Blame for code/bugfind/bench/make_kernels.py

#!/usr/bin/env python3 -I
"""Minimal-extraction items (Phase 5 Part A, "extract the affected pure function into a minimal standalone crate").

Each KERNEL is a hand-extracted, dependency-free reduction of the *decision logic* that a RustSec fix changed
(pre = vulnerable revision's logic, post = patched revision's logic). Whole crates are not translatable (native deps,
dyn traits, early returns in loops, ...: see TOOLCHAIN.md / SUMMARY.json), so the unit is the function kernel.
`fidelity`:
  verbatim_logic  the changed expression/branch is copied from the crate with std/crate types replaced by integers/slices
  model_of_std    the vulnerable behaviour lives in a std/crate call (slice split_at, str slicing, unchecked memcpy length);
                  the kernel models that call's panic/UB condition explicitly. Weaker; reported separately.
Extraction was done by reading the pre/post diff, so kernels are NOT blind to the bug; only the *properties* (property bank)
are authored blind, from `spec_doc` + signature alone (see baselines/bank/README_PROVENANCE.md).

Writes bench/kernels/<id>/{meta.json,pre/{Cargo.toml,src/lib.rs},post/{Cargo.toml,src/lib.rs}}.
"""
import json, os
HERE = os.path.dirname(os.path.abspath(__file__))
CAND = "/apps/development/rlhf/bugfind_data/out/advisory_candidates.jsonl"
K = []

def k(kid, adv, fn, sig, spec_doc, bug_class, fidelity, pre, post, witness, note, file):
    K.append(dict(id=kid, adv=adv, fn=fn, sig=sig, spec_doc=spec_doc, bug_class=bug_class, fidelity=fidelity,
                  pre=pre.strip() + "\n", post=post.strip() + "\n", witness=witness, note=note, file=file))

k("claxon_rice", "RUSTSEC-2018-0004", "rice_layout", "pub fn rice_layout(block_size: u16, order: u32, n_warm_up: u16) -> Result<u32, u8>",
  "Computes how many residual samples a FLAC Rice-coded subframe's 2^order partitions cover (order is a 4-bit field, so order > 15 is rejected with Err). On Ok(n), n must equal block_size (the partitions fill the block); otherwise return Err.",
  "logic", "verbatim_logic",
  """
pub fn rice_layout(block_size: u16, order: u32, n_warm_up: u16) -> Result<u32, u8> {
    if order > 15 {
        return Err(3);
    }
    let n_partitions = 1u32 << order;
    let n_samples_per_partition = block_size >> order;
    if n_warm_up > n_samples_per_partition {
        return Err(1);
    }
    Ok(n_partitions * (n_samples_per_partition as u32))
}
""", """
pub fn rice_layout(block_size: u16, order: u32, n_warm_up: u16) -> Result<u32, u8> {
    if order > 15 {
        return Err(3);
    }
    let n_partitions = 1u32 << order;
    let n_samples_per_partition = block_size >> order;
    if block_size & ((n_partitions - 1) as u16) != 0 {
        return Err(2);
    }
    if n_warm_up > n_samples_per_partition {
        return Err(1);
    }
    Ok(n_partitions * (n_samples_per_partition as u32))
}
""", "10u16, 2u32, 0u16", "src/subframe.rs decode_residual: block size not a multiple of 2^order left buffer tail uninitialised", "src/subframe.rs")

k("bytes_reserve", "RUSTSEC-2026-0007", "reserve_fits", "pub fn reserve_fits(v_capacity: usize, new_cap: usize, offset: usize) -> bool",
  "Decides whether a Vec-backed buffer with capacity v_capacity can serve a reserve request of new_cap bytes when the live window starts at offset; must be true iff v_capacity >= new_cap + offset in exact arithmetic.",
  "overflow", "verbatim_logic",
  "pub fn reserve_fits(v_capacity: usize, new_cap: usize, offset: usize) -> bool {\n    v_capacity >= new_cap + offset\n}",
  """
pub fn reserve_fits(v_capacity: usize, new_cap: usize, offset: usize) -> bool {
    match new_cap.checked_add(offset) {
        Some(s) => v_capacity >= s,
        None => false,
    }
}
""", "10usize, usize::MAX, 1usize", "src/bytes_mut.rs reserve_inner: new_cap + offset overflow", "src/bytes_mut.rs")

