First release available from PyPI:
pip install sabba
sabba verify cwe121_stack_overflowThat second command proves a real stack buffer overflow with no clone, no model and no API key,
because the demo targets now ship inside the package.
Soundness fixes in the C and C++ oracle
Read this part if you use verify or prove, because it changes what counts as a finding.
A bare fatal signal is no longer verified. The oracle used to verify any signal it saw when
no sanitizer fired. The signal a PoC most often earns is SIGABRT from assert() or abort(),
and a defensive assertion refusing bad input is hardening rather than a vulnerability, so that
rule turned target robustness checks into confirmed findings. Such a run now returns
signal_unconfirmed and is surfaced as an unverified candidate, the same way a hang already
was. Every managed prover already required an attributed frame before calling a signal
native_crash; the C path now matches them.
The vulnerability class comes off the sanitizer's own error line. It used to be matched
anywhere in stderr, which the target also writes to, so a program that logged "guarding against
double-free" while UBSan reported a signed integer overflow was filed as a double-free.
Both are covered by regression tests. If you were relying on crash_signal verdicts, expect
fewer findings and more candidates, which is the intended direction.
Packaging
The demo targets moved under sabba/ so they ship in the wheel, and a target argument resolves
either as a path or as the bare name of a bundled target. An existing path always wins, so a
directory of your own is never shadowed by a bundled name. A missing target now lists what is
available instead of raising a traceback.
Full test suite: 303 passed, 11 skipped.