execução: `docker run -it --rm map2check-dev` -- [ ] Verificação: `clang-16 --version`, `opt --version`, `cmake --version` - -### A.2 Execução de benchmarks -- [ ] Comandos para smoke test: `map2check --property-file ...` -- [ ] Comandos para TestComp 2026: `cd test-comp2026/simulation && ./run_checkpoint.sh` -- [ ] Verificação de vereditos: `./verify_verdicts.sh` - -### A.3 CI e qualidade -- [ ] Link para GitHub Actions (nomes/instituições podem constar — single-blind) -- [ ] Comandos para static analysis: `./scripts/run-static-analysis.sh` -- [ ] Comandos para sanitizers: `cmake -DENABLE_SANITIZER_ADDRESS=ON ...` - -### A.4 Declaração de IA Generativa (se aplicável) -- [ ] Verificar Código de Conduta SBC: https://sol.sbc.org.br/index.php/indice/conduta -- [ ] Declarar uso de ferramentas de IA no processo de escrita/revisão se aplicável - ---- - -*Estado do outline: Sprint 0 — estrutura completa, aguardando redação secção a secção.* -*Última atualização: 2026-06-18 (revisado com edital oficial SBSeg 2026 SF)* diff --git a/docs/paper-sbseg-2026/references/references.bib b/docs/paper-sbseg-2026/references/references.bib deleted file mode 100644 index 82d01a8db..000000000 --- a/docs/paper-sbseg-2026/references/references.bib +++ /dev/null @@ -1,22 +0,0 @@ -% Placeholder para referencias BibTeX -% BACKLOG: usuario deve fornecer as referencias das publicacoes anteriores -% e demais citacoes necessarias. - -% Exemplo de formato: -% @inproceedings{rocha2016map2check, -% title={Map2Check: Using Symbolic Execution and Fuzzing}, -% author={Rocha, Herbert and others}, -% booktitle={TACAS}, -% year={2016} -% } - -% Referencias necessarias: -% - TACAS 2016 (Map2Check original) -% - TACAS 2018 (LLVM + KLEE) -% - TACAS 2020 (Hibrido: fuzzing + symex + invariantes) -% - FuSeBMC (Alshmrany et al., 2022/2024) -% - Symbiotic (Chalupa et al., 2021) -% - KLEE (Cadar et al., 2008) -% - AFL++ (Fioraldi et al., 2020) -% - CWE/MITRE -% - SV-COMP / TestComp (Beyer, 2023) diff --git a/docs/paper-sbseg-2026/sbseg-article/.gitignore b/docs/paper-sbseg-2026/sbseg-article/.gitignore deleted file mode 100644 index 694f4184c..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/.gitignore +++ /dev/null @@ -1,3 +0,0 @@ -*.bbl -*.blg -*.log diff --git a/docs/paper-sbseg-2026/sbseg-article/caption2.sty b/docs/paper-sbseg-2026/sbseg-article/caption2.sty deleted file mode 100644 index 0575c72fc..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/caption2.sty +++ /dev/null @@ -1,406 +0,0 @@ -%% -%% This is file `caption2.sty', -%% generated with the docstrip utility. -%% -%% The original source files were: -%% -%% caption2.dtx (with options: `package') -%% -%% Copyright (C) 1994-2002 Axel Sommerfeldt (caption@sommerfeldt.net) -%% -%% -------------------------------------------------------------------------- -%% -%% It may be distributed and/or modified under the -%% conditions of the LaTeX Project Public License, either version 1.2 -%% of this license or (at your option) any later version. -%% The latest version of this license is in -%% http://www.latex-project.org/lppl.txt -%% and version 1.2 or later is part of all distributions of LaTeX -%% version 1999/12/01 or later. -%% -\NeedsTeXFormat{LaTeX2e}[1994/12/01] -\ProvidesPackage{caption2} - [2002/08/03 v2.1 Customising captions (AS)] -\newcommand*\captionfont{} -\newcommand*\captionlabelfont{} -\newcommand*\captionlabeldelim{} -\newcommand*\captionlabelsep{} -\newcommand*\captionsize{} -\newdimen\captionmargin -\newdimen\captionwidth -\newif\ifcaptionwidth -\newdimen\captionindent -\newif\ifcaptionlabel\captionlabeltrue -\newif\ifonelinecaptions -\newif\ifignoreLTcapwidth -\newcommand*\setcaptionmargin{% - \captionwidthfalse - \setlength\captionmargin} -\newcommand*\setcaptionwidth{% - \captionwidthtrue - \setlength\captionwidth} -\newcommand*\normalcaptionparams{% - \let\captionsize\@empty - \renewcommand*\captionfont{\captionsize}% - \let\captionlabelfont\@empty% - \renewcommand*\captionlabeldelim{:}% - \renewcommand*\captionlabelsep{\space}% - \setcaptionmargin\z@\setlength\captionindent\z@ - \onelinecaptionstrue} -\newcommand*\caption@eh{% - If you do not understand this error, please take a closer look\MessageBreak - at the documentation of the `caption2' package.\MessageBreak - \@ehc} -\newcommand*\defcaptionstyle[1]{% - \@namedef{caption@@#1}} -\newcommand*\newcaptionstyle[1]{% - \expandafter\ifx\csname caption@@#1\endcsname\relax - \expandafter\defcaptionstyle - \else - \PackageError{caption2}{Caption style `#1' already defined}{\caption@eh}% - \expandafter\@gobbletwo - \fi - {#1}} -\newcommand*\renewcaptionstyle[1]{% - \expandafter\ifx\csname caption@@#1\endcsname\relax - \PackageError{caption2}{Caption style `#1' undefined}{\caption@eh}% - \expandafter\@gobbletwo - \else - \expandafter\defcaptionstyle - \fi - {#1}} -\newcommand*\dummycaptionstyle[2]{% - \defcaptionstyle{#1}{% - \expandafter\ifx\csname caption@@\caption@style\expandafter\endcsname% - \csname caption@@#1\endcsname - \PackageError{caption2}{You can't use the caption style `#1' directy}{% - The caption style `#1' is only a dummy and does not really exists.% - \MessageBreak You have to redefine it (with \protect\renewcaptionstyle) - before you can select\MessageBreak it with \protect\captionstyle. - \space\caption@eh}% - \else - #2\usecaptionstyle{\caption@style}% - \fi}} -\newcaptionstyle{normal}{\caption@makecaption{normal}} -\newcaptionstyle{center}{\caption@makecaption{center}} -\newcaptionstyle{centerlast}{\caption@makecaption{centerlast}} -\newcaptionstyle{flushleft}{\caption@makecaption{flushleft}} -\newcaptionstyle{flushright}{\caption@makecaption{flushright}} -\newcaptionstyle{hang}{\caption@makecaption{hang}} -\newcaptionstyle{hang+center}{\caption@makecaption{hang@center}} -\newcaptionstyle{hang+centerlast}{\caption@makecaption{hang@centerlast}} -\newcaptionstyle{hang+flushleft}{\caption@makecaption{hang@flushleft}} -\newcaptionstyle{indent}{\caption@makecaption{indent}} -\newcommand*\captionstyle[1]{% - \expandafter\ifx\csname caption@@#1\endcsname\relax - \PackageError{caption2}{Undefined caption style `#1'}{\caption@eh}% - \else - \def\caption@style{#1}% - \fi} -\DeclareOption{normal}{\captionstyle{normal}} -\DeclareOption{center}{\captionstyle{center}} -\DeclareOption{centerlast}{\captionstyle{centerlast}} -\DeclareOption{flushleft}{\captionstyle{flushleft}} -\DeclareOption{flushright}{\captionstyle{flushright}} -\DeclareOption{anne}{\ExecuteOptions{centerlast}} -\DeclareOption{hang}{\captionstyle{hang}} -\DeclareOption{hang+center}{\captionstyle{hang+center}} -\DeclareOption{hang+centerlast}{\captionstyle{hang+centerlast}} -\DeclareOption{hang+flushleft}{\captionstyle{hang+flushleft}} -\DeclareOption{isu}{\ExecuteOptions{hang}} -\DeclareOption{indent}{\captionstyle{indent}} -\DeclareOption{scriptsize}{\g@addto@macro\captionsize\scriptsize} -\DeclareOption{footnotesize}{\g@addto@macro\captionsize\footnotesize} -\DeclareOption{small}{\g@addto@macro\captionsize\small} -\DeclareOption{normalsize}{\g@addto@macro\captionsize\normalsize} -\DeclareOption{large}{\g@addto@macro\captionsize\large} -\DeclareOption{Large}{\g@addto@macro\captionsize\Large} -\DeclareOption{up}{\g@addto@macro\captionlabelfont\upshape} -\DeclareOption{it}{\g@addto@macro\captionlabelfont\itshape} -\DeclareOption{sl}{\g@addto@macro\captionlabelfont\slshape} -\DeclareOption{sc}{\g@addto@macro\captionlabelfont\scshape} -\DeclareOption{md}{\g@addto@macro\captionlabelfont\mdseries} -\DeclareOption{bf}{\g@addto@macro\captionlabelfont\bfseries} -\DeclareOption{rm}{\g@addto@macro\captionlabelfont\rmfamily} -\DeclareOption{sf}{\g@addto@macro\captionlabelfont\sffamily} -\DeclareOption{tt}{\g@addto@macro\captionlabelfont\ttfamily} -\DeclareOption{oneline}{\onelinecaptionstrue} -\DeclareOption{nooneline}{\onelinecaptionsfalse} -\newcommand*\caption@package[1]{\@namedef{caption@pkt@#1}} -\DeclareOption{float}{\caption@twozerofalse\caption@package{float}{1}} -\DeclareOption{longtable}{\caption@twozerofalse\caption@package{longtable}{1}} -\DeclareOption{subfigure}{\caption@twozerofalse\caption@package{subfigure}{1}} -\DeclareOption{none}{\caption@twozerofalse - \caption@package{float}{0}\caption@package{longtable}{0}% - \caption@package{subfigure}{0}} -\DeclareOption{all}{\ExecuteOptions{float,longtable,subfigure}} -\DeclareOption{ruled}{} -\DeclareOption{ignoreLTcapwidth}{\ignoreLTcapwidthtrue} -\DeclareOption{debug}{\caption@debugtrue} -\newif\ifcaption@debug -\newif\ifcaption@twozero -\normalcaptionparams -\ExecuteOptions{none,normal} -\caption@twozerotrue -\ProcessOptions* -\ifcaption@twozero - \PackageInfo{caption2}{Running in caption2 v2.0 compatibility mode} -\fi -\def\captionof{\@ifstar{\caption@of{\caption*}}{\caption@of\caption}} -\newcommand*\caption@of[2]{\def\@captype{#2}#1} -\@ifundefined{abovecaptionskip}{% - \newlength\abovecaptionskip\setlength\abovecaptionskip{10\p@}}{} -\@ifundefined{belowcaptionskip}{% - \newlength\belowcaptionskip\setlength\belowcaptionskip{0\p@}}{} -\newdimen\captionlinewidth -\renewcommand\@makecaption[2]{% - \vskip\abovecaptionskip - \captionlinewidth\hsize - \def\captionlabel{#1}% - \def\captiontext{#2}% - \usecaptionstyle{\caption@style}% - \vskip\belowcaptionskip} -\newcommand*\usecaptionstyle[1]{% - \ifx\captiontext\relax - \PackageError{caption2}{You can't use \protect#1 - in normal text}{The usage of \protect#1 is only - allowed inside code declared with\MessageBreak \protect\defcaptionstyle, - \protect\newcaptionstyle \space or \protect\renewcaptionstyle. - \space\caption@eh} - \else - \@ifundefined{caption@@#1}% - {\PackageError{caption2}{Caption style `#1' undefined}{\caption@eh}}% - {\@nameuse{caption@@#1}} - \fi} -\newcommand*\caption@makecaption[1]{% - \ifcaptionlabel - \def\caption@label{{\captionlabelfont\captionlabel\captionlabeldelim}\captionlabelsep}% - \else - \let\caption@label\@empty - \fi - \usecaptionmargin\captionfont - \onelinecaption{\caption@label\captiontext}% - {\@nameuse{caption@@@#1}}} -\newcommand*\caption@@@normal{% - \caption@label\captiontext\par} -\newcommand*\caption@@@center{% - \centering\caption@label\captiontext\par}% -\newcommand*\caption@centerlast{% - \advance\leftskip by 0pt plus 1fil% - \advance\rightskip by 0pt plus -1fil% - \parfillskip0pt plus 2fil\relax} -\newcommand*\caption@@@centerlast{% - \caption@centerlast\caption@label\captiontext\par} -\newcommand*\caption@@@flushleft{% - \raggedright\caption@label\captiontext\par}% -\newcommand*\caption@@@flushright{% - \raggedleft\caption@label\captiontext\par}% -\newcommand*\caption@@@hang{% - \sbox\@tempboxa{\caption@label}% - \hangindent\wd\@tempboxa\noindent - \usebox\@tempboxa\caption@hangplus\captiontext\par} -\newcommand*\caption@hangplus{} -\newcommand*\caption@@@hang@center{% - \let\caption@hangplus\centering\caption@@@hang} -\newcommand*\caption@@@hang@centerlast{% - \let\caption@hangplus\caption@centerlast\caption@@@hang} -\newcommand*\caption@@@hang@flushleft{% - \let\caption@hangplus\raggedright\caption@@@hang} -\newcommand*\caption@@@indent{% - \hangindent\captionindent\noindent - \caption@label\captiontext\par} -\newcommand\onelinecaption[1]{% - \let\next\@firstofone - \ifonelinecaptions - \sbox\@tempboxa{#1}% - \ifdim\wd\@tempboxa >\captionlinewidth - \else - \def\next{{\centering\usebox{\@tempboxa}\par}\@gobble}% - \fi - \fi\next} -\newcommand*\usecaptionmargin{% - \ifcaptionwidth - \leftskip\captionlinewidth - \advance\leftskip by -\captionwidth - \divide\leftskip by 2 - \rightskip\leftskip - \captionlinewidth\captionwidth - \else - \leftskip\captionmargin - \rightskip\captionmargin - \advance\captionlinewidth by -2\captionmargin - \fi} -\renewcommand*\caption@package[3]{% - \if1\@nameuse{caption@pkt@#1}% - \@ifundefined{#2}% - {\let\next\AtBeginDocument}% - {\let\next\@firstofone}% - \else - \ifcaption@twozero - \@ifundefined{#2}{#3\let\next\@gobble}{% - \PackageWarning{caption2}{% - The `#1' package will be supported without explicit option % - (v2.0 compatibility issue)}% - \let\next\@firstofone}% - \else - #3\let\next\@gobble - \fi - \fi - \expandafter\let\csname caption@pkt@#1\endcsname\undefined - \ifcaption@debug - \ifx\next\@gobble\PackageInfo{caption2}{#1 => gobble}% - \else\ifx\next\@firstofone\PackageInfo{caption2}{#1 => firstofone}% - \else\ifx\next\AtBeginDocument\PackageInfo{caption2}{#1 => AtBeginDocument}% - \else\PackageInfo{caption2}{#1 => ???}\fi\fi\fi - \fi - \next} -\caption@package{float}{floatc@plain}{}{% - \ifx\floatc@plain\relax - \PackageWarning{caption2}{% - Option `float' was set but there is no float package loaded} - \else - \PackageInfo{caption2}{float package v1.2 (or newer) detected} - \newcommand\caption@floatc[3]{% - \ifx\captionlabelfont\@empty - \let\captionlabelfont\@fs@cfont - \fi - \captionlinewidth\hsize - \def\captionlabel{#2}% - \def\captiontext{#3}% - \usecaptionstyle{#1}} - \renewcommand*\floatc@plain{\caption@floatc{\caption@style}} - \@ifpackagewith{caption2}{ruled}{% - \dummycaptionstyle{ruled}{\onelinecaptionsfalse\setcaptionmargin{\z@}}% - }{% - \newcaptionstyle{ruled}{% - \ifcaptionlabel - {\@fs@cfont\captionlabel}\space% - \fi\captiontext\par}% - } - \renewcommand*\floatc@ruled{\caption@floatc{ruled}} - \renewcommand*\caption@of[2]{\def\@captype{#2}% - \@ifundefined{fst@#2}{}{% - \@nameuse{fst@#2}% - \@ifundefined{@float@setevery}{}{\@float@setevery{#2}}% - \let\caption@fs@capt\@fs@capt - \let\@fs@capt\caption@of@float} - #1} - \newcommand\caption@of@float[2]{\egroup - \vskip\abovecaptionskip - \normalsize\caption@fs@capt{#1}{#2}% - \vskip\belowcaptionskip - \bgroup}% - \fi} -\caption@package{longtable}{LT@makecaption}{}{% - \ifx\LT@makecaption\relax - \PackageWarning{caption2}{% - Option `longtable' was set but there is no longtable package loaded} - \else - \PackageInfo{caption2}{longtable package v3.15 (or newer) detected} - \dummycaptionstyle{longtable}{} - \renewcommand\LT@makecaption[3]{% - \LT@mcol\LT@cols c{\hbox to\z@{\hss\parbox[t]\hsize{% - \ifignoreLTcapwidth - \else - \setcaptionwidth\LTcapwidth - \fi - \captionlinewidth\hsize - \captionlabelfalse#1\captionlabeltrue - \def\captionlabel{#2}% - \def\captiontext{#3}% - \usecaptionstyle{longtable}% - \endgraf\vskip\baselineskip}% - \hss}}} - \fi} -\newcommand*\setsubcapstyle{% - \@ifundefined{subcapraggedrightfalse}{% - \newif\ifsubcapraggedright}{}% - \ifsubcaphang - \ifsubcapcenter - \subcapstyle{hang+center}% - \else\ifsubcapcenterlast - \subcapstyle{hang+centerlast}% - \else\ifsubcapraggedright - \subcapstyle{hang+flushleft}% - \else - \subcapstyle{hang}% - \fi\fi\fi - \else\ifsubcapcenter - \subcapstyle{center}% - \else\ifsubcapcenterlast - \subcapstyle{centerlast}% - \else\ifsubcapraggedright - \subcapstyle{flushleft}% - \else - \subcapstyle{normal}% - \fi\fi\fi\fi} -\newcommand\caption@makesubcaption[2]{% - \renewcommand*\captionfont{\subcapsize\subcapfont}% - \renewcommand*\captionlabelfont{\normalfont\subcapsize\subcaplabelfont}% - \let\captionlabeldelim\subcaplabeldelim - \let\captionlabelsep\subcaplabelsep - \ifsubfigcapwidth\captionwidthtrue\else\captionwidthfalse\fi - \setlength\captionmargin\subfigcapmargin - \setlength\captionwidth\subfigcapwidth - \captionindent\subcapindent - \ifsubcapnooneline\onelinecaptionsfalse\else\onelinecaptionstrue\fi - \hbox to\@tempdima{% - \caption@subfig@hss\parbox[t]{\@tempdima}{% - \captionlinewidth\@tempdima - \captionlabeltrue - \def\captionlabel{#1}% - \def\captiontext{\ignorespaces #2}% - \usecaptionstyle{\caption@substyle}}% - \caption@subfig@hss}} -\caption@package{subfigure}{@makesubfigurecaption}{% - \let\setsubcapstyle\undefined - \let\caption@makesubcaption\undefined}{% - \ifx\@makesubfigurecaption\relax - \PackageWarning{caption2}{% - Option `subfigure' was set but there is no subfigure package loaded} - \let\setsubcapstyle\undefined - \let\caption@makesubcaption\undefined - \else - \ifx\subcapfont\undefined - \PackageInfo{caption2}{subfigure package v2.0 detected} - \let\subcapfont\@empty - \newcommand*\subfigcapwidth{\z@} - \newcommand*\setsubcapmargin{% - \subfigcapwidthfalse - \renewcommand*\subfigcapmargin} - \newcommand*\setsubcapwidth{% - \subfigcapwidthtrue - \renewcommand*\subfigcapwidth} - \newcommand*\subcaplabelsep{\space} - \let\caption@subfig@hss\hfil - \else - \PackageInfo{caption2}{subfigure package v2.1 (or newer) detected} - \newdimen\subfigcapwidth - \newcommand*\setsubcapmargin{% - \subfigcapwidthfalse - \setlength\subfigcapmargin} - \newcommand*\setsubcapwidth{% - \subfigcapwidthtrue - \setlength\subfigcapwidth} - \newcommand*\subcaplabelsep{\hskip\subfiglabelskip} - \let\caption@subfig@hss\hss - \fi - \newif\ifsubfigcapwidth - \newdimen\subcapindent - \newcommand*\subcaplabeldelim{} - \newcommand*\subcapstyle[1]{% - \expandafter\ifx\csname caption@@#1\endcsname\relax - \PackageError{caption2}{Undefined caption style `#1'}{\caption@eh}% - \else - \def\caption@substyle{#1}% - \fi} - \setsubcapstyle - \renewcommand*\@thesubfigure{\thesubfigure} - \renewcommand*\@thesubtable{\thesubtable} - \let\@makesubfigurecaption\caption@makesubcaption - \let\@makesubtablecaption\caption@makesubcaption - \fi} -\let\caption@package\undefined -\endinput -%% -%% End of file `caption2.sty'. diff --git a/docs/paper-sbseg-2026/sbseg-article/img/README.md b/docs/paper-sbseg-2026/sbseg-article/img/README.md deleted file mode 100644 index a3394ca63..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/img/README.md +++ /dev/null @@ -1,23 +0,0 @@ -# Figuras do Artigo SBSeg 2026 - -## Figuras TikZ (compilação nativa pelo LaTeX) -- `fig1-timeline.tikz.tex` — Timeline 2016→2026 (Substitui PNG antigo, fonte maior) -- `fig2-pipeline.tikz.tex` — Pipeline de verificação 5 estágios (Substitui PNG antigo) - -Estas são incluídas diretamente no LaTeX via `\input{img/figX-tikz.tex}`. - -## Figura Mermaid (requer renderização externa) -- `fig6-wasm-pipeline.mmd` — Pipeline WASM: `.wasm → wasm2c → LLVM IR → Passes → KLEE` - -Para gerar PNG a partir do .mmd: -```bash -npm install -g @mermaid-js/mermaid-cli -mmdc -i fig6-wasm-pipeline.mmd -o fig6-wasm-pipeline.png -b transparent -w 1200 -``` - -Ou use: https://mermaid.live (copiar conteúdo do .mmd, exportar como PNG) - -O arquivo `main.tex` referencia via `\includegraphics{img/fig6-wasm-pipeline}`. - -## Figuras removidas -As figuras fig3-passes, fig4-testcomp2026 e fig5-cicd foram removidas do artigo por orientação do revisor. Seus arquivos `.mmd` e `.png` ainda existem no diretório mas não são mais referenciadas no `main.tex`. diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig1-timeline.mmd b/docs/paper-sbseg-2026/sbseg-article/img/fig1-timeline.mmd deleted file mode 100644 index 00da6bd91..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/img/fig1-timeline.mmd +++ /dev/null @@ -1,32 +0,0 @@ -## Figura 1 — Timeline de Evolução do Map2Check (2016→2026) - -```mermaid -timeline - title Evolução do Map2Check - 2016 : TACAS 2016 - : "Hunting Memory Bugs" - : BMC com CBMC - 2018 : TACAS 2018 - : LLVM + KLEE - : Execução Simbólica - 2020 : TACAS 2020 - : Abordagem Híbrida - : LibFuzzer + KLEE + Crab-LLVM - 2019 : Último release v7.3.1 - : Estagnação até 2025 - 2026 : SBSeg 2026 - : Renascimento - : LLVM 16 + New PM + C++17 - : CI/CD + TestComp 2026 -``` - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar como SVG/PNG via: -```bash -mmdc -i fig1-timeline.mmd -o fig1-timeline.svg -``` - -**Observação para redação:** -- A timeline mostra claramente o hiato de 2019→2026 -- Usar como figura na Seção 2 (História e Evolução) diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig1-timeline.png b/docs/paper-sbseg-2026/sbseg-article/img/fig1-timeline.png deleted file mode 100644 index ba7da9fcc..000000000 Binary files a/docs/paper-sbseg-2026/sbseg-article/img/fig1-timeline.png and /dev/null differ diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig1-timeline.tikz.tex b/docs/paper-sbseg-2026/sbseg-article/img/fig1-timeline.tikz.tex deleted file mode 100644 index 59d38d9f2..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/img/fig1-timeline.tikz.tex +++ /dev/null @@ -1,52 +0,0 @@ -% Figura 1 — Timeline de Evolução do Map2Check (2016→2026) -% Uso: \input{img/fig1-timeline.tikz} - -\begin{tikzpicture}[ - node distance=0.2cm, - year/.style={font=\bfseries\footnotesize, text=black, anchor=south}, - event/.style={align=left, font=\scriptsize, text=black!70, anchor=north}, - milestone/.style={draw=blue!50!black, fill=blue!5, rounded corners=3pt, - inner sep=6pt, text width=4.8cm, align=center, font=\small\bfseries}, - rest/.style={font=\footnotesize, text=black!40, align=center}, - arrow/.style={->, >=stealth, thick, blue!40}, -] - -% Timeline base line -\draw[thick, blue!30] (0,0) -- (16,0); - -% Years and tick marks -\foreach \x/\label in {0/2016, 3/2018, 6/2020, 9/2021, 13/2026}{ - \draw[blue!40] (\x,0.15) -- (\x,-0.15); - \node[year] at (\x,0.25) {\label}; -} - -% --- 2016 --- -\node[milestone] at (0,-1.8) {CBMC + BMC}; -\node[event] at (0,-2.6) {TACAS 2016}; - -% --- 2018 --- -\node[milestone] at (3,-1.8) {LLVM + KLEE}; -\node[event] at (3,-2.6) {TACAS 2018}; - -% --- 2020 --- -\node[milestone] at (6,-1.8) {KLEE + LibFuzzer\\+ Crab-LLVM}; -\node[event] at (6,-2.8) {TACAS 2020}; - -% --- Stagnation --- -\draw[thick, gray!30, dotted] (7.5,-0.8) rectangle (11.5,-2.2); -\node[rest] at (9.5,-1.5) {Estagnação\\2019--2025}; - -% --- 2026 --- -\node[milestone] at (13,-1.8) {LLVM 16 + New PM\\+ C++17 + CI/CD\\+ WASM}; -\node[event] at (13,-3.2) {SBSeg 2026}; - -% Concorrentes -\node[rest, anchor=north west] at (0,-4.2) {Concorrentes:}; -\node[rest, anchor=north west] at (0,-4.7) {CPAchecker (SV-COMP)}; -\node[rest, anchor=north west] at (6,-4.7) {Symbiotic (slicing + KLEE)}; -\node[rest, anchor=north west] at (11,-4.7) {FuSeBMC (smart seeds)}; - -% Renascimento arrow -\draw[->, >=stealth, very thick, red!50] (9.5,-2.3) to[bend left=15] (13,-1.3); - -\end{tikzpicture} diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig2-pipeline.mmd b/docs/paper-sbseg-2026/sbseg-article/img/fig2-pipeline.mmd deleted file mode 100644 index d60505f7a..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/img/fig2-pipeline.mmd +++ /dev/null @@ -1,50 +0,0 @@ -## Figura 2 — Pipeline de Verificação Map2Check 2026 - -```mermaid -flowchart LR - subgraph Entrada - A[Código C\n(.c/.i)] - end - - subgraph Frontend - B[clang-16\n-O0 -emit-llvm] - C[LLVM IR\n(.bc)] - end - - subgraph Instrumentação - D[opt-16\n-load-pass-plugin] - E["9 Passes New PM\n(Assert, Target, LoopPred,\nMap2CheckLib, NonDet,\nTrackBB, Overflow,\nAutomata, MemoryTrack)"] - end - - subgraph Linking - F[llvm-link] - G[Bitcode\nInstrumentado] - end - - subgraph Motores - H["KLEE 3.1\n(Execução Simbólica)"] - I["LibFuzzer\n(Fuzzing)"] - end - - subgraph Saída - J[Veredito\nTRUE / FALSE / UNKNOWN] - K[Witness\n(GraphML)] - L[Teste\n(Concreto)] - end - - A --> B --> C --> D --> E --> F --> G - G --> H - G --> I - H --> J - H --> K - H --> L - I --> J -``` - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar como SVG/PNG. - -**Observação para redação:** -- Destacar que o pipeline é executado inteiramente dentro do container Docker -- Usar como figura principal na Seção 3 (Arquitetura) diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig2-pipeline.png b/docs/paper-sbseg-2026/sbseg-article/img/fig2-pipeline.png deleted file mode 100644 index 7aec0b679..000000000 Binary files a/docs/paper-sbseg-2026/sbseg-article/img/fig2-pipeline.png and /dev/null differ diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig2-pipeline.tikz.tex b/docs/paper-sbseg-2026/sbseg-article/img/fig2-pipeline.tikz.tex deleted file mode 100644 index 7404c2745..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/img/fig2-pipeline.tikz.tex +++ /dev/null @@ -1,68 +0,0 @@ -% Figura 2 — Pipeline de Verificação do Map2Check 2026 -% Uso: \input{img/fig2-pipeline.tikz} - -\begin{tikzpicture}[ - node distance=0.8cm and 0.4cm, - stage/.style={draw=blue!60!black, fill=blue!5, rounded corners=4pt, - inner sep=6pt, align=center, font=\footnotesize, minimum width=2.2cm}, - substage/.style={draw=gray!40, fill=gray!5, rounded corners=2pt, - inner sep=4pt, align=center, font=\tiny, minimum width=2.0cm}, - arrow/.style={->, >=stealth, thick}, - label/.style={font=\scriptsize\bfseries, text=blue!60!black}, -] - -% --- Stage 1: Compilação --- -\node[label, above] at (0,1.8) {Compilação}; -\node[stage] (compile) at (0,0) {Código C\\(.c / .i)}; -\node[substage, below=of compile] (clang) {clang-16\\-O0 -emit-llvm}; - -\draw[arrow] (compile) -- (clang); - -% --- Stage 2: LLVM IR --- -\node[label, above] at (2.8,1.8) {LLVM IR}; -\node[stage] (ir) at (2.8,0) {Bitcode\\(.bc)}; - -\draw[arrow] (clang.east) -- (ir.west); - -% --- Stage 3: Instrumentação --- -\node[label, above] at (6.2,1.8) {Instrumentação}; -\node[stage] (opt) at (6.2,0) {opt-16\\-load-pass-plugin}; -\node[substage, below=of opt] (passes) {9 Passes NPM\\(MemoryTrack, Overflow,\\Assert, Target, NonDet,\\Map2CheckLib, TrackBB,\\AutoGen, LoopPred)}; - -\draw[arrow] (ir.east) -- (opt.west); -\draw[arrow] (opt) -- (passes); - -% --- Stage 4: Linking --- -\node[label, above] at (9.7,1.8) {Linking}; -\node[stage] (link) at (9.7,0) {llvm-link}; -\node[substage, below=of link] (linked) {Bitcode\\Instrumentado}; - -\draw[arrow] (passes.east) -- (link.west); -\draw[arrow] (link) -- (linked); - -% --- Stage 5: Motores + Saída --- -\node[label, above] at (13.5,2.0) {Análise}; -\node[stage] (klee) at (12.5,0) {KLEE 3.1\\Exec. Simbólica}; -\node[stage] (fuzz) at (14.5,0) {LibFuzzer\\Fuzzing}; - -\node[stage, draw=red!50!black, fill=red!5] (result) at (13.5,-2.2) {Veredito\\TRUE / FALSE /\\UNKNOWN}; -\node[substage] (witness) at (13.5,-3.6) {Witness\\GraphML}; - -\draw[arrow] (linked.east) -- (klee.west); -\draw[arrow] (linked.east) -- (fuzz.west); -\draw[arrow] (klee) -- (result); -\draw[arrow] (fuzz) -- (result); -\draw[arrow] (result) -- (witness); - -% Labels on top -\node[label,font=\scriptsize] at (0,2.5) {Estágio 1}; -\node[label,font=\scriptsize] at (2.8,2.5) {Estágio 2}; -\node[label,font=\scriptsize] at (6.2,2.5) {Estágio 3}; -\node[label,font=\scriptsize] at (9.7,2.5) {Estágio 4}; -\node[label,font=\scriptsize] at (13.5,0.8) {Estágio 5}; - -% Docker envelope -\draw[thick, green!40!black, dashed, rounded corners=8pt] (-0.8,-4.0) rectangle (15.8,2.9); -\node[font=\tiny, text=green!40!black] at (15.0,2.6) {Docker (Ubuntu 22.04)}; - -\end{tikzpicture} diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig3-passes.mmd b/docs/paper-sbseg-2026/sbseg-article/img/fig3-passes.mmd deleted file mode 100644 index c058a560d..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/img/fig3-passes.mmd +++ /dev/null @@ -1,54 +0,0 @@ -## Figura 3 — Passes de Instrumentação (New Pass Manager) - -```mermaid -flowchart TB - subgraph "Entrada: LLVM IR" - IR["Module LLVM\nFunções C instrumentadas"] - end - - subgraph "Passes de Análise" - A[AssertPass] - B[TargetPass] - C[LoopPredAssumePass] - D[Map2CheckLibrary] - E[NonDetPass] - F[TrackBasicBlockPass] - G[OverflowPass] - H[GenerateAutomataTruePass] - I[MemoryTrackPass] - end - - subgraph "Saída: LLVM IR Instrumentado" - OUT["Module LLVM\n+ Calls para Runtime\n+ Metadados de Witness"] - end - - IR --> A & B & C & D & E & F & G & H & I --> OUT - - style A fill:#e1f5e1 - style B fill:#e1f5e1 - style C fill:#e1f5e1 - style D fill:#e1f5e1 - style E fill:#fff5e1 - style F fill:#fff5e1 - style G fill:#ffe1e1 - style H fill:#ffe1e1 - style I fill:#ffe1e1 - - LEG1["🟢 Simples"] - LEG2["🟡 Médios"] - LEG3["🔴 Complexos"] -``` - -**Legenda:** -- 🟢 **Simples** (~130–160 LOC): AssertPass, TargetPass, LoopPredAssumePass, Map2CheckLibrary -- 🟡 **Médios** (~330–400 LOC): NonDetPass, TrackBasicBlockPass -- 🔴 **Complexos** (~520–900 LOC): OverflowPass, GenerateAutomataTruePass, MemoryTrackPass - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar como SVG/PNG. - -**Observação para redação:** -- Mencionar que todos os 9 passes declaram `static bool isRequired() { return true; }` -- Sem isso, `opt -O0` pula os passes em funções com atributo `optnone` -- Usar como figura na Seção 3.2 diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig3-passes.png b/docs/paper-sbseg-2026/sbseg-article/img/fig3-passes.png deleted file mode 100644 index f4cfc2b48..000000000 Binary files a/docs/paper-sbseg-2026/sbseg-article/img/fig3-passes.png and /dev/null differ diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig4-testcomp2026.mmd b/docs/paper-sbseg-2026/sbseg-article/img/fig4-testcomp2026.mmd deleted file mode 100644 index 6c0346331..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/img/fig4-testcomp2026.mmd +++ /dev/null @@ -1,41 +0,0 @@ -## Figura 4 — Resultados TestComp 2026: C.coverage-error-call.Heap - -```mermaid -pie title Resultados Consolidados (594 tasks) - "TRUE (264)" : 264 - "UNKNOWN (271)" : 271 - "FALSE (56)" : 56 - "TIMEOUT (2)" : 2 - "FALSE_FREE (1)" : 1 -``` - ---- - -### Tabela complementar (para inserir no corpo do artigo) - -| Resultado | Count | % | -|:----------|:------|:--| -| TRUE | 264 | 44.4% | -| UNKNOWN | 271 | 45.6% | -| FALSE | 56 | 9.4% | -| FALSE_FREE | 1 | 0.2% | -| TIMEOUT | 2 | 0.3% | -| **Total** | **594** | **100%** | -| **Score** | **57** | — | - -### Por set - -| Set | Tasks | FALSE | TRUE | UNKNOWN | TIMEOUT | -|:----|:------|:------|:-----|:--------|:--------| -| Heap | 428 | 39 | 203 | 184 | 2 | -| LinkedLists | 166 | 18 | 61 | 87 | 0 | - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar o pie chart como SVG/PNG. -A tabela deve ser inserida diretamente como `table` em LaTeX. - -**Observação para redação:** -- Destacar que 56 bugs reais foram encontrados (FALSE positives de erro, TRUE positives de detecção) -- Score 57 é competitivo para uma primeira execução em LLVM 16 -- Usar como figura/tabela na Seção 4.2 diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig4-testcomp2026.png b/docs/paper-sbseg-2026/sbseg-article/img/fig4-testcomp2026.png deleted file mode 100644 index 82f187df9..000000000 Binary files a/docs/paper-sbseg-2026/sbseg-article/img/fig4-testcomp2026.png and /dev/null differ diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig5-cicd.mmd b/docs/paper-sbseg-2026/sbseg-article/img/fig5-cicd.mmd deleted file mode 100644 index 9bc140529..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/img/fig5-cicd.mmd +++ /dev/null @@ -1,35 +0,0 @@ -## Figura 5 — Workflow CI/CD e Qualidade de Artefato - -```mermaid -flowchart LR - subgraph "CI/CD GitHub Actions" - A[Push / PR] --> B[Build] - B --> C["Unit Tests\n(7/7)"] - B --> D["Pass Plugin Load\n(9/9)"] - B --> E["Sanitizers\n(ASAN/UBSAN/TSAN)"] - B --> F["Static Analysis\n(clang-tidy / cppcheck)"] - C & D & E & F --> G["Docker Image\nGHCR"] - end - - subgraph "Qualidade" - H[".clang-tidy\n(C++17)"] - I[".cppcheck-suppressions\n(C backend)"] - J["scripts/run-static-analysis.sh"] - K["OpenSSF Best Practices\n(em andamento)"] - end - - G --> L["Reprodutibilidade\nCTA Score"] - H & I & J & K --> L -``` - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar como SVG/PNG. - -**Observação para redação:** -- Destacar que esta infraestrutura pontua diretamente nos critérios CTA: - - **Disponibilidade:** repositório público + Docker image GHCR - - **Funcionalidade:** 7/7 unit tests + 9/9 passes - - **Reprodutibilidade:** `Dockerfile.dev` + scripts de benchmark - - **Sustentabilidade:** CI/CD, static analysis, sanitizers, documentação -- Usar como figura na Seção 3.4 diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig5-cicd.png b/docs/paper-sbseg-2026/sbseg-article/img/fig5-cicd.png deleted file mode 100644 index 88a2bf22f..000000000 Binary files a/docs/paper-sbseg-2026/sbseg-article/img/fig5-cicd.png and /dev/null differ diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig6-wasm-pipeline.mmd b/docs/paper-sbseg-2026/sbseg-article/img/fig6-wasm-pipeline.mmd deleted file mode 100644 index e928fbab6..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/img/fig6-wasm-pipeline.mmd +++ /dev/null @@ -1,57 +0,0 @@ -## Figura 6 — Pipeline WASM Map2Check 2026 - -```mermaid -flowchart LR - subgraph Entrada - A["Binário WASM\n(.wasm)"] - end - - subgraph Lifting - B["wasm2c\n(WABT 1.0.41)"] - C["Código C\n(.c/.h)"] - D["clang-16\n-c -emit-llvm"] - end - - subgraph Wrapper - E["generateWasmWrapperStatic()\nmain() → w2c_*_start"] - F["llvm-link\n(wrapper + lifted IR)"] - end - - subgraph Runtime - G["WasmRuntimeStubs.bc\n(calloc/free KLEE-friendly)"] - end - - subgraph Instrumentação - H["opt-16\n--wasm-mode"] - I["MemoryTrackPass\n(dlmalloc intercept + bounds check)"] - end - - subgraph Verificação - J["KLEE 3.1\n(Execução Simbólica)"] - K["Z3\n(Solver SMT)"] - end - - subgraph Saída - L["Veredito\nFALSE / UNKNOWN"] - M["Witness\n(GraphML)"] - end - - A --> B --> C --> D --> F - E --> F - G --> F - F --> H --> I --> J --> L - J --> K - J --> M -``` - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar como SVG/PNG. - -**Observação para redação:** -- O pipeline é ativado via `map2check --wasm modulo.wasm` -- `wasm2c` converte o binário WASM para código C com semântica preservada -- `generateWasmWrapperStatic` cria uma função `main()` que instancia o módulo, chama `_start` e libera recursos -- `WasmRuntimeStubs.bc` substitui `mmap`/`munmap` do WABT por `calloc`/`free` compatíveis com KLEE -- O `MemoryTrackPass` em modo WASM intercepta `w2c_*_dlmalloc`/`_dlfree` e injeta bounds checks -- O KLEE opera sobre o LLVM IR levantado e linkado, sem modificações diff --git a/docs/paper-sbseg-2026/sbseg-article/main.tex b/docs/paper-sbseg-2026/sbseg-article/main.tex deleted file mode 100644 index 2aa78d4b2..