T3MP3ST public launch build

bench/cve-hunt/samples/CVE-2019-11043/ground-truth.yaml

@@ -0,0 +1,27 @@
+cve: CVE-2019-11043
+alias: PHP-FPM env_path_info underflow
+cwe_primary: CWE-787
+cwe_acceptable: [CWE-787, CWE-191, CWE-119, CWE-124, CWE-125]
+target_file: source.c
+vuln_lines: [21, 28, 29, 33]
+severity: critical
+vuln_class: out_of_bounds_write
+exploit_pattern_regex: '%0a|negative.*offset|underflow|path_info'
+must_mention_any:
+  - negative
+  - bounds check
+  - underflow
+  - path_info
+  - script_name
+  - out-of-bounds write
+  - pointer arithmetic
+points: 30
+notes: |
+  Vulnerability: path_info_offset is computed as pointer difference and may
+  go negative when attacker engineers path_info < script_name (via specific
+  URL encodings). The subsequent `script_name[path_info_offset] = '\\0'`
+  writes outside the buffer with attacker-influenced index.
+  Hunter MUST identify:
+    1. The pointer arithmetic that produces path_info_offset.
+    2. The missing bounds check / sign check.
+    3. The out-of-bounds write at the indexed location.