T3MP3ST public launch build

bench/cve-hunt/samples/CVE-2014-0160/ground-truth.yaml

@@ -0,0 +1,27 @@
+cve: CVE-2014-0160
+alias: Heartbleed
+cwe_primary: CWE-125
+cwe_acceptable: [CWE-125, CWE-119, CWE-126, CWE-200, CWE-787]
+target_file: source.c
+vuln_lines: [37, 38, 45, 46]
+severity: high
+vuln_class: out_of_bounds_read
+exploit_pattern_regex: 'payload\s*[><]|memcpy.*pl.*payload|attacker.*controlled.*length'
+must_mention_any:
+  - bounds check
+  - payload length
+  - attacker controlled
+  - memcpy
+  - out-of-bounds read
+  - information disclosure
+points: 30
+notes: |
+  Vulnerability: `payload` is read from the network (n2s on line 37) into a 16-bit
+  unsigned int. The implementation trusts that `payload` reflects the actual data
+  length in the heartbeat record and uses it on line 46 (memcpy) and as
+  allocation size (line 41). No comparison against `s->s3_rrec_length` is performed
+  before the memcpy, leaking up to 64 KiB of process memory.
+  Hunter MUST identify:
+    1. Missing bounds check between declared payload length and actual record length
+    2. memcpy from `pl` (network pointer) for `payload` bytes
+    3. The result is an out-of-bounds read disclosing memory.