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/main.tex +++ /dev/null @@ -1,360 +0,0 @@ -\documentclass[12pt]{article} - -\usepackage{sbc-template} -\usepackage{graphicx,url} -\usepackage[utf8]{inputenc} -\usepackage[brazil]{babel} -\usepackage{booktabs} -\usepackage{listings} -\usepackage{tabularx} -\usepackage{array} -\usepackage{tikz} -\usetikzlibrary{positioning, arrows.meta, shapes, calc, backgrounds} -% Macros para dados numéricos (ajustáveis em um único lugar) -\newcommand{\TotalTasks}{594} -\newcommand{\ScoreTestComp}{57} -\newcommand{\CountTrue}{264} -\newcommand{\CountUnknown}{271} -\newcommand{\CountFalse}{56} -\newcommand{\CountFalseFree}{1} -\newcommand{\CountTimeout}{2} -\newcommand{\PctTrue}{44,4} -\newcommand{\PctUnknown}{45,6} -\newcommand{\PctFalse}{9,4} -\newcommand{\CountBugsFixed}{3} -\newcommand{\CountCommits}{35} -\newcommand{\CountFiles}{84} -\newcommand{\LinesAdded}{5.785} -\newcommand{\LinesRemoved}{657} -\newcommand{\UnitTests}{7/7} -\newcommand{\PassTests}{9/9} -\newcommand{\CountPasses}{9} -\newcommand{\LLVMVersion}{16} -\newcommand{\KLEEVersion}{3.1} -\newcommand{\CppStandard}{C++17} -\newcommand{\DockerBase}{Ubuntu~22.04} -\newcommand{\TimeoutVal}{300} -\newcommand{\WasmCases}{15} -\newcommand{\WasmFalse}{\WasmCases} -\newcommand{\WasmTimeout}{290} - - -% ControlFlow (coverage-error-call) results -\newcommand{\TotalCF}{138} -\newcommand{\ScoreCF}{38} -\newcommand{\CountFalseCF}{38} -\newcommand{\CountTrueCF}{30} -\newcommand{\CountUnknownCF}{70} -\newcommand{\PctTrueCF}{21,7} -\newcommand{\PctUnknownCF}{50,7} -\newcommand{\PctFalseCF}{27,5} - -\sloppy - -\title{Map2Check 2026: Modernização Sustentável de uma Ferramenta de Verificação de Memory Safety com LLVM~16 e New Pass Manager} - -\author{Guilherme L. P. Bernardo\inst{1}, Inácio Viana\inst{1}, Francisco Nobre\inst{2}, Herbert Rocha\inst{1}} - -\address{Departamento de Informática e Matemática Aplicada -- Universidade Federal do Rio Grande do Norte (UFRN)\\ - Natal -- RN -- Brasil -\nextinstitute - Departamento de Engenharia Elétrica -- Universidade Federal de Roraima (UFRR)\\ - Boa Vista -- RR -- Brasil - \email{bguilherme51@gmail.com, inacioviana.iv@gmail.com,}\\[-2pt] - {\footnotesize\texttt{\{diego.nobre,herbert.rocha\}@ufrr.br}} -} - -\begin{document} - -\maketitle - -\begin{abstract} - Map2Check is a hybrid verification tool for C programs that combines symbolic - execution and fuzzing to detect memory safety vulnerabilities. After a period - of stagnation since 2019 (LLVM~6.0), the tool underwent a complete stack - modernization in 2026: migration to LLVM~\LLVMVersion, adoption of the New Pass Manager, - \CppStandard{} standard, CI/CD infrastructure, static analysis, and sanitizers. This - paper presents the engineering modernization, reports results from TestComp - 2026 (\TotalTasks{} tasks, score~\ScoreTestComp), and discusses ongoing WebAssembly support. -\end{abstract} - -\begin{resumo} - O Map2Check é uma ferramenta de verificação híbrida para programas em C que combina execução simbólica e fuzzing para detectar vulnerabilidades de memory safety. Após um período de estagnação desde 2019 (LLVM~6.0), a ferramenta passou por uma modernização completa da stack em 2026: migração - para LLVM~\LLVMVersion, adoção do New Pass Manager, padrão \CppStandard, infraestrutura de CI/CD, análise estática e sanitizers. Este artigo apresenta a modernização de engenharia, reporta resultados do TestComp~2026 (\TotalTasks{} tarefas, score~\ScoreTestComp) e discute o suporte em desenvolvimento a WebAssembly. -\end{resumo} - - -\section{Introdução} -\label{sec:intro} - -Vulnerabilidades de memory safety em programas C e C++ permanecem entre as classes de falhas de segurança mais críticas e persistentes. Dados do \textit{2025 CWE Top 25 Most Dangerous Software Weaknesses}~\cite{cwe2025} mostram que \textit{Out-of-bounds Write} (CWE-787), \textit{Use-After-Free} (CWE-416) e \textit{Buffer Overflow} (CWE-119) figuram consistentemente entreas principais causas de vulnerabilidades exploráveis. Em sistemas críticos, falhas de memory safety podem resultar em execução remota de código, elevação de privilégios ou negação de serviço, como ilustrado pelo acidente do -Therac-25~\cite{leveson1993investigation}. - -Diante desse cenário, a verificação híbrida combina o rigor da análise formal com a escalabilidade dos testes dinâmicos. Técnicas como execução simbólica, exemplificada pelo KLEE~\cite{klee2008}, e fuzzing guiado por cobertura, como o AFL++~\cite{fioraldi2020aflpp}, são complementares: enquanto o fuzzing é -eficiente para explorar caminhos superficiais, a execução simbólica penetra guardas lógicas complexas por meio de \textit{path constraints} resolvidas por solvers SMT. O estado da arte em competições de verificação, como SV-COMP e TestComp~\cite{beyersvcomp2013,beyertestcomp2023}, demonstra que as -ferramentas mais bem-sucedidas adotam arquiteturas de orquestração com múltiplos motores: o FuSeBMC~\cite{fusebmc2022} utiliza \textit{smart seeds} geradas por BMC para desbloquear o fuzzer, atingindo cobertura de código superior a 81\% em categorias críticas; o Symbiotic~\cite{chalupa2021symbiotic} integra \textit{program slicing} estático com KLEE para reduzir o espaço de busca; e o ESBMC~\cite{gadelha2021esbmc} emprega \textit{bounded model checking} com múltiplos solvers SMT. - -O Map2Check é uma ferramenta brasileira de verificação híbrida para programas C, com histórico de publicações no TACAS (2016, 2018, 2020) \cite{map2check2018,map2check2020}. Desde 2019, contudo, a ferramenta permaneceu estagnada: a última versão estável (v7.3.1) operava sobre LLVM~6.0 e Ubuntu~16.04 com um fork do KLEE~2.0. Essa obsolescência técnica inviabilizava a participação em competições e -comprometia a reprodutibilidade dos resultados. - -Para ilustrar a operação da ferramenta modernizada, a Listagem~\ref{lst:example} apresenta uma execução completa do Map2Check 2026 sobre um benchmark com buffer overflow. O comando \texttt{map2check} compila o código C com Clang~16, instrumenta o bitcode LLVM com os passes de memory safety, executa o KLEE e reporta o veredito com um contra-exemplo concreto que identifica a entrada responsável pela violação. - -\begin{lstlisting}[caption={Execução do Map2Check em um cenário de buffer overflow.}, label=lst:example, basicstyle=\ttfamily\small] -$ cat array-2.c -int main() { - int a[10], i = __VERIFIER_nondet_int(); - a[i] = 42; // i pode ser >= 10 - return 0; -} -$ map2check --property-file coverage-error-call.prp array-2.c -VERIFICATION FAILED -Counter-example: nondet_int() -> 31763, line 3, scope main -\end{lstlisting} - -Este artigo apresenta o Map2Check 2026, resultado de uma modernização sistemática da stack completa. As principais contribuições são: -\begin{enumerate} -\item Migração da infraestrutura LLVM da versão~6 para~\LLVMVersion, com reescrita dos \CountPasses{} passes de instrumentação para o New Pass Manager e adoção do padrão \CppStandard; -\item Infraestrutura de engenharia de software com CI/CD, containerização Docker, análise estática e sanitizers, alinhada aos critérios do OpenSSF Best Practices~\cite{openssf2024}; -\item Validação no TestComp~2026, sub-categoria Heap, com \TotalTasks{} tarefas (corretamente detectanddo ~\ScoreTestComp casos de bugs); -\item Mapeamento formal das propriedades de memory safety para a taxonomia CWE do MITRE, fortalecendo a aplicabilidade da ferramenta em cenários de cibersegurança; -\item Suporte a WebAssembly (WASM) em desenvolvimento, estendendo o pipeline LLVM~16 para análise de módulos WASM via \texttt{wasm2c}. -\end{enumerate} - - -\section{História e Evolução} -\label{sec:historia} - -O Map2Check foi apresentado em três edições consecutivas do TACAS. Em 2016, a ferramenta empregava \textit{Bounded Model Checking} (BMC) com o verificador CBMC para detectar violações de memory safety. À época, ferramentas como CPAchecker~\cite{beyersvcomp2013} já combinavam múltiplas estratégias de verificação (análise de valor, \textit{predicate abstraction}, BMC), enquanto o Map2Check dependia exclusivamente do BMC com um único solver. - -Em 2018, a ferramenta migrou para a infraestrutura LLVM e adotou o KLEE como motor de execução simbólica, permitindo a geração de casos de teste por \textit{path-based symbolic execution}~\cite{map2check2018}. Nesse período, o Symbiotic~\cite{chalupa2021symbiotic} despontava ao integrar \textit{program slicing} estático com KLEE, reduzindo o espaço de busca antes da análise simbólica. O ESBMC, por sua vez, consolidava o uso de múltiplos solvers SMT (Z3, Boolector, Yices) em um \textit{portfolio} para reduzir a taxa de resultados inconclusivos\cite{gadelha2021esbmc}. - -Em 2020, o Map2Check consolidou uma abordagem híbrida, combinando fuzzing (LibFuzzer), execução simbólica (KLEE) e inferência de invariantes indutivos (Crab-LLVM~\cite{crabllvm2021}) em uma estratégia de \textit{iterative deepening}~\cite{map2check2020}. Contudo, a ausência de um orquestrador com troca dinâmica de sementes limitava a cooperação entre os motores: enquanto o FuSeBMC~\cite{fusebmc2022} introduzia \textit{smart seeds} geradas por BMC para desbloquear o fuzzer, atingindo cobertura de código superior a 81\% em categorias da Test-Comp, o Map2Check operava os motores em fases estanques, -sem compartilhamento de estado em tempo real. - -Após 2020, a ferramenta entrou em um período de estagnação que durou até 2025. A stack LLVM~6.0 e Ubuntu~16.04 atingiram fim de vida, o fork do KLEE~2.0 perdeu compatibilidade com versões recentes do solver Z3, e a ausência de CI/CD e containerização impedia a reprodução dos resultados por terceiros. O renascimento em 2026 partiu da constatação de que a modernização de engenharia era pré-requisito para qualquer avanço algorítmico. A Figura~\ref{fig:timeline} sintetiza essa trajetória. - -\begin{figure}[ht] -\centering -\input{img/fig1-timeline.tikz.tex} -\caption{Evolução do Map2Check de 2016 a 2026, com os marcos de cada edição do TACAS e o período de estagnação.} -\label{fig:timeline} -\end{figure} - - -\section{Arquitetura e Funcionalidades} -\label{sec:arquitetura} - -\subsection{Pipeline de Verificação} -\label{subsec:pipeline} - -O pipeline do Map2Check 2026 opera em cinco estágios, ilustrados na Figura~\ref{fig:pipeline}. O código-fonte C é compilado pelo Clang~\LLVMVersion{} com \texttt{-O0}, gerando bitcode LLVM (IR). Esse bitcode é instrumentado por \CountPasses{} passes que executam via \texttt{opt} com o New Pass Manager, injetando chamadas à biblioteca de runtime para rastrear alocações de memória, acessos a ponteiros e operações aritméticas. O bitcode instrumentado é ligado à biblioteca de runtime via \texttt{llvm-link} e executado pelo motor de análise KLEE~\KLEEVersion{} para execução simbólica ou LibFuzzer para fuzzing guiado por cobertura. O resultado consiste em um veredito (TRUE, FALSE ou UNKNOWN) e, para violações, um witness no formato GraphML com o caso de teste concreto que aciona o erro. - -\begin{figure}[ht] -\centering -\input{img/fig2-pipeline.tikz.tex} -\caption{Pipeline de verificação do Map2Check 2026: compilação, instrumentação, ligação com runtime e análise por KLEE ou LibFuzzer.} -\label{fig:pipeline} -\end{figure} - -A migração do Legacy Pass Manager (LPM) para o New Pass Manager (NPM) exigiu a reescrita completa dos \CountPasses{} passes, uma vez que as APIs \texttt{FunctionPass} e \texttt{ModulePass} foram substituídas pelo -modelo baseado em \texttt{PassInfoMixin} do LLVM~\cite{lattner:2004}. O NPM viabiliza a interoperabilidade com pipelines de otimização modernos e habilita a compilação com \texttt{-O0} sem perda de instrumentação. - -\subsection{Passes de Instrumentação} -\label{subsec:passes} - -Os \CountPasses{} passes migrados cobrem as principais classes de vulnerabilidades de memory safety. O \textit{MemoryTrackPass} emprega análise de fluxo de dados para rastrear alocações (\texttt{malloc}, -\texttt{free}), acessos a ponteiros (\texttt{load}, \texttt{store}) e desreferências, detectando use-after-free, double-free e acessos inválidos. O \textit{OverflowPass} realiza análise de intervalos em operações aritméticas para identificar buffer overflow (CWE-119/787) e integer overflow (CWE-190). O \textit{GenerateAutomataTruePass} produz o autômato de witness em GraphML que descreve o caminho de execução até a violação, permitindo validação externa por ferramentas como o CPAchecker. Os demais passes oferecem suporte à infraestrutura de verificação: injeção de predicados em laços, substituição de entradas não determinísticas, rastreamento de cobertura de blocos básicos e instrumentação de asserts do verificador. - -\subsection{Infraestrutura de Engenharia} -\label{subsec:engenharia} - -A modernização de 2026 abrangeu a infraestrutura de desenvolvimento em múltiplas camadas. O código foi migrado para \CppStandard{}, com adoção de \texttt{std::filesystem} para manipulação portável de caminhos. O ambiente -de build é containerizado via Docker (\DockerBase{} LTS), incluindo LLVM~\LLVMVersion, KLEE~\KLEEVersion, Z3 e Boost, garantindo reprodutibilidade em qualquer máquina. A qualidade é assegurada por CI/CD no GitHub Actions: build com GCC e Clang, \UnitTests{} testes unitários, \PassTests{} testes de carga dos passes no \texttt{opt}, análise estática com clang-tidy e cppcheck, e sanitizers ASAN, UBSAN e TSAN. O projeto está em processo de certificação no programa OpenSSF Best Practices~\cite{openssf2024}, atendendo aos critérios de disponibilidade, -funcionalidade, reprodutibilidade e sustentabilidade exigidos pelo comitê de avaliação de artefatos do SBSeg. - - -\section{Análise Experimental} -\label{sec:ciberseguranca} - -\subsection{Mapeamento de Memory Safety para CWEs} -\label{subsec:cwe} - -O ecossistema de cibersegurança utiliza a taxonomia CWE (\textit{Common Weakness Enumeration}) do MITRE~\cite{cwe2025} como linguagem padrão para classificação de vulnerabilidades. Para posicionar o Map2Check nesse ecossistema, estabelecemos um mapeamento formal entre as propriedades de memory safety verificadas pela ferramenta e os identificadores CWE correspondentes, apresentado na Tabela~\ref{tab:cwe}. Esse mapeamento permite que resultados de verificação formal sejam interpretados diretamente por profissionais de AppSec, que utilizam CWEs como referência em pipelines de análise de vulnerabilidades. - -\begin{table}[ht] -\centering -\caption{Mapeamento entre propriedades SV-COMP, CWEs e passes de instrumentação.} -\label{tab:cwe} -% Usamos >{\raggedright\arraybackslash} antes do X para alinhar à esquerda sem justificar -\begin{tabularx}{\textwidth}{@{}ll>{\raggedright\arraybackslash}X@{}} -\toprule -Propriedade SV-COMP & CWE & Técnica empregada \\ -\midrule -\texttt{valid-free} & CWE-415 (Double-Free) & Análise de fluxo de dados (MemoryTrackPass) \\ -\texttt{valid-deref} & CWE-416 (Use-After-Free) & Análise de fluxo de dados (MemoryTrackPass) \\ -\texttt{valid-memtrack} & CWE-401 (Memory Leak) & Tracking de alocações (MemoryTrackPass) \\ -\texttt{valid-memsafety} & CWE-119/787 (Buffer Overflow) & Análise de intervalos + fluxo de dados \\ -\texttt{no-overflow} & CWE-190 (Integer Overflow) & Análise de intervalos (OverflowPass) \\ -\bottomrule -\end{tabularx} -\end{table} - -\subsection{Resultados no TestComp 2026} -\label{subsec:testcomp} - -Para validação em larga escala, executamos o Map2Check 2026 contra a sub-categoria \texttt{C.coverage-error-call.Heap} do TestComp~2026~\cite{beyertestcomp2023}, composta por \TotalTasks{} tarefas distribuídas em dois conjuntos: \textit{Heap} (428 tarefas, com alocação dinâmica) e \textit{LinkedLists} (166 tarefas, com estruturas encadeadas). A configuração experimental utilizou timeout de \TimeoutVal{}s por tarefa, solver Z3~\cite{z3esbmc2008}, função-alvo \texttt{reach\_error} e ambiente Docker single-container (\DockerBase{} LTS). A execução total durou aproximadamente 20 horas. - -A Tabela~\ref{tab:testcomp} apresenta os resultados consolidados. A ferramenta obteve \CountTrue{} vereditos TRUE (\PctTrue\%), confirmando a ausência de violações nesses benchmarks; \CountFalse{} vereditos FALSE -(\PctFalse\%), representando bugs reais de memory safety detectados com contra-exemplo; e \CountUnknown{} vereditos UNKNOWN (\PctUnknown\%), que refletem principalmente timeouts na exploração de caminhos pelo KLEE. O -score final foi \ScoreTestComp{}. - -\begin{table}[ht] -\centering -\caption{Resultados no TestComp 2026 --- C.coverage-error-call.Heap.} -\label{tab:testcomp} -\begin{tabular}{@{}lrr@{}} -\toprule -Veredito & Tarefas & \% \\ -\midrule -TRUE & \CountTrue{} & \PctTrue \% \\ -UNKNOWN & \CountUnknown{} & \PctUnknown \% \\ -FALSE (bugs detectados) & \CountFalse{} & \PctFalse \% \\ -FALSE\_FREE & \CountFalseFree{} & 0,2 \% \\ -TIMEOUT & \CountTimeout{} & 0,3 \% \\ -\midrule -\textbf{Total} & \textbf{\TotalTasks} & \textbf{100 \%} \\ -\textbf{Score} & \textbf{\ScoreTestComp} & --- \\ -\bottomrule -\end{tabular} -\end{table} - -A validação manual de vereditos com smoke tests nos benchmarks canônicos \texttt{loops/array-1.c} (TRUE) e \texttt{loops/array-2.c} (FALSE, com counter-example \texttt{nondet\_int() $\rightarrow$ 31763}) confirmou a -corretude do pipeline completo. Durante a migração, três inconsistências na API do New Pass Manager foram identificadas e corrigidas: incompatibilidade de flags entre versões do KLEE, passes instrumentalizados sendo ignorados silenciosamente pelo \texttt{opt} em funções \texttt{optnone}, e divergência no nome da função-alvo entre a variável de ambiente e o \texttt{cl::opt}. Nenhum desses problemas era detectável pelos testes -unitários existentes (\UnitTests{}), que cobrem apenas a biblioteca C de runtime, evidenciando a necessidade de testes de integração E2E no pipeline de CI. - -\subsection{Resultados no ControlFlow} -\label{subsec:testcomp-cf} - -Além da categoria Heap, executamos o Map2Check 2026 contra a sub-categoria \texttt{C.coverage-error-call.ControlFlow} do TestComp~2026, composta por \TotalCF{} tarefas que abrangem drivers de dispositivos simplificados, estruturas de controle complexas e benchmarks de overflow aritmético. Diferentemente da categoria Heap, focada em alocação dinâmica e estruturas encadeadas, a ControlFlow explora programas cuja corretude depende predominantemente de fluxo de controle e variáveis inteiras, sem ênfase em ponteiros ou estruturas de dados. - -A Tabela~\ref{tab:testcomp-cf} apresenta os resultados. A ferramenta obteve \CountTrueCF{} vereditos TRUE (\PctTrueCF\%), \CountFalseCF{} FALSE (\PctFalseCF\%), e \CountUnknownCF{} UNKNOWN (\PctUnknownCF\%). O score final foi \ScoreCF/\TotalCF{}. A taxa de detecção de bugs (27,5\%) demonstra que a instrumentação do Map2Check é eficaz em código de drivers e controle de fluxo, enquanto os UNKNOWNs (50,7\%) refletem a complexidade inerente desses benchmarks, particularmente os drivers \texttt{ntdrivers-simplified} e \texttt{openssl-simplified}, que demandam tempos de exploração superiores ao timeout configurado. A execução completa levou aproximadamente 5 horas, evidenciando a escalabilidade da abordagem. - -\begin{table}[ht] -\centering -\caption{Resultados no TestComp 2026 --- C.coverage-error-call.ControlFlow.} -\label{tab:testcomp-cf} -\begin{tabular}{@{}lrr@{}} -\toprule -Veredito & Tarefas & \% \\ -\midrule -TRUE & \CountTrueCF{} & \PctTrueCF \% \\ -UNKNOWN & \CountUnknownCF{} & \PctUnknownCF \% \\ -FALSE (bugs detectados) & \CountFalseCF{} & \PctFalseCF \% \\ -\midrule -\textbf{Total} & \textbf{\TotalCF} & \textbf{100 \%} \\ -\textbf{Score} & \textbf{\ScoreCF} & --- \\ -\bottomrule -\end{tabular} -\end{table} - -\subsection{Validação no WebAssembly com Juliet Test Suite} -\label{subsec:wasm-juliet} - -Para validar experimentalmente o pipeline de lifting WASM e o bounds checking por alocação, selecionamos \WasmCases{} casos da Juliet Test Suite v1.3 (NIST/NSA)~\cite{nsa2017juliet} cobrindo cinco categorias de buffer overflow: CWE-121 (Stack Buffer Overflow), CWE-122 (Heap Buffer Overflow), CWE-124 (Buffer Underwrite), CWE-126 (Buffer Overread) e CWE-127 (Buffer Underread). A seleção priorizou exclusivamente casos sem dependências de rede, usando três mecanismos de entrada: \texttt{fgets}/stdin, valores hardcoded, e operações locais de memória como \texttt{memcpy}/\texttt{strcpy}/\texttt{alloca}. Todos compilam para WASM via \texttt{wasi-sdk-33.0}, sem modificações. - -Os módulos foram submetidos ao pipeline \texttt{map2check --wasm --memtrack} com timeout de \WasmTimeout{}s. O \texttt{MemoryTrackPass} foi estendido com um modo WASM que intercepta as funções de alocação do musl (\texttt{w2c\_*\_dlmalloc}/\texttt{w2c\_*\_dlfree}) no IR levantado, registrando offsets e tamanhos no \texttt{AllocationLog}. Em cada \texttt{load}/\texttt{store} na memória linear, o offset acessado é verificado contra as alocações registradas, detectando acessos fora dos limites por meio do mecanismo de bounds checking por alocação individual. - -A Tabela~\ref{tab:wasm-juliet} apresenta os resultados. Todos os \WasmCases{} casos foram corretamente detectados como FALSE, com a propriedade OVERFLOW violada, confirmando que a interceptação do alocador funciona e o bounds checking por alocação é eficaz. A detecção abrange tanto casos de heap overflow (\texttt{malloc}/\texttt{memcpy}: CWE-122 e CWE-126) quanto casos de stack overflow e underwrite/underread (CWE-121, CWE-124, CWE-127), demonstrando que o mecanismo de bounds checking captura violações independentemente do tipo de alocação. Com timeouts mais curtos (110s), todos os casos retornavam UNKNOWN; o aumento para \WasmTimeout{}s permitiu que o KLEE explorasse caminhos suficientes para encontrar as violações. - -A validação confirma que o pipeline Map2Check-WASM está funcional end-to-end e que o bounds checking por alocação individual é viável para código WASM gerado a partir de C com \texttt{wasi-sdk}. Esta é, até onde sabemos, a primeira demonstração de verificação formal de memory safety em binários WASM via lifting para LLVM IR com instrumentação do alocador. - -\begin{table}[ht] -\centering -\caption{Bounds checking por alocação no Map2Check-WASM (Juliet, \WasmTimeout{}s timeout).} -\label{tab:wasm-juliet} -\begin{tabular}{@{}lllr@{}} -\toprule -CWE & Tipo & Entrada & Veredito \\ -\midrule -121 & Stack Overflow & \texttt{fgets} & FALSE \\ -121 & Stack Overflow & valor hardcoded & FALSE \\ -121 & Stack Overflow & \texttt{alloca+memcpy} & FALSE \\ -122 & Heap Overflow & \texttt{malloc+memcpy} & FALSE \\ -122 & Heap Overflow & \texttt{sizeof} errado & FALSE \\ -122 & Heap Overflow & \texttt{fgets} & FALSE \\ -122 & Heap Overflow & valor hardcoded & FALSE \\ -124 & Buffer Underwrite & \texttt{fgets} & FALSE \\ -124 & Buffer Underwrite & valor hardcoded & FALSE \\ -124 & Buffer Underwrite & \texttt{alloca+strcpy} & FALSE \\ -126 & Buffer Overread & \texttt{fgets} & FALSE \\ -126 & Buffer Overread & valor hardcoded & FALSE \\ -126 & Buffer Overread & \texttt{malloc+memcpy} & FALSE \\ -127 & Buffer Underread & \texttt{fgets} & FALSE \\ -127 & Buffer Underread & valor hardcoded & FALSE \\ -\midrule -\multicolumn{3}{@{}l}{\textbf{Total}} & \textbf{\WasmCases/\WasmCases{} FALSE} \\ -\bottomrule -\end{tabular} -\end{table} - -\subsection{Suporte a WebAssembly} -\label{subsec:wasm} - -Estendemos o pipeline LLVM~\LLVMVersion{} para análise de módulos WebAssembly (WASM). A abordagem emprega o \texttt{wasm2c} (WABT~1.0.41) para converter binários WASM em código C com semântica preservada e, em seguida, o Clang~16 para gerar LLVM IR. O IR resultante é submetido aos mesmos passes de instrumentação e motores de análise do pipeline C nativo, permitindo verificar memory safety em binários WASM sem reimplementar a lógica de verificação. - -\begin{figure}[ht] -\centering -\includegraphics[width=.95\textwidth]{img/fig6-wasm-pipeline} -\caption{Pipeline WASM do Map2Check 2026: lifting via \texttt{wasm2c}, geração de wrapper, instrumentação com bounds check e verificação via KLEE.} -\label{fig:wasm-pipeline} -\end{figure} - -Um desafio arquitetural significativo é a diferença de entrypoints. Programas C nativos possuem a função \texttt{main} como ponto de entrada, que o \texttt{Map2CheckLibrary} renomeia para \texttt{\_\_map2check\_main\_\_} durante a instrumentação. O \texttt{wasm2c}, por outro lado, traduz o entrypoint do módulo WASM, tipicamente \texttt{\_start} do WASI, para funções com nome determinístico no formato \texttt{w2c\_\_start}, e o \texttt{main} original do usuário aparece como \texttt{w2c\_\_original\_main}. Para unificar o pipeline, implementamos a função \texttt{generateWasmWrapperStatic}, que dinamicamente extrai o nome do módulo a partir do entrypoint levantado e gera um arquivo C contendo uma função \texttt{main} canônica que instancia o módulo WASM (\texttt{wasm2c\_\_instantiate}), invoca o entrypoint (\texttt{w2c\_\_start}), e libera a instância (\texttt{wasm2c\_\_free}). Este wrapper é compilado para bitcode e ligado ao IR levantado via \texttt{llvm-link}, permitindo que o restante do pipeline opere sobre a função \texttt{main} sem modificações. - -A ativação do modo WASM é feita via CLI com a flag \texttt{--wasm}, que orquestra automaticamente o lifting, a geração do wrapper e a aplicação dos passes com o flag \texttt{--wasm-mode}. A biblioteca \texttt{WasmRuntimeStubs.bc} substitui as funções de runtime do WABT por implementações baseadas em \texttt{calloc}/\texttt{free}, compatíveis com o modelo de memória do KLEE, e redireciona \texttt{wasm\_rt\_trap} para \texttt{map2check\_error}, integrando os bounds checks nativos do \texttt{wasm2c} ao sistema de geração de witnesses do Map2Check. - - -\section{Conclusão} -\label{sec:conclusao} - -Este artigo apresentou a modernização do Map2Check, uma ferramenta brasileira de verificação híbrida de memory safety para programas C. A migração da stack de LLVM~6.0 para~\LLVMVersion{} com New Pass Manager e \CppStandard{} abrangeu \CountCommits{} commits em \CountFiles{} arquivos (+\LinesAdded{}/$-$\LinesRemoved{} linhas), com \CountPasses{} passes reescritos, \UnitTests{} testes unitários e \PassTests{} passes validados no -\texttt{opt-16}. A infraestrutura de engenharia adicionada como o estabelecimento de práticas de CI/CD, testes Dockerizados, utilização de testes com análise estática no desenvolvimento, sanitizers e a aquisição da certificação OpenSSF Best Practices~\cite{openssf2024}, que estabelece as condições de reprodutibilidade e sustentabilidade exigidas pela comunidade científica. - -A validação no TestComp~2026 demonstrou a viabilidade competitiva da ferramenta em múltiplas categorias: \TotalTasks{} tarefas na sub-categoria Heap (score~\ScoreTestComp{}) e \TotalCF{} tarefas na sub-categoria ControlFlow (score~\ScoreCF/\TotalCF{}), totalizando \CountFalse+\CountFalseCF{} bugs reais detectados com contra-exemplos precisos. O mapeamento formal das propriedades de memory safety para a taxonomia CWE do MITRE posiciona o Map2Check como ponte entre verificação formal e cibersegurança aplicada. - -As principais limitações identificadas são a taxa de \PctUnknown\% de vereditos inconclusivos e a ausência de testes de integração E2E no CI, que direcionam os próximos ciclos de desenvolvimento. O suporte a WebAssembly foi validado com \WasmCases{} casos da Juliet Test Suite, demonstrando a viabilidade do bounds checking por alocação individual em todos os buffers testados (heap e stack) com vereditos FALSE em \WasmCases/\WasmCases{} casos.. Com código aberto e infraestrutura de artefato validada, o Map2Check 2026 está posicionado para contribuir com as comunidades de verificação formal, engenharia de software e cibersegurança. - -\section{Reprodutibilidade} -\label{ap:repro} - -\subsection{Build com Docker} - -\begin{verbatim} -docker build -f Dockerfile.dev -t map2check-dev . -docker run -it --rm map2check-dev -\end{verbatim} - -\subsection{Execução de Benchmarks} - -\begin{verbatim} -map2check --property-file coverage-error-call.prp \ - --target-function-name reach_error loops/array-1.c - -cd test-comp2026/simulation/ -./run_checkpoint.sh --category Heap --timeout 300 -./verify_verdicts.sh -\end{verbatim} - -\subsection{Declaração de Uso de IA Generativa} -\label{ap:ia} - -Ferramentas de Inteligência Artificial Generativa foram utilizadas -como assistentes de escrita e revisão no processo de redação deste -artigo, conforme o Código de Conduta da SBC. -\bibliographystyle{sbc} -\bibliography{references} - -\newpage -\appendix - -\end{document} diff --git a/docs/paper-sbseg-2026/sbseg-article/references.bib b/docs/paper-sbseg-2026/sbseg-article/references.bib deleted file mode 100644 index 24ef15140..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/references.bib +++ /dev/null @@ -1,628 +0,0 @@ -@Book{knuth:84, - author = {Donald E. Knuth}, - title = {The {\TeX} Book}, - publisher = {Addison-Wesley}, - year = {1984}, - edition = {15th} -} - -@article{leveson1993investigation, - title={An investigation of the Therac-25 accidents}, - author={Leveson, Nancy G and Turner, Clark S}, - journal={Computer}, - volume={26}, - number={7}, - pages={18--41}, - year={1993}, - publisher={IEEE} -} - -@article{evaluationcriticalsoftware, -author = {Parnas, David L. and van Schouwen, A. John and Kwan, Shu Po}, -title = {Evaluation of safety-critical software}, -year = {1990}, -issue_date = {June 1990}, -publisher = {Association for Computing Machinery}, -address = {New York, NY, USA}, -volume = {33}, -number = {6}, -issn = {0001-0782}, -url = {https://doi.org/10.1145/78973.78974}, -doi = {10.1145/78973.78974}, -abstract = {Methods and approaches for testing the reliability and trustworthiness of software remain among the most controversial issues facing this age of high technology. The authors present some of the crucial questions faced by software programmers and eventual users.}, -journal = {Commun. ACM}, -month = {jun}, -pages = {636–648}, -numpages = {13} -} - -@INPROCEEDINGS{stresstest2009, - author={Mustafa, Khaled M. and Al-Qutaish, Rafa E. and Muhairat, Mohammad I.}, - booktitle={2009 Second International Conference on Computer and Electrical Engineering}, - title={Classification of Software Testing Tools Based on the Software Testing Methods}, - year={2009}, - volume={1}, - number={}, - pages={229-233}, - keywords={Software testing;System testing;Software tools;Automatic testing;Application software;Open source software;Programming;Life testing;Software quality;Protocols;Software Testing Tools;Classification;Types of Software;CASE}, - doi={10.1109/ICCEE.2009.9}} - - -@INPROCEEDINGS{whitebox2010, - author={Omar, Faizah and Ibrahim, Suhaimi}, - booktitle={2010 10th International Conference on Quality Software}, - title={Designing Test Coverage for Grey Box Analysis}, - year={2010}, - volume={}, - number={}, - pages={353-356}, - keywords={Software;test coverage;software testing;grey box;white box;black box;software traceability}, - doi={10.1109/QSIC.2010.44}} - - -@INPROCEEDINGS{blackwhitebox2011, - author={Khan, Mumtaz Ahmad and Sadiq, Mohd.}, - booktitle={The 2011 International Conference and Workshop on Current Trends in Information Technology (CTIT 11)}, - title={Analysis of black box software testing techniques: A case study}, - year={2011}, - volume={}, - number={}, - pages={1-5}, - keywords={Software;Robustness;Software engineering;Software testing;Input variables;Programming;Software;Software Testing;Black Box Testing;Boundary Value Analysis;Robustness Technique}, - doi={10.1109/CTIT.2011.6107931}} - - -@INPROCEEDINGS{CprogramingLanguage2009, - author={Yu He}, - booktitle={2009 4th International Conference on Computer Science & Education}, - title={The course choice between C language and C++ language}, - year={2009}, - volume={}, - number={}, - pages={1588-1590}, - keywords={Computer languages;Application software;Programming profession;Computer science;Object oriented programming;Educational institutions;High level languages;Software maintenance;Design methodology;Education;C language;C++ language;programming design methods;object-oriented;curriculum design}, - doi={10.1109/ICCSE.2009.5228304}} - - - -@InProceedings{map2check2018, -author="Menezes, Rafael -and Rocha, Herbert -and Cordeiro, Lucas -and Barreto, Raimundo", -editor="Beyer, Dirk -and Huisman, Marieke", -title="Map2Check Using LLVM and KLEE", -booktitle="Tools and Algorithms for the Construction and Analysis of Systems", -year="2018", -publisher="Springer International Publishing", -address="Cham", -pages="437--441", -abstract="Map2Check is a bug hunting tool that automatically checks safety properties in C programs. It tracks memory pointers and variable assignments to check user-specified assertions, overflow, and pointer safety. Here, we extend Map2Check to: (i) simplify the program using Clang/LLVM; (ii) perform a path-based symbolic execution using the KLEE tool; and (iii) transform and instrument the code using the LLVM dynamic information flow. The SVCOMP'18 results show that Map2Check can be effective in generating and checking test cases related to memory management of C programs.", -isbn="978-3-319-89963-3" -} - -@misc{fandrey2010clang, - author = {Dietmar Fandrey}, - title = {Clang/LLVM Maturity Report}, - howpublished = {\url{http://www.iwi.hs-karlsruhe.de}}, - year = {2010}, - note = {Accessed: 2024-06-16} -} - -@inproceedings{klee2008, -author = {Cadar, Cristian and Dunbar, Daniel and Engler, Dawson}, -title = {KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs}, -year = {2008}, -publisher = {USENIX Association}, -address = {USA}, -abstract = {We present a new symbolic execution tool, KLEE, capable of automatically generating tests that achieve high coverage on a diverse set of complex and environmentally-intensive programs. We used KLEE to thoroughly check all 89 stand-alone programs in the GNU COREUTILS utility suite, which form the core user-level environment installed on millions of Unix systems, and arguably are the single most heavily tested set of open-source programs in existence. KLEE-generated tests achieve high line coverage -- on average over 90\% per tool (median: over 94\%) -- and significantly beat the coverage of the developers' own hand-written test suite. When we did the same for 75 equivalent tools in the BUSYBOX embedded system suite, results were even better, including 100\% coverage on 31 of them.We also used KLEE as a bug finding tool, applying it to 452 applications (over 430K total lines of code), where it found 56 serious bugs, including three in COREUTILS that had been missed for over 15 years. Finally, we used KLEE to crosscheck purportedly identical BUSYBOX and COREUTILS utilities, finding functional correctness errors and a myriad of inconsistencies.}, -booktitle = {Proceedings of the 8th USENIX Conference on Operating Systems Design and Implementation}, -pages = {209–224}, -numpages = {16}, -location = {San Diego, California}, -series = {OSDI'08} -} - - -@InProceedings{map2check2020, -author="Rocha, Herbert -and Menezes, Rafael -and Cordeiro, Lucas C. -and Barreto, Raimundo", -editor="Biere, Armin -and Parker, David", -title="Map2Check: Using Symbolic Execution and Fuzzing", -booktitle="Tools and Algorithms for the Construction and Analysis of Systems", -year="2020", -publisher="Springer International Publishing", -address="Cham", -pages="403--407", -abstract="Map2Check is a software verification tool that combines fuzzing, symbolic execution, and inductive invariants. It automatically checks safety properties in C programs by adopting source code instrumentation to monitor data (e.g., memory pointers) from the program's executions using LLVM compiler infrastructure. For SV-COMP 2020, we extended Map2Check to exploit an iterative deepening approach using LibFuzzer and Klee to check for safety properties. We also use Crab-LLVM to infer program invariants based on reachability analysis. Experimental results show that Map2Check can handle a wide variety of safety properties in several intricate verification tasks from SV-COMP 2020.", -isbn="978-3-030-45237-7" -} - -%%%%%%%%%%%%%%%%%%%%%%%%% referencias da fundamentação teorica -@techreport{dijkstra1970notes, - author = {Dijkstra, Edsger W.