k("mldsa_hint", "RUSTSEC-2026-0076", "hint_weight", "pub fn hint_weight(hint: &[u8], max_ones: usize, rows: usize) -> Option<usize>",
  "Decodes the ML-DSA signature hint encoding: hint[..max_ones] are positions, hint[max_ones..max_ones+rows] are cumulative counts that must be non-decreasing and at most max_ones. Returns the sum of the hint bytes it consumed, or None for a malformed encoding. Must never panic on any input of length >= max_ones+rows.",
  "panic", "verbatim_logic",
  """
pub fn hint_weight(hint: &[u8], max_ones: usize, rows: usize) -> Option<usize> {
    let mut previous = 0usize;
    let mut total = 0usize;
    let mut bad = false;
    let mut i = 0usize;
    while i < rows {
        let current = hint[max_ones + i] as usize;
        if current < previous || previous > max_ones {
            bad = true;
        } else {
            let mut j = previous;
            while j < current {
                total += hint[j] as usize;
                j += 1;
            }
            previous = current;
        }
        i += 1;
    }
    if bad { None } else { Some(total) }
}
""", """
pub fn hint_weight(hint: &[u8], max_ones: usize, rows: usize) -> Option<usize> {
    let mut previous = 0usize;
    let mut total = 0usize;
    let mut bad = false;
    let mut i = 0usize;
    while i < rows {
        let current = hint[max_ones + i] as usize;
        if current < previous || current > max_ones {
            bad = true;
        } else {
            let mut j = previous;
            while j < current {
                total += hint[j] as usize;
                j += 1;
            }
            previous = current;
        }
        i += 1;
    }
    if bad { None } else { Some(total) }
}
""", "&[0u8, 0, 200], 2usize, 1usize", "src/ml_dsa_generic.rs / encoding/signature.rs deserialize hint: checked previous instead of current against max_ones", "src/encoding/signature.rs")

k("mldsa_norm", "RUSTSEC-2026-0076", "response_bound", "pub fn response_bound(gamma1_exponent: u32, beta: i32) -> i32",
  "ML-DSA verification bound for the signer response: gamma1 - beta where gamma1 = 2^gamma1_exponent.",
  "logic", "verbatim_logic",
  "pub fn response_bound(gamma1_exponent: u32, beta: i32) -> i32 {\n    (2i32 << gamma1_exponent) - beta\n}",
  "pub fn response_bound(gamma1_exponent: u32, beta: i32) -> i32 {\n    (1i32 << gamma1_exponent) - beta\n}",
  "17u32, 78i32", "src/ml_dsa_generic.rs verify: (2 << GAMMA1_EXPONENT) - BETA instead of (1 << ...) - BETA", "src/ml_dsa_generic.rs")

k("odoh_split", "RUSTSEC-2023-0095", "encrypted_payload_len", "pub fn encrypted_payload_len(msg: &[u8], key_size: usize) -> Result<usize, u8>",
  "Splits an encrypted ODoH query into an encapsulated key (first key_size bytes) and ciphertext (the rest); returns the ciphertext length, or Err if the message is shorter than key_size. Must not panic on any input.",
  "panic", "model_of_std",
  "pub fn encrypted_payload_len(msg: &[u8], key_size: usize) -> Result<usize, u8> {\n    let ct = &msg[key_size..];\n    Ok(ct.len())\n}",
  "pub fn encrypted_payload_len(msg: &[u8], key_size: usize) -> Result<usize, u8> {\n    if key_size > msg.len() {\n        return Err(1);\n    }\n    let ct = &msg[key_size..];\n    Ok(ct.len())\n}",
  "&[1u8, 2, 3], 32usize", "src/protocol.rs decrypt_query: split_at(key_size) without length check", "src/protocol.rs")

