code wiki / _hdl_build / nx_doc_ubscan_gate.nx
`nx_doc_ubscan_gate.nx` source

1import "nx_gate_gn.nx"
2// nx_doc_ubscan_gate.nx -- liar-kill gate for the UB cast-then-index detector (the recycler's CONVERT of the
3// undefined-behavior critique). MUST-FLAG: the dangerous inline `(EXPR as *T)[i]` (incl. inside a call). MUST-NOT-
4// FLAG: the SAFE bind-then-index (`let p = ... as *T; p[i]`), a plain cast with no index, and a paren-index with no
5// cast. Grounding: the motivating critique artifact recyc_crit_ub.raw really exists. expect_exit: 0
6import "nx_syscalls.nx"
7import "nx_doc_ubscan.nx"
8
9func gp(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
10func slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
11func have_file(p: *u8) -> i64 { let fd: i64=sys_openat_rd(p); if fd<0 { return 0 } sys_close(fd); return 1 }
12
13func main() -> i64 {
14    gp("=== nx_doc_ubscan_gate: detect the LM-031 inline cast-then-index UB (recycled from the UB critique) ===\n" as *u8)
15    var pass: i64=0; var fail: i64=0
16
17    // KAT1 MUST-FLAG: the exact LM-031 dangerous form
18    let s1: *u8 = "func f() -> i64 { return (c[5] as *i64)[idx] }" as *u8
19    if ub_scan(s1, slen(s1)) >= 0 { pass=pass+1 } else { fail=fail+1; gp("  FAIL kat1-missed-castindex\n" as *u8) }
20
21    // KAT2 MUST-NOT-FLAG: the SAFE bind-then-index (the LM-031 fix)
22    let s2: *u8 = "func g() -> i64 { let p: *i64 = c[5] as *i64; return p[idx] }" as *u8
23    if ub_scan(s2, slen(s2)) < 0 { pass=pass+1 } else { fail=fail+1; gp("  FAIL kat2-flagged-safe-bind\n" as *u8) }
24
25    // KAT3 MUST-NOT-FLAG: a plain cast with NO index
26    let s3: *u8 = "func h() -> i64 { let x: *u8 = p as *u8; return 0 }" as *u8
27    if ub_scan(s3, slen(s3)) < 0 { pass=pass+1 } else { fail=fail+1; gp("  FAIL kat3-flagged-plain-cast\n" as *u8) }
28
29    // KAT4 MUST-NOT-FLAG: a parenthesized index with NO cast
30    let s4: *u8 = "func k() -> i64 { let v: i64 = (a + b)[i]; return v }" as *u8
31    if ub_scan(s4, slen(s4)) < 0 { pass=pass+1 } else { fail=fail+1; gp("  FAIL kat4-flagged-noncast-index\n" as *u8) }
32
33    // KAT5 MUST-FLAG: cast-then-index nested inside a call argument
34    let s5: *u8 = "func m() -> i64 { return foo((x as *i64)[0]) }" as *u8
35    if ub_scan(s5, slen(s5)) >= 0 { pass=pass+1 } else { fail=fail+1; gp("  FAIL kat5-missed-nested\n" as *u8) }
36
37    // KAT6 grounding: the motivating critique artifact exists (this hardening was recycled from a real fetched page)
38    if have_file("knowledge/fetched/recyc_crit_ub.raw" as *u8)==1 { pass=pass+1 } else { fail=fail+1; gp("  FAIL kat6-ungrounded (recyc_crit_ub.raw missing)\n" as *u8) }
39
40    gp("DOC-UBSCAN-GATE pass=" as *u8); gn(pass); gp(" fail=" as *u8); gn(fail)
41    if fail==0 { gp(" verdict=GREEN (inline cast-then-index UB flagged incl. nested; safe bind-then-index/plain-cast/noncast-index NOT flagged; recycled from the UB critique)\n" as *u8); sys_exit(0); return 0 }
42    gp(" verdict=RED\n" as *u8); sys_exit(1); return 1
43}
nx_doc_ubscan_gate.nx source

`nx_doc_ubscan_gate.nx` source