}, - title = {Notes on Structured Programming (EWD249)}, - institution = {Mathematical Centre, Amsterdam}, - year = {1970}, - url = {http://www.cs.utexas.edu/users/EWD/}, -} - - -@article{parnassoftwarecritico1990, -author = {Parnas, David L. and van Schouwen, A. John and Kwan, Shu Po}, -title = {Evaluation of safety-critical software}, -year = {1990}, -issue_date = {June 1990}, -publisher = {Association for Computing Machinery}, -address = {New York, NY, USA}, -volume = {33}, -number = {6}, -issn = {0001-0782}, -url = {https://doi.org/10.1145/78973.78974}, -doi = {10.1145/78973.78974}, -abstract = {Methods and approaches for testing the reliability and trustworthiness of software remain among the most controversial issues facing this age of high technology. The authors present some of the crucial questions faced by software programmers and eventual users.}, -journal = {Communications ACM}, -month = {jun}, -pages = {636–648}, -numpages = {13} -} - -@inproceedings{coverageSpaceProject2017, -author = {Prause, Christian and Werner, Jürgen and Hornig, Kay and Bosecker, Sascha and Kuhrmann, Marco}, -year = {2017}, -month = {11}, -pages = {}, -title = {Is 100% Test Coverage a Reasonable Requirement? Lessons Learned from a Space Software Project}, -isbn = {978-3-319-69925-7}, -doi = {10.1007/978-3-319-69926-4_25} -} - -@article{al2021jacoco, - title={Jacoco-coverage based statistical approach for ranking and selecting key classes in object-oriented software}, - author={Al-Ahmad, Bilal and AL-TAHARWA, ISMAIL and ALKHAWALDEH, RAMI S and ALAZZAM, IYAD M and GHATASHEH, NAZEEH}, - journal={Journal of Engineering Science and Technology}, - volume={16}, - number={08}, - pages={2021}, - year={2021} -} - -@article{clarkemetodosformais1996, -author = {Clarke, Edmund M. and Wing, Jeannette M.}, -title = {Formal methods: state of the art and future directions}, -year = {1996}, -issue_date = {Dec. 1996}, -publisher = {Association for Computing Machinery}, -address = {New York, NY, USA}, -volume = {28}, -number = {4}, -issn = {0360-0300}, -url = {https://doi.org/10.1145/242223.242257}, -doi = {10.1145/242223.242257}, -journal = {ACM Computing Surveys}, -month = {dec}, -pages = {626–643}, -numpages = {18} -} - -@INPROCEEDINGS{testcovferramenta, - author={Beyer, Dirk and Lemberger, Thomas}, - booktitle={2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE)}, - title={TestCov: Robust Test-Suite Execution and Coverage Measurement}, - year={2019}, - volume={}, - number={}, - pages={1074-1077}, - keywords={Containers;Generators;Tools;Standards;Metadata;Linux;Computer architecture;Test Execution, Coverage, Test-Suite Reduction}, - doi={10.1109/ASE.2019.00105}} - - -@article{soremekun2021programslicing, - title={Locating faults with program slicing: an empirical analysis}, - author={Soremekun, Ezekiel and Kirschner, Lukas and Böhme, Marcel and Zeller, Andreas}, - journal={Empirical Software Engineering}, - volume={26}, - issue={3}, - pages={51}, - year={2021}, - month={April}, - doi={10.1007/s10664-020-09931-7}, - url={https://doi.org/10.1007/s10664-020-09931-7}, - publisher={Springer} -} - -@article{korel1988dynamicslice, -title = {Dynamic slicing of computer programs}, -journal = {Journal of Systems and Software}, -volume = {13}, -number = {3}, -pages = {187-195}, -year = {1990}, -issn = {0164-1212}, -doi = {https://doi.org/10.1016/0164-1212(90)90094-3}, -url = {https://www.sciencedirect.com/science/article/pii/0164121290900943}, -author = {Bogdan Korel and Janusz Laski}, -abstract = {Program slicing is a useful tool in program debugging [25, 26]. Dynamic slicing introduced in this paper differs from the original static slicing in that it is defined on the basis of a computation. A dynamic program slice is an executable part of the original program that preserves part of the program's behavior for a specific input with respect to a subset of selected variables, rather than for all possible computations. As a result, the size of a slice can be significantly reduced. Moreover, the approach allows us to treat array elements and fields in dynamic records as individual variables. This leads to a further reduction of the slice size.} -} - -@article{tip1994dynamicslice, - title={A survey of program slicing techniques}, - author={Frank Tip}, - journal={Journal of Programming Languages}, - year={1994}, - volume={3}, - url={https://api.semanticscholar.org/CorpusID:9882901} -} - -@article{li2018fuzzing, - title={Fuzzing: a survey}, - author={Li, Jun and Zhao, Bodong and Zhang, Chao}, - journal={Cybersecurity}, - volume={1}, - number={1}, - pages={6}, - year={2018}, - month={June}, - doi={10.1186/s42400-018-0002-y}, - url={https://doi.org/10.1186/s42400-018-0002-y}, - publisher={Springer} -} - - -@article{zhang2004dynamicslice, -author = {Zhang, Xiangyu and Gupta, Rajiv}, -title = {Cost effective dynamic program slicing}, -year = {2004}, -issue_date = {May 2004}, -publisher = {Association for Computing Machinery}, -address = {New York, NY, USA}, -volume = {39}, -number = {6}, -issn = {0362-1340}, -url = {https://doi.org/10.1145/996893.996855}, -doi = {10.1145/996893.996855}, -abstract = {Although dynamic program slicing was first introduced to aid in user level debugging, applications aimed at improving software quality, reliability, security, and performance have since been identified as candidates for using dynamic slicing. However, the dynamic dependence graph constructed to compute dynamic slices can easily cause slicing algorithms to run out of memory for realistic program runs. In this paper we present the design and evaluation of a cost effective dynamic program slicing algorithm. This algorithm is based upon a dynamic dependence graph representation that is highly compact and rapidly traversable. Thus, the graph can be held in memory and dynamic slices can be quickly computed. A compact representation is derived by recognizing that all dynamic dependences (data and control) need not be individually represented. We identify sets of dynamic dependence edges between a pair of statements that can share a single representative edge. We further show that the dependence graph can be transformed in a manner that increases sharing and sharing can be performed even in the presence of aliasing. Experiments show that transformed dynamic dependence graphs explicitly represent only 6\% of the dependence edges present in the full dynamic dependence graph. When the full graph sizes range from 0.84 to 1.95 Gigabytes in size, our compacted graphs range from 20 to 210 Megabytes in size. Average slicing times for our algorithm range from 1.74 to 36.25 seconds across several benchmarks from SPECInt2000/95.}, -journal = {SIGPLAN Not.}, -month = {jun}, -pages = {94–106}, -numpages = {13}, -keywords = {testing, dynamic dependence graph, debugging} -} - - -@inproceedings{justfuzzit2019, -author = {Liew, Daniel and Cadar, Cristian and Donaldson, Alastair F. and Stinnett, J. Ryan}, -title = {Just fuzz it: solving floating-point constraints using coverage-guided fuzzing}, -year = {2019}, -isbn = {9781450355728}, -publisher = {Association for Computing Machinery}, -address = {New York, NY, USA}, -url = {https://doi.org/10.1145/3338906.3338921}, -doi = {10.1145/3338906.3338921}, -abstract = {We investigate the use of coverage-guided fuzzing as a means of proving satisfiability of SMT formulas over finite variable domains, with specific application to floating-point constraints. We show how an SMT formula can be encoded as a program containing a location that is reachable if and only if the program’s input corresponds to a satisfying assignment to the formula. A coverage-guided fuzzer can then be used to search for an input that reaches the location, yielding a satisfying assignment. We have implemented this idea in a tool, Just Fuzz-it Solver (JFS), and we present a large experimental evaluation showing that JFS is both competitive with and complementary to state-of-the-art SMT solvers with respect to solving floating-point constraints, and that the coverage-guided approach of JFS provides significant benefit over naive fuzzing in the floating-point domain. Applied in a portfolio manner, the JFS approach thus has the potential to complement traditional SMT solvers for program analysis tasks that involve reasoning about floating-point constraints.}, -booktitle = {Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering}, -pages = {521–532}, -numpages = {12}, -keywords = {feedback-directed fuzzing, Constraint solving}, -location = {Tallinn, Estonia}, -series = {ESEC/FSE 2019} -} - -@article{godefuzzing2012, -author = {Godefroid, Patrice and Levin, Michael Y. and Molnar, David}, -title = {SAGE: whitebox fuzzing for security testing}, -year = {2012}, -issue_date = {March 2012}, -publisher = {Association for Computing Machinery}, -address = {New York, NY, USA}, -volume = {55}, -number = {3}, -issn = {0001-0782}, -url = {https://doi.org/10.1145/2093548.2093564}, -doi = {10.1145/2093548.2093564}, -abstract = {SAGE has had a remarkable impact at Microsoft.}, -journal = {Commun. ACM}, -month = {mar}, -pages = {40–44}, -numpages = {5} -} - -@misc{manes2019mutationfuzzy, - title={The Art, Science, and Engineering of Fuzzing: A Survey}, - author={Valentin J. M. Manes and HyungSeok Han and Choongwoo Han and Sang Kil Cha and Manuel Egele and Edward J. Schwartz and Maverick Woo}, - year={2019}, - eprint={1812.00140}, - archivePrefix={arXiv}, - primaryClass={id='cs.CR' full_name='Cryptography and Security' is_active=True alt_name=None in_archive='cs' is_general=False description='Covers all areas of cryptography and security including authentication, public key cryptosytems, proof-carrying code, etc. Roughly includes material in ACM Subject Classes D.4.6 and E.3.'} -} - - -@inproceedings{godefroid2005execsimbol, -author = {Godefroid, Patrice and Klarlund, Nils and Sen, Koushik}, -title = {DART: directed automated random testing}, -year = {2005}, -isbn = {1595930566}, -publisher = {Association for Computing Machinery}, -address = {New York, NY, USA}, -url = {https://doi.org/10.1145/1065010.1065036}, -doi = {10.1145/1065010.1065036}, -abstract = {We present a new tool, named DART, for automatically testing software that combines three main techniques: (1) automated extraction of the interface of a program with its external environment using static source-code parsing; (2) automatic generation of a test driver for this interface that performs random testing to simulate the most general environment the program can operate in; and (3) dynamic analysis of how the program behaves under random testing and automatic generation of new test inputs to direct systematically the execution along alternative program paths. Together, these three techniques constitute Directed Automated Random Testing, or DART for short. The main strength of DART is thus that testing can be performed completely automatically on any program that compiles -- there is no need to write any test driver or harness code. During testing, DART detects standard errors such as program crashes, assertion violations, and non-termination. Preliminary experiments to unit test several examples of C programs are very encouraging.}, -booktitle = {Proceedings of the 2005 ACM SIGPLAN Conference on Programming Language Design and Implementation}, -pages = {213–223}, -numpages = {11}, -keywords = {automated test generation, interfaces, program verification, random testing, software testing}, -location = {Chicago, IL, USA}, -series = {PLDI '05} -} - -@inproceedings{cadar2006execsimbol, -author = {Cadar, Cristian and Ganesh, Vijay and Pawlowski, Peter M. and Dill, David L. and Engler, Dawson R.}, -title = {EXE: automatically generating inputs of death}, -year = {2006}, -isbn = {1595935185}, -publisher = {Association for Computing Machinery}, -address = {New York, NY, USA}, -url = {https://doi.org/10.1145/1180405.1180445}, -doi = {10.1145/1180405.1180445}, -abstract = {This paper presents EXE, an effective bug-finding tool that automatically generates inputs that crash real code. Instead of running code on manually or randomly constructed input, EXE runs it on symbolic input initially allowed to be "anything." As checked code runs, EXE tracks the constraints on each symbolic (i.e., input-derived) memory location. If a statement uses a symbolic value, EXE does not run it, but instead adds it as an input-constraint; all other statements run as usual. If code conditionally checks a symbolic expression, EXE forks execution, constraining the expression to be true on the true branch and false on the other. Because EXE reasons about all possible values on a path, it has much more power than a traditional runtime tool: (1) it can force execution down any feasible program path and (2) at dangerous operations (e.g., a pointer dereference), it detects if the current path constraints allow any value that causes a bug.When a path terminates or hits a bug, EXE automatically generates a test case by solving the current path constraints to find concrete values using its own co-designed constraint solver, STP. Because EXE's constraints have no approximations, feeding this concrete input to an uninstrumented version of the checked code will cause it to follow the same path and hit the same bug (assuming deterministic code).EXE works well on real code, finding bugs along with inputs that trigger them in: the BSD and Linux packet filter implementations, the udhcpd DHCP server, the pcre regular expression library, and three Linux file systems.}, -booktitle = {Proceedings of the 13th ACM Conference on Computer and Communications Security}, -pages = {322–335}, -numpages = {14}, -keywords = {test case generation, symbolic execution, dynamic analysis, constraint solving, bug finding, attack generation}, -location = {Alexandria, Virginia, USA}, -series = {CCS '06} -} - -%%%%%%%%%%%%%%%%%%%%%%%%% referencias dos trabalhos correlatos - -%%%% referencias fusebmc - -@InProceedings{fusebmc2022, -author="Alshmrany, Kaled M. -and Aldughaim, Mohannad -and Bhayat, Ahmed -and Cordeiro, Lucas C.", -editor="Johnsen, Einar Broch -and Wimmer, Manuel", -title="FuSeBMC v4: Smart Seed Generation for Hybrid Fuzzing", -booktitle="Fundamental Approaches to Software Engineering", -year="2022", -publisher="Springer International Publishing", -address="Cham", -pages="336--340", -abstract="FuSeBMC is a test generator for finding security vulnerabilities in C programs. In Test-Comp 2021, we described a previous version that incrementally injected labels to guide Bounded Model Checking (BMC) and Evolutionary Fuzzing engines to produce test cases for code coverage and bug finding. This paper introduces an improved version of FuSeBMC that utilizes both engines to produce smart seeds. First, the engines run with a short time limit on a lightly instrumented version of the program to produce the seeds. The BMC engine is particularly useful in producing seeds that can pass through complex mathematical guards. Then, FuSeBMC runs its engines with extended time limits using the smart seeds created in the previous round. FuSeBMC manages this process in two main ways. Firstly, it uses shared memory to record the labels covered by each test case. Secondly, it evaluates test cases, and those of high impact are turned into seeds for subsequent test fuzzing. In this year's competition, we participate in the Cover-Error, Cover-Branches, and Overall categories. The Test-Comp 2022 results show that we significantly increased our code coverage score from last year, outperforming all tools in all categories.", -isbn="978-3-030-99429-7" -} - -@InProceedings{beyertestcomp2022, -author="Beyer, Dirk", -editor="Johnsen, Einar Broch -and Wimmer, Manuel", -title="Advances in Automatic Software Testing: Test-Comp 2022", -booktitle="Fundamental Approaches to Software Engineering", -year="2022", -publisher="Springer International Publishing", -address="Cham", -pages="321--335", -abstract="Test-Comp 2022 is the 4th edition of the Competition on Software Testing. Research competitions are a means to provide annual comparative evaluations. Test-Comp focusses on fully automatic software test generators for C programs. The results of the competition shall be reproducible and provide an overview of the current state of the art in the area of automatic test-generation. The competition was based on 4 236 test-generation tasks for C programs. Each test-generation task consisted of a program and a test specification (error coverage, branch coverage). Test-Comp 2022 had 12 participating test generators from 5 countries.", -isbn="978-3-030-99429-7" -} - - -%%%$ referencias klee - -@article{cadar2021klee, - title={KLEE symbolic execution engine in 2019}, - author={Cadar, Cristian and Nowack, Martin}, - journal={International Journal on Software Tools for Technology Transfer}, - volume={23}, - number={6}, - pages={867-870}, - year={2021}, - month={December}, - doi={10.1007/s10009-020-00570-3}, - url={https://doi.org/10.1007/s10009-020-00570-3}, - publisher={Springer} -} - -@article{beyer2021first, - title={First international competition on software testing}, - author={Beyer, Dirk}, - journal={International Journal on Software Tools for Technology Transfer}, - volume={23}, - number={6}, - pages={833-846}, - year={2021}, - month={December}, - doi={10.1007/s10009-021-00613-3}, - url={https://doi.org/10.1007/s10009-021-00613-3}, - publisher={Springer} -} - -%%%% referencias esbmc - -@article{gadelha2021esbmc, - title={ESBMC 6.1: automated test case generation using bounded model checking}, - author={Gadelha, Mikhail R. and Menezes, Rafael S. and Cordeiro, Lucas C.}, - journal={International Journal on Software Tools for Technology Transfer}, - volume={23}, - number={6}, - pages={857-861}, - year={2021}, - month={December}, - doi={10.1007/s10009-020-00571-2}, - url={https://doi.org/10.1007/s10009-020-00571-2}, - publisher={Springer} -} - -@book{clangesbmc, -author = {Lopes, Bruno Cardoso and Auler, Rafael}, -title = {Getting Started with LLVM Core Libraries}, -year = {2014}, -isbn = {1782166920}, -publisher = {Packt Publishing}, -abstract = {Get to grips with LLVM essentials and use the core libraries to build advanced tools About This BookLearn how to configure, build, and use LLVM and Clang based toolsExplore the depths of the LLVM front-end, IR, code generator, and libraries, and learn how a modern compiler is implemented in a practical way.Customize your project to benefit from Just in Time compilation (JIT), static analysis and source-to-source transformations.Who This Book Is ForThis book is intended for enthusiasts, computer science students, and compiler engineers interested in learning about the LLVM framework. You need a background in C++ and, although not mandatory, should know at least some compiler theory. Whether you are a newcomer or a compiler expert, this book provides a practical introduction to LLVM and avoids complex scenarios. If you are interested enough and excited about this technology, then this book is definitely for you. In Detail LLVM is a bleeding edge compiler technology framework. Easily extendable and designed as a multitude of libraries, LLVM provides a smooth experience for compiler newcomers and reduces the steep learning curve often associated with compiler development.To start, this book will show you how to configure, build, and install LLVM libraries, tools, and external projects. Next, you will be introduced to LLVM design and how it works in practice throughout each LLVM compiler stage: frontend, IR, backend, the JIT engine, cross-compilation capabilities, and the plugin interface. With multiple hands-on examples and source code snippets, Getting Started with LLVM Core Libraries ensures a solid and smooth first step into the LLVM compiler development environment.} -} - -@InProceedings{boolectorpaper2009, -author="Brummayer, Robert -and Biere, Armin", -editor="Kowalewski, Stefan -and Philippou, Anna", -title="Boolector: An Efficient SMT Solver for Bit-Vectors and Arrays", -booktitle="Tools and Algorithms for the Construction and Analysis of Systems", -year="2009", -publisher="Springer Berlin Heidelberg", -address="Berlin, Heidelberg", -pages="174--177", -abstract="Satisfiability Modulo Theories (SMT) is the problem of deciding satisfiability of a logical formula, expressed in a combination of first-order theories. We present the architecture and selected features of Boolector, which is an efficient SMT solver for the quantifier-free theories of bit-vectors and arrays. It uses term rewriting, bit-blasting to handle bit-vectors, and lemmas on demand for arrays.", -isbn="978-3-642-00768-2" -} - -@InProceedings{z3esbmc2008, -author="de Moura, Leonardo -and Bj{\o}rner, Nikolaj", -editor="Ramakrishnan, C. R. -and Rehof, Jakob", -title="Z3: An Efficient SMT Solver", -booktitle="Tools and Algorithms for the Construction and Analysis of Systems", -year="2008", -publisher="Springer Berlin Heidelberg", -address="Berlin, Heidelberg", -pages="337--340", -abstract="Satisfiability Modulo Theories (SMT) problem is a decision problem for logical first order formulas with respect to combinations of background theories such as: arithmetic, bit-vectors, arrays, and uninterpreted functions. Z3 is a new and efficient SMT Solver freely available from Microsoft Research. It is used in various software verification and analysis applications.", -isbn="978-3-540-78800-3" -} - -@article{gotoesbmc2018, - author = {Baldoni, Roberto and Coppa, Emilio and D'Elia, Daniele Cono and Demetrescu, Camil and Finocchi, Irene}, - title = {A Survey of Symbolic Execution Techniques}, - journal = {ACM Computing Surveys}, - volume = {51}, - number = {3}, - articleno = {50}, - publisher = {ACM}, - address = {New York, NY, USA}, - year = {2018} -} - -@InProceedings{yicesesbmc2014, -author="Dutertre, Bruno", -editor="Biere, Armin -and Bloem, Roderick", -title="Yices 2.2", -booktitle="Computer Aided Verification", -year="2014", -publisher="Springer International Publishing", -address="Cham", -pages="737--744", -abstract="Yices is an SMT solver developed by SRI International. The first version of Yices was released in 2006 and has been continuously updated since then. In 2007, we started a complete re-implementation of the solver to improve performance and increase modularity and flexibility. We describe the latest release of Yices, namely, Yices 2.2. We present the tool's architecture and discuss the algorithms it implements, and we describe recent developments such as support for the SMT-LIB 2.0 notation and various performance improvements.", -isbn="978-3-319-08867-9" -} - -@InProceedings{beyertestcomp2023, -author="Beyer, Dirk", -editor="Lambers, Leen -and Uchitel, Sebasti{\'a}n", -title="Software Testing: 5th Comparative Evaluation: Test-Comp 2023", -booktitle="Fundamental Approaches to Software Engineering", -year="2023", -publisher="Springer Nature Switzerland", -address="Cham", -pages="309--323", -abstract="The 5th edition of the Competition on Software Testing (Test-Comp 2023) provides again an overview and comparative evaluation of automatic test-suite generators for C programs. The experiment was performed on a benchmark set of 4 106 test-generation tasks for C programs. Each test-generation task consisted of a program and a test specification (error coverage, branch coverage). There were 13 participating test-suite generators from 6 countries in Test-Comp 2023.", -isbn="978-3-031-30826-0" -} - -@InProceedings{beyersvcomp2013, -author="Beyer, Dirk", -editor="Piterman, Nir -and Smolka, Scott A.", -title="Second Competition on Software Verification", -booktitle="Tools and Algorithms for the Construction and Analysis of Systems", -year="2013", -publisher="Springer Berlin Heidelberg", -address="Berlin, Heidelberg", -pages="594--609", -abstract="This report describes the 2nd International Competition on Software Verification (SV-COMP 2013), which is the second edition of this thorough evaluation of fully automatic verifiers for software programs. The reported results represent the 2012 state-of-the-art in automatic software verification, in terms of effectiveness and efficiency, and as available and participated. The benchmark set of verification tasks consists of 2 315 programs, written in C, and exposing features of integers, heap-data structures, bit-vector operations, and concurrency; the properties include reachability and memory safety. The competition is again organized as a satellite event of TACAS.", -isbn="978-3-642-36742-7" -} - - - - - -%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% referencias metodo - -@InProceedings{lattner:2004, - author = {Chris Lattner and Vikram Adve}, - title = "{LLVM: A Compilation Framework for Lifelong Program Analysis \& Transformation}", - booktitle = "{Proceedings of the 2004 International Symposium on Code Generation and Optimization (CGO'04)}", - address = {Palo Alto, California}, - month = {Mar}, - year = {2004} - } - -@InProceedings{crabllvm2021, -author="Gurfinkel, Arie -and Navas, Jorge A.", -editor="Bloem, Roderick -and Dimitrova, Rayna -and Fan, Chuchu -and Sharygina, Natasha", -title="Abstract Interpretation of LLVM with a Region-Based Memory Model", -booktitle="Software Verification", -year="2022", -publisher="Springer International Publishing", -address="Cham", -pages="122--144", -abstract="Static analysis of low-level programs (C or LLVM) requires modeling memory. To strike a good balance between precision and performance, most static analyzers rely on the C memory model in which a pointer is a numerical offset within a memory object. Finite partitioning of the address space is a common abstraction. For instance, the allocation-site abstraction creates partitions by merging all objects created at the same allocation site. Recency abstraction refines the allocation-site abstraction by distinguishing the most recent allocated memory object from the previous ones. Unfortunately, these abstractions are not often precise enough to infer invariants that are expressed over the contents of dynamically allocated data-structures such as linked lists. In those cases, more expensive abstractions such as shapes that consider connectivity patterns between memory locations are often needed.", -isbn="978-3-030-95561-8" -} - - - -@misc{cwe2025, - author = {{MITRE}}, - title = {2025 CWE Top 25 Most Dangerous Software Weaknesses}, - howpublished = {\url{https://cwe.mitre.org/top25/archive/2025/2025_cwe_top25.html}}, - year = {2025}, - note = {Accessed: 2026-07-02} -} - -@inproceedings{fioraldi2020aflpp, - author = {Fioraldi, Andrea and Maier, Dominik and Eißfeldt, Heiko and Heuse, Marc}, - title = {{AFL++}: Combining Incremental Steps of Fuzzing Research}, - booktitle = {Proceedings of the 14th USENIX Workshop on Offensive Technologies (WOOT 20)}, - year = {2020}, - publisher = {USENIX Association} -} - -@inproceedings{chalupa2021symbiotic, - author = {Chalupa, Marek and Vitovská, Martina and Jašek, Tomáš and Šimáček, Michal and Strejček, Jan}, - title = {Symbiotic 8: Parallel and Targeted Test Generation}, - booktitle = {Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE '21)}, - year = {2021}, - publisher = {ACM}, - doi = {10.1145/3468264.3473125} -} - -@misc{openssf2024, - author = {{Open Source Security Foundation}}, - title = {OpenSSF Best Practices Badge Program}, - howpublished = {\url{https://www.bestpractices.dev/}}, - year = {2024}, - note = {Accessed: 2026-07-02} -} - -@techreport{nsa2017juliet, - author = {{National Security Agency}}, - title = {Juliet Test Suite v1.3 for C/C++}, - institution = {NSA Center for Assured Software}, - year = {2017}, - url = {https://samate.nist.gov/SARD/test-suites/112} -} \ No newline at end of file diff --git a/docs/paper-sbseg-2026/sbseg-article/sbc-template.sty b/docs/paper-sbseg-2026/sbseg-article/sbc-template.sty deleted file mode 100644 index 6d6890a37..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/sbc-template.sty +++ /dev/null @@ -1,200 +0,0 @@ -% LaTeX definitions for SBC 2001 style -% -% Created by Jomi Hubner & Rafael Bordini, june 2001 -% updated march 2005 -% updated december 2017 - -\NeedsTeXFormat{LaTeX2e} -\ProvidesPackage{sbc-template}[2001/06/09] - -% margem sup 3.5 cm: h� 1,5 cm para header, + 2 cm para top -% margem inf 2.5 cm: h� 1,5 cm para foot, + 1 cm para bottom -% margem esq/dir 3 cm -\RequirePackage[a4paper,top=3.5cm,left=3cm,right=3cm,bottom=2.5cm]{geometry} - -\parindent 1.27cm -\parskip 6pt - -\flushbottom - -% captions -%updated 2017. Change deprecated caption2 to caption package -\RequirePackage[bf,sf,footnotesize,indent]{caption} -\setlength{\captionmargin}{0.8cm} -\renewcommand{\captionfont}{\sffamily\footnotesize\bfseries} -%\renewcommand{\captionlabeldelim}{.} -\captionsetup{labelsep=period} - -% font -\RequirePackage{times} - -\renewcommand{\normalsize}{\@setfontsize\normalsize\@xiipt\@xivpt} -\newcommand{\XIIIPT}{\@setfontsize\xiiipt{13}{17}} -\newcommand{\XVIPT}{\@setfontsize\xvipt{16}{20}} - -% new commands -\newcounter{instn} -\setcounter{instn}{1} -\newcommand{\instnum}{\arabic{instn}} -\newcommand{\inst}[1]{\ensuremath{^{#1}}} -\newcommand{\nextinstitute}{\\\mbox{}\\[-6pt] \addtocounter{instn}{1}\inst{\instnum}} -\newcommand{\email}[1]{\\\mbox{}\\[-6pt]\footnotesize\texttt{#1}} -\renewcommand{\and}{, } - -% to avoid [...] in the bibliography -% \item[] instead of \item[\@biblabel{#1}\hfill] -\def\@lbibitem[#1]#2{\item[]\if@filesw - {\let\protect\noexpand - \immediate - \write\@auxout{\string\bibcite{#2}{#1}}}\fi\ignorespaces} -\renewenvironment{thebibliography}[1] - {\section*{\refname - \@mkboth{\MakeUppercase\refname}{\MakeUppercase\refname}}% - \list{\@biblabel{\@arabic\c@enumiv}}% - {\settowidth\labelwidth{\@biblabel{#1}}% - \leftmargin\labelwidth - \advance\leftmargin\labelsep - %% changed! - \itemindent -\leftmargin - \itemsep 6pt - %%%%%%%%%%% - \@openbib@code - \usecounter{enumiv}% - \let\p@enumiv\@empty - \renewcommand\theenumiv{\@arabic\c@enumiv}}% - \sloppy - \clubpenalty4000 - \@clubpenalty \clubpenalty - \widowpenalty4000% - \sfcode`\.\@m} - {\def\@noitemerr - {\@latex@warning{Empty `thebibliography' environment}}% - \endlist} - - -% itens -\setlength\leftmargini {1.27cm} -\setlength\leftmargin {\leftmargini} -\setlength\leftmarginii {\leftmargini} -\setlength\leftmarginiii {\leftmargini} -\setlength\leftmarginiv {\leftmargini} -\setlength \labelsep {.5em} -\setlength \labelwidth {\leftmargini} -\addtolength\labelwidth {-\labelsep} -\def\@listI{\leftmargin\leftmargini - \parsep 0\p@ \@plus1\p@ \@minus\p@ - \topsep 0\p@ \@plus2\p@ \@minus4\p@ - \itemsep0\p@} -\let\@listi\@listI -\@listi -\def\@listii {\leftmargin\leftmarginii - \labelwidth\leftmarginii - \advance\labelwidth-\labelsep - \topsep 0\p@ \@plus2\p@ \@minus\p@} -\def\@listiii{\leftmargin\leftmarginiii - \labelwidth\leftmarginiii - \advance\labelwidth-\labelsep - \topsep 0\p@ \@plus\p@\@minus\p@ - \parsep \z@ - \partopsep \p@ \@plus\z@ \@minus\p@} - - -% sections -\renewcommand\section{\@startsection{section}{1}{\z@}% - {-6\p@ \@plus -4\p@ \@minus -4\p@}% - {0\p@ \@plus 4\p@ \@minus 4\p@}% - {\normalfont\XIIIPT\bfseries\boldmath - \rightskip=\z@ \@plus 8em\pretolerance=10000 }} - -\renewcommand\subsection{\@startsection{subsection}{2}{\z@}% - {-6\p@ \@plus -4\p@ \@minus -4\p@}% - {0\p@ \@plus 4\p@ \@minus 4\p@}% - {\normalfont\normalsize\bfseries\boldmath - \rightskip=\z@ \@plus 8em\pretolerance=10000 }} - -%\renewcommand{\thesection}{\arabic{section}.} -%\renewcommand{\thesubsection}{\thesection\arabic{subsection}.} -%\renewcommand{\thesubsubsection}{\thesubsection\arabic{subsubsection}.} - -\RequirePackage{titlesec} -\titlelabel{\thetitle.\hspace{1ex}} - -% first page - -\pagestyle{empty} - -\newcommand{\authortag}[1]{$^{#1}$} - -\def\address#1{\gdef\@address{#1}} - -\def\@maketitle{\newpage - %\null % isso dava um espaco extra antes do title - \begin{center} - %\vglue -6pt -% \vspace*{12pt} -\vspace*{-.7cm} - {\XVIPT\bf\@title\par} - \vglue 6pt plus 3pt minus 3pt - {\normalsize - \textbf{\begin{tabular}[t]{c}\@author\end{tabular}}\par} - \vglue 6pt plus 3pt minus 3pt - {\normalsize - \begin{tabular}[t]{c}\inst{\instnum}\@address\end{tabular}\par} - \vglue 6pt plus 3pt minus 3pt - \end{center}\par -} -\let\maketitleOLD\maketitle -\renewcommand{\maketitle}{\maketitleOLD\thispagestyle{empty}} - -\renewenvironment{abstract}{% - \list{}{\advance\topsep by6pt\relax%\small - \leftmargin=0.8cm - \labelwidth=\z@ - \listparindent=\z@ - \itemindent\listparindent - \rightmargin\leftmargin}\item[\hskip\labelsep - \bfseries\itshape Abstract.]\itshape}% - {\endlist} - -\newenvironment{resumo}{% - \list{}{\advance\topsep by6pt\relax%\small - \leftmargin=0.8cm - \labelwidth=\z@ - \listparindent=\z@ - \itemindent\listparindent - \rightmargin\leftmargin}\item[\hskip\labelsep - \bfseries\itshape Resumo.]\itshape}% - {\endlist} - -%Updated 2017. If hyperref is used, do not change references styles -\RequirePackage{etoolbox}% -\AtEndPreamble{\@ifpackageloaded{hyperref} - {% - \makeatletter - \def\@lbibitem[#1]#2{% - \@skiphyperreftrue - \H@item[% - \ifx\Hy@raisedlink\@empty - \hyper@anchorstart{cite.#2\@extra@b@citeb}% - \hyper@anchorend - \else - \Hy@raisedlink{% - \hyper@anchorstart{cite.#2\@extra@b@citeb}\hyper@anchorend - }% - \fi - \hfill - ]% - \@skiphyperreffalse - \if@filesw - \begingroup - \let\protect\noexpand - \immediate\write\@auxout{% - \string\bibcite{#2}{#1}% - }% - \endgroup% - \fi% - \ignorespaces% - }% - \makeatother% - }% -}% \ No newline at end of file diff --git a/docs/paper-sbseg-2026/sbseg-article/sbc.bst b/docs/paper-sbseg-2026/sbseg-article/sbc.bst deleted file mode 100644 index 8d5db03bf..