k("matrix_power", "RUSTSEC-2025-0065", "normalize_power_level", "pub fn normalize_power_level(power_level: i64, max_power_level: i64) -> i64",
  "Scales a Matrix user power level (|power_level| < 2^53) to the range 0..=100 relative to max_power_level > 0.",
  "panic", "verbatim_logic",
  """
const INT_MAX: i64 = 9007199254740991;
pub fn normalize_power_level(power_level: i64, max_power_level: i64) -> i64 {
    let n = (power_level * 100) / max_power_level;
    assert!(n >= -INT_MAX && n <= INT_MAX);
    n
}
""", """
pub fn normalize_power_level(power_level: i64, max_power_level: i64) -> i64 {
    let n = (power_level * 100) / max_power_level;
    if n < 0 {
        0
    } else if n > 100 {
        100
    } else {
        n
    }
}
""", "9007199254740991i64, 1i64", "src/room/members.rs normalized_power_level: expect() on out-of-range Int when max_power_level is small", "src/room/members.rs")

k("nostr_iv", "RUSTSEC-2026-0219", "load_iv", "pub fn load_iv(iv: &[u8]) -> Result<[u8; 16], u8>",
  "Loads a NIP-04 AES-CBC initialisation vector from untrusted bytes; must return Err unless the input is exactly 16 bytes, and must never panic.",
  "panic", "model_of_std",
  """
pub fn load_iv(iv: &[u8]) -> Result<[u8; 16], u8> {
    let mut out = [0u8; 16];
    let mut i = 0usize;
    while i < 16 {
        out[i] = iv[i];
        i += 1;
    }
    Ok(out)
}
""", """
pub fn load_iv(iv: &[u8]) -> Result<[u8; 16], u8> {
    if iv.len() != 16 {
        return Err(1);
    }
    let mut out = [0u8; 16];
    let mut i = 0usize;
    while i < 16 {
        out[i] = iv[i];
        i += 1;
    }
    Ok(out)
}
""", "&[1u8, 2, 3]", "src/nips/nip04.rs decrypt: iv.as_slice().into() panics on wrong length", "src/nips/nip04.rs")

k("phone_ctx", "RUSTSEC-2023-0082", "context_prefix_skip", "pub fn context_prefix_skip(s: &[u8]) -> usize",
  "Returns how many leading bytes of an RFC3966 phone-context value to skip: 1 if it starts with '+', otherwise 0. Must not panic on empty input.",
  "panic", "verbatim_logic",
  "pub fn context_prefix_skip(s: &[u8]) -> usize {\n    if s[0] == b'+' { 1 } else { 0 }\n}",
  "pub fn context_prefix_skip(s: &[u8]) -> usize {\n    if !s.is_empty() && s[0] == b'+' { 1 } else { 0 }\n}",
  "&[]", "src/parser/rfc3966.rs: s.as_bytes()[0] on empty phone-context", "src/parser/rfc3966.rs")

k("poly1305_key", "RUSTSEC-2026-0073", "key_len_ok", "pub fn key_len_ok(key: &[u8]) -> bool",
  "Poly1305 one-time keys are r (16 bytes) followed by s (16 bytes): a key is acceptable iff it is exactly 32 bytes.",
  "logic", "verbatim_logic",
  "pub const KEY_LEN: usize = 16;\npub fn key_len_ok(key: &[u8]) -> bool {\n    key.len() == KEY_LEN\n}",
  "pub const KEY_LEN: usize = 32;\npub fn key_len_ok(key: &[u8]) -> bool {\n    key.len() == KEY_LEN\n}",
  "&[0u8; 32]", "src/lib.rs KEY_LEN = 16 (standalone mac rejected/panicked on real 32-byte keys)", "src/lib.rs")

k("ecdh_scalar", "RUSTSEC-2026-0023", "validate_x25519_scalar", "pub fn validate_x25519_scalar(s: &[u8]) -> bool",
  "Validates an X25519 secret scalar: must be exactly 32 bytes, not all zero, and clamped (low 3 bits of byte 0 clear, top bit of byte 31 clear, second-highest bit of byte 31 set).",
  "logic", "verbatim_logic",
  """
pub fn validate_x25519_scalar(s: &[u8]) -> bool {
    let mut all_zero = true;
    let mut i = 0usize;
    while i < s.len() {
        if s[i] != 0 {
            all_zero = false;
        }
        i += 1;
    }
    !all_zero
}
""", """
pub fn validate_x25519_scalar(s: &[u8]) -> bool {
    if s.len() != 32 {
        return false;
    }
    let mut all_zero = true;
    let mut i = 0usize;
    while i < s.len() {
        if s[i] != 0 {
            all_zero = false;
        }
        i += 1;
    }
    if all_zero {
        return false;
    }
    (s[0] & 7) == 0 && (s[31] & 128) == 0 && (s[31] & 64) != 0
}
""", "&[1u8, 2, 3]", "src/ecdh.rs validate_scalar: only checked all-zero", "src/ecdh.rs")

k("nanoid_mask", "RUSTSEC-2024-0343", "alphabet_mask", "pub fn alphabet_mask(len: usize) -> usize",
  "Bit mask used to index an alphabet of len symbols (len >= 2) from a random byte: the smallest all-ones value m with m >= len - 1, i.e. next_power_of_two(len) - 1.",
  "logic", "verbatim_logic",
  "pub fn alphabet_mask(len: usize) -> usize {\n    len - 1\n}",
  """
pub fn alphabet_mask(len: usize) -> usize {
    let mut p = 1usize;
    while p < len {
        p = p * 2;
    }
    p - 1
}
""", "62usize", "src/lib.rs MASK = $len - 1 is not a bit mask for non-power-of-two alphabets (biased/short alphabet)", "src/lib.rs")

k("tar_pax", "RUSTSEC-2026-0145", "apply_pax", "pub fn apply_pax(entry_type: u8, has_pax: bool) -> bool",
  "PAX extended-header data describes the next file entry. Returns whether pending PAX data must be applied to a header of the given type byte: only for real entries, never for GNU long-name 'L', long-link 'K', PAX local 'x' or global 'g' headers.",
  "logic", "verbatim_logic",
  "pub fn apply_pax(entry_type: u8, has_pax: bool) -> bool {\n    has_pax\n}",
  """
pub fn apply_pax(entry_type: u8, has_pax: bool) -> bool {
    let mut is_extension_header = false;
    if entry_type == b'L' || entry_type == b'K' || entry_type == b'x' || entry_type == b'g' {
        is_extension_header = true;
    }
    if has_pax {
        if is_extension_header { false } else { true }
    } else {
        false
    }
}
""", "b'L', true", "src/archive.rs: PAX data applied to extension headers (desynchronisation)", "src/archive.rs")

k("exif_discard", "RUSTSEC-2021-0143", "discard_exact", "pub fn discard_exact(avail: usize, len: usize) -> Result<usize, u8>",
  "Models skipping len bytes of a reader that has only avail bytes: returns Ok(number of read rounds) when the reader had enough data, Err when it hits EOF early. Must terminate on every input.",
  "dos_loop_or_recursion", "verbatim_logic",
  """
pub fn discard_exact(avail: usize, len: usize) -> Result<usize, u8> {
    let mut avail = avail;
    let mut len = len;
    let mut rounds = 0usize;
    while len > 0 {
        let consume_len = if avail < len { avail } else { len };
        avail -= consume_len;
        len -= consume_len;
        rounds += 1;
    }
    Ok(rounds)
}
""", """
pub fn discard_exact(avail: usize, len: usize) -> Result<usize, u8> {
    let mut avail = avail;
    let mut len = len;
    let mut rounds = 0usize;
    let mut eof = false;
    while len > 0 && !eof {
        let consume_len = if avail < len { avail } else { len };
        if consume_len == 0 {
            eof = true;
        } else {
            avail -= consume_len;
            len -= consume_len;
            rounds += 1;
        }
    }
    if eof { Err(1) } else { Ok(rounds) }
}
""", "3usize, 10usize", "src/util.rs discard_exact: spins forever at EOF (consume_len == 0)", "src/util.rs")