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/sbc.bst +++ /dev/null @@ -1,1103 +0,0 @@ -%% copy of "apalike" for SBC (no comma before year in citation label) - -% BibTeX `apalike' bibliography style (24-Jan-88 version) -% Adapted from the `alpha' style, version 0.99a; for BibTeX version 0.99a. -% Copyright (C) 1988, all rights reserved. -% Copying of this file is allowed, provided that if you make any changes at all -% you name it something other than `apalike.bst'. -% This restriction helps ensure that all copies are identical. -% Differences between this style and `alpha' are generally heralded by a `%'. -% The file btxbst.doc has the documentation for alpha.bst. -% -% This style should be used with the `apalike' LaTeX style (apalike.sty). -% \cite's come out like "(Jones, 1986)" in the text but there are no labels -% in the bibliography, and something like "(1986)" comes out immediately -% after the author. Author (and editor) names appear as last name, comma, -% initials. A `year' field is required for every entry, and so is either -% an author (or in some cases, an editor) field or a key field. -% -% Editorial note: -% Many journals require a style like `apalike', but I strongly, strongly, -% strongly recommend that you not use it if you have a choice---use something -% like `plain' instead. Mary-Claire van Leunen (A Handbook for Scholars, -% Knopf, 1979) argues convincingly that a style like `plain' encourages better -% writing than one like `apalike'. Furthermore the strongest arguments for -% using an author-date style like `apalike'---that it's "the most practical" -% (The Chicago Manual of Style, University of Chicago Press, thirteenth -% edition, 1982, pages 400--401)---fall flat on their face with the new -% computer-typesetting technology. For instance page 401 anachronistically -% states "The chief disadvantage of [a style like `plain'] is that additions -% or deletions cannot be made after the manuscript is typed without changing -% numbers in both text references and list." LaTeX sidesteps the disadvantage. -% -% History: -% 15-sep-86 (SK,OP) Original version, by Susan King and Oren Patashnik. -% 10-nov-86 (OP) Truncated the sort.key$ string to the correct length -% in bib.sort.order to eliminate error message. -% 24-jan-88 (OP) Updated for BibTeX version 0.99a, from alpha.bst 0.99a; -% apalike now sorts by author, then year, then title; -% THIS `apalike' VERSION DOES NOT WORK WITH BIBTEX 0.98i. - -ENTRY - { address - author - booktitle - chapter - edition - editor - howpublished - institution - journal - key -% month not used in apalike - note - number - organization - pages - publisher - school - series - title - type - volume - year - } - {} - { label extra.label sort.label } - -INTEGERS { output.state before.all mid.sentence after.sentence after.block } - -FUNCTION {init.state.consts} -{ #0 'before.all := - #1 'mid.sentence := - #2 'after.sentence := - #3 'after.block := -} - -STRINGS { s t } - -FUNCTION {output.nonnull} -{ 's := - output.state mid.sentence = - { ", " * write$ } - { output.state after.block = - { add.period$ write$ - newline$ - "\newblock " write$ - } - { output.state before.all = - 'write$ - { add.period$ " " * write$ } - if$ - } - if$ - mid.sentence 'output.state := - } - if$ - s -} - -FUNCTION {output} -{ duplicate$ empty$ - 'pop$ - 'output.nonnull - if$ -} - -FUNCTION {output.check} -{ 't := - duplicate$ empty$ - { pop$ "empty " t * " in " * cite$ * warning$ } - 'output.nonnull - if$ -} - -% apalike needs this function because -% the year has special punctuation; -% apalike ignores the month -FUNCTION {output.year.check} -{ year empty$ - { "empty year in " cite$ * warning$ } - { write$ - " (" year * extra.label * ")" * - mid.sentence 'output.state := - } - if$ -} - -FUNCTION {output.bibitem} -{ newline$ - "\bibitem[" write$ - label write$ - "]{" write$ - cite$ write$ - "}" write$ - newline$ - "" - before.all 'output.state := -} - -FUNCTION {fin.entry} -{ add.period$ - write$ - newline$ -} - -FUNCTION {new.block} -{ output.state before.all = - 'skip$ - { after.block 'output.state := } - if$ -} - -FUNCTION {new.sentence} -{ output.state after.block = - 'skip$ - { output.state before.all = - 'skip$ - { after.sentence 'output.state := } - if$ - } - if$ -} - -FUNCTION {not} -{ { #0 } - { #1 } - if$ -} - -FUNCTION {and} -{ 'skip$ - { pop$ #0 } - if$ -} - -FUNCTION {or} -{ { pop$ #1 } - 'skip$ - if$ -} - -FUNCTION {new.block.checkb} -{ empty$ - swap$ empty$ - and - 'skip$ - 'new.block - if$ -} - -FUNCTION {field.or.null} -{ duplicate$ empty$ - { pop$ "" } - 'skip$ - if$ -} - -FUNCTION {emphasize} -{ duplicate$ empty$ - { pop$ "" } - { "{\em " swap$ * "}" * } - if$ -} - -INTEGERS { nameptr namesleft numnames } - -FUNCTION {format.names} -{ 's := - #1 'nameptr := - s num.names$ 'numnames := - numnames 'namesleft := - { namesleft #0 > } - { s nameptr "{vv~}{ll}{, jj}{, f.}" format.name$ 't := % last name first - nameptr #1 > - { namesleft #1 > - { ", " * t * } - { numnames #2 > - { "," * } - 'skip$ - if$ - t "others" = - { " et~al." * } - { " and " * t * } - if$ - } - if$ - } - 't - if$ - nameptr #1 + 'nameptr := - namesleft #1 - 'namesleft := - } - while$ -} - -FUNCTION {format.authors} -{ author empty$ - { "" } - { author format.names } - if$ -} - -FUNCTION {format.key} % this function is just for apalike -{ empty$ - { key field.or.null } - { "" } - if$ -} - -FUNCTION {format.editors} -{ editor empty$ - { "" } - { editor format.names - editor num.names$ #1 > - { ", editors" * } - { ", editor" * } - if$ - } - if$ -} - -FUNCTION {format.title} -{ title empty$ - { "" } - { title "t" change.case$ } - if$ -} - -FUNCTION {n.dashify} -{ 't := - "" - { t empty$ not } - { t #1 #1 substring$ "-" = - { t #1 #2 substring$ "--" = not - { "--" * - t #2 global.max$ substring$ 't := - } - { { t #1 #1 substring$ "-" = } - { "-" * - t #2 global.max$ substring$ 't := - } - while$ - } - if$ - } - { t #1 #1 substring$ * - t #2 global.max$ substring$ 't := - } - if$ - } - while$ -} - -FUNCTION {format.btitle} -{ title emphasize -} - -FUNCTION {tie.or.space.connect} -{ duplicate$ text.length$ #3 < - { "~" } - { " " } - if$ - swap$ * * -} - -FUNCTION {either.or.check} -{ empty$ - 'pop$ - { "can't use both " swap$ * " fields in " * cite$ * warning$ } - if$ -} - -FUNCTION {format.bvolume} -{ volume empty$ - { "" } - { "volume" volume tie.or.space.connect - series empty$ - 'skip$ - { " of " * series emphasize * } - if$ - "volume and number" number either.or.check - } - if$ -} - -FUNCTION {format.number.series} -{ volume empty$ - { number empty$ - { series field.or.null } - { output.state mid.sentence = - { "number" } - { "Number" } - if$ - number tie.or.space.connect - series empty$ - { "there's a number but no series in " cite$ * warning$ } - { " in " * series * } - if$ - } - if$ - } - { "" } - if$ -} - -FUNCTION {format.edition} -{ edition empty$ - { "" } - { output.state mid.sentence = - { edition "l" change.case$ " edition" * } - { edition "t" change.case$ " edition" * } - if$ - } - if$ -} - -INTEGERS { multiresult } - -FUNCTION {multi.page.check} -{ 't := - #0 'multiresult := - { multiresult not - t empty$ not - and - } - { t #1 #1 substring$ - duplicate$ "-" = - swap$ duplicate$ "," = - swap$ "+" = - or or - { #1 'multiresult := } - { t #2 global.max$ substring$ 't := } - if$ - } - while$ - multiresult -} - -FUNCTION {format.pages} -{ pages empty$ - { "" } - { pages multi.page.check - { "pages" pages n.dashify tie.or.space.connect } - { "page" pages tie.or.space.connect } - if$ - } - if$ -} - -FUNCTION {format.vol.num.pages} -{ volume field.or.null - number empty$ - 'skip$ - { "(" number * ")" * * - volume empty$ - { "there's a number but no volume in " cite$ * warning$ } - 'skip$ - if$ - } - if$ - pages empty$ - 'skip$ - { duplicate$ empty$ - { pop$ format.pages } - { ":" * pages n.dashify * } - if$ - } - if$ -} - -FUNCTION {format.chapter.pages} -{ chapter empty$ - 'format.pages - { type empty$ - { "chapter" } - { type "l" change.case$ } - if$ - chapter tie.or.space.connect - pages empty$ - 'skip$ - { ", " * format.pages * } - if$ - } - if$ -} - -FUNCTION {format.in.ed.booktitle} -{ booktitle empty$ - { "" } - { editor empty$ - { "In " booktitle emphasize * } - { "In " format.editors * ", " * booktitle emphasize * } - if$ - } - if$ -} - -FUNCTION {format.thesis.type} -{ type empty$ - 'skip$ - { pop$ - type "t" change.case$ - } - if$ -} - -FUNCTION {format.tr.number} -{ type empty$ - { "Technical Report" } - 'type - if$ - number empty$ - { "t" change.case$ } - { number tie.or.space.connect } - if$ -} - -FUNCTION {format.article.crossref} -{ "In" % this is for apalike - " \cite{" * crossref * "}" * -} - -FUNCTION {format.book.crossref} -{ volume empty$ - { "empty volume in " cite$ * "'s crossref of " * crossref * warning$ - "In " - } - { "Volume" volume tie.or.space.connect - " of " * - } - if$ - "\cite{" * crossref * "}" * % this is for apalike -} - -FUNCTION {format.incoll.inproc.crossref} -{ "In" % this is for apalike - " \cite{" * crossref * "}" * -} - -FUNCTION {article} -{ output.bibitem - format.authors "author" output.check - author format.key output % special for - output.year.check % apalike - new.block - format.title "title" output.check - new.block - crossref missing$ - { journal emphasize "journal" output.check - format.vol.num.pages output - } - { format.article.crossref output.nonnull - format.pages output - } - if$ - new.block - note output - fin.entry -} - -FUNCTION {book} -{ output.bibitem - author empty$ - { format.editors "author and editor" output.check - editor format.key output - } - { format.authors output.nonnull - crossref missing$ - { "author and editor" editor either.or.check } - 'skip$ - if$ - } - if$ - output.year.check % special for apalike - new.block - format.btitle "title" output.check - crossref missing$ - { format.bvolume output - new.block - format.number.series output - new.sentence - publisher "publisher" output.check - address output - } - { new.block - format.book.crossref output.nonnull - } - if$ - format.edition output - new.block - note output - fin.entry -} - -FUNCTION {booklet} -{ output.bibitem - format.authors output - author format.key output % special for - output.year.check % apalike - new.block - format.title "title" output.check - new.block - howpublished output - address output - new.block - note output - fin.entry -} - -FUNCTION {inbook} -{ output.bibitem - author empty$ - { format.editors "author and editor" output.check - editor format.key output - } - { format.authors output.nonnull - crossref missing$ - { "author and editor" editor either.or.check } - 'skip$ - if$ - } - if$ - output.year.check % special for apalike - new.block - format.btitle "title" output.check - crossref missing$ - { format.bvolume output - format.chapter.pages "chapter and pages" output.check - new.block - format.number.series output - new.sentence - publisher "publisher" output.check - address output - } - { format.chapter.pages "chapter and pages" output.check - new.block - format.book.crossref output.nonnull - } - if$ - format.edition output - new.block - note output - fin.entry -} - -FUNCTION {incollection} -{ output.bibitem - format.authors "author" output.check - author format.key output % special for - output.year.check % apalike - new.block - format.title "title" output.check - new.block - crossref missing$ - { format.in.ed.booktitle "booktitle" output.check - format.bvolume output - format.number.series output - format.chapter.pages output - new.sentence - publisher "publisher" output.check - address output - format.edition output - } - { format.incoll.inproc.crossref output.nonnull - format.chapter.pages output - } - if$ - new.block - note output - fin.entry -} - -FUNCTION {inproceedings} -{ output.bibitem - format.authors "author" output.check - author format.key output % special for - output.year.check % apalike - new.block - format.title "title" output.check - new.block - crossref missing$ - { format.in.ed.booktitle "booktitle" output.check - format.bvolume output - format.number.series output - format.pages output - address output % for apalike - new.sentence % there's no year - organization output % here so things - publisher output % are simpler - } - { format.incoll.inproc.crossref output.nonnull - format.pages output - } - if$ - new.block - note output - fin.entry -} - -FUNCTION {conference} { inproceedings } - -FUNCTION {manual} -{ output.bibitem - format.authors output - author format.key output % special for - output.year.check % apalike - new.block - format.btitle "title" output.check - organization address new.block.checkb - organization output - address output - format.edition output - new.block - note output - fin.entry -} - -FUNCTION {mastersthesis} -{ output.bibitem - format.authors "author" output.check - author format.key output % special for - output.year.check % apalike - new.block - format.title "title" output.check - new.block - "Master's thesis" format.thesis.type output.nonnull - school "school" output.check - address output - new.block - note output - fin.entry -} - -FUNCTION {misc} -{ output.bibitem - format.authors output - author format.key output % special for - output.year.check % apalike - new.block - format.title output - new.block - howpublished output - new.block - note output - fin.entry -} - -FUNCTION {phdthesis} -{ output.bibitem - format.authors "author" output.check - author format.key output % special for - output.year.check % apalike - new.block - format.btitle "title" output.check - new.block - "PhD thesis" format.thesis.type output.nonnull - school "school" output.check - address output - new.block - note output - fin.entry -} - -FUNCTION {proceedings} -{ output.bibitem - format.editors output - editor format.key output % special for - output.year.check % apalike - new.block - format.btitle "title" output.check - format.bvolume output - format.number.series output - address output % for apalike - new.sentence % we always output - organization output % a nonempty organization - publisher output % here - new.block - note output - fin.entry -} - -FUNCTION {techreport} -{ output.bibitem - format.authors "author" output.check - author format.key output % special for - output.year.check % apalike - new.block - format.title "title" output.check - new.block - format.tr.number output.nonnull - institution "institution" output.check - address output - new.block - note output - fin.entry -} - -FUNCTION {unpublished} -{ output.bibitem - format.authors "author" output.check - author format.key output % special for - output.year.check % apalike - new.block - format.title "title" output.check - new.block - note "note" output.check - fin.entry -} - -FUNCTION {default.type} { misc } - -MACRO {jan} {"January"} - -MACRO {feb} {"February"} - -MACRO {mar} {"March"} - -MACRO {apr} {"April"} - -MACRO {may} {"May"} - -MACRO {jun} {"June"} - -MACRO {jul} {"July"} - -MACRO {aug} {"August"} - -MACRO {sep} {"September"} - -MACRO {oct} {"October"} - -MACRO {nov} {"November"} - -MACRO {dec} {"December"} - -MACRO {acmcs} {"ACM Computing Surveys"} - -MACRO {acta} {"Acta Informatica"} - -MACRO {cacm} {"Communications of the ACM"} - -MACRO {ibmjrd} {"IBM Journal of Research and Development"} - -MACRO {ibmsj} {"IBM Systems Journal"} - -MACRO {ieeese} {"IEEE Transactions on Software Engineering"} - -MACRO {ieeetc} {"IEEE Transactions on Computers"} - -MACRO {ieeetcad} - {"IEEE Transactions on Computer-Aided Design of Integrated Circuits"} - -MACRO {ipl} {"Information Processing Letters"} - -MACRO {jacm} {"Journal of the ACM"} - -MACRO {jcss} {"Journal of Computer and System Sciences"} - -MACRO {scp} {"Science of Computer Programming"} - -MACRO {sicomp} {"SIAM Journal on Computing"} - -MACRO {tocs} {"ACM Transactions on Computer Systems"} - -MACRO {tods} {"ACM Transactions on Database Systems"} - -MACRO {tog} {"ACM Transactions on Graphics"} - -MACRO {toms} {"ACM Transactions on Mathematical Software"} - -MACRO {toois} {"ACM Transactions on Office Information Systems"} - -MACRO {toplas} {"ACM Transactions on Programming Languages and Systems"} - -MACRO {tcs} {"Theoretical Computer Science"} - -READ - -FUNCTION {sortify} -{ purify$ - "l" change.case$ -} - -INTEGERS { len } - -FUNCTION {chop.word} -{ 's := - 'len := - s #1 len substring$ = - { s len #1 + global.max$ substring$ } - 's - if$ -} - -% There are three apalike cases: one person (Jones), -% two (Jones and de~Bruijn), and more (Jones et~al.). -% This function is much like format.crossref.editors. -% -FUNCTION {format.lab.names} -{ 's := - s #1 "{vv~}{ll}" format.name$ - s num.names$ duplicate$ - #2 > - { pop$ " et~al." * } - { #2 < - 'skip$ - { s #2 "{ff }{vv }{ll}{ jj}" format.name$ "others" = - { " et~al." * } - { " and " * s #2 "{vv~}{ll}" format.name$ * } - if$ - } - if$ - } - if$ -} - -FUNCTION {author.key.label} -{ author empty$ - { key empty$ - { cite$ #1 #3 substring$ } - 'key % apalike uses the whole key - if$ - } - { author format.lab.names } - if$ -} - -FUNCTION {author.editor.key.label} -{ author empty$ - { editor empty$ - { key empty$ - { cite$ #1 #3 substring$ } - 'key % apalike uses the whole key - if$ - } - { editor format.lab.names } - if$ - } - { author format.lab.names } - if$ -} - -FUNCTION {editor.key.label} -{ editor empty$ - { key empty$ - { cite$ #1 #3 substring$ } - 'key % apalike uses the whole key, no organization - if$ - } - { editor format.lab.names } - if$ -} - -FUNCTION {calc.label} -{ type$ "book" = - type$ "inbook" = - or - 'author.editor.key.label - { type$ "proceedings" = - 'editor.key.label % apalike ignores organization - 'author.key.label % for labeling and sorting - if$ - } - if$ - " " % these three lines are - * % for apalike, which - year field.or.null purify$ #-1 #4 substring$ % uses all four digits - * - 'label := -} - -FUNCTION {sort.format.names} -{ 's := - #1 'nameptr := - "" - s num.names$ 'numnames := - numnames 'namesleft := - { namesleft #0 > } - { nameptr #1 > - { " " * } - 'skip$ - if$ % apalike uses initials - s nameptr "{vv{ } }{ll{ }}{ f{ }}{ jj{ }}" format.name$ 't := % <= here - nameptr numnames = t "others" = and - { "et al" * } - { t sortify * } - if$ - nameptr #1 + 'nameptr := - namesleft #1 - 'namesleft := - } - while$ -} - -FUNCTION {sort.format.title} -{ 't := - "A " #2 - "An " #3 - "The " #4 t chop.word - chop.word - chop.word - sortify - #1 global.max$ substring$ -} - -FUNCTION {author.sort} -{ author empty$ - { key empty$ - { "to sort, need author or key in " cite$ * warning$ - "" - } - { key sortify } - if$ - } - { author sort.format.names } - if$ -} - -FUNCTION {author.editor.sort} -{ author empty$ - { editor empty$ - { key empty$ - { "to sort, need author, editor, or key in " cite$ * warning$ - "" - } - { key sortify } - if$ - } - { editor sort.format.names } - if$ - } - { author sort.format.names } - if$ -} - -FUNCTION {editor.sort} -{ editor empty$ - { key empty$ - { "to sort, need editor or key in " cite$ * warning$ - "" - } - { key sortify } - if$ - } - { editor sort.format.names } - if$ -} - -% apalike uses two sorting passes; the first one sets the -% labels so that the `a's, `b's, etc. can be computed; -% the second pass puts the references in "correct" order. -% The presort function is for the first pass. It computes -% label, sort.label, and title, and then concatenates. -FUNCTION {presort} -{ calc.label - label sortify - " " - * - type$ "book" = - type$ "inbook" = - or - 'author.editor.sort - { type$ "proceedings" = - 'editor.sort - 'author.sort - if$ - } - if$ - #1 entry.max$ substring$ % for - 'sort.label := % apalike - sort.label % style - * - " " - * - title field.or.null - sort.format.title - * - #1 entry.max$ substring$ - 'sort.key$ := -} - -ITERATE {presort} - -SORT % by label, sort.label, title---for final label calculation - -STRINGS { last.label next.extra } % apalike labels are only for the text; - -INTEGERS { last.extra.num } % there are none in the bibliography - -FUNCTION {initialize.extra.label.stuff} % and hence there is no `longest.label' -{ #0 int.to.chr$ 'last.label := - "" 'next.extra := - #0 'last.extra.num := -} - -FUNCTION {forward.pass} -{ last.label label = - { last.extra.num #1 + 'last.extra.num := - last.extra.num int.to.chr$ 'extra.label := - } - { "a" chr.to.int$ 'last.extra.num := - "" 'extra.label := - label 'last.label := - } - if$ -} - -FUNCTION {reverse.pass} -{ next.extra "b" = - { "a" 'extra.label := } - 'skip$ - if$ - label extra.label * 'label := - extra.label 'next.extra := -} - -EXECUTE {initialize.extra.label.stuff} - -ITERATE {forward.pass} - -REVERSE {reverse.pass} - -% Now that the label is right we sort for real, -% on sort.label then year then title. This is -% for the second sorting pass. -FUNCTION {bib.sort.order} -{ sort.label - " " - * - year field.or.null sortify - * - " " - * - title field.or.null - sort.format.title - * - #1 entry.max$ substring$ - 'sort.key$ := -} - -ITERATE {bib.sort.order} - -SORT % by sort.label, year, title---giving final bibliography order - -FUNCTION {begin.bib} -{ preamble$ empty$ % no \etalchar in apalike - 'skip$ - { preamble$ write$ newline$ } - if$ - "\begin{thebibliography}{}" write$ newline$ % no labels in apalike -} - -EXECUTE {begin.bib} - -EXECUTE {init.state.consts} - -ITERATE {call.type$} - -FUNCTION {end.bib} -{ newline$ - "\end{thebibliography}" write$ newline$ -} - -EXECUTE {end.bib} diff --git a/docs/paper-sbseg-2026/sections/01-introducao.md b/docs/paper-sbseg-2026/sections/01-introducao.md deleted file mode 100644 index cdb301616..000000000 --- a/docs/paper-sbseg-2026/sections/01-introducao.md +++ /dev/null @@ -1,41 +0,0 @@ -# 1. Introducao e Motivacao - -**Estado:** Rascunho nao iniciado. -**Fontes:** docs/pre-projeto, dados de CVEs/CWEs (usuario deve buscar estatisticas atualizadas). -**Figuras:** Nenhuma nesta secao. - ---- - -## 1.1 O problema de memory safety em C/C++ - -[PARAGRAFO A REDIGIR] -- Abrir com estatisticas de vulnerabilidades de memoria (CWEs 119, 416, 415, 401, 787) -- Citar que memory-safety bugs continuam entre as principais causas de CVEs exploraveis -- Contextualizar: sistemas embarcados, infraestrutura critica, consequencias de falhas - -## 1.2 Verificacao hibrida como abordagem promissora - -[PARAGRAFO A REDIGIR] -- Breve explicacao da combinacao analise estatica + dinamica (fuzzing + execucao simbolica) -- Citar trabalhos de ponta: FuSeBMC (smart seeds), Symbiotic (slicing + KLEE) -- Destacar que ferramentas de competicao (SV-COMP, TestComp) impulsionam o estado da arte - -## 1.3 Posicionamento do Map2Check - -[PARAGRAFO A REDIGIR] -- Map2Check como verificador hibrido consolidado para programas C -- Mencao as publicacoes anteriores (TACAS 2016, 2018, 2020) -- O problema: estagnacao desde 2019 (LLVM 6.0, Ubuntu 16.04, ultimo release nov/2019) - -## 1.4 Contribuicoes desta versao (2026) - -[PARAGRAFO A REDIGIR] -- Lista numerada de contribuicoes: - 1. Migracao completa da stack: LLVM 6 -> 16, New Pass Manager, C++17 - 2. Infraestrutura de engenharia: CI/CD, Docker, sanitizers, static analysis - 3. Validacao em benchmarks reais: TestComp 2026 (Heap, 594 tasks, score 57) - 4. Fortalecimento do posicionamento em ciberseguranca (mapeamento CWE) - ---- - -*Nota: Aguardando redacao na Sprint 1.* diff --git a/docs/paper-sbseg-2026/sections/02-historia.md b/docs/paper-sbseg-2026/sections/02-historia.md deleted file mode 100644 index 59da7ff7b..000000000 --- a/docs/paper-sbseg-2026/sections/02-historia.md +++ /dev/null @@ -1,29 +0,0 @@ -# 2. Historia e Evolucao - -**Estado:** Rascunho nao iniciado. -**Fontes:** CHANGELOG.md, docs/migration/. -**Figuras:** Figura 1 (timeline). - ---- - -## 2.1 Linha do tempo (2016->2026) - -[PARAGRAFO A REDIGIR] -- 2016 (TACAS): "Hunting Memory Bugs" — abordagem BMC com CBMC -- 2018 (TACAS): Migracao para LLVM + KLEE — execucao simbolica como motor principal -- 2020 (TACAS): Abordagem hibrida — fuzzing (LibFuzzer) + execucao simbolica (KLEE) + invariantes indutivos (Crab-LLVM) -- 2019-2025: Estagnacao — ultimo release, LLVM 6.0 obsoleto, dependencias deprecadas -- 2026: Renascimento — modernizacao sistematica da stack completa -- Figura 1: Timeline visual da evolucao - -## 2.2 O que motivou o renascimento - -[PARAGRAFO A REDIGIR] -- Obsolescencia tecnica: LLVM 6.0 EOL, Ubuntu 16.04 EOL, KLEE 2.0 sem suporte -- Impossibilidade de competir em SV-COMP/TestComp com stack legada -- Necessidade de sustentabilidade de engenharia (CI/CD, reproducibilidade, qualidade de artefato) -- Alinhamento com ciberseguranca: CWEs como linguagem comum entre verificacao formal e industria de seguranca - ---- - -*Nota: Aguardando redacao na Sprint 1. BACKLOG: referencias BibTeX das publicacoes TACAS.* diff --git a/docs/paper-sbseg-2026/sections/03-arquitetura.md b/docs/paper-sbseg-2026/sections/03-arquitetura.md deleted file mode 100644 index d2cbef090..000000000 --- a/docs/paper-sbseg-2026/sections/03-arquitetura.md +++ /dev/null @@ -1,47 +0,0 @@ -# 3. Arquitetura e Funcionalidades - -**Estado:** Rascunho nao iniciado. -**Fontes:** docs/migration/1.3-passes-new-pm.md, docs/migration/1.4-frontend-cpp17.md, .github/workflows/. -**Figuras:** Figura 2 (pipeline), Figura 3 (passes), Figura 5 (CI/CD). - ---- - -## 3.1 Pipeline de verificacao (visao geral) - -[PARAGRAFO A REDIGIR] -- Fluxo completo: Codigo C -> clang-16 -> LLVM IR -> opt (passes) -> llvm-link -> runtime -> KLEE / LibFuzzer -> Veredito + Witness -- Figura 2: Diagrama do pipeline - -## 3.2 Passes de instrumentacao (New Pass Manager) - -[PARAGRAFO A REDIGIR] -- Descricao dos 9 passes migrados: - - AssertPass, TargetPass, LoopPredAssumePass, Map2CheckLibrary - - NonDetPass, TrackBasicBlockPass - - OverflowPass, GenerateAutomataTruePass, MemoryTrackPass -- Figura 3: Diagrama dos passes -- Destacar: isRequired() como fix critico - -## 3.3 Motores de analise - -[PARAGRAFO A REDIGIR] -- KLEE 3.1 (LLVM 16): execucao simbolica -- LibFuzzer (LLVM 16): fuzzing guiado por cobertura -- Iterative deepening: combinacao dos dois motores - -## 3.4 Modernizacao de engenharia (pilar de sustentabilidade) - -[PARAGRAFO A REDIGIR] -- LLVM 16 + New Pass Manager -- C++17 (std::filesystem, structured bindings) -- CI/CD (GitHub Actions) -- Docker (Dockerfile.dev, Ubuntu 22.04) -- Static analysis (clang-tidy, cppcheck) -- Sanitizers (ASAN, UBSAN, TSAN) -- OpenSSF Best Practices (em andamento) -- Figura 5: Workflow CI/CD -- CTA: esta infraestrutura pontua nos criterios de artefato - ---- - -*Nota: Aguardando redacao na Sprint 1.* diff --git a/docs/paper-sbseg-2026/sections/04-ciberseguranca.md b/docs/paper-sbseg-2026/sections/04-ciberseguranca.md deleted file mode 100644 index 7429fa106..000000000 --- a/docs/paper-sbseg-2026/sections/04-ciberseguranca.md +++ /dev/null @@ -1,52 +0,0 @@ -# 4. Features de Ciberseguranca - -**Estado:** Rascunho nao iniciado. -**Fontes:** docs/migration/1.4.3-checkpoint-testcomp2026.md, docs/migration/1.4-checkpoint-smoke-test.md. -**Figuras:** Figura 4 (resultados TestComp 2026). - ---- - -## 4.1 Mapeamento de memory safety para CWEs - -[PARAGRAFO A REDIGIR] -- CWE-401: Memory Leak -- CWE-416: Use-After-Free -- CWE-415: Double-Free -- CWE-119 / CWE-787: Buffer Overflow -- Tabela: Propriedade SV-COMP -> CWE -> pass responsavel - -## 4.2 TestComp 2026 — Execucao Heap - -[PARAGRAFO A REDIGIR] -- Contexto: TestComp 2026, sub-categoria C.coverage-error-call.Heap -- Configuracao experimental -- Tabela de resultados consolidados -- Tabela por set (Heap, LinkedLists) -- Figura 4: Grafico dos resultados - -## 4.3 Smoke test e validacao de vereditos - -[PARAGRAFO A REDIGIR] -- Execucao E2E manual em benchmarks loops/array-1.c e loops/array-2.c -- Counter-example validado -- Framework de checkpoint automatizado - -## 4.4 Bugs criticos encontrados e corrigidos - -[PARAGRAFO A REDIGIR] -- Tabela dos 3 bugs (KLEE flags, isRequired, target function) -- Destacar: nenhum detectavel pelos unit tests existentes -- Implicacao: necessidade de testes de integracao E2E - -## 4.5 Suporte a WebAssembly (WASM) — Em Desenvolvimento - -[PARAGRAFO A REDIGIR] -- Extensao do pipeline LLVM 16 existente para analise de modulos WASM -- Backend LLVM-WASM: compilacao C -> LLVM IR -> WASM -> instrumentacao -> verificacao -- Vetor de ataque: memory safety em runtimes WASM (Wasmtime, Wasmer) -- Testes preliminares em benchmarks SV-COMP adaptados para WASM -- Status: implementacao em andamento na branch feat-update (pos-merge) - ---- - -*Nota: Aguardando redacao na Sprint 2. WASM sera integrado conforme resultados dos testes SV-COMP.* diff --git a/docs/paper-sbseg-2026/sections/05-demonstracao.md b/docs/paper-sbseg-2026/sections/05-demonstracao.md deleted file mode 100644 index ffa9f76f7..000000000 --- a/docs/paper-sbseg-2026/sections/05-demonstracao.md +++ /dev/null @@ -1,34 +0,0 @@ -# 5. Demonstracao Planejada - -**Estado:** Rascunho nao iniciado. -**Fontes:** test-comp2026/simulation/, Dockerfile.dev. -**Figuras:** Nenhuma. - ---- - -## 5.1 O que sera demonstrado ao vivo - -[PARAGRAFO A REDIGIR] -- Pipeline completo em Docker: compilacao -> instrumentacao -> execucao -> veredito -- Exemplo interativo: loops/array-2.c mostrando veredito FALSE + counter-example -- Execucao do framework TestComp 2026 (subset) mostrando throughput - -## 5.2 Equipamentos necessarios - -[PARAGRAFO A REDIGIR] -- Laptop com Docker instalado -- Imagem map2check-dev pre-construida (ou build no local, ~30 min) -- Subconjunto de benchmarks SV-COMP (testcomp26 tag) -- Acesso a internet (para pull da imagem Docker, se necessario) - -## 5.3 Video tecnico - -[PARAGRAFO A REDIGIR] -- Link do video (sera preenchido apos gravacao) -- Duracao: 5-7 minutos -- Conteudo: instalacao (Docker), build, execucao E2E, resultados TestComp 2026 -- Roteiro detalhado: ver video/roteiro-gravacao.md - ---- - -*Nota: Aguardando redacao na Sprint 2. BACKLOG: gravacao do video.* diff --git a/docs/paper-sbseg-2026/sections/06-conclusao.md b/docs/paper-sbseg-2026/sections/06-conclusao.md deleted file mode 100644 index 9a6232a63..000000000 --- a/docs/paper-sbseg-2026/sections/06-conclusao.md +++ /dev/null @@ -1,43 +0,0 @@ -# 6. Avaliacao, Perspectivas e Conclusao - -**Estado:** Rascunho nao iniciado. -**Fontes:** Dados consolidados em data/consolidated-data.md. -**Figuras:** Nenhuma. - ---- - -## 6.1 Resumo dos resultados - -[PARAGRAFO A REDIGIR] -- Modernizacao completa: 35 commits, 84 arquivos, +5.785/-657 linhas -- 9 passes migrados, 7/7 unit tests, 9/9 passes carregando -- TestComp 2026 Heap: 594 tasks, score 57, 56 bugs reais -- 3 bugs criticos de regressao descobertos e corrigidos - -## 6.2 Limitacoes - -[PARAGRAFO A REDIGIR] -- Taxa de UNKNOWN alta (45.6%): investigacao de timeout tuning e estrategia de solver -- Ausencia de testes de integracao E2E no CI -- ControlFlow benchmarks usaram property no-overflow — incomparavel -- C++17 dead store warnings em libc++ headers (documentado) - -## 6.3 Perspectivas - -[PARAGRAFO A REDIGIR] -- Aprofundamento do suporte a WebAssembly: expansao dos benchmarks, modelagem formal da memoria linear WASM -- Reducao da taxa de UNKNOWN: tuning de timeout, estrategias de solver SMT, heuristicas de path exploration -- Testes de integracao E2E no CI: automatizar o pipeline completo compile -> instrument -> link -> execute -- NAO mencionar: DG Library, AFL++, Coordenador, Smart Seeds (fora do escopo). - -## 6.4 Conclusao - -[PARAGRAFO A REDIGIR] -- Map2Check renasceu como plataforma sustentavel de verificacao de memory safety -- Modernizacao de engenharia e pre-requisito fundamental para qualquer avanco futuro -- Resultados do TestComp 2026 demonstram viabilidade competitiva -- Projeto aberto a contribuicoes (open source, repositorio publico) - ---- - -*Nota: Aguardando redacao na Sprint 2.* diff --git a/docs/paper-sbseg-2026/video-storyboard.md b/docs/paper-sbseg-2026/video-storyboard.md deleted file mode 100644 index 10c952f0e..000000000 --- a/docs/paper-sbseg-2026/video-storyboard.md +++ /dev/null @@ -1,56 +0,0 @@ -# Roteiro — Vídeo Técnico Map2Check 2026 (SBSeg SF — 5-7 min) - -## Cena 1: Apresentação (0:00–0:45) -**Slide:** Título + autores + UFRN/UFRR -- "Map2Check 2026 é uma ferramenta de verificação híbrida para C que combina execução simbólica e fuzzing" -- "SBSeg 2026 — Salão de Ferramentas" -- Stack: LLVM 16, KLEE 3.1, C++17, Docker - -## Cena 2: Demonstração E2E — Buffer Overflow (0:45–2:00) -**Terminal ao vivo:** -```bash -$ cat array-2.c -$ map2check --property-file coverage-error-call.prp array-2.c -VERIFICATION FAILED -Counter-example: nondet_int() -> 31763 -``` -- Mostrar: compilação → instrumentação → KLEE → contra-exemplo - -## Cena 3: Pipeline de Verificação (2:00–2:30) -**Slide:** Diagrama do pipeline (fig2-pipeline.png) -- 5 estágios: compilação, instrumentação, linking, análise, veredito -- 9 passes LLVM New PM (MemoryTrackPass, OverflowPass, etc.) - -## Cena 4: Resultados TestComp 2026 (2:30–3:30) -**Slide:** Tabela de resultados Heap + ControlFlow -- Heap: 594 tasks, score 57, 56 bugs reais encontrados -- ControlFlow: 138 tasks, score 38, 38 bugs -- KPI: 45.6% UNKNOWN → direcionamento para próximos ciclos - -## Cena 5: WASM Pipeline (3:30–4:30) -**Slide:** Diagrama WASM pipeline (fig6-wasm-pipeline.png) -- `.wasm → wasm2c → LLVM IR → Passes → KLEE` -- `map2check --wasm modulo.wasm` — mesmo pipeline, binários de terceiros - -## Cena 6: Demo WASM — Heap Overflow detectado (4:30–5:30) -**Terminal ao vivo:** -```bash -$ cat test_heap_overflow.c # malloc(10*sizeof(int)); p[10] = 999; -$ wasi-sdk clang --target=wasm32-wasip1 test_heap_overflow.c -o overflow.wasm -$ map2check --wasm --memtrack overflow.wasm -VERIFICATION FAILED -Violated property: OVERFLOW -``` -- Juliet: 15/15 casos FALSE - -## Cena 7: Infraestrutura de Engenharia (5:30–6:15) -**Slide:** CI/CD + Docker + OpenSSF -- GitHub Actions: build, test, static analysis, sanitizers, E2E Docker -- Dockerfile.dev: ambiente reproduzível -- OpenSSF Best Practices badge - -## Cena 8: Conclusão + Links (6:15–7:00) -**Slide:** Repositório + DOI + contato -- `github.com/hbgit/Map2Check` -- Código aberto (GPL-2.0), Docker image pública (GHCR) -- Contribuições bem-vindas diff --git a/docs/paper-sbseg-2026/video/roteiro-gravacao.md b/docs/paper-sbseg-2026/video/roteiro-gravacao.md deleted file mode 100644 index fea89296a..000000000 --- a/docs/paper-sbseg-2026/video/roteiro-gravacao.md +++ /dev/null @@ -1,131 +0,0 @@ -# Roteiro do Vídeo Tecnico — Map2Check 2026 - -**Duracao alvo:** 5–7 minutos -**Formato:** Screencast + narracao -**Resolucao:** 1920x1080, 30fps -**Audio:** Narracao clara, sem musica de fundo -**Legendas:** Recomendado - ---- - -## Storyboard — 8 Cenas - -### Cena 1: Introducao (30 segundos) -**Visual:** Terminal limpo, texto overlay. -**Texto:** Map2Check 2026 — Modernizacao de uma Ferramenta de Verificacao de Memory Safety. -**Narracao:** Map2Check e uma ferramenta de verificacao hibrida para programas em C. Em 2026, completamos uma modernizacao completa da stack: de LLVM 6 para LLVM 16, migrando todos os passes para o New Pass Manager e adotando C++17. Neste video, demonstramos o pipeline completo de instalacao, build e execucao. - ---- - -### Cena 2: Clone e Build com Docker (60 segundos) -**Visual:** Terminal executando comandos. Time-lapse no docker build. -**Comandos:** -```bash -git clone https://github.com//Map2Check.git -cd Map2Check -docker build -f Dockerfile.dev -t map2check-dev . -docker run --rm map2check-dev clang-16 --version -docker run --rm map2check-dev opt --version -``` -**Narracao:** O ambiente e inteiramente containerizado. A imagem Docker inclui LLVM 16, KLEE 3.1, Z3, Boost e todas as dependencias. O build e reprodutivel em qualquer maquina com Docker. - ---- - -### Cena 3: Execucao do Smoke Test (60 segundos) -**Visual:** Execucao de array-1.c (TRUE) e array-2.c (FALSE). Highlight no veredito. -**Comandos:** -```bash -map2check --property-file coverage-error-call.prp \ - --target-function-name reach_error loops/array-1.c -# Resultado: VERIFICATION SUCCEEDED - -map2check --property-file coverage-error-call.prp \ - --target-function-name reach_error loops/array-2.c -# Resultado: VERIFICATION FAILED + counter-example -``` -**Narracao:** O pipeline completo e invocado por um unico comando. No primeiro exemplo, o erro nunca e alcancado. No segundo, encontramos o erro e geramos um contra-exemplo concreto. - ---- - -### Cena 4: Verificacao do Counter-Example (60 segundos) -**Visual:** Saida detalhada do counter-example. Highlight nos valores. -**Texto exibido:** -``` -Counter-example: - Call Function : __VERIFIER_nondet_int() - Value : 31763 - Line Number : 19 - Function Scope : main - -Violated property: - FALSE: Target Reached -``` -**Narracao:** O contra-exemplo fornece valores concretos para as entradas nao-deterministicas que levam a violacao, tornando a falha reprodutivel. - ---- - -### Cena 5: Framework TestComp 2026 (60 segundos) -**Visual:** Navegacao ate test-comp2026/simulation/. Execucao de run_checkpoint.sh. -**Comandos:** -```bash -cd test-comp2026/simulation/ -./run_checkpoint.sh --category Heap --timeout 300 -./verify_verdicts.sh -``` -**Narracao:** Para validar em escala, executamos o framework de checkpoint contra benchmarks reais do TestComp 2026. O script gerencia multiplas tarefas, timeouts e validacao automatica. - ---- - -### Cena 6: Resultados Consolidados (45 segundos) -**Visual:** Tabela/painel com resultados. Grafico de barras (Figura 4). -**Texto:** -``` -Resultados TestComp 2026 — Heap -Total tasks : 594 -Score : 57 -TRUE : 264 (44.4%) -UNKNOWN : 271 (45.6%) -FALSE : 56 (9.4%) -TIMEOUT : 2 (0.3%) -``` -**Narracao:** Na subcategoria Heap, executamos 594 tasks. A ferramenta encontrou 56 bugs reais e alcancou um score de 57. Estes resultados demonstram a viabilidade competitiva. - ---- - -### Cena 7: CI/CD e Qualidade de Artefato (45 segundos) -**Visual:** Pagina GitHub Actions. Badge verde. Terminal com static analysis. -**Comandos:** -```bash -./scripts/run-static-analysis.sh -mkdir build-asan && cd build-asan -cmake -DENABLE_SANITIZER_ADDRESS=ON .. -make -j$(nproc) -``` -**Narracao:** A sustentabilidade e garantida por CI/CD automatizado, analise estatica com clang-tidy e cppcheck, e testes com sanitizers. Estas praticas sao essenciais para a reproducibilidade cientifica. - ---- - -### Cena 8: WebAssembly — Sneak Peek (opcional, 20 segundos) -**Visual:** Terminal mostrando compilacao C -> WASM via LLVM. -**Comandos:** -```bash -clang-16 --target=wasm32-wasi -emit-llvm -c exemplo.c -o exemplo.bc -``` -**Narracao:** Como direcao futura, estamos estendendo o pipeline LLVM para analise de modulos WebAssembly, ampliando o escopo da verificacao para runtimes WASM. - ---- - -### Cena 9: Conclusao (30 segundos) -**Visual:** Tela final com link do repositorio e QR code. -**Texto:** Map2Check 2026 — Codigo aberto, verificacao sustentavel. -**Narracao:** O Map2Check esta disponivel como codigo aberto. Agradecemos o interesse e convidamos a comunidade a contribuir. - ---- - -## Notas de Producao - -- Usar `asciinema` ou `terminalizer` para gravacao elegante do terminal. -- Acelerar partes longas (docker build, execucao de multiplos benchmarks) com time-lapse. -- Manter fonte do terminal grande o suficiente para leitura em projetor. -- URL do repositorio pode constar normalmente no video (single-blind). Opcional: usar URL generica se preferir. -- Dura total nao deve exceder 7 minutos. diff --git a/docs/paper-sbseg-2026/wasm-implementation-plan.md b/docs/paper-sbseg-2026/wasm-implementation-plan.md deleted file mode 100644 index c42169abe..000000000 --- a/docs/paper-sbseg-2026/wasm-implementation-plan.md +++ /dev/null @@ -1,138 +0,0 @@ -# Plano de Implementação — WASM Pipeline (Map2Check) - -**Branch:** `feat-wasm-verification` -**Deadline MVP:** 13/jul/2026 -**Deadline submissão SBSeg:** 20/jul/2026 - ---- - -## Contexto atual - -| Componente | Estado | -|------------|--------| -| WasmLifter (`wasm_lifter.