k("trustdns_ptr", "RUSTSEC-2018-0007", "pointer_ok", "pub fn pointer_ok(location: usize, pointer_location: usize, name_start: usize) -> bool",
  "A DNS name-compression pointer is acceptable iff its target lies strictly before the start of the name currently being parsed (so pointer chains cannot loop).",
  "dos_loop_or_recursion", "verbatim_logic",
  "pub fn pointer_ok(location: usize, pointer_location: usize, name_start: usize) -> bool {\n    let _ = name_start;\n    location < pointer_location\n}",
  "pub fn pointer_ok(location: usize, pointer_location: usize, name_start: usize) -> bool {\n    let _ = pointer_location;\n    location < name_start\n}",
  "0usize, 2usize, 0usize", "src/rr/domain/name.rs Name::read: pointer compared with current label instead of name start (self-referential name)", "src/rr/domain/name.rs")

k("ring_ctr", "RUSTSEC-2025-0009", "increment_by", "pub fn increment_by(old_value: u32, increment_by: u32) -> u32",
  "Increments a 32-bit big-endian AES-GCM block counter, wrapping modulo 2^32.",
  "overflow", "verbatim_logic",
  "pub fn increment_by(old_value: u32, increment_by: u32) -> u32 {\n    old_value + increment_by\n}",
  "pub fn increment_by(old_value: u32, increment_by: u32) -> u32 {\n    old_value.wrapping_add(increment_by)\n}",
  "4294967295u32, 1u32", "src/aead/aes.rs increment_by_less_safe: + panics with overflow checks", "src/aead/aes.rs")

k("stack_insert", "RUSTSEC-2020-0042", "insert_shift_len", "pub fn insert_shift_len(len: usize, index: usize) -> Result<usize, u8>",
  "Number of elements to shift when inserting at index into a vector of length len; Err if index > len.",
  "panic", "model_of_std",
  "pub fn insert_shift_len(len: usize, index: usize) -> Result<usize, u8> {\n    Ok(len.wrapping_sub(index))\n}",
  "pub fn insert_shift_len(len: usize, index: usize) -> Result<usize, u8> {\n    if index > len {\n        return Err(1);\n    }\n    Ok(len - index)\n}",
  "3usize, 5usize", "src/vector.rs insert: missing index <= len assert; copy length len - index wrapped (release) -> OOB write", "src/vector.rs")

k("tract_len", "RUSTSEC-2026-0217", "tensor_len_ok", "pub fn tensor_len_ok(dims: &[usize], bits_per_item: usize, data_size_bytes: usize) -> bool",
  "NNEF tensor header consistency: true iff prod(dims) * (bits_per_item / 8) == data_size_bytes in exact arithmetic (false if the product does not fit usize).",
  "overflow", "verbatim_logic",
  """
pub fn tensor_len_ok(dims: &[usize], bits_per_item: usize, data_size_bytes: usize) -> bool {
    let mut len = 1usize;
    let mut i = 0usize;
    while i < dims.len() {
        len = len * dims[i];
        i += 1;
    }
    len * (bits_per_item / 8) == data_size_bytes
}
""", """
pub fn tensor_len_ok(dims: &[usize], bits_per_item: usize, data_size_bytes: usize) -> bool {
    let mut len = 1usize;
    let mut overflow = false;
    let mut i = 0usize;
    while i < dims.len() {
        let d = dims[i];
        if d != 0 && len > usize::MAX / d {
            overflow = true;
        } else {
            len = len * d;
        }
        i += 1;
    }
    if overflow {
        return false;
    }
    let per = bits_per_item / 8;
    if per != 0 && len > usize::MAX / per {
        return false;
    }
    len * per == data_size_bytes
}
""", "&[4294967296usize, 4294967296], 8usize, 0usize", "src/tensors.rs read_tensor: unchecked shape product", "src/tensors.rs")

k("transpose_dims", "RUSTSEC-2023-0080", "dims_match", "pub fn dims_match(width: usize, height: usize, len: usize) -> bool",
  "True iff width * height == len in exact arithmetic (false when the product does not fit usize).",
  "overflow", "verbatim_logic",
  "pub fn dims_match(width: usize, height: usize, len: usize) -> bool {\n    width * height == len\n}",
  "pub fn dims_match(width: usize, height: usize, len: usize) -> bool {\n    match width.checked_mul(height) {\n        Some(p) => p == len,\n        None => false,\n    }\n}",
  "4294967296usize, 4294967296usize, 0usize", "src/lib.rs transpose: assert_eq!(w*h, len) wraps in release -> buffer overflow", "src/lib.rs")