{hpp,cpp}`) | ✅ Compila, integrado ao CMake, NÃO invocado pelo CLI | -| Docker (WABT 1.0.41 + wasi-sdk 33.0) | ✅ Dockerfile.dev atualizado | -| Scripts de validação (`test_wasm_pipeline.sh`) | ✅ Pipeline C→WASM→LLVM IR validado | -| Paper SBSeg (LaTeX) | ✅ 6 seções escritas, falta seção WASM | -| Integração CLI (`map2check --wasm`) | 🔴 Não existe | -| PoC E2E (detectar bug real em WASM) | 🔴 Não testado | -| MemoryTrackPass adaptado | 🔴 Não iniciado | - ---- - -## Arquitetura Proposta - -O WasmLifter já produz `.bc` (LLVM bitcode). O pipeline existente: - -``` -C (.c) → clang → .bc → opt (passes) → llvm-link (runtime) → KLEE → veredito -``` - -Para WASM, o step de compilação é substituído pelo lifter: - -``` -WASM (.wasm) → wasm2c → .c → clang-16 → .bc → opt (passes) → llvm-link (runtime) → KLEE → veredito - └─────────── WasmLifter ──────────┘ └─────── pipeline existente (inalterado) ───────┘ -``` - -**Vantagem**: do `.bc` pra frente, tudo é reutilizado — passes, runtime, KLEE, leitura de veredito. - ---- - -## Sub-etapas - -### 1.7.3 — PoC E2E manual (2 dias) - -**Objetivo**: Provar que o pipeline detecta um bug de memory safety em WASM. - -**Tarefas**: -1. Criar caso de teste canônico: `test_overflow.c` com buffer overflow intencional -2. Compilar para WASM: `wasi-sdk clang --target=wasm32-wasip1 test_overflow.c -o test.wasm` -3. Liftar para LLVM IR: `WasmLifter::lift("test.wasm")` → `test.bc` -4. Inspecionar o IR: verificar se o wasm2c gera `load`/`store`/`call` que o MemoryTrackPass reconhece -5. Rodar passes: `opt -load-pass-plugin=libMemoryTrackPass.so -passes=memory-track test.bc -o test-instr.bc` -6. Linkar com runtime: `llvm-link test-instr.bc Map2CheckFunctions.bc AnalysisModeMemtrack.bc ...` -7. Executar KLEE: verificar se o overflow é detectado (FALSE + counter-example) -8. Documentar descobertas: padrões de IR do wasm2c que diferem do C nativo - -**Riscos**: -- `wasm2c` não gera `malloc`/`free` → usa `wasm_rt_allocate_memory()` → MemoryTrackPass não captura -- Memória linear WASM é array contíguo acessado via offset, não ponteiro → bounds check precisa ser adaptado -- Entry point é `w2c__start`, não `main` → Map2CheckLibrary pass não injeta init/exit - ---- - -### 1.7.4 — Adaptação MemoryTrackPass para WASM (3 dias) - -| Componente | Problema | Solução | -|------------|----------|---------| -| **Map2CheckLibrary** | Não reconhece `w2c__start` como entry point | Adicionar flag `--entry-function` ou detectar `w2c_*` automaticamente | -| **MemoryTrackPass** | `malloc`/`free` não existem no IR wasm2c — usa `wasm_rt_allocate_memory` | Adicionar handlers para `wasm_rt_*` calls; instrumentar `wasm_rt_allocate_memory` como `map2check_malloc` | -| **MemoryTrackPass** | Ponteiros são offsets i32 dentro da memória linear, não endereços reais | Tratar stores/loads em `wasm_rt_memory_t.data` como acessos à memória; validar offset < `memory.size` | -| **OverflowPass** | Buffer overflow em WASM = acesso à memória linear além do bounds | Adicionar bounds check: `assert(offset + size <= memory_pages * 64KB)` antes de cada store/load | -| **Runtime** | `map2check_malloc` espera endereço real, WASM usa offset | Criar modo `WASM_MODE` na runtime que trabalha com offsets relativos à base da memória linear | - ---- - -### 1.7.5 — CLI `--wasm` + WasmBackend (2 dias) - -1. Adicionar flag `--wasm` no `map2check.cpp` (via `boost::program_options`) -2. Modificar `map2check_execution()`: - ```cpp - if (args.wasmMode) { - WasmLifter lifter(config); - WasmLifterResult result = lifter.lift(args.inputFile); - args.inputFile = result.bitcodePath; // substitui .wasm por .bc - } - // Resto do pipeline inalterado - ``` -3. Passar `--wasm-mode` para o `callPass()` quando em modo WASM -4. Ajustar `Caller::compileCFile()` para ser no-op quando input já é `.bc` - -**Arquivos afetados**: -- `modules/frontend/map2check.cpp` — adicionar flag + WasmLifter call -- `modules/frontend/map2check.hpp` — adicionar campos ao `map2check_args` -- `modules/frontend/caller.cpp` — opcional: skip compileCFile para .bc - ---- - -### 1.7.6 — Benchmarks Juliet WASM (2 dias) - -1. Selecionar subset da Juliet Test Suite: CWE-119 (Buffer Overflow), CWE-416 (Use-After-Free) -2. Compilar para WASM com wasi-sdk-33 -3. Rodar pipeline em cada benchmark -4. Tabular: total, bugs detectados (FALSE), safe confirmados (TRUE), inconclusivos (UNKNOWN) -5. Comparar taxa de detecção: WASM vs C nativo (via pipeline normal) - ---- - -### 1.7.7 — Documentação no artigo (2 dias) - -1. Escrever seção WASM (~1 página) no `main.tex`: arquitetura do lifter, modelagem, pipeline, resultados Juliet -2. Adicionar figura do pipeline WASM -3. Atualizar abstract/conclusão com menção ao suporte WASM - ---- - -## Cronograma - -| Data | Marco | -|------|-------| -| 04-05/jul | 1.7.3 PoC E2E | -| 06-08/jul | 1.7.4 Passes adaptados | -| 09-10/jul | 1.7.5 CLI integrado | -| 11-12/jul | 1.7.6 Juliet benchmarks | -| 13/jul | 1.7.7 Seção WASM no artigo | - -**Dependência crítica**: 1.7.3 é o gate — se o PoC falhar, reavaliar abordagem. - ---- - -## Riscos (atualizado) - -| Risco | Impacto | Prob | Mitigação | -|:---|:---|:---|:---| -| wasm2c gera código C incompreensível para passes | Alto | Média | Validar exemplos simples primeiro; ajustar passes para `wasm_rt_*` | -| KLEE não resolve memória linear levantada | Alto | Média | Injetar asserts de bounds manualmente; `klee_make_symbolic` para offsets | -| Juliet compilado para WASM perde semântica de malloc/free | Médio | Alta | Validar preservação; mapear para `wasm_rt_malloc` se necessário | -| IR levantado explode após lifting | Médio | Média | Usar slicing antes da instrumentação; limitar a benchmarks pequenos | diff --git a/docs/superpowers/plans/2026-07-16-castle-benchmark.md b/docs/superpowers/plans/2026-07-16-castle-benchmark.md new file mode 100644 index 000000000..5c161443c --- /dev/null +++ b/docs/superpowers/plans/2026-07-16-castle-benchmark.md @@ -0,0 +1,573 @@ +# CASTLE-Benchmark Integration Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Integrate CASTLE C250 benchmark (250 C micro-benchmarks, 25 CWEs) into Map2Check: 5 regression tests in CI + standalone evaluation script for paper results. + +**Architecture:** Two-layer approach. Layer 1: `tests/integration/test_castle_regression.sh` — 5 curated CASTLE tests compiled to LLVM bitcode, verified with `--memtrack`, following the `test_wasm_pipeline.sh` pattern. Layer 2: `tests/castle/run_castle_evaluation.sh` — standalone script that runs all 250 tests with two-pass invariants strategy, scores against `CASTLE-C250.min.json` ground truth, outputs CSV + summary. + +**Tech Stack:** bash, clang-16 (bitcode compilation), map2check (--memtrack), python3 (JSON parsing), git submodule (CASTLE-Benchmark), Docker ghcr.io/hbgit/map2check-dev (CI) + +## Global Constraints + +- clang-16 is the required compiler version +- map2check binary must be built with KLEE support (not SKIP_KLEE) +- All CASTLE tests use plain `main()` — no `reach_error()` or `__VERIFIER_nondet_int()` harness +- `--memtrack` mode covers valid-free, valid-deref, valid-memtrack via KLEE symbolic execution +- `--add-invariants` is used as fallback only when first pass returns UNKNOWN +- Per-test timeout: 60s (regression) / 120s (evaluation) +- Out-of-scope CWEs (22, 78, 89, 327, 522, 798) flagged N/A +- CASTLE-Benchmark is a git submodule pinned to main HEAD + +--- + +### Task 1: Add CASTLE-Benchmark git submodule + +**Files:** +- Modify: `.gitmodules` +- Create: `tests/castle/CASTLE-Benchmark` (submodule directory) + +**Interfaces:** +- Produces: `tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250/*.c` (250 C files), `tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250.min.json` (ground truth) + +- [ ] **Step 1: Add the submodule** + +```bash +cd /home/guilherme/github/Map2Check +mkdir -p tests/castle +git submodule add --name CASTLE-Benchmark \ + https://github.com/CASTLE-Benchmark/CASTLE-Benchmark \ + tests/castle/CASTLE-Benchmark +``` + +- [ ] **Step 2: Pin to current main HEAD and verify** + +```bash +cd tests/castle/CASTLE-Benchmark +git log --oneline -1 +# Should show the latest commit on main +cd /home/guilherme/github/Map2Check +ls tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-1.c +``` + +Run: `ls tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250/ | wc -l` +Expected: `> 250` (250 .c files + Makefile) + +- [ ] **Step 3: Commit** + +```bash +git add .gitmodules tests/castle/CASTLE-Benchmark +git commit -m "chore: add CASTLE-Benchmark git submodule" +``` + +--- + +### Task 2: Write CASTLE regression test script + +**Files:** +- Create: `tests/integration/test_castle_regression.sh` + +**Interfaces:** +- Consumes: `tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250/*.c` (from Task 1), `$MAP2CHECK_PATH` env var (points to map2check binary) +- Produces: Exit code 0 (all passed) or 1 (any failed), console output with PASS/FAIL per test + +- [ ] **Step 1: Create the script** + +```bash +#!/bin/bash +set -e + +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" +CLANG="${CLANG:-/usr/bin/clang-16}" +CASTLE_DIR="tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250" +TMPDIR=$(mktemp -d) +PASSED=0 +FAILED=0 + +cleanup() { rm -rf "$TMPDIR"; } +trap cleanup EXIT + +echo "============================================================" +echo "Map2Check CASTLE Regression Tests" +echo "============================================================" + +run_castle_test() { + local name="$1" + local cwe="$2" + local expect_fail="$3" + + local src="$CASTLE_DIR/$name" + local bc="$TMPDIR/$name.bc" + + echo "" + echo "--- Test: $name (CWE-$cwe) ---" + + $CLANG -c -emit-llvm -g -O0 "$src" -o "$bc" 2>/dev/null || { + echo " SKIP: compile failed" + return 0 + } + + local output + output=$(timeout 120 "$MAP2CHECK" --memtrack --timeout 60 "$bc" 2>&1) || true + + if [ "$expect_fail" = "true" ]; then + if echo "$output" | grep -qE "VERIFICATION FAILED|FALSE_"; then + echo " PASS: vulnerability detected" + PASSED=$((PASSED+1)) + else + echo " FAIL: expected FALSE, got:" + echo "$output" | tail -5 + FAILED=$((FAILED+1)) + fi + else + if echo "$output" | grep -qE "VERIFICATION FAILED|FALSE_"; then + echo " FAIL: expected TRUE, got FALSE:" + echo "$output" | tail -5 + FAILED=$((FAILED+1)) + else + echo " PASS: no false alarm" + PASSED=$((PASSED+1)) + fi + fi +} + +run_castle_test "CASTLE-476-1.c" "476" "true" +run_castle_test "CASTLE-415-2.c" "415" "true" +run_castle_test "CASTLE-476-8.c" "476" "false" +run_castle_test "CASTLE-416-1.c" "416" "true" +run_castle_test "CASTLE-787-3.c" "787" "true" + +echo "" +echo "============================================================" +echo "Results: $PASSED passed, $FAILED failed" +echo "============================================================" + +[ $FAILED -eq 0 ] && exit 0 || exit 1 +``` + +- [ ] **Step 2: Make executable** + +```bash +chmod +x tests/integration/test_castle_regression.sh +``` + +- [ ] **Step 3: Run locally to verify syntax** + +```bash +bash -n tests/integration/test_castle_regression.sh +``` + +Expected: no output (syntax OK) + +- [ ] **Step 4: Commit** + +```bash +git add tests/integration/test_castle_regression.sh +git commit -m "test: add CASTLE regression tests (5 micro-benchmarks)" +``` + +--- + +### Task 3: Add CI job for CASTLE regression + +**Files:** +- Modify: `.github/workflows/ci.yml` (append new job after e2e-wasm) + +**Interfaces:** +- Consumes: `tests/integration/test_castle_regression.sh` (from Task 2), `ghcr.io/hbgit/map2check-dev:latest` Docker image +- Produces: CI job `castle-regression` that runs on push to develop/feat-*, PRs to develop/main + +- [ ] **Step 1: Add the CI job** + +Insert this YAML block after the `e2e-wasm` job (after line 291 in ci.yml): + +```yaml + # =========================================================== + # Job 6: CASTLE Benchmark Regression Tests + # =========================================================== + # Verifies Map2Check against 5 CASTLE micro-benchmarks + # (CWE-415, 416, 476, 787) — memory safety regression suite. + castle-regression: + name: CASTLE Regression + runs-on: ubuntu-22.04 + timeout-minutes: 20 + needs: [build-and-test] + + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + submodules: recursive + + - name: Free disk space + run: | + sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc + sudo docker image prune -a -f || true + + - name: Pull map2check-dev image + run: docker pull ghcr.io/hbgit/map2check-dev:latest + + - name: Build + install Map2Check in container + run: | + docker run --rm \ + -u root \ + -v "${{ github.workspace }}:/workspace" \ + -w /workspace \ + -e CC=/usr/bin/clang-16 \ + -e CXX=/usr/bin/clang++-16 \ + ghcr.io/hbgit/map2check-dev:latest bash -c ' + rm -rf build_castle_ci install_castle_ci + mkdir -p build_castle_ci && cd build_castle_ci + cmake .. -G Ninja \ + -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DENABLE_TEST=ON \ + -DMAP2CHECK_DYNAMIC_LINK=ON \ + -DCMAKE_INSTALL_PREFIX=/workspace/install_castle_ci + ninja + ninja install + mkdir -p /workspace/install_castle_ci/lib/klee + ln -sf /opt/klee/lib/klee/runtime /workspace/install_castle_ci/lib/klee/runtime + ln -sf /usr/lib/llvm-16/lib/clang /workspace/install_castle_ci/lib/clang + ' + + - name: Run CASTLE regression tests + run: | + docker run --rm \ + -u root \ + -v "${{ github.workspace }}:/workspace" \ + -w /workspace \ + -e MAP2CHECK_PATH=/workspace/install_castle_ci \ + ghcr.io/hbgit/map2check-dev:latest bash -c ' + bash tests/integration/test_castle_regression.sh + ' +``` + +- [ ] **Step 2: Verify YAML syntax** + +```bash +python3 -c "import yaml; yaml.safe_load(open('.github/workflows/ci.yml'))" +``` + +- [ ] **Step 3: Commit** + +```bash +git add .github/workflows/ci.yml +git commit -m "ci: add CASTLE regression job" +``` + +--- + +### Task 4: Write CASTLE evaluation script + +**Files:** +- Create: `tests/castle/run_castle_evaluation.sh` + +**Interfaces:** +- Consumes: `tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250/*.c` (250 C files), `tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250.min.json` (ground truth), `$MAP2CHECK_PATH` env var +- Produces: `tests/castle/results/castle_results.csv`, `tests/castle/results/castle_summary.txt` + +- [ ] **Step 1: Create the evaluation script** + +```bash +#!/bin/bash +# run_castle_evaluation.sh — Run all 250 CASTLE C250 benchmarks through Map2Check +# Two-pass strategy: direct, then --add-invariants fallback on UNKNOWN +set -e + +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" +CLANG="${CLANG:-/usr/bin/clang-16}" +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +CASTLE_DIR="$SCRIPT_DIR/CASTLE-Benchmark/datasets/CASTLE-C250" +JSON_FILE="$SCRIPT_DIR/CASTLE-Benchmark/datasets/CASTLE-C250.min.json" +RESULTS_DIR="$SCRIPT_DIR/results" +TIMEOUT_SEC=120 + +# CWE → mode mapping (single-pass flags, --add-invariants added on UNKNOWN) +declare -A CWE_MODE=( + # Memory safety (memtrack) + [125]="--memtrack" + [415]="--memtrack" + [416]="--memtrack" + [476]="--memtrack" + [761]="--memtrack" + [787]="--memtrack" + [822]="--memtrack" + [843]="--memtrack" + # Overflow + [190]="--check-overflow" + # Memcleanup + [401]="--memcleanup-property" + # Assert + [134]="--check-asserts" + [617]="--check-asserts" + # Reachability (other) + [253]="--target-function --target-function-name main" + [362]="--target-function --target-function-name main" + [369]="--target-function --target-function-name main" + [628]="--target-function --target-function-name main" + [674]="--target-function --target-function-name main" + [770]="--target-function --target-function-name main" + [835]="--target-function --target-function-name main" + # Out of scope (still run for completeness, flagged N/A) + [22]="--target-function --target-function-name main" + [78]="--target-function --target-function-name main" + [89]="--target-function --target-function-name main" + [327]="--target-function --target-function-name main" + [522]="--target-function --target-function-name main" + [798]="--target-function --target-function-name main" +) + +OUT_OF_SCOPE_CWES=(22 78 89 327 522 798) + +is_out_of_scope() { + local cwe="$1" + for o in "${OUT_OF_SCOPE_CWES[@]}"; do + [ "$cwe" = "$o" ] && return 0 + done + return 1 +} + +mkdir -p "$RESULTS_DIR" + +echo "CASTLE C250 × Map2Check Evaluation" +echo "==================================" + +# --- Phase 1: Compile all --- +echo "" +echo "Phase 1: Compiling C → LLVM bitcode..." +mkdir -p "$RESULTS_DIR/bc" +COMPILED=0 +COMPILE_FAILED=0 + +for c_file in "$CASTLE_DIR"/*.c; do + name=$(basename "$c_file") + bc_file="$RESULTS_DIR/bc/${name%.c}.bc" + if "$CLANG" -c -emit-llvm -g -O0 -Wno-everything "$c_file" -o "$bc_file" 2>/dev/null; then + COMPILED=$((COMPILED+1)) + else + COMPILE_FAILED=$((COMPILE_FAILED+1)) + echo " FAIL: $name" + fi +done + +echo " Compiled: $COMPILED, Failed: $COMPILE_FAILED" + +# --- Phase 2: Verify + Score --- +echo "" +echo "Phase 2: Running Map2Check on each benchmark..." +echo "id,cwe,name,vulnerable,mode,verdict,invariants,expected,result,time_sec" > "$RESULTS_DIR/castle_results.csv" + +RUN=0 +TP=0; TN=0; FP=0; FN=0; UNK=0; TO=0; NA=0 + +for c_file in "$CASTLE_DIR"/*.c; do + name=$(basename "$c_file") + id="${name%.c}" + id_short=$(echo "$id" | sed 's/CASTLE-//') + + bc_file="$RESULTS_DIR/bc/${id}.bc" + [ -f "$bc_file" ] || continue + + RUN=$((RUN+1)) + + # Extract ground truth from JSON + entry=$(python3 -c " +import json +with open('$JSON_FILE') as f: + data = json.load(f) +for t in data['tests']: + if t['name'] == '$name': + print(json.dumps({'vulnerable': t['vulnerable'], 'cwe': t['cwe'], 'lines': t.get('lines',[])})) + break +" 2>/dev/null) + + vulnerable=$(echo "$entry" | python3 -c "import sys,json; print(json.loads(sys.stdin.read())['vulnerable'])") + cwe=$(echo "$entry" | python3 -c "import sys,json; print(json.loads(sys.stdin.read())['cwe'])") + + mode_flags="${CWE_MODE[$cwe]:---target-function --target-function-name main}" + + # --- Pass 1: direct --- + start=$(date +%s%N) + output=$(timeout "$TIMEOUT_SEC" "$MAP2CHECK" $mode_flags --timeout 60 "$bc_file" 2>&1) || true + end=$(date +%s%N) + elapsed=$(echo "scale=1; ($end - $start) / 1000000000" | bc) + + used_invariants="no" + if echo "$output" | grep -qi "TIMEOUT\|timed out"; then + verdict="TIMEOUT" + elif echo "$output" | grep -q "FALSE-DEREF"; then + verdict="FALSE-DEREF" + elif echo "$output" | grep -q "FALSE-FREE"; then + verdict="FALSE-FREE" + elif echo "$output" | grep -q "FALSE-MEMTRACK"; then + verdict="FALSE-MEMTRACK" + elif echo "$output" | grep -q "FALSE-OVERFLOW"; then + verdict="FALSE-OVERFLOW" + elif echo "$output" | grep -q "FALSE-MEMCLEANUP"; then + verdict="FALSE-MEMCLEANUP" + elif echo "$output" | grep -q "VERIFICATION FAILED"; then + verdict="FALSE" + elif echo "$output" | grep -q "VERIFICATION SUCCEEDED"; then + verdict="TRUE" + else + verdict="UNKNOWN" + fi + + # --- Pass 2: --add-invariants fallback --- + if [ "$verdict" = "UNKNOWN" ] && [ "$mode_flags" != "--check-asserts" ]; then + used_invariants="yes" + start=$(date +%s%N) + output=$(timeout "$TIMEOUT_SEC" "$MAP2CHECK" $mode_flags --add-invariants --timeout 60 "$bc_file" 2>&1) || true + end=$(date +%s%N) + elapsed=$(echo "scale=1; ($end - $start) / 1000000000" | bc) + + if echo "$output" | grep -qi "TIMEOUT\|timed out"; then + verdict="TIMEOUT" + elif echo "$output" | grep -q "FALSE-DEREF"; then + verdict="FALSE-DEREF" + elif echo "$output" | grep -q "FALSE-FREE"; then + verdict="FALSE-FREE" + elif echo "$output" | grep -q "FALSE-MEMTRACK"; then + verdict="FALSE-MEMTRACK" + elif echo "$output" | grep -q "FALSE-OVERFLOW"; then + verdict="FALSE-OVERFLOW" + elif echo "$output" | grep -q "FALSE-MEMCLEANUP"; then + verdict="FALSE-MEMCLEANUP" + elif echo "$output" | grep -q "VERIFICATION FAILED"; then + verdict="FALSE" + elif echo "$output" | grep -q "VERIFICATION SUCCEEDED"; then + verdict="TRUE" + else + verdict="UNKNOWN" + fi + fi + + # --- Classify --- + if is_out_of_scope "$cwe"; then + classification="N/A" + NA=$((NA+1)) + elif [ "$verdict" = "TIMEOUT" ]; then + classification="TIMEOUT" + TO=$((TO+1)) + elif [ "$verdict" = "UNKNOWN" ]; then + classification="UNKNOWN" + UNK=$((UNK+1)) + elif [ "$verdict" != "TRUE" ] && [ "$vulnerable" = "True" ]; then + classification="TP" + TP=$((TP+1)) + elif [ "$verdict" != "TRUE" ] && [ "$vulnerable" = "False" ]; then + classification="FP" + FP=$((FP+1)) + elif [ "$verdict" = "TRUE" ] && [ "$vulnerable" = "False" ]; then + classification="TN" + TN=$((TN+1)) + elif [ "$verdict" = "TRUE" ] && [ "$vulnerable" = "True" ]; then + classification="FN" + FN=$((FN+1)) + else + classification="UNCLASSIFIED" + UNK=$((UNK+1)) + fi + + echo "$id_short,$cwe,$name,$vulnerable,$mode_flags,$verdict,$used_invariants,$vulnerable,$classification,$elapsed" >> "$RESULTS_DIR/castle_results.csv" + echo " [$RUN/250] $name (CWE-$cwe): $verdict → $classification (${elapsed}s)" +done + +# --- Phase 3: Summary --- +echo "" +echo "Phase 3: Generating summary..." +TOTAL_SCOPE=$((TP+TN+FP+FN)) +DETECTABLE=$((TOTAL_SCOPE - NA)) + +cat > "$RESULTS_DIR/castle_summary.txt" << EOF +CASTLE C250 × Map2Check Evaluation Results +=========================================== +Date: $(date -u +"%Y-%m-%dT%H:%M:%SZ") +Map2Check binary: $MAP2CHECK + +Totals: + Total tests: 250 + Detected (in-scope): $DETECTABLE + Out of scope (N/A): $NA + Timeouts: $TO + Unknown: $UNK + +Detection Metrics (in-scope): + True Positives: $TP + False Positives: $FP + True Negatives: $TN + False Negatives: $FN + + Precision: $(python3 -c "print(f'{$TP/($TP+$FP)*100:.1f}%')" 2>/dev/null || echo "N/A") + Recall: $(python3 -c "print(f'{$TP/($TP+$FN)*100:.1f}%')" 2>/dev/null || echo "N/A") + +Results written to: + CSV: $RESULTS_DIR/castle_results.csv +EOF + +cat "$RESULTS_DIR/castle_summary.txt" + +echo "" +echo "Done. Results in $RESULTS_DIR/" +``` + +- [ ] **Step 2: Make executable** + +```bash +chmod +x tests/castle/run_castle_evaluation.sh +``` + +- [ ] **Step 3: Syntax check** + +```bash +bash -n tests/castle/run_castle_evaluation.sh +``` + +Expected: no output + +- [ ] **Step 4: Commit** + +```bash +git add tests/castle/run_castle_evaluation.sh +git commit -m "feat(castle): add evaluation script for all 250 CASTLE benchmarks" +``` + +--- + +### Task 5: Verify end-to-end + +**Files:** +- Test: `tests/integration/test_castle_regression.sh` (already committed) +- Test: `tests/castle/run_castle_evaluation.sh` (already committed) + +- [ ] **Step 1: Run regression tests locally (Docker)** + +```bash +docker run --rm \ + -u root \ + -v "$(pwd):/workspace" \ + -w /workspace \ + -e MAP2CHECK_PATH=/workspace/install_e2e \ + ghcr.io/hbgit/map2check-dev:latest bash -c '\ + rm -rf build_castle_ci install_castle_ci && \ + mkdir -p build_castle_ci && cd build_castle_ci && \ + cmake .. -G Ninja \ + -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DENABLE_TEST=ON \ + -DMAP2CHECK_DYNAMIC_LINK=ON \ + -DCMAKE_INSTALL_PREFIX=/workspace/install_castle_ci && \ + ninja && ninja install && \ + mkdir -p /workspace/install_castle_ci/lib/klee && \ + ln -sf /opt/klee/lib/klee/runtime /workspace/install_castle_ci/lib/klee/runtime && \ + ln -sf /usr/lib/llvm-16/lib/clang /workspace/install_castle_ci/lib/clang && \ + bash tests/integration/test_castle_regression.sh' +``` + +- [ ] **Step 2: Push and verify CI passes** + +```bash +git push origin feat/wasm-clean +# Check GitHub Actions for castle-regression job +``` diff --git a/docs/superpowers/specs/2026-07-16-castle-benchmark-design.md b/docs/superpowers/specs/2026-07-16-castle-benchmark-design.md new file mode 100644 index 000000000..8e242fae7 --- /dev/null +++ b/docs/superpowers/specs/2026-07-16-castle-benchmark-design.md @@ -0,0 +1,122 @@ +# CASTLE-Benchmark Integration for Map2Check + +**Design spec** | 2026-07-16 | Reference: TODO #8 (SBSeg 2026) + +## Goals + +- Run all 250 CASTLE C250 micro-benchmarks through Map2Check +- Report per-CWE detection results (TP/FP/TN/FN) for the paper +- Add 5 regression tests to CI to prevent future regressions + +## Non-goals + +- CASTLE Score calculation (done by CASTLE-Source separately) +- Tool wrappers for automated CASTLE scoring (out of scope) +- BenchExec XML (not needed for paper evaluation) + +--- + +## File Layout + +``` +tests/castle/ + CASTLE-Benchmark/ ← git submodule (pinned main) + run_castle_evaluation.sh ← standalone: compile → run → score → report + results/ + castle_results.csv ← per-test verdicts + castle_summary.txt ← paper-ready table + +tests/integration/ + test_castle_regression.sh ← 5 must-pass tests (CI) + +.github/workflows/ci.yml ← new job: castle-regression +``` + +### Dependencies + +- `clang-16` (LLVM bitcode compilation) +- `map2check` binary (in PATH or `MAP2CHECK_PATH`) +- KLEE runtime libraries (for symbolic execution) +- `python3` (JSON parsing, already available) +- Git submodule: `CASTLE-Benchmark/main` + +--- + +## Evaluation Script: `run_castle_evaluation.sh` + +### Phases + +1. **Setup**: Verify dependencies, ensure submodule is checked out +2. **Compile**: Each `CASTLE_C250/*.c` → `.bc` via `clang-16 -c -emit-llvm -g -O0` +3. **Verify**: Two-pass strategy per test: + - Pass 1: `map2check --timeout 60 <.bc>` → verdict + - Pass 2 (if UNKNOWN): retry with `--add-invariants` +4. **Score**: Compare verdict against `CASTLE-C250.min.json` ground truth +5. **Report**: Write `castle_results.csv` + `castle_summary.txt` + +### Mode Selection + +| CWE Group | CWEs | Map2Check Flags | +|-----------|------|----------------| +| Memory safety | 125, 415, 416, 476, 761, 787, 822, 843 | `--memtrack` | +| Overflow | 190 | `--check-overflow` | +| Memcleanup | 401 | `--memcleanup-property` | +| Assert | 134, 617 | `--check-asserts` | +| Reachability (other) | 253, 362, 369, 628, 674, 770, 835 | `--target-function --target-function-name main` | +| Out of scope | 22, 78, 89, 327, 522, 798 | `--target-function --target-function-name main` (marked N/A) | + +All modes use `--add-invariants` as UNKNOWN fallback in pass 2. + +### Classification + +| Verdict Substring | Ground Truth `vulnerable` | Line Match | Result | +|-------------------|--------------------------|------------|--------| +| `FALSE-DEREF`, `FALSE-FREE`, `FALSE-MEMTRACK`, `FALSE-OVERFLOW`, `FALSE-MEMCLEANUP` | `true` | Yes | **TP** | +| `FALSE-*` | `true` | No | **FP** (wrong line) | +| `FALSE-*` | `false` | -- | **FP** | +| `SUCCESSFUL` | `false` | -- | **TN** | +| `SUCCESSFUL` | `true` | -- | **FN** | +| `UNKNOWN`, timeout | any | -- | **UNKNOWN** | +| Out-of-scope CWE | any | -- | **N/A** | + +### Output + +**castle_results.csv:** +``` +id,cwe,name,vulnerable,mode,verdict,invariants,expected,result,time_sec +``` + +**castle_summary.txt:** Aggregate table per CWE + overall totals for paper. + +--- + +## Regression Tests: `test_castle_regression.sh` + +5 CASTLE tests compiled to LLVM bitcode, verified with `--memtrack`: + +| Test | CWE | Expected | +|------|-----|----------| +| CASTLE-476-1 | NULL deref via malloc | `VERIFICATION FAILED` | +| CASTLE-415-2 | Double free | `VERIFICATION FAILED` | +| CASTLE-476-8 | Safe NULL check | `VERIFICATION SUCCEEDED` | +| CASTLE-416-1 | Use-after-free | `VERIFICATION FAILED` | +| CASTLE-787-3 | Out-of-bounds write | `VERIFICATION FAILED` | + +### CI Job: `castle-regression` + +- **Trigger**: push to `develop`, `feat-*`; PRs +- **Runtime**: ~5 min +- **Runs**: `tests/integration/test_castle_regression.sh` +- **Depends on**: `build-and-test` (needs compiled map2check binary) +- **Environment**: ubuntu-22.04, clang-16, no Docker needed + +--- + +## Implementation Order + +1. Add CASTLE-Benchmark git submodule +2. Write `tests/integration/test_castle_regression.sh` (5 tests) +3. Add `castle-regression` CI job +4. Verify CI passes +5. Write `tests/castle/run_castle_evaluation.sh` (full 250) +6. Run evaluation, collect results for paper diff --git a/examples/use-after-free/README.md b/examples/use-after-free/README.md new file mode 100644 index 000000000..16ff19b65 --- /dev/null +++ b/examples/use-after-free/README.md @@ -0,0 +1,21 @@ +# Use-After-Free Example (CVE-2024-9680 inspired) + +This example illustrates a simplified use-after-free vulnerability inspired by +the Animation timelines bug in Firefox v131.0.2 +([CVE-2024-9680](https://nvd.nist.gov/vuln/detail/CVE-2024-9680)). + +The program allocates memory with `malloc`, stores a value, frees the pointer, +and then dereferences it — a classic temporal memory safety violation +(CWE-416). + +## Running with Map2Check + +```bash +$ ./map2check --memtrack sample_use_after_free.c +``` + +Expected output: `VERIFICATION FAILED` with `FALSE-DEREF: Reference to pointer was lost`, +which corresponds to CWE-416 (Use-After-Free). + +This example is discussed in the Map2Check SBSeg 2026 paper as Listing 1 +(*Motivating Example* section). diff --git a/examples/use-after-free/sample_use_after_free.c b/examples/use-after-free/sample_use_after_free.c new file mode 100644 index 000000000..f10c5bd65 --- /dev/null +++ b/examples/use-after-free/sample_use_after_free.c @@ -0,0 +1,13 @@ +#include +#include + +int main() { + int *ptr = (int *)malloc(sizeof(int)); + *ptr = 42; + free(ptr); // Free the memory + + // Use the pointer after freeing the memory (use-after-free) + // Undefined behavior, potential crash or exploit + printf("%d\n", *ptr); + return 0; +} diff --git a/sbseg_plan.md b/sbseg_plan.md deleted file mode 100644 index aa87d8cc4..000000000 --- a/sbseg_plan.md +++ /dev/null @@ -1,60 +0,0 @@ -**Plano de Trabalho — Submissão ao Salão de Ferramentas (SF) do SBSeg 2026![](Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.001.png)** - -**Ferramenta:** Map2Check — Finding Software Vulnerabilities using Symbolic Execution and Fuzzing **Modalidade sugerida:** Código Aberto (repositório público + vídeo técnico → elegível a prêmio e à avaliação de artefatos pelo CTA) **Coordenação técnica:** PD&I / Engenharia de Sistemas Computacionais - -Antes do plano em si, deixo registradas três restrições do edital que moldam todo o trabalho, porque é nelas que submissões ao SF costumam tropeçar. - -**Restrições do edital que precisam ser respeitadas desde já![](Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.002.png)** - -O **limite é de 10 páginas: 8 de corpo (incluindo figuras e tabelas) + até 2 de referências e apêndices** — O modelo obrigatório é o template SBC, o que exige reformatação do material histórico. - -O artigo deve conter obrigatoriamente, segundo o edital: descrição e motivação do problema; arquitetura e principais funcionalidades; descrição da demonstração planejada (com equipamentos necessários); e URL de vídeo de instalação/uso. A premiação depende de avaliação de artefato (disponibilidade, funcionalidade, reprodutibilidade, sustentabilidade) — e os commits recentes de CI/CD, Dockerfile e hardening são exatamente o que sustenta uma boa nota de artefato. - -**Datas:** submissão **20/jul/2026** - -Considerando hoje (17/jun/2026), há **~33 dias** até a submissão. - -**Posicionamento e narrativa do artigo![ref1]** - -A oportunidade aqui é tratar este artigo como o **marco de "renascimento" do Map2Check**. As publicações anteriores (TACAS 2016, 2018, 2020) eram *competition contributions* de 4–5 páginas, focadas em SV-COMP. Desde 2020 a ferramenta ficou essencialmente estagnada (LLVM 6.0, último release de nov/2019). Os commits de maio–junho/2026 mostram um esforço sistemático de modernização: migração para **LLVM 16 / Ubuntu 22.04**, conversão completa para o **New Pass Manager**, modernização para **C++17**, introdução de **CI/CD via GitHub Actions**, **análise estática (clang-tidy, cppcheck)**, **sanitizers**, busca pelo **OpenSSF Best Practices badge** e um framework de checkpoint para **TestComp 2026**. - -A tese central que sugiro para o artigo: *o Map2Check evoluiu de um verificador de C orientado a competição para uma plataforma de detecção de vulnerabilidades de memória, modernizada em engenharia e estendida para alvos emergentes (WebAssembly), com foco renovado em memory safety (memory leak, use-after-free, invalid-free/deref).* - -Sobre as features que vamos destacar: - -- As features de **memory safety/overflow** já são histórico consolidado e funcional da ferramenta — --memtrack , e as propriedades valid-free , valid-deref , valid-memtrack , ![](Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.004.png)![](Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.005.png)![](Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.006.png)![](Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.007.png)valid-memcleanup do SV-COMP. Aqui o trabalho é de *fortalecimento e reposicionamento* sob a ótica de cibersegurança (mapear para CWEs: CWE-401 memory leak, CWE-416 use-after-free, CWE-415 double-free, CWE-119/787 buffer overflow). É terreno seguro. -- A feature de **WebAssembly (WASM)** é a novidade de maior impacto para um público de cibersegurança, mas **não aparece iniciamos nos commits**. Para isso temos duas saídas honestas: (a) implementar um pipeline mínimo viável de WASM antes de 20/jul (escopo abaixo), ou (b) posicionar WASM como *roadmap / trabalho em andamento* numa seção de perspectivas. Recomendo tentar (a) com escopo enxuto e ter (b) como plano de contingência. - -**Estrutura proposta do artigo (8 páginas de corpo)![](Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.008.png)** - -A distribuição abaixo equilibra história, arquitetura e novidade, dando peso às features que você quer destacar sem inflar o que ainda não existe. - -A introdução e motivação (~1 pág) abrem com o problema de vulnerabilidades de memória em C/C++ como classe persistente e crítica de falhas de segurança, ancorando em CWEs e citando que memory-safety bugs seguem entre as principais causas de CVEs exploráveis. Posiciona o Map2Check nesse contexto e enuncia as contribuições da versão 2026. - -A história e evolução (~1 a 1,5 pág) traça a linha 2016→2018→2020→2026: de *Hunting Memory Bugs* (TACAS 2016, BMC), para LLVM+KLEE (TACAS 2018), para a combinação fuzzing + execução simbólica + invariantes indutivos com LibFuzzer/KLEE/Crab-LLVM (TACAS 2020), até a modernização atual. Aqui entra uma figura de timeline. - -A arquitetura e funcionalidades (~2 a 2,5 pág) é o núcleo técnico: instrumentação de código- fonte sobre LLVM, monitoramento de ponteiros e atribuições, geração de casos de teste por execução simbólica (KLEE) e fuzzing (LibFuzzer), invariantes indutivos (Crab-LLVM), e a abordagem de *iterative deepening*. Documenta a modernização de engenharia (LLVM 16, New Pass Manager, C++17, CI/CD, análise estática, sanitizers) como pilar de **sustentabilidade e qualidade de artefato** — que pontua diretamente no CTA. Figura de arquitetura/pipeline aqui. As novas features de cibersegurança (~1,5 pág) detalham a detecção de memory leak e violações de memory safety mapeadas para CWEs, com a integração ao TestComp 2026 (geração/validação de testes, execução de heap + verificação de veredito) como evidência de capacidade atual. É a seção que conecta a ferramenta ao escopo "cibersegurança" do SBSeg. - -WebAssembly (~1 pág) apresenta o suporte a análise de binários/módulos WASM — seja como feature entregue (MVP) ou como direção arquitetural via o pipeline LLVM existente, discutindo o vetor de ataque de memory safety em runtimes WASM. - -A demonstração planejada e o vídeo (~~0,5 pág) descrevem o que será mostrado ao vivo e os equipamentos (item obrigatório do edital). Encerra com avaliação preliminar, perspectivas e conclusão (~~0,5 pág). Referências e apêndice de reprodutibilidade vão nas 2 páginas extras. - -**Cronograma de execução (17/jun → 20/jul)![](Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.009.png)** - -Trabalhando para a submissão de 20 de julho, proponho quatro sprints. - -**Sprint 0 — Fundação e decisão de escopo (17–22/jun, ~5 dias).** Baixar o template SBC e montar o esqueleto anonimizado; auditar o repositório para garantir que o estado de master ![](Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.010.png)compila e roda os exemplos do README ( --memtrack ); definir o conjunto de benchmarks para a avaliação preliminar (subset SV-COMP MemSafety + casos próprios mapeados a CWEs). Entregável: outline aprovado + ambiente de build reprodutível (imagem Docker LLVM 16).![](Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.011.png) - -**Sprint 1 — Núcleo técnico e história (23/jun–02/jul, ~10 dias).** Redigir história, arquitetura e funcionalidades; produzir as figuras de timeline e de pipeline; consolidar a narrativa de modernização (mapeando os commits de maio–junho para a seção de sustentabilidade). Em paralelo, executar os experimentos de memory safety e tabular resultados. Entregável: seções 1–4 em rascunho + tabela de resultados. - -**Sprint 2 — Cibersegurança + WASM + demo (03–13/jul, ~10 dias).** Finalizar a seção de memory leak/CWE; implementar (ou documentar como roadmap) o caminho WASM; gravar e editar o **vídeo técnico** de instalação e uso (obrigatório); escrever a seção de demonstração com lista de equipamentos. Entregável: artigo completo em rascunho + vídeo publicado (link anonimizado) + checklist de artefato (disponibilidade/funcionalidade/reprodutibilidade/sustentabilidade). - -**Sprint 3 — Revisão, anonimização e submissão (14–20/jul, ~7 dias).** Revisão técnica e de escrita; verificação rigorosa de anonimato (sem nomes, instituições, URLs identificáveis, metadados do PDF); checagem do limite de 8 páginas de corpo; revisão à luz do código de conduta da SBC sobre IA generativa; geração do PDF final e submissão no **JEMS**. Entregável: PDF submetido + pacote de artefato preparado para o eventual camera-ready/CTA. - -**Riscos e recomendações![ref1]** - -O maior risco é o **WASM não ficar funcional a tempo**; a mitigação é ter a versão "roadmap" pronta como contingência — não vale comprometer a nota de artefato apresentando algo irreprodutível. O segundo risco é **falha de anonimização**, que pode levar a *desk reject* num processo double-blind; por isso a verificação é uma etapa formal no Sprint 3, incluindo metadados do PDF. O terceiro é o **build não reprodutível** para o CTA — os commits recentes de Docker/CI ajudam, mas o ambiente precisa ser validado do zero por alguém que não seja o autor. - -Uma nota sobre IA generativa: o edital remete explicitamente ao novo Código de Conduta da SBC quanto ao uso de IA generativa. Convém revisar essas regras antes de redigir e, se aplicável, declarar o uso conforme exigido. - -[ref1]: Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.003.png diff --git a/tests/castle/CASTLE-Benchmark b/tests/castle/CASTLE-Benchmark new file mode 160000 index 000000000..231bc3eb3 --- /dev/null +++ b/tests/castle/CASTLE-Benchmark @@ -0,0 +1 @@ +Subproject commit 231bc3eb3e9e117278327a250915e3c6b470cbdf diff --git a/tests/castle/benchexec/generate_benchexec.py b/tests/castle/benchexec/generate_benchexec.py new file mode 100644 index 000000000..0362c2144 --- /dev/null +++ b/tests/castle/benchexec/generate_benchexec.py @@ -0,0 +1,163 @@ +#!/usr/bin/env python3 +"""Generate BenchExec YML task files, SET files, and XML for CASTLE C250.""" + +import json +import os + +SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__)) +JSON_PATH = os.path.join(SCRIPT_DIR, "..", "CASTLE-Benchmark", "datasets", "CASTLE-C250.min.json") +TASKS_DIR = os.path.join(SCRIPT_DIR, "tasks") +SETS_DIR = os.path.join(SCRIPT_DIR, "sets") +PROPS_DIR = os.path.join(SCRIPT_DIR, "properties") +XML_PATH = os.path.join(SCRIPT_DIR, "map2check_castle.xml") + +CWE_PROPERTY = { + 125: "valid-memsafety.prp", + 134: "unreach-call.prp", + 190: "no-overflow.prp", + 253: "unreach-call.prp", + 327: "unreach-call.prp", + 362: "unreach-call.prp", + 369: "unreach-call.prp", + 401: "valid-memcleanup.prp", + 415: "valid-memsafety.prp", + 416: "valid-memsafety.prp", + 476: "valid-memsafety.prp", + 522: "unreach-call.prp", + 617: "unreach-call.prp", + 628: "unreach-call.prp", + 674: "unreach-call.prp", + 761: "valid-memsafety.prp", + 770: "unreach-call.prp", + 787: "valid-memsafety.prp", + 798: "unreach-call.prp", + 822: "valid-memsafety.prp", + 835: "unreach-call.prp", + 843: "valid-memsafety.prp", + 22: "unreach-call.prp", + 78: "unreach-call.prp", + 89: "unreach-call.prp", +} + +SET_GROUPS = { + "castle-memsafety": [ + 125, 415, 416, 476, 761, 787, 822, 843, + ], + "castle-overflow": [190], + "castle-memcleanup": [401], + "castle-reachability": [ + 134, 253, 362, 369, 617, 628, 674, 770, 835, + 22, 78, 89, 327, 522, 798, + ], +} + +# Load JSON +with open(JSON_PATH) as f: + data = json.load(f) + +tests = data["tests"] +print(f"Loaded {len(tests)} tests from CASTLE-C250.min.json") + +# Clear and recreate task directories +for d in [TASKS_DIR, SETS_DIR]: + os.makedirs(d, exist_ok=True) + for fname in os.listdir(d): + os.remove(os.path.join(d, fname)) + +# CWE → list of test names (for set grouping) +cwe_tests = {cwe: [] for cwe in CWE_PROPERTY} + +# Generate YML and SET file content +yml_count = 0 +for t in tests: + name = t["name"] + cwe = t["cwe"] + vulnerable = t["vulnerable"] + test_id = t["id"] + + if cwe not in CWE_PROPERTY: + cwe = 843 # fallback to memsafety + print(f" WARNING: unknown CWE {t['cwe']} for {name}, using CWE-843") + + prop_file = CWE_PROPERTY[cwe] + expected_verdict = "false" if vulnerable else "true" + + # Path to C file relative to tasks/ directory + c_file_rel = f"../../CASTLE-Benchmark/datasets/CASTLE-C250/{name}" + + yml_content = f"""format_version: '2.0' +input_files: '{c_file_rel}' + +properties: + - property_file: ../properties/{prop_file} + expected_verdict: {expected_verdict} +""" + + yml_path = os.path.join(TASKS_DIR, f"CASTLE-{test_id}.yml") + with open(yml_path, "w") as f: + f.write(yml_content) + yml_count += 1 + cwe_tests[cwe].append(f"CASTLE-{test_id}") + +print(f"Generated {yml_count} YML task files") + +# Generate SET files grouped by verification mode +set_count = 0 +for set_name, cwe_list in SET_GROUPS.items(): + lines = [] + for cwe in cwe_list: + for task_file in cwe_tests.get(cwe, []): + lines.append(f"../tasks/{task_file}.yml") + + set_path = os.path.join(SETS_DIR, f"{set_name}.set") + with open(set_path, "w") as f: + f.write("\n".join(lines) + "\n") + set_count += 1 + print(f" {set_name}.set: {len(lines)} tasks") + +print(f"Generated {set_count} SET files") + +# Map2Check wrapper dir (relative to CASTLE dir inside Docker volume) +# The user mounts the whole repo at e.g. /home/bench/benchexec_files/ +# Map2Check binary is in release/ (the CWD when BenchExec runs) + +# Generate BenchExec XML +xml_parts = [ + '', + '', + '', + "", + ' ', + "", +] + +BENCHEXEC_BASE = "/home/bench/benchexec_files/tests/castle/benchexec" + +for set_name in ["castle-memsafety", "castle-overflow", "castle-memcleanup", "castle-reachability"]: + prop_file_map = { + "castle-memsafety": "valid-memsafety.prp", + "castle-overflow": "no-overflow.prp", + "castle-memcleanup": "valid-memcleanup.prp", + "castle-reachability": "unreach-call.prp", + } + prop_file = prop_file_map[set_name] + display_name = set_name.replace("castle-", "CASTLE-") + + xml_parts.append(f' ') + xml_parts.append(f' {BENCHEXEC_BASE}/sets/{set_name}.set') + xml_parts.append(f' {BENCHEXEC_BASE}/properties/{prop_file}') + xml_parts.append(" ") + xml_parts.append("") + +xml_parts.append("") + +with open(XML_PATH, "w") as f: + f.write("\n".join(xml_parts)) + +print(f"\nBenchExec XML written to {XML_PATH}") +print(f"\nTo run:") +print(f" cd Map2Check") +print(f" docker run -it --rm -v /sys/fs/cgroup:/sys/fs/cgroup:rw \\") +print(f" -v $(pwd):/home/bench/benchexec_files:Z hrocha/benchexec \\") +print(f' /bin/bash -c "cd release && python3 -m benchexec.benchexec --no-container ../tests/castle/benchexec/map2check_castle.xml"') diff --git a/tests/castle/benchexec/map2check_castle.xml b/tests/castle/benchexec/map2check_castle.xml new file mode 100644 index 000000000..7e0f0bb32 --- /dev/null +++ b/tests/castle/benchexec/map2check_castle.xml @@ -0,0 +1,28 @@ + + + + + + + + /home/bench/benchexec_files/tests/castle/benchexec/sets/castle-memsafety.set + /home/bench/benchexec_files/tests/castle/benchexec/properties/valid-memsafety.prp + + + + /home/bench/benchexec_files/tests/castle/benchexec/sets/castle-overflow.set + /home/bench/benchexec_files/tests/castle/benchexec/properties/no-overflow.prp + + + + /home/bench/benchexec_files/tests/castle/benchexec/sets/castle-memcleanup.set + /home/bench/benchexec_files/tests/castle/benchexec/properties/valid-memcleanup.prp + + + + /home/bench/benchexec_files/tests/castle/benchexec/sets/castle-reachability.set + /home/bench/benchexec_files/tests/castle/benchexec/properties/unreach-call.prp + + + \ No newline at end of file diff --git a/tests/castle/benchexec/properties/no-overflow.prp b/tests/castle/benchexec/properties/no-overflow.prp new file mode 120000 index 000000000..988a4e65b --- /dev/null +++ b/tests/castle/benchexec/properties/no-overflow.prp @@ -0,0 +1 @@ +../../../regression_test/test_cases/sv-benchmarks/properties/no-overflow.prp \ No newline at end of file diff --git a/tests/castle/benchexec/properties/unreach-call.prp b/tests/castle/benchexec/properties/unreach-call.prp new file mode 120000 index 000000000..660f202b7 --- /dev/null +++ b/tests/castle/benchexec/properties/unreach-call.prp @@ -0,0 +1 @@ +../../../regression_test/test_cases/sv-benchmarks/properties/unreach-call.prp \ No newline at end of file diff --git a/tests/castle/benchexec/properties/valid-memcleanup.prp b/tests/castle/benchexec/properties/valid-memcleanup.prp new file mode 120000 index 000000000..6fdfd3fc9 --- /dev/null +++ b/tests/castle/benchexec/properties/valid-memcleanup.prp @@ -0,0 +1 @@ +../../../regression_test/test_cases/sv-benchmarks/properties/valid-memcleanup.prp \ No newline at end of file diff --git a/tests/castle/benchexec/properties/valid-memsafety.prp b/tests/castle/benchexec/properties/valid-memsafety.prp new file mode 120000 index 000000000..08ca2076d --- /dev/null +++ b/tests/castle/benchexec/properties/valid-memsafety.prp @@ -0,0 +1 @@ +../../../regression_test/test_cases/sv-benchmarks/properties/valid-memsafety.prp \ No newline at end of file diff --git a/tests/castle/benchexec/sets/castle-memcleanup.set b/tests/castle/benchexec/sets/castle-memcleanup.set new file mode 100644 index 000000000..743f526e3 --- /dev/null +++ b/tests/castle/benchexec/sets/castle-memcleanup.set @@ -0,0 +1,10 @@ +../tasks/CASTLE-401-1.yml +../tasks/CASTLE-401-2.yml +../tasks/CASTLE-401-3.yml +../tasks/CASTLE-401-4.yml +../tasks/CASTLE-401-5.yml +../tasks/CASTLE-401-6.yml +../tasks/CASTLE-401-7.yml +../tasks/CASTLE-401-8.yml +../tasks/CASTLE-401-9.yml +../tasks/CASTLE-401-10.yml diff --git a/tests/castle/benchexec/sets/castle-memsafety.set b/tests/castle/benchexec/sets/castle-memsafety.set new file mode 100644 index 000000000..bce26ad60 --- /dev/null +++ b/tests/castle/benchexec/sets/castle-memsafety.set @@ -0,0 +1,80 @@ +../tasks/CASTLE-125-1.yml +../tasks/CASTLE-125-2.yml +../tasks/CASTLE-125-3.yml +../tasks/CASTLE-125-4.yml +../tasks/CASTLE-125-5.yml +../tasks/CASTLE-125-6.yml +../tasks/CASTLE-125-7.yml +../tasks/CASTLE-125-8.yml +../tasks/CASTLE-125-9.yml +../tasks/CASTLE-125-10.yml +../tasks/CASTLE-415-1.yml +../tasks/CASTLE-415-2.yml +../tasks/CASTLE-415-3.yml +../tasks/CASTLE-415-4.yml +../tasks/CASTLE-415-5.yml +../tasks/CASTLE-415-6.yml +../tasks/CASTLE-415-7.yml +../tasks/CASTLE-415-8.yml +../tasks/CASTLE-415-9.yml +../tasks/CASTLE-415-10.yml +../tasks/CASTLE-416-1.yml +../tasks/CASTLE-416-2.yml +../tasks/CASTLE-416-3.yml +../tasks/CASTLE-416-4.yml +../tasks/CASTLE-416-5.yml +../tasks/CASTLE-416-6.yml +../tasks/CASTLE-416-7.yml +../tasks/CASTLE-416-8.yml +../tasks/CASTLE-416-9.yml +../tasks/CASTLE-416-10.yml +../tasks/CASTLE-476-1.yml +../tasks/CASTLE-476-2.yml +../tasks/CASTLE-476-3.yml +../tasks/CASTLE-476-4.yml +../tasks/CASTLE-476-5.yml +../tasks/CASTLE-476-6.yml +../tasks/CASTLE-476-7.yml +../tasks/CASTLE-476-8.yml +../tasks/CASTLE-476-9.yml +../tasks/CASTLE-476-10.yml +../tasks/CASTLE-761-1.yml +../tasks/CASTLE-761-2.yml +../tasks/CASTLE-761-3.yml +../tasks/CASTLE-761-4.yml +../tasks/CASTLE-761-5.yml +../tasks/CASTLE-761-6.yml +../tasks/CASTLE-761-7.yml +../tasks/CASTLE-761-8.yml +../tasks/CASTLE-761-9.yml +../tasks/CASTLE-761-10.yml +../tasks/CASTLE-787-1.yml +../tasks/CASTLE-787-2.yml +../tasks/CASTLE-787-3.yml +../tasks/CASTLE-787-4.yml +../tasks/CASTLE-787-5.yml +../tasks/CASTLE-787-6.yml +../tasks/CASTLE-787-7.yml +../tasks/CASTLE-787-8.yml +../tasks/CASTLE-787-9.yml +../tasks/CASTLE-787-10.yml +../tasks/CASTLE-822-1.yml +../tasks/CASTLE-822-2.yml +../tasks/CASTLE-822-3.yml +../tasks/CASTLE-822-4.yml +../tasks/CASTLE-822-5.yml +../tasks/CASTLE-822-6.yml +../tasks/CASTLE-822-7.yml +../tasks/CASTLE-822-8.yml +../tasks/CASTLE-822-9.yml +../tasks/CASTLE-822-10.yml +../tasks/CASTLE-843-1.yml +../tasks/CASTLE-843-2.yml +../tasks/CASTLE-843-3.yml +../tasks/CASTLE-843-4.yml +../tasks/CASTLE-843-5.yml +../tasks/CASTLE-843-6.yml +../tasks/CASTLE-843-7.yml +../tasks/CASTLE-843-8.yml +../tasks/CASTLE-843-9.yml +../tasks/CASTLE-843-10.yml diff --git a/tests/castle/benchexec/sets/castle-overflow.set b/tests/castle/benchexec/sets/castle-overflow.set new file mode 100644 index 000000000..9ff4e7bdc --- /dev/null +++ b/tests/castle/benchexec/sets/castle-overflow.set @@ -0,0 +1,10 @@ +../tasks/CASTLE-190-1.yml +../tasks/CASTLE-190-2.yml +../tasks/CASTLE-190-3.yml +../tasks/CASTLE-190-4.yml +../tasks/CASTLE-190-5.yml +../tasks/CASTLE-190-6.yml +../tasks/CASTLE-190-7.yml +../tasks/CASTLE-190-8.yml +../tasks/CASTLE-190-9.yml +../tasks/CASTLE-190-10.yml diff --git a/tests/castle/benchexec/sets/castle-reachability.set b/tests/castle/benchexec/sets/castle-reachability.set new file mode 100644 index 000000000..ff043a3a3 --- /dev/null +++ b/tests/castle/benchexec/sets/castle-reachability.set @@ -0,0 +1,150 @@ +../tasks/CASTLE-134-1.yml +../tasks/CASTLE-134-2.yml +../tasks/CASTLE-134-3.yml +../tasks/CASTLE-134-4.yml +../tasks/CASTLE-134-5.yml +../tasks/CASTLE-134-6.yml +../tasks/CASTLE-134-7.yml +../tasks/CASTLE-134-8.yml +../tasks/CASTLE-134-9.yml +../tasks/CASTLE-134-10.yml +../tasks/CASTLE-253-1.yml +../tasks/CASTLE-253-2.yml +../tasks/CASTLE-253-3.yml +../tasks/CASTLE-253-4.yml +../tasks/CASTLE-253-5.yml +../tasks/CASTLE-253-6.yml +../tasks/CASTLE-253-7.yml +../tasks/CASTLE-253-8.yml +../tasks/CASTLE-253-9.yml +../tasks/CASTLE-253-10.yml +../tasks/CASTLE-362-1.yml +../tasks/CASTLE-362-2.yml +../tasks/CASTLE-362-3.yml +../tasks/CASTLE-362-4.yml +../tasks/CASTLE-362-5.yml +../tasks/CASTLE-362-6.yml +../tasks/CASTLE-362-7.yml +../tasks/CASTLE-362-8.yml +../tasks/CASTLE-362-9.yml +../tasks/CASTLE-362-10.yml +../tasks/CASTLE-369-1.yml +../tasks/CASTLE-369-2.yml +../tasks/CASTLE-369-3.yml +../tasks/CASTLE-369-4.yml +../tasks/CASTLE-369-5.yml +../tasks/CASTLE-369-6.yml +../tasks/CASTLE-369-7.yml +../tasks/CASTLE-369-8.yml +../tasks/CASTLE-369-9.yml +../tasks/CASTLE-369-10.yml +../tasks/CASTLE-617-1.yml +../tasks/CASTLE-617-2.yml +../tasks/CASTLE-617-3.yml +../tasks/CASTLE-617-4.yml +../tasks/CASTLE-617-5.yml +../tasks/CASTLE-617-6.yml +../tasks/CASTLE-617-7.yml +../tasks/CASTLE-617-8.yml +../tasks/CASTLE-617-9.yml +../tasks/CASTLE-617-10.yml +../tasks/CASTLE-628-1.yml +../tasks/CASTLE-628-2.yml +../tasks/CASTLE-628-3.yml +../tasks/CASTLE-628-4.yml +../tasks/CASTLE-628-5.yml +../tasks/CASTLE-628-6.yml +../tasks/CASTLE-628-7.yml +../tasks/CASTLE-628-8.yml +../tasks/CASTLE-628-9.yml +../tasks/CASTLE-628-10.yml +../tasks/CASTLE-674-1.yml +../tasks/CASTLE-674-2.yml +../tasks/CASTLE-674-3.yml +../tasks/CASTLE-674-4.yml +../tasks/CASTLE-674-5.yml +../tasks/CASTLE-674-6.yml +../tasks/CASTLE-674-7.yml +../tasks/CASTLE-674-8.yml +../tasks/CASTLE-674-9.yml +../tasks/CASTLE-674-10.yml +../tasks/CASTLE-770-1.yml +../tasks/CASTLE-770-2.yml +../tasks/CASTLE-770-3.yml +../tasks/CASTLE-770-4.yml +../tasks/CASTLE-770-5.yml +../tasks/CASTLE-770-6.yml +../tasks/CASTLE-770-7.yml +../tasks/CASTLE-770-8.yml +../tasks/CASTLE-770-9.yml +../tasks/CASTLE-770-10.yml +../tasks/CASTLE-835-1.yml +../tasks/CASTLE-835-2.yml +../tasks/CASTLE-835-3.yml +../tasks/CASTLE-835-4.yml +../tasks/CASTLE-835-5.yml +../tasks/CASTLE-835-6.yml +../tasks/CASTLE-835-7.yml +../tasks/CASTLE-835-8.yml +../tasks/CASTLE-835-9.yml +../tasks/CASTLE-835-10.yml +../tasks/CASTLE-22-1.yml +../tasks/CASTLE-22-2.yml +../tasks/CASTLE-22-3.yml +../tasks/CASTLE-22-4.yml +../tasks/CASTLE-22-5.yml +../tasks/CASTLE-22-6.yml +../tasks/CASTLE-22-7.yml +../tasks/CASTLE-22-8.yml +../tasks/CASTLE-22-9.yml +../tasks/CASTLE-22-10.yml +../tasks/CASTLE-78-1.yml +../tasks/CASTLE-78-2.yml +../tasks/CASTLE-78-3.yml +../tasks/CASTLE-78-4.yml +../tasks/CASTLE-78-5.yml +../tasks/CASTLE-78-6.yml +../tasks/CASTLE-78-7.yml +../tasks/CASTLE-78-8.yml +../tasks/CASTLE-78-9.yml +../tasks/CASTLE-78-10.yml +../tasks/CASTLE-89-1.yml +../tasks/CASTLE-89-2.yml +../tasks/CASTLE-89-3.yml +../tasks/CASTLE-89-4.yml +../tasks/CASTLE-89-5.yml +../tasks/CASTLE-89-6.yml +../tasks/CASTLE-89-7.yml +../tasks/CASTLE-89-8.yml +../tasks/CASTLE-89-9.yml +../tasks/CASTLE-89-10.yml +../tasks/CASTLE-327-1.yml +../tasks/CASTLE-327-2.yml +../tasks/CASTLE-327-3.yml +../tasks/CASTLE-327-4.yml +../tasks/CASTLE-327-5.yml +../tasks/CASTLE-327-6.yml +../tasks/CASTLE-327-7.yml +../tasks/CASTLE-327-8.yml +../tasks/CASTLE-327-9.yml +../tasks/CASTLE-327-10.yml +../tasks/CASTLE-522-1.yml +../tasks/CASTLE-522-2.yml +../tasks/CASTLE-522-3.yml +../tasks/CASTLE-522-4.yml +../tasks/CASTLE-522-5.yml +../tasks/CASTLE-522-6.yml +../tasks/CASTLE-522-7.yml +../tasks/CASTLE-522-8.yml +../tasks/CASTLE-522-9.yml +../tasks/CASTLE-522-10.yml +../tasks/CASTLE-798-1.yml +../tasks/CASTLE-798-2.yml +../tasks/CASTLE-798-3.yml +../tasks/CASTLE-798-4.yml +../tasks/CASTLE-798-5.yml +../tasks/CASTLE-798-6.yml +../tasks/CASTLE-798-7.yml +../tasks/CASTLE-798-8.yml +../tasks/CASTLE-798-9.yml +../tasks/CASTLE-798-10.yml diff --git a/tests/castle/benchexec/tasks/CASTLE-125-1.yml b/tests/castle/benchexec/tasks/CASTLE-125-1.yml new file mode 100644 index 000000000..d0f2522e3 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-125-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-125-1.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-125-10.yml b/tests/castle/benchexec/tasks/CASTLE-125-10.yml new file mode 100644 index 000000000..e86112517 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-125-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-125-10.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-125-2.yml b/tests/castle/benchexec/tasks/CASTLE-125-2.yml new file mode 100644 index 000000000..e0e84ac99 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-125-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-125-2.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-125-3.yml b/tests/castle/benchexec/tasks/CASTLE-125-3.yml new file mode 100644 index 000000000..b03599a85 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-125-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-125-3.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-125-4.yml b/tests/castle/benchexec/tasks/CASTLE-125-4.yml new file mode 100644 index 000000000..96e94d201 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-125-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-125-4.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-125-5.yml b/tests/castle/benchexec/tasks/CASTLE-125-5.yml new file mode 100644 index 000000000..1c53e6308 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-125-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-125-5.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-125-6.yml b/tests/castle/benchexec/tasks/CASTLE-125-6.yml new file mode 100644 index 000000000..3d91486ac --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-125-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-125-6.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-125-7.yml b/tests/castle/benchexec/tasks/CASTLE-125-7.yml new file mode 100644 index 000000000..eebc8d953 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-125-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-125-7.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-125-8.yml b/tests/castle/benchexec/tasks/CASTLE-125-8.yml new file mode 100644 index 000000000..50fcf6844 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-125-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-125-8.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-125-9.yml b/tests/castle/benchexec/tasks/CASTLE-125-9.yml new file mode 100644 index 000000000..834746644 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-125-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-125-9.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-134-1.yml b/tests/castle/benchexec/tasks/CASTLE-134-1.yml new file mode 100644 index 000000000..74b36cddd --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-134-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-134-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-134-10.yml b/tests/castle/benchexec/tasks/CASTLE-134-10.yml new file mode 100644 index 000000000..e55812193 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-134-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-134-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-134-2.yml b/tests/castle/benchexec/tasks/CASTLE-134-2.yml new file mode 100644 index 000000000..5b4d45d15 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-134-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-134-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-134-3.yml b/tests/castle/benchexec/tasks/CASTLE-134-3.yml new file mode 100644 index 000000000..a559fe764 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-134-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-134-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-134-4.yml b/tests/castle/benchexec/tasks/CASTLE-134-4.yml new file mode 100644 index 000000000..d2b2cdf34 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-134-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-134-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-134-5.yml b/tests/castle/benchexec/tasks/CASTLE-134-5.yml new file mode 100644 index 000000000..f23e07967 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-134-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-134-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-134-6.yml b/tests/castle/benchexec/tasks/CASTLE-134-6.yml new file mode 100644 index 000000000..aff002f6d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-134-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-134-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-134-7.yml b/tests/castle/benchexec/tasks/CASTLE-134-7.yml new file mode 100644 index 000000000..8111d96da --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-134-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-134-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-134-8.yml b/tests/castle/benchexec/tasks/CASTLE-134-8.yml new file mode 100644 index 000000000..b9575e882 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-134-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-134-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-134-9.yml b/tests/castle/benchexec/tasks/CASTLE-134-9.yml new file mode 100644 index 000000000..0ca0c077e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-134-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-134-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-190-1.yml b/tests/castle/benchexec/tasks/CASTLE-190-1.yml new file mode 100644 index 000000000..96296c20a --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-190-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-190-1.c' + +properties: + - property_file: ../properties/no-overflow.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-190-10.yml b/tests/castle/benchexec/tasks/CASTLE-190-10.yml new file mode 100644 index 000000000..def751944 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-190-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-190-10.c' + +properties: + - property_file: ../properties/no-overflow.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-190-2.yml b/tests/castle/benchexec/tasks/CASTLE-190-2.yml new file mode 100644 index 000000000..70cd842da --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-190-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-190-2.c' + +properties: + - property_file: ../properties/no-overflow.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-190-3.yml b/tests/castle/benchexec/tasks/CASTLE-190-3.yml new file mode 100644 index 000000000..868ef5a9b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-190-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-190-3.c' + +properties: + - property_file: ../properties/no-overflow.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-190-4.yml b/tests/castle/benchexec/tasks/CASTLE-190-4.yml new file mode 100644 index 000000000..c607786d5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-190-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-190-4.c' + +properties: + - property_file: ../properties/no-overflow.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-190-5.yml b/tests/castle/benchexec/tasks/CASTLE-190-5.yml new file mode 100644 index 000000000..293ead85a --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-190-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-190-5.c' + +properties: + - property_file: ../properties/no-overflow.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-190-6.yml b/tests/castle/benchexec/tasks/CASTLE-190-6.yml new file mode 100644 index 000000000..a3de4b735 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-190-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-190-6.c' + +properties: + - property_file: ../properties/no-overflow.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-190-7.yml b/tests/castle/benchexec/tasks/CASTLE-190-7.yml new file mode 100644 index 000000000..0b7a86ec0 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-190-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-190-7.c' + +properties: + - property_file: ../properties/no-overflow.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-190-8.yml b/tests/castle/benchexec/tasks/CASTLE-190-8.yml new file mode 100644 index 000000000..49fe2eeb2 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-190-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-190-8.c' + +properties: + - property_file: ../properties/no-overflow.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-190-9.yml b/tests/castle/benchexec/tasks/CASTLE-190-9.yml new file mode 100644 index 000000000..20a7a7fe8 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-190-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-190-9.c' + +properties: + - property_file: ../properties/no-overflow.