k("toodee_drain", "RUSTSEC-2025-0062", "drain_col_copy_len", "pub fn drain_col_copy_len(orig_cols: usize, col: usize) -> usize",
  "When removing column col from a row of orig_cols cells, the number of cells to shift left: those strictly after col (orig_cols - col - 1).",
  "overflow", "verbatim_logic",
  "pub fn drain_col_copy_len(orig_cols: usize, col: usize) -> usize {\n    orig_cols - col\n}",
  "pub fn drain_col_copy_len(orig_cols: usize, col: usize) -> usize {\n    orig_cols - col - 1\n}",
  "5usize, 2usize", "src/toodee.rs DrainCol::drop: ptr::copy length off by one (heap overflow)", "src/toodee.rs")

k("tinyhttp_hdr", "RUSTSEC-2020-0031", "header_field_ok", "pub fn header_field_ok(s: &[u8]) -> bool",
  "A header field name is valid iff it is ASCII and contains no whitespace (no trimming: ' Transfer-Encoding' and 'Transfer-Encoding ' are invalid).",
  "logic", "verbatim_logic",
  """
fn is_ws(b: u8) -> bool {
    b == b' ' || b == b'\\t' || b == b'\\n' || b == b'\\r' || b == 11u8 || b == 12u8
}
pub fn header_field_ok(s: &[u8]) -> bool {
    let mut start = 0usize;
    let mut end = s.len();
    while start < end && is_ws(s[start]) {
        start += 1;
    }
    while end > start && is_ws(s[end - 1]) {
        end -= 1;
    }
    let mut ok = true;
    let mut i = start;
    while i < end {
        if s[i] >= 128 {
            ok = false;
        }
        i += 1;
    }
    ok
}
""", """
fn is_ws(b: u8) -> bool {
    b == b' ' || b == b'\\t' || b == b'\\n' || b == b'\\r' || b == 11u8 || b == 12u8
}
pub fn header_field_ok(s: &[u8]) -> bool {
    let mut ok = true;
    let mut i = 0usize;
    while i < s.len() {
        if s[i] >= 128 || is_ws(s[i]) {
            ok = false;
        }
        i += 1;
    }
    ok
}
""", "b\"Transfer-Encoding \"", "src/common.rs HeaderField::from_str: trimmed whitespace (request smuggling)", "src/common.rs")

k("evm_memset", "RUSTSEC-2021-0066", "memory_set_len", "pub fn memory_set_len(cur_len: usize, offset: usize, value_len: usize, target_size: Option<usize>, limit: usize) -> Result<usize, u8>",
  "New length of EVM memory after writing value (value_len bytes) at offset, zero-padded to target_size (default value_len). Err if offset+target_size exceeds limit. Writing an empty value must not grow memory.",
  "dos_loop_or_recursion", "verbatim_logic",
  """
pub fn memory_set_len(cur_len: usize, offset: usize, value_len: usize, target_size: Option<usize>, limit: usize) -> Result<usize, u8> {
    let target = match target_size {
        Some(t) => t,
        None => value_len,
    };
    match offset.checked_add(target) {
        Some(pos) => {
            if pos > limit {
                return Err(1);
            }
        }
        None => return Err(1),
    }
    if cur_len < offset + target {
        Ok(offset + target)
    } else {
        Ok(cur_len)
    }
}
""", """
pub fn memory_set_len(cur_len: usize, offset: usize, value_len: usize, target_size: Option<usize>, limit: usize) -> Result<usize, u8> {
    if value_len == 0 {
        return Ok(cur_len);
    }
    let target = match target_size {
        Some(t) => t,
        None => value_len,
    };
    match offset.checked_add(target) {
        Some(pos) => {
            if pos > limit {
                return Err(1);
            }
        }
        None => return Err(1),
    }
    if cur_len < offset + target {
        Ok(offset + target)
    } else {
        Ok(cur_len)
    }
}
""", "0usize, 0usize, 0usize, Some(1000usize), 1048576usize", "src/memory.rs Memory::set: empty value with large target_size over-allocates", "src/memory.rs")