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-22-1.yml b/tests/castle/benchexec/tasks/CASTLE-22-1.yml new file mode 100644 index 000000000..e224a915e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-22-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-22-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-22-10.yml b/tests/castle/benchexec/tasks/CASTLE-22-10.yml new file mode 100644 index 000000000..7f143ee3d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-22-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-22-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-22-2.yml b/tests/castle/benchexec/tasks/CASTLE-22-2.yml new file mode 100644 index 000000000..628e77dae --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-22-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-22-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-22-3.yml b/tests/castle/benchexec/tasks/CASTLE-22-3.yml new file mode 100644 index 000000000..2c6177e34 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-22-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-22-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-22-4.yml b/tests/castle/benchexec/tasks/CASTLE-22-4.yml new file mode 100644 index 000000000..346d89e21 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-22-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-22-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-22-5.yml b/tests/castle/benchexec/tasks/CASTLE-22-5.yml new file mode 100644 index 000000000..7ce5c89b5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-22-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-22-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-22-6.yml b/tests/castle/benchexec/tasks/CASTLE-22-6.yml new file mode 100644 index 000000000..697f351fa --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-22-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-22-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-22-7.yml b/tests/castle/benchexec/tasks/CASTLE-22-7.yml new file mode 100644 index 000000000..900f4a642 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-22-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-22-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-22-8.yml b/tests/castle/benchexec/tasks/CASTLE-22-8.yml new file mode 100644 index 000000000..25ea047af --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-22-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-22-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-22-9.yml b/tests/castle/benchexec/tasks/CASTLE-22-9.yml new file mode 100644 index 000000000..5258ab26e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-22-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-22-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-253-1.yml b/tests/castle/benchexec/tasks/CASTLE-253-1.yml new file mode 100644 index 000000000..fe42b627e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-253-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-253-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-253-10.yml b/tests/castle/benchexec/tasks/CASTLE-253-10.yml new file mode 100644 index 000000000..fccf13882 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-253-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-253-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-253-2.yml b/tests/castle/benchexec/tasks/CASTLE-253-2.yml new file mode 100644 index 000000000..090b93ac8 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-253-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-253-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-253-3.yml b/tests/castle/benchexec/tasks/CASTLE-253-3.yml new file mode 100644 index 000000000..10e8be43b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-253-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-253-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-253-4.yml b/tests/castle/benchexec/tasks/CASTLE-253-4.yml new file mode 100644 index 000000000..6f728c1f3 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-253-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-253-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-253-5.yml b/tests/castle/benchexec/tasks/CASTLE-253-5.yml new file mode 100644 index 000000000..a14433deb --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-253-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-253-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-253-6.yml b/tests/castle/benchexec/tasks/CASTLE-253-6.yml new file mode 100644 index 000000000..92818bfda --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-253-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-253-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-253-7.yml b/tests/castle/benchexec/tasks/CASTLE-253-7.yml new file mode 100644 index 000000000..7cdf6929a --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-253-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-253-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-253-8.yml b/tests/castle/benchexec/tasks/CASTLE-253-8.yml new file mode 100644 index 000000000..976da4c75 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-253-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-253-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-253-9.yml b/tests/castle/benchexec/tasks/CASTLE-253-9.yml new file mode 100644 index 000000000..07c25b818 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-253-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-253-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-327-1.yml b/tests/castle/benchexec/tasks/CASTLE-327-1.yml new file mode 100644 index 000000000..f84403cf2 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-327-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-327-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-327-10.yml b/tests/castle/benchexec/tasks/CASTLE-327-10.yml new file mode 100644 index 000000000..8147fbbec --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-327-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-327-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-327-2.yml b/tests/castle/benchexec/tasks/CASTLE-327-2.yml new file mode 100644 index 000000000..79d731914 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-327-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-327-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-327-3.yml b/tests/castle/benchexec/tasks/CASTLE-327-3.yml new file mode 100644 index 000000000..14f846c1d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-327-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-327-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-327-4.yml b/tests/castle/benchexec/tasks/CASTLE-327-4.yml new file mode 100644 index 000000000..76b9f419d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-327-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-327-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-327-5.yml b/tests/castle/benchexec/tasks/CASTLE-327-5.yml new file mode 100644 index 000000000..d9c285a12 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-327-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-327-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-327-6.yml b/tests/castle/benchexec/tasks/CASTLE-327-6.yml new file mode 100644 index 000000000..3e5b1b167 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-327-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-327-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-327-7.yml b/tests/castle/benchexec/tasks/CASTLE-327-7.yml new file mode 100644 index 000000000..a8016237c --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-327-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-327-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-327-8.yml b/tests/castle/benchexec/tasks/CASTLE-327-8.yml new file mode 100644 index 000000000..8f3726640 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-327-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-327-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-327-9.yml b/tests/castle/benchexec/tasks/CASTLE-327-9.yml new file mode 100644 index 000000000..10ca77d40 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-327-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-327-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-362-1.yml b/tests/castle/benchexec/tasks/CASTLE-362-1.yml new file mode 100644 index 000000000..64af2e91c --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-362-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-362-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-362-10.yml b/tests/castle/benchexec/tasks/CASTLE-362-10.yml new file mode 100644 index 000000000..10565ce25 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-362-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-362-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-362-2.yml b/tests/castle/benchexec/tasks/CASTLE-362-2.yml new file mode 100644 index 000000000..e2078bc88 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-362-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-362-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-362-3.yml b/tests/castle/benchexec/tasks/CASTLE-362-3.yml new file mode 100644 index 000000000..b20f70525 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-362-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-362-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-362-4.yml b/tests/castle/benchexec/tasks/CASTLE-362-4.yml new file mode 100644 index 000000000..1e1dfbde2 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-362-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-362-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-362-5.yml b/tests/castle/benchexec/tasks/CASTLE-362-5.yml new file mode 100644 index 000000000..2a963aecd --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-362-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-362-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-362-6.yml b/tests/castle/benchexec/tasks/CASTLE-362-6.yml new file mode 100644 index 000000000..f39f221e4 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-362-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-362-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-362-7.yml b/tests/castle/benchexec/tasks/CASTLE-362-7.yml new file mode 100644 index 000000000..95928177c --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-362-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-362-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-362-8.yml b/tests/castle/benchexec/tasks/CASTLE-362-8.yml new file mode 100644 index 000000000..658b75a15 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-362-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-362-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-362-9.yml b/tests/castle/benchexec/tasks/CASTLE-362-9.yml new file mode 100644 index 000000000..ce0032d18 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-362-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-362-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-369-1.yml b/tests/castle/benchexec/tasks/CASTLE-369-1.yml new file mode 100644 index 000000000..f7b4a77d6 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-369-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-369-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-369-10.yml b/tests/castle/benchexec/tasks/CASTLE-369-10.yml new file mode 100644 index 000000000..e16c1827c --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-369-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-369-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-369-2.yml b/tests/castle/benchexec/tasks/CASTLE-369-2.yml new file mode 100644 index 000000000..5698e90e1 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-369-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-369-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-369-3.yml b/tests/castle/benchexec/tasks/CASTLE-369-3.yml new file mode 100644 index 000000000..e2b8a0cd4 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-369-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-369-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-369-4.yml b/tests/castle/benchexec/tasks/CASTLE-369-4.yml new file mode 100644 index 000000000..68b742153 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-369-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-369-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-369-5.yml b/tests/castle/benchexec/tasks/CASTLE-369-5.yml new file mode 100644 index 000000000..4298d8f2c --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-369-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-369-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-369-6.yml b/tests/castle/benchexec/tasks/CASTLE-369-6.yml new file mode 100644 index 000000000..129bd7822 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-369-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-369-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-369-7.yml b/tests/castle/benchexec/tasks/CASTLE-369-7.yml new file mode 100644 index 000000000..460ff4636 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-369-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-369-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-369-8.yml b/tests/castle/benchexec/tasks/CASTLE-369-8.yml new file mode 100644 index 000000000..20b8cc301 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-369-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-369-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-369-9.yml b/tests/castle/benchexec/tasks/CASTLE-369-9.yml new file mode 100644 index 000000000..7e59e5087 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-369-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-369-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-401-1.yml b/tests/castle/benchexec/tasks/CASTLE-401-1.yml new file mode 100644 index 000000000..7effbbaa9 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-401-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-401-1.c' + +properties: + - property_file: ../properties/valid-memcleanup.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-401-10.yml b/tests/castle/benchexec/tasks/CASTLE-401-10.yml new file mode 100644 index 000000000..a89655b03 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-401-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-401-10.c' + +properties: + - property_file: ../properties/valid-memcleanup.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-401-2.yml b/tests/castle/benchexec/tasks/CASTLE-401-2.yml new file mode 100644 index 000000000..49d852aa8 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-401-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-401-2.c' + +properties: + - property_file: ../properties/valid-memcleanup.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-401-3.yml b/tests/castle/benchexec/tasks/CASTLE-401-3.yml new file mode 100644 index 000000000..d1cf54ebf --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-401-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-401-3.c' + +properties: + - property_file: ../properties/valid-memcleanup.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-401-4.yml b/tests/castle/benchexec/tasks/CASTLE-401-4.yml new file mode 100644 index 000000000..011ce4d84 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-401-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-401-4.c' + +properties: + - property_file: ../properties/valid-memcleanup.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-401-5.yml b/tests/castle/benchexec/tasks/CASTLE-401-5.yml new file mode 100644 index 000000000..13f6080a5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-401-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-401-5.c' + +properties: + - property_file: ../properties/valid-memcleanup.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-401-6.yml b/tests/castle/benchexec/tasks/CASTLE-401-6.yml new file mode 100644 index 000000000..ef265d663 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-401-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-401-6.c' + +properties: + - property_file: ../properties/valid-memcleanup.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-401-7.yml b/tests/castle/benchexec/tasks/CASTLE-401-7.yml new file mode 100644 index 000000000..535c2b5ab --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-401-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-401-7.c' + +properties: + - property_file: ../properties/valid-memcleanup.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-401-8.yml b/tests/castle/benchexec/tasks/CASTLE-401-8.yml new file mode 100644 index 000000000..fa06f285d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-401-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-401-8.c' + +properties: + - property_file: ../properties/valid-memcleanup.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-401-9.yml b/tests/castle/benchexec/tasks/CASTLE-401-9.yml new file mode 100644 index 000000000..67ce01e22 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-401-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-401-9.c' + +properties: + - property_file: ../properties/valid-memcleanup.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-415-1.yml b/tests/castle/benchexec/tasks/CASTLE-415-1.yml new file mode 100644 index 000000000..add2267fb --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-415-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-415-1.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-415-10.yml b/tests/castle/benchexec/tasks/CASTLE-415-10.yml new file mode 100644 index 000000000..4f685705f --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-415-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-415-10.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-415-2.yml b/tests/castle/benchexec/tasks/CASTLE-415-2.yml new file mode 100644 index 000000000..73d257a3b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-415-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-415-2.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-415-3.yml b/tests/castle/benchexec/tasks/CASTLE-415-3.yml new file mode 100644 index 000000000..ba4be573e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-415-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-415-3.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-415-4.yml b/tests/castle/benchexec/tasks/CASTLE-415-4.yml new file mode 100644 index 000000000..9177f0f1f --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-415-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-415-4.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-415-5.yml b/tests/castle/benchexec/tasks/CASTLE-415-5.yml new file mode 100644 index 000000000..dc4991315 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-415-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-415-5.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-415-6.yml b/tests/castle/benchexec/tasks/CASTLE-415-6.yml new file mode 100644 index 000000000..4a7fedd6b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-415-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-415-6.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-415-7.yml b/tests/castle/benchexec/tasks/CASTLE-415-7.yml new file mode 100644 index 000000000..5a25d4985 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-415-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-415-7.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-415-8.yml b/tests/castle/benchexec/tasks/CASTLE-415-8.yml new file mode 100644 index 000000000..50aeebb48 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-415-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-415-8.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-415-9.yml b/tests/castle/benchexec/tasks/CASTLE-415-9.yml new file mode 100644 index 000000000..8566cc7b3 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-415-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-415-9.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-416-1.yml b/tests/castle/benchexec/tasks/CASTLE-416-1.yml new file mode 100644 index 000000000..3e1cbe1b6 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-416-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-416-1.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-416-10.yml b/tests/castle/benchexec/tasks/CASTLE-416-10.yml new file mode 100644 index 000000000..fe31f31f5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-416-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-416-10.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-416-2.yml b/tests/castle/benchexec/tasks/CASTLE-416-2.yml new file mode 100644 index 000000000..aa770b2a0 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-416-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-416-2.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-416-3.yml b/tests/castle/benchexec/tasks/CASTLE-416-3.yml new file mode 100644 index 000000000..3c764e6f0 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-416-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-416-3.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-416-4.yml b/tests/castle/benchexec/tasks/CASTLE-416-4.yml new file mode 100644 index 000000000..0f0b6c984 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-416-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-416-4.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-416-5.yml b/tests/castle/benchexec/tasks/CASTLE-416-5.yml new file mode 100644 index 000000000..d0bba96a6 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-416-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-416-5.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-416-6.yml b/tests/castle/benchexec/tasks/CASTLE-416-6.yml new file mode 100644 index 000000000..878e780aa --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-416-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-416-6.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-416-7.yml b/tests/castle/benchexec/tasks/CASTLE-416-7.yml new file mode 100644 index 000000000..81733931d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-416-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-416-7.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-416-8.yml b/tests/castle/benchexec/tasks/CASTLE-416-8.yml new file mode 100644 index 000000000..0de683abf --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-416-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-416-8.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-416-9.yml b/tests/castle/benchexec/tasks/CASTLE-416-9.yml new file mode 100644 index 000000000..fc6e71c18 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-416-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-416-9.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-476-1.yml b/tests/castle/benchexec/tasks/CASTLE-476-1.yml new file mode 100644 index 000000000..5981c0f04 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-476-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-1.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-476-10.yml b/tests/castle/benchexec/tasks/CASTLE-476-10.yml new file mode 100644 index 000000000..09bbce668 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-476-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-10.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-476-2.yml b/tests/castle/benchexec/tasks/CASTLE-476-2.yml new file mode 100644 index 000000000..e7703d0d1 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-476-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-2.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-476-3.yml b/tests/castle/benchexec/tasks/CASTLE-476-3.yml new file mode 100644 index 000000000..b98c094d5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-476-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-3.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-476-4.yml b/tests/castle/benchexec/tasks/CASTLE-476-4.yml new file mode 100644 index 000000000..f7f8d8744 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-476-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-4.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-476-5.yml b/tests/castle/benchexec/tasks/CASTLE-476-5.yml new file mode 100644 index 000000000..5236f5a70 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-476-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-5.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-476-6.yml b/tests/castle/benchexec/tasks/CASTLE-476-6.yml new file mode 100644 index 000000000..50cb213b8 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-476-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-6.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-476-7.yml b/tests/castle/benchexec/tasks/CASTLE-476-7.yml new file mode 100644 index 000000000..f6c2b9ec9 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-476-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-7.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-476-8.yml b/tests/castle/benchexec/tasks/CASTLE-476-8.yml new file mode 100644 index 000000000..95b747ace --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-476-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-8.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-476-9.yml b/tests/castle/benchexec/tasks/CASTLE-476-9.yml new file mode 100644 index 000000000..3a807aa19 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-476-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-9.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-522-1.yml b/tests/castle/benchexec/tasks/CASTLE-522-1.yml new file mode 100644 index 000000000..d2a48e3b5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-522-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-522-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-522-10.yml b/tests/castle/benchexec/tasks/CASTLE-522-10.yml new file mode 100644 index 000000000..fecaa76db --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-522-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-522-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-522-2.yml b/tests/castle/benchexec/tasks/CASTLE-522-2.yml new file mode 100644 index 000000000..ee30c5890 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-522-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-522-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-522-3.yml b/tests/castle/benchexec/tasks/CASTLE-522-3.yml new file mode 100644 index 000000000..867f77edf --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-522-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-522-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-522-4.yml b/tests/castle/benchexec/tasks/CASTLE-522-4.yml new file mode 100644 index 000000000..580199139 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-522-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-522-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-522-5.yml b/tests/castle/benchexec/tasks/CASTLE-522-5.yml new file mode 100644 index 000000000..d9681c782 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-522-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-522-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-522-6.yml b/tests/castle/benchexec/tasks/CASTLE-522-6.yml new file mode 100644 index 000000000..c690769a5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-522-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-522-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-522-7.yml b/tests/castle/benchexec/tasks/CASTLE-522-7.yml new file mode 100644 index 000000000..ff1a0782b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-522-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-522-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-522-8.yml b/tests/castle/benchexec/tasks/CASTLE-522-8.yml new file mode 100644 index 000000000..d5e08d717 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-522-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-522-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-522-9.yml b/tests/castle/benchexec/tasks/CASTLE-522-9.yml new file mode 100644 index 000000000..7428db824 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-522-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-522-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-617-1.yml b/tests/castle/benchexec/tasks/CASTLE-617-1.yml new file mode 100644 index 000000000..9d8102c4d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-617-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-617-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-617-10.yml b/tests/castle/benchexec/tasks/CASTLE-617-10.yml new file mode 100644 index 000000000..1393ad4f6 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-617-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-617-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-617-2.yml b/tests/castle/benchexec/tasks/CASTLE-617-2.yml new file mode 100644 index 000000000..19ba973ab --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-617-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-617-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-617-3.yml b/tests/castle/benchexec/tasks/CASTLE-617-3.yml new file mode 100644 index 000000000..58cd59ef7 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-617-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-617-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-617-4.yml b/tests/castle/benchexec/tasks/CASTLE-617-4.yml new file mode 100644 index 000000000..32bf344fc --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-617-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-617-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-617-5.yml b/tests/castle/benchexec/tasks/CASTLE-617-5.yml new file mode 100644 index 000000000..dbdd0d15e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-617-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-617-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-617-6.yml b/tests/castle/benchexec/tasks/CASTLE-617-6.yml new file mode 100644 index 000000000..2d98bb44b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-617-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-617-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-617-7.yml b/tests/castle/benchexec/tasks/CASTLE-617-7.yml new file mode 100644 index 000000000..b4712fea1 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-617-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-617-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-617-8.yml b/tests/castle/benchexec/tasks/CASTLE-617-8.yml new file mode 100644 index 000000000..e7518087d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-617-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-617-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-617-9.yml b/tests/castle/benchexec/tasks/CASTLE-617-9.yml new file mode 100644 index 000000000..7059b8785 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-617-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-617-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-628-1.yml b/tests/castle/benchexec/tasks/CASTLE-628-1.yml new file mode 100644 index 000000000..221235f77 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-628-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-628-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-628-10.yml b/tests/castle/benchexec/tasks/CASTLE-628-10.yml new file mode 100644 index 000000000..87b23f3e8 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-628-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-628-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-628-2.yml b/tests/castle/benchexec/tasks/CASTLE-628-2.yml new file mode 100644 index 000000000..21ff80ef5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-628-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-628-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-628-3.yml b/tests/castle/benchexec/tasks/CASTLE-628-3.yml new file mode 100644 index 000000000..6920540c7 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-628-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-628-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-628-4.yml b/tests/castle/benchexec/tasks/CASTLE-628-4.yml new file mode 100644 index 000000000..2254cd8e4 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-628-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-628-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-628-5.yml b/tests/castle/benchexec/tasks/CASTLE-628-5.yml new file mode 100644 index 000000000..ecadc408e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-628-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-628-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-628-6.yml b/tests/castle/benchexec/tasks/CASTLE-628-6.yml new file mode 100644 index 000000000..376a1ae9e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-628-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-628-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-628-7.yml b/tests/castle/benchexec/tasks/CASTLE-628-7.yml new file mode 100644 index 000000000..6aa514d66 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-628-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-628-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-628-8.yml b/tests/castle/benchexec/tasks/CASTLE-628-8.yml new file mode 100644 index 000000000..0911bcbd2 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-628-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-628-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-628-9.yml b/tests/castle/benchexec/tasks/CASTLE-628-9.yml new file mode 100644 index 000000000..7e7e8a147 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-628-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-628-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-674-1.yml b/tests/castle/benchexec/tasks/CASTLE-674-1.yml new file mode 100644 index 000000000..7d94cf227 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-674-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-674-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-674-10.yml b/tests/castle/benchexec/tasks/CASTLE-674-10.yml new file mode 100644 index 000000000..82ba1fad7 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-674-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-674-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-674-2.yml b/tests/castle/benchexec/tasks/CASTLE-674-2.yml new file mode 100644 index 000000000..0eb330955 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-674-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-674-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-674-3.yml b/tests/castle/benchexec/tasks/CASTLE-674-3.yml new file mode 100644 index 000000000..47ae35f98 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-674-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-674-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-674-4.yml b/tests/castle/benchexec/tasks/CASTLE-674-4.yml new file mode 100644 index 000000000..884760243 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-674-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-674-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-674-5.yml b/tests/castle/benchexec/tasks/CASTLE-674-5.yml new file mode 100644 index 000000000..851a371d8 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-674-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-674-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-674-6.yml b/tests/castle/benchexec/tasks/CASTLE-674-6.yml new file mode 100644 index 000000000..ddb114086 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-674-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-674-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-674-7.yml b/tests/castle/benchexec/tasks/CASTLE-674-7.yml new file mode 100644 index 000000000..f8173313c --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-674-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-674-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-674-8.yml b/tests/castle/benchexec/tasks/CASTLE-674-8.yml new file mode 100644 index 000000000..516b13bf9 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-674-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-674-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-674-9.yml b/tests/castle/benchexec/tasks/CASTLE-674-9.yml new file mode 100644 index 000000000..b3424b3d9 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-674-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-674-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-761-1.yml b/tests/castle/benchexec/tasks/CASTLE-761-1.yml new file mode 100644 index 000000000..98ea94cf9 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-761-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-761-1.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-761-10.yml b/tests/castle/benchexec/tasks/CASTLE-761-10.yml new file mode 100644 index 000000000..fc1f5754a --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-761-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-761-10.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-761-2.yml b/tests/castle/benchexec/tasks/CASTLE-761-2.yml new file mode 100644 index 000000000..5b27b25fc --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-761-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-761-2.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-761-3.yml b/tests/castle/benchexec/tasks/CASTLE-761-3.yml new file mode 100644 index 000000000..21a0cd87a --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-761-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-761-3.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-761-4.yml b/tests/castle/benchexec/tasks/CASTLE-761-4.yml new file mode 100644 index 000000000..b29289309 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-761-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-761-4.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-761-5.yml b/tests/castle/benchexec/tasks/CASTLE-761-5.yml new file mode 100644 index 000000000..cbc41115a --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-761-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-761-5.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-761-6.yml b/tests/castle/benchexec/tasks/CASTLE-761-6.yml new file mode 100644 index 000000000..ea694d049 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-761-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-761-6.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-761-7.yml b/tests/castle/benchexec/tasks/CASTLE-761-7.yml new file mode 100644 index 000000000..dcec468ec --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-761-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-761-7.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-761-8.yml b/tests/castle/benchexec/tasks/CASTLE-761-8.yml new file mode 100644 index 000000000..0ae8f1e4d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-761-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-761-8.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-761-9.yml b/tests/castle/benchexec/tasks/CASTLE-761-9.yml new file mode 100644 index 000000000..facc290fa --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-761-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-761-9.