k("bcrypt_split", "RUSTSEC-2026-0199", "split_hash_salt_len", "pub fn split_hash_salt_len(hash: &[u8]) -> Result<usize, u8>",
  "Validates a bcrypt hash string and returns the salt length (22). A valid hash is exactly 60 ASCII bytes; every other input must give Err, never panic.",
  "panic", "model_of_std",
  """
fn is_char_boundary(b: u8) -> bool {
    b < 128 || b >= 192
}
pub fn split_hash_salt_len(hash: &[u8]) -> Result<usize, u8> {
    if hash.len() != 60 {
        return Err(1);
    }
    assert!(is_char_boundary(hash[22]));
    Ok(22)
}
""", """
pub fn split_hash_salt_len(hash: &[u8]) -> Result<usize, u8> {
    if hash.len() != 60 {
        return Err(1);
    }
    let mut ascii = true;
    let mut i = 0usize;
    while i < hash.len() {
        if hash[i] >= 128 {
            ascii = false;
        }
        i += 1;
    }
    if !ascii {
        return Err(2);
    }
    Ok(22)
}
""", "&[b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', 0xA3, b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a', b'a']",
  "src/lib.rs split_hash: &str slicing at a non-char-boundary on non-ASCII 60-byte input", "src/lib.rs")

k("versionize_fam", "RUSTSEC-2023-0030", "fam_entry", "pub fn fam_entry(entries: &[u32], header_len: usize, i: usize) -> Result<u32, u8>",
  "Reads entry i (< header_len) of a deserialised flexible-array struct whose header declares header_len entries; Err if the header length disagrees with the actual number of entries, never panic.",
  "panic", "model_of_std",
  "pub fn fam_entry(entries: &[u32], header_len: usize, i: usize) -> Result<u32, u8> {\n    if i < header_len {\n        Ok(entries[i])\n    } else {\n        Err(2)\n    }\n}",
  "pub fn fam_entry(entries: &[u32], header_len: usize, i: usize) -> Result<u32, u8> {\n    if header_len != entries.len() {\n        return Err(1);\n    }\n    if i < header_len {\n        Ok(entries[i])\n    } else {\n        Err(2)\n    }\n}",
  "&[7u32, 8], 5usize, 3usize", "src/primitives.rs FamStructWrapper::deserialize: header length not checked against entries", "src/primitives.rs")


def main():
    cand = {}
    for l in open(CAND):
        r = json.loads(l); cand[r["adv_id"]] = r
    root = os.path.join(HERE, "kernels")
    for e in K:
        c = cand[e["adv"]]
        d = os.path.join(root, e["id"])
        for ver in ("pre", "post"):
            os.makedirs(f"{d}/{ver}/src", exist_ok=True)
            open(f"{d}/{ver}/Cargo.toml", "w").write(f'[package]\nname = "k_{e["id"]}_{ver}"\nversion = "0.1.0"\nedition = "2021"\n\n[lib]\npath = "src/lib.rs"\n\n[workspace]\n')
            open(f"{d}/{ver}/src/lib.rs", "w").write(e[ver])
        meta = dict(item_id=f"ker-{e['id']}", kernel=e["id"], advisory=e["adv"], crate=c["crate"], pre_version=c["pre_version"], post_version=c["post_version"],
                    advisory_url=c["url"], title=c["title"], source_file=e["file"], function=e["fn"], signature=e["sig"], spec_doc=e["spec_doc"],
                    bug_class=e["bug_class"], fidelity=e["fidelity"], extraction_note=e["note"], witness_args=e["witness"],
                    labels={"buggy": f"{c['crate']}@{c['pre_version']}", "reference": f"{c['crate']}@{c['post_version']}"})
        json.dump(meta, open(f"{d}/meta.json", "w"), indent=1)
    print(len(K), "kernels written to", root)

if __name__ == "__main__":
    main()