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-770-1.yml b/tests/castle/benchexec/tasks/CASTLE-770-1.yml new file mode 100644 index 000000000..577804e8a --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-770-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-770-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-770-10.yml b/tests/castle/benchexec/tasks/CASTLE-770-10.yml new file mode 100644 index 000000000..a1be6c831 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-770-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-770-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-770-2.yml b/tests/castle/benchexec/tasks/CASTLE-770-2.yml new file mode 100644 index 000000000..a14ec7de0 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-770-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-770-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-770-3.yml b/tests/castle/benchexec/tasks/CASTLE-770-3.yml new file mode 100644 index 000000000..9ad86f11f --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-770-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-770-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-770-4.yml b/tests/castle/benchexec/tasks/CASTLE-770-4.yml new file mode 100644 index 000000000..1ffaf78ee --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-770-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-770-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-770-5.yml b/tests/castle/benchexec/tasks/CASTLE-770-5.yml new file mode 100644 index 000000000..7eac49143 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-770-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-770-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-770-6.yml b/tests/castle/benchexec/tasks/CASTLE-770-6.yml new file mode 100644 index 000000000..de7b36f69 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-770-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-770-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-770-7.yml b/tests/castle/benchexec/tasks/CASTLE-770-7.yml new file mode 100644 index 000000000..acb678dce --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-770-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-770-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-770-8.yml b/tests/castle/benchexec/tasks/CASTLE-770-8.yml new file mode 100644 index 000000000..c8b37904f --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-770-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-770-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-770-9.yml b/tests/castle/benchexec/tasks/CASTLE-770-9.yml new file mode 100644 index 000000000..1979268e5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-770-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-770-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-78-1.yml b/tests/castle/benchexec/tasks/CASTLE-78-1.yml new file mode 100644 index 000000000..0a32b575d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-78-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-78-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-78-10.yml b/tests/castle/benchexec/tasks/CASTLE-78-10.yml new file mode 100644 index 000000000..94f258181 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-78-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-78-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-78-2.yml b/tests/castle/benchexec/tasks/CASTLE-78-2.yml new file mode 100644 index 000000000..9bb259863 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-78-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-78-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-78-3.yml b/tests/castle/benchexec/tasks/CASTLE-78-3.yml new file mode 100644 index 000000000..a14422e94 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-78-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-78-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-78-4.yml b/tests/castle/benchexec/tasks/CASTLE-78-4.yml new file mode 100644 index 000000000..e5c895537 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-78-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-78-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-78-5.yml b/tests/castle/benchexec/tasks/CASTLE-78-5.yml new file mode 100644 index 000000000..4a074ecfa --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-78-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-78-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-78-6.yml b/tests/castle/benchexec/tasks/CASTLE-78-6.yml new file mode 100644 index 000000000..5e7f02900 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-78-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-78-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-78-7.yml b/tests/castle/benchexec/tasks/CASTLE-78-7.yml new file mode 100644 index 000000000..9670d7f66 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-78-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-78-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-78-8.yml b/tests/castle/benchexec/tasks/CASTLE-78-8.yml new file mode 100644 index 000000000..628625d21 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-78-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-78-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-78-9.yml b/tests/castle/benchexec/tasks/CASTLE-78-9.yml new file mode 100644 index 000000000..f0b386dc7 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-78-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-78-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-787-1.yml b/tests/castle/benchexec/tasks/CASTLE-787-1.yml new file mode 100644 index 000000000..11095bc12 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-787-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-787-1.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-787-10.yml b/tests/castle/benchexec/tasks/CASTLE-787-10.yml new file mode 100644 index 000000000..d88cd3c81 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-787-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-787-10.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-787-2.yml b/tests/castle/benchexec/tasks/CASTLE-787-2.yml new file mode 100644 index 000000000..e978deebf --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-787-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-787-2.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-787-3.yml b/tests/castle/benchexec/tasks/CASTLE-787-3.yml new file mode 100644 index 000000000..026f34bfb --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-787-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-787-3.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-787-4.yml b/tests/castle/benchexec/tasks/CASTLE-787-4.yml new file mode 100644 index 000000000..a641ed0a1 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-787-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-787-4.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-787-5.yml b/tests/castle/benchexec/tasks/CASTLE-787-5.yml new file mode 100644 index 000000000..fb93e31ef --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-787-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-787-5.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-787-6.yml b/tests/castle/benchexec/tasks/CASTLE-787-6.yml new file mode 100644 index 000000000..a2eaf794b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-787-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-787-6.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-787-7.yml b/tests/castle/benchexec/tasks/CASTLE-787-7.yml new file mode 100644 index 000000000..f0b98224b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-787-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-787-7.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-787-8.yml b/tests/castle/benchexec/tasks/CASTLE-787-8.yml new file mode 100644 index 000000000..c3251c174 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-787-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-787-8.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-787-9.yml b/tests/castle/benchexec/tasks/CASTLE-787-9.yml new file mode 100644 index 000000000..3c0b97457 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-787-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-787-9.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-798-1.yml b/tests/castle/benchexec/tasks/CASTLE-798-1.yml new file mode 100644 index 000000000..04c8619ea --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-798-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-798-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-798-10.yml b/tests/castle/benchexec/tasks/CASTLE-798-10.yml new file mode 100644 index 000000000..3d9d24f3c --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-798-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-798-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-798-2.yml b/tests/castle/benchexec/tasks/CASTLE-798-2.yml new file mode 100644 index 000000000..22aed01f3 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-798-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-798-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-798-3.yml b/tests/castle/benchexec/tasks/CASTLE-798-3.yml new file mode 100644 index 000000000..4fa2c3ddc --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-798-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-798-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-798-4.yml b/tests/castle/benchexec/tasks/CASTLE-798-4.yml new file mode 100644 index 000000000..0818da41f --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-798-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-798-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-798-5.yml b/tests/castle/benchexec/tasks/CASTLE-798-5.yml new file mode 100644 index 000000000..9dd1e8188 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-798-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-798-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-798-6.yml b/tests/castle/benchexec/tasks/CASTLE-798-6.yml new file mode 100644 index 000000000..9c6ff0310 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-798-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-798-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-798-7.yml b/tests/castle/benchexec/tasks/CASTLE-798-7.yml new file mode 100644 index 000000000..c1b683629 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-798-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-798-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-798-8.yml b/tests/castle/benchexec/tasks/CASTLE-798-8.yml new file mode 100644 index 000000000..cae6e6f99 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-798-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-798-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-798-9.yml b/tests/castle/benchexec/tasks/CASTLE-798-9.yml new file mode 100644 index 000000000..2bc6042b3 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-798-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-798-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-822-1.yml b/tests/castle/benchexec/tasks/CASTLE-822-1.yml new file mode 100644 index 000000000..b53c965cf --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-822-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-1.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-822-10.yml b/tests/castle/benchexec/tasks/CASTLE-822-10.yml new file mode 100644 index 000000000..152d01199 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-822-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-10.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-822-2.yml b/tests/castle/benchexec/tasks/CASTLE-822-2.yml new file mode 100644 index 000000000..84913217b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-822-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-2.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-822-3.yml b/tests/castle/benchexec/tasks/CASTLE-822-3.yml new file mode 100644 index 000000000..ab6ae6053 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-822-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-3.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-822-4.yml b/tests/castle/benchexec/tasks/CASTLE-822-4.yml new file mode 100644 index 000000000..d458cafe5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-822-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-4.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-822-5.yml b/tests/castle/benchexec/tasks/CASTLE-822-5.yml new file mode 100644 index 000000000..616250b6e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-822-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-5.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-822-6.yml b/tests/castle/benchexec/tasks/CASTLE-822-6.yml new file mode 100644 index 000000000..e746b5e54 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-822-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-6.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-822-7.yml b/tests/castle/benchexec/tasks/CASTLE-822-7.yml new file mode 100644 index 000000000..385fd184b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-822-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-7.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-822-8.yml b/tests/castle/benchexec/tasks/CASTLE-822-8.yml new file mode 100644 index 000000000..28eb6056e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-822-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-8.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-822-9.yml b/tests/castle/benchexec/tasks/CASTLE-822-9.yml new file mode 100644 index 000000000..1ec7eb78a --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-822-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-9.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-835-1.yml b/tests/castle/benchexec/tasks/CASTLE-835-1.yml new file mode 100644 index 000000000..efc952568 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-835-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-835-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-835-10.yml b/tests/castle/benchexec/tasks/CASTLE-835-10.yml new file mode 100644 index 000000000..24f2ea851 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-835-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-835-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-835-2.yml b/tests/castle/benchexec/tasks/CASTLE-835-2.yml new file mode 100644 index 000000000..e8d8b6103 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-835-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-835-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-835-3.yml b/tests/castle/benchexec/tasks/CASTLE-835-3.yml new file mode 100644 index 000000000..2c1384348 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-835-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-835-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-835-4.yml b/tests/castle/benchexec/tasks/CASTLE-835-4.yml new file mode 100644 index 000000000..f38eca310 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-835-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-835-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-835-5.yml b/tests/castle/benchexec/tasks/CASTLE-835-5.yml new file mode 100644 index 000000000..fceb02987 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-835-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-835-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-835-6.yml b/tests/castle/benchexec/tasks/CASTLE-835-6.yml new file mode 100644 index 000000000..48fb4be4d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-835-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-835-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-835-7.yml b/tests/castle/benchexec/tasks/CASTLE-835-7.yml new file mode 100644 index 000000000..c0f854c4f --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-835-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-835-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-835-8.yml b/tests/castle/benchexec/tasks/CASTLE-835-8.yml new file mode 100644 index 000000000..b9d625339 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-835-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-835-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-835-9.yml b/tests/castle/benchexec/tasks/CASTLE-835-9.yml new file mode 100644 index 000000000..720f53c4f --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-835-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-835-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-843-1.yml b/tests/castle/benchexec/tasks/CASTLE-843-1.yml new file mode 100644 index 000000000..d2f00662f --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-843-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-843-1.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-843-10.yml b/tests/castle/benchexec/tasks/CASTLE-843-10.yml new file mode 100644 index 000000000..f9d7c2058 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-843-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-843-10.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-843-2.yml b/tests/castle/benchexec/tasks/CASTLE-843-2.yml new file mode 100644 index 000000000..83fead22c --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-843-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-843-2.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-843-3.yml b/tests/castle/benchexec/tasks/CASTLE-843-3.yml new file mode 100644 index 000000000..3751f035b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-843-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-843-3.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-843-4.yml b/tests/castle/benchexec/tasks/CASTLE-843-4.yml new file mode 100644 index 000000000..a50f56bc1 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-843-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-843-4.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-843-5.yml b/tests/castle/benchexec/tasks/CASTLE-843-5.yml new file mode 100644 index 000000000..cc7ddcb40 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-843-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-843-5.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-843-6.yml b/tests/castle/benchexec/tasks/CASTLE-843-6.yml new file mode 100644 index 000000000..a5f55c930 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-843-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-843-6.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-843-7.yml b/tests/castle/benchexec/tasks/CASTLE-843-7.yml new file mode 100644 index 000000000..69d639e52 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-843-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-843-7.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-843-8.yml b/tests/castle/benchexec/tasks/CASTLE-843-8.yml new file mode 100644 index 000000000..4484acecf --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-843-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-843-8.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-843-9.yml b/tests/castle/benchexec/tasks/CASTLE-843-9.yml new file mode 100644 index 000000000..36d3b960f --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-843-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-843-9.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-89-1.yml b/tests/castle/benchexec/tasks/CASTLE-89-1.yml new file mode 100644 index 000000000..3e2de17cd --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-89-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-89-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-89-10.yml b/tests/castle/benchexec/tasks/CASTLE-89-10.yml new file mode 100644 index 000000000..cc912bb1e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-89-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-89-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-89-2.yml b/tests/castle/benchexec/tasks/CASTLE-89-2.yml new file mode 100644 index 000000000..46f7b2817 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-89-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-89-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-89-3.yml b/tests/castle/benchexec/tasks/CASTLE-89-3.yml new file mode 100644 index 000000000..db6e846a5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-89-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-89-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-89-4.yml b/tests/castle/benchexec/tasks/CASTLE-89-4.yml new file mode 100644 index 000000000..92cf6abf2 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-89-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-89-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-89-5.yml b/tests/castle/benchexec/tasks/CASTLE-89-5.yml new file mode 100644 index 000000000..4272beac4 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-89-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-89-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-89-6.yml b/tests/castle/benchexec/tasks/CASTLE-89-6.yml new file mode 100644 index 000000000..774d89c76 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-89-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-89-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-89-7.yml b/tests/castle/benchexec/tasks/CASTLE-89-7.yml new file mode 100644 index 000000000..7799f249d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-89-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-89-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-89-8.yml b/tests/castle/benchexec/tasks/CASTLE-89-8.yml new file mode 100644 index 000000000..efab56787 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-89-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-89-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-89-9.yml b/tests/castle/benchexec/tasks/CASTLE-89-9.yml new file mode 100644 index 000000000..c824d872e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-89-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-89-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/run_castle_benchexec.sh b/tests/castle/run_castle_benchexec.sh new file mode 100755 index 000000000..634ba239b --- /dev/null +++ b/tests/castle/run_castle_benchexec.sh @@ -0,0 +1,55 @@ +#!/bin/bash +# run_castle_benchexec.sh — CASTLE C250 via BenchExec inside map2check-dev Docker +set -e + +REPO="/home/guilherme/github/Map2Check" +LOG="$REPO/tests/castle/results/benchexec_run.log" +mkdir -p "$(dirname "$LOG")" + +echo "=== CASTLE BenchExec started: $(date) ===" | tee "$LOG" + +docker run --rm -u root \ + --privileged \ + -v "$REPO:/workspace" \ + -w /workspace \ + ghcr.io/hbgit/map2check-dev:latest bash -c ' + set -e + LOG=/workspace/tests/castle/results/benchexec_run.log + + echo "=== Install BenchExec: $(date)" | tee -a $LOG + pip3 install benchexec 2>&1 | tail -3 | tee -a $LOG + + echo "=== Build Map2Check: $(date)" | tee -a $LOG + rm -rf /workspace/build_be /workspace/release + mkdir -p /workspace/build_be && cd /workspace/build_be + cmake .. -G Ninja \ + -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DENABLE_TEST=ON \ + -DMAP2CHECK_DYNAMIC_LINK=ON \ + -DCMAKE_INSTALL_PREFIX=/workspace/release + ninja 2>&1 | tail -5 | tee -a $LOG + ninja install 2>&1 | tail -5 | tee -a $LOG + + # Map2Check binary is installed at release/map2check directly + cp /workspace/utils/map2check-wrapper.py /workspace/release/map2check-wrapper.py + + mkdir -p /workspace/release/lib/klee + ln -sf /opt/klee/lib/klee/runtime /workspace/release/lib/klee/runtime + ln -sf /usr/lib/llvm-16/lib/clang /workspace/release/lib/clang + + # Symlink Z3 for --smt-solver flag in wrapper + ln -sf /opt/klee/lib/libz3* /workspace/release/lib/ 2>/dev/null || true + + echo "=== Run BenchExec: $(date)" | tee -a $LOG + mkdir -p /workspace/release/results + + cd /workspace/release + python3 -m benchexec.benchexec --no-container \ + ../tests/castle/benchexec/map2check_castle.xml 2>&1 | tee -a $LOG + + echo "=== Completed: $(date)" | tee -a $LOG + ' 2>&1 | tee -a "$LOG" + +echo "=== CASTLE BenchExec finished: $(date) ===" | tee -a "$LOG" +echo "Results in: release/results/" +ls -la "$REPO/release/results/" diff --git a/tests/castle/run_castle_evaluation.sh b/tests/castle/run_castle_evaluation.sh new file mode 100755 index 000000000..c3316232e --- /dev/null +++ b/tests/castle/run_castle_evaluation.sh @@ -0,0 +1,279 @@ +#!/bin/bash +# run_castle_evaluation.sh — Run all 250 CASTLE C250 benchmarks through Map2Check +# Two-pass strategy: direct, then --add-invariants fallback on UNKNOWN +set -e + +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" +CLANG="${CLANG:-/usr/bin/clang-16}" +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +CASTLE_DIR="$SCRIPT_DIR/CASTLE-Benchmark/datasets/CASTLE-C250" +JSON_FILE="$SCRIPT_DIR/CASTLE-Benchmark/datasets/CASTLE-C250.min.json" +RESULTS_DIR="$SCRIPT_DIR/results" +TIMEOUT_SEC=120 + +# CWE → mode mapping (single-pass flags, --add-invariants added on UNKNOWN) +declare -A CWE_MODE=( + # Memory safety (memtrack) + [125]="--memtrack" + [415]="--memtrack" + [416]="--memtrack" + [476]="--memtrack" + [761]="--memtrack" + [787]="--memtrack" + [822]="--memtrack" + [843]="--memtrack" + # Overflow + [190]="--check-overflow" + # Memcleanup + [401]="--memcleanup-property" + # Assert + [134]="--check-asserts" + [617]="--check-asserts" + # Reachability (other) + [253]="--target-function --target-function-name main" + [362]="--target-function --target-function-name main" + [369]="--target-function --target-function-name main" + [628]="--target-function --target-function-name main" + [674]="--target-function --target-function-name main" + [770]="--target-function --target-function-name main" + [835]="--target-function --target-function-name main" + # Out of scope (still run for completeness, flagged N/A) + [22]="--target-function --target-function-name main" + [78]="--target-function --target-function-name main" + [89]="--target-function --target-function-name main" + [327]="--target-function --target-function-name main" + [522]="--target-function --target-function-name main" + [798]="--target-function --target-function-name main" +) + +OUT_OF_SCOPE_CWES=(22 78 89 327 522 798) + +is_out_of_scope() { + local cwe="$1" + for o in "${OUT_OF_SCOPE_CWES[@]}"; do + [ "$cwe" = "$o" ] && return 0 + done + return 1 +} + +mkdir -p "$RESULTS_DIR" + +echo "CASTLE C250 × Map2Check Evaluation" +echo "==================================" + +# --- Phase 1: Compile all --- +echo "" +echo "Phase 1: Compiling C → LLVM bitcode..." +mkdir -p "$RESULTS_DIR/bc" +COMPILED=0 +COMPILE_FAILED=0 + +for c_file in "$CASTLE_DIR"/*.c; do + name=$(basename "$c_file") + bc_file="$RESULTS_DIR/bc/${name%.c}.bc" + if "$CLANG" -c -emit-llvm -g -O0 -Wno-everything "$c_file" -o "$bc_file" 2>/dev/null; then + COMPILED=$((COMPILED+1)) + else + COMPILE_FAILED=$((COMPILE_FAILED+1)) + echo " FAIL: $name" + fi +done + +echo " Compiled: $COMPILED, Failed: $COMPILE_FAILED" + +# --- Phase 2: Verify + Score --- +echo "" +echo "Phase 2: Running Map2Check on each benchmark..." +echo "id,cwe,name,vulnerable,mode,verdict,invariants,expected,result,time_sec" > "$RESULTS_DIR/castle_results.csv" + +RUN=0 +TP=0; TN=0; FP=0; FN=0; UNK=0; TO=0; NA=0 + +for c_file in "$CASTLE_DIR"/*.c; do + name=$(basename "$c_file") + id="${name%.c}" + id_short=$(echo "$id" | sed 's/CASTLE-//') + + bc_file="$RESULTS_DIR/bc/${id}.bc" + [ -f "$bc_file" ] || continue + + RUN=$((RUN+1)) + + # Extract ground truth from JSON + entry=$(python3 -c " +import json +with open('$JSON_FILE') as f: + data = json.load(f) +for t in data['tests']: + if t['name'] == '$name': + print(json.dumps({'vulnerable': t['vulnerable'], 'cwe': t['cwe'], 'lines': t.get('lines',[])})) + break +" 2>/dev/null) + + [ -n "$entry" ] || { echo " SKIP: $name not found in JSON"; continue; } + + vulnerable=$(echo "$entry" | python3 -c "import sys,json; print(json.loads(sys.stdin.read())['vulnerable'])") + cwe=$(echo "$entry" | python3 -c "import sys,json; print(json.loads(sys.stdin.read())['cwe'])") + + mode_flags="${CWE_MODE[$cwe]:---target-function --target-function-name main}" + + # --- Pass 1: direct --- + start=$(date +%s%N) + output=$(timeout "$TIMEOUT_SEC" "$MAP2CHECK" $mode_flags --timeout 60 "$bc_file" 2>&1) || true + end=$(date +%s%N) + elapsed=$(python3 -c "print(round(($end - $start) / 1000000000, 1))") + + used_invariants="no" + if echo "$output" | grep -qi "TIMEOUT\|timed out"; then + verdict="TIMEOUT" + elif echo "$output" | grep -q "FALSE-DEREF"; then + verdict="FALSE-DEREF" + elif echo "$output" | grep -q "FALSE-FREE"; then + verdict="FALSE-FREE" + elif echo "$output" | grep -q "FALSE-MEMTRACK"; then + verdict="FALSE-MEMTRACK" + elif echo "$output" | grep -q "FALSE-OVERFLOW"; then + verdict="FALSE-OVERFLOW" + elif echo "$output" | grep -q "FALSE-MEMCLEANUP"; then + verdict="FALSE-MEMCLEANUP" + elif echo "$output" | grep -q "VERIFICATION FAILED"; then + verdict="FALSE" + elif echo "$output" | grep -q "VERIFICATION SUCCEEDED"; then + verdict="TRUE" + else + verdict="UNKNOWN" + fi + + # --- Pass 2: --add-invariants fallback --- + if [ "$verdict" = "UNKNOWN" ] && [ "$mode_flags" != "--check-asserts" ]; then + used_invariants="yes" + start=$(date +%s%N) + output=$(timeout "$TIMEOUT_SEC" "$MAP2CHECK" $mode_flags --add-invariants --timeout 60 "$bc_file" 2>&1) || true + end=$(date +%s%N) + elapsed=$(python3 -c "print(round(($end - $start) / 1000000000, 1))") + + if echo "$output" | grep -qi "TIMEOUT\|timed out"; then + verdict="TIMEOUT" + elif echo "$output" | grep -q "FALSE-DEREF"; then + verdict="FALSE-DEREF" + elif echo "$output" | grep -q "FALSE-FREE"; then + verdict="FALSE-FREE" + elif echo "$output" | grep -q "FALSE-MEMTRACK"; then + verdict="FALSE-MEMTRACK" + elif echo "$output" | grep -q "FALSE-OVERFLOW"; then + verdict="FALSE-OVERFLOW" + elif echo "$output" | grep -q "FALSE-MEMCLEANUP"; then + verdict="FALSE-MEMCLEANUP" + elif echo "$output" | grep -q "VERIFICATION FAILED"; then + verdict="FALSE" + elif echo "$output" | grep -q "VERIFICATION SUCCEEDED"; then + verdict="TRUE" + else + verdict="UNKNOWN" + fi + fi + + reported_line=$(echo "$output" | grep -oP '(?:line )\d+' | grep -oP '\d+' | head -1) + + # --- Classify --- + if is_out_of_scope "$cwe"; then + classification="N/A" + NA=$((NA+1)) + elif [ "$verdict" = "TIMEOUT" ]; then + classification="TIMEOUT" + TO=$((TO+1)) + elif [ "$verdict" = "UNKNOWN" ]; then + classification="UNKNOWN" + UNK=$((UNK+1)) + elif [ "$verdict" != "TRUE" ] && [ "$vulnerable" = "True" ]; then + has_line_match="false" + if [ -n "$reported_line" ]; then + expected_lines=$(echo "$entry" | python3 -c "import sys,json; print(','.join(str(l) for l in json.loads(sys.stdin.read())['lines']))" 2>/dev/null || echo "") + if [ -n "$expected_lines" ]; then + for exp_line in $(echo "$expected_lines" | tr ',' ' '); do + if [ "$reported_line" -eq "$exp_line" ] 2>/dev/null; then + has_line_match="true" + break + fi + done + else + has_line_match="true" + fi + else + has_line_match="true" + fi + if [ "$has_line_match" = "true" ]; then + classification="TP" + TP=$((TP+1)) + else + classification="FP" + FP=$((FP+1)) + fi + elif [ "$verdict" != "TRUE" ] && [ "$vulnerable" = "False" ]; then + classification="FP" + FP=$((FP+1)) + elif [ "$verdict" = "TRUE" ] && [ "$vulnerable" = "False" ]; then + classification="TN" + TN=$((TN+1)) + elif [ "$verdict" = "TRUE" ] && [ "$vulnerable" = "True" ]; then + classification="FN" + FN=$((FN+1)) + else + classification="UNCLASSIFIED" + UNK=$((UNK+1)) + fi + + echo "$id_short,$cwe,$name,$vulnerable,$mode_flags,$verdict,$used_invariants,$vulnerable,$classification,$elapsed" >> "$RESULTS_DIR/castle_results.csv" + echo " [$RUN/250] $name (CWE-$cwe): $verdict → $classification (${elapsed}s)" +done + +# --- Phase 3: Summary --- +echo "" +echo "Phase 3: Generating summary..." +TOTAL_SCOPE=$((TP+TN+FP+FN)) + +cat > "$RESULTS_DIR/castle_summary.txt" << EOF +CASTLE C250 × Map2Check Evaluation Results +=========================================== +Date: $(date -u +"%Y-%m-%dT%H:%M:%SZ") +Map2Check binary: $MAP2CHECK + +Totals: + Total tests: 250 + In-scope results: $TOTAL_SCOPE + Out of scope (N/A): $NA + Timeouts: $TO + Unknown: $UNK + +Detection Metrics (in-scope): + True Positives: $TP + False Positives: $FP + True Negatives: $TN + False Negatives: $FN + +EOF + + if [ $((TP + FP)) -gt 0 ]; then + prec=$(python3 -c "print(f'{$TP/($TP+$FP)*100:.1f}%')") + echo " Precision: $prec" >> "$RESULTS_DIR/castle_summary.txt" + else + echo " Precision: N/A (no positives)" >> "$RESULTS_DIR/castle_summary.txt" + fi + if [ $((TP + FN)) -gt 0 ]; then + rec=$(python3 -c "print(f'{$TP/($TP+$FN)*100:.1f}%')") + echo " Recall: $rec" >> "$RESULTS_DIR/castle_summary.txt" + else + echo " Recall: N/A (no condition positives)" >> "$RESULTS_DIR/castle_summary.txt" + fi + + cat >> "$RESULTS_DIR/castle_summary.txt" << EOF + +Results written to: + CSV: $RESULTS_DIR/castle_results.csv +EOF + +cat "$RESULTS_DIR/castle_summary.txt" + +echo "" +echo "Done. Results in $RESULTS_DIR/" diff --git a/tests/integration/test_castle_regression.sh b/tests/integration/test_castle_regression.sh new file mode 100755 index 000000000..48919ca17 --- /dev/null +++ b/tests/integration/test_castle_regression.sh @@ -0,0 +1,70 @@ +#!/bin/bash +set -e + +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" +CLANG="${CLANG:-/usr/bin/clang-16}" +CASTLE_DIR="tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250" +TMPDIR=$(mktemp -d) +PASSED=0 +FAILED=0 + +cleanup() { rm -rf "$TMPDIR"; } +trap cleanup EXIT + +echo "============================================================" +echo "Map2Check CASTLE Regression Tests" +echo "============================================================" + +run_castle_test() { + local name="$1" + local cwe="$2" + local expect_fail="$3" + + local src="$CASTLE_DIR/$name" + local bc="$TMPDIR/$name.bc" + + echo "" + echo "--- Test: $name (CWE-$cwe) ---" + + $CLANG -c -emit-llvm -g -O0 "$src" -o "$bc" 2>/dev/null || { + echo " SKIP: compile failed" + return 0 + } + + local output + output=$(timeout 120 "$MAP2CHECK" --memtrack --timeout 60 "$bc" 2>&1) || true + + if [ "$expect_fail" = "true" ]; then + if echo "$output" | grep -qE "VERIFICATION FAILED|FALSE_"; then + echo " PASS: vulnerability detected" + PASSED=$((PASSED+1)) + else + echo " FAIL: expected FALSE, got:" + echo "$output" | tail -5 + FAILED=$((FAILED+1)) + fi + else + if echo "$output" | grep -qE "VERIFICATION FAILED|FALSE_"; then + echo " FAIL: expected TRUE, got FALSE:" + echo "$output" | tail -5 + FAILED=$((FAILED+1)) + else + echo " PASS: no false alarm" + PASSED=$((PASSED+1)) + fi + fi +} + +run_castle_test "CASTLE-476-1.c" "476" "true" +run_castle_test "CASTLE-415-2.c" "415" "true" +run_castle_test "CASTLE-476-8.c" "476" "false" +run_castle_test "CASTLE-416-1.c" "416" "true" +run_castle_test "CASTLE-787-3.c" "787" "true" + +echo "" +echo "============================================================" +echo "Results: $PASSED passed, $FAILED failed" +echo "============================================================" + +[ $FAILED -eq 0 ] && exit 0 || exit 1