"""

Cyclops v2 - Pillar 3, the dynamic oracle.

The ONLY component allowed to declare a finding real. It does not read code and

opine; it executes and observes. For the memory-corruption / parser archetype it:

  1. compiles a libFuzzer harness against the target with ASan/UBSan,

  2. fuzzes for a time budget,

  3. on a crash: saves the reproducer + sanitizer report,

  4. TRIAGES the crash (write vs read primitive, PC control, exploitability),

  5. writes a Proof node and - only if the triage clears the severity bar -

     promotes the hypothesis to a Finding through memory's gate.

A crash is ground truth. memory.promote_to_finding refuses anything without it.

"""

import os, sys, re, subprocess, glob, shutil, time

sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "memory"))

from memory import Memory

CYCLOPS_HOME = os.environ.get("CYCLOPS_HOME", "/opt/cyclops-v2")

CRASH_DIR    = os.path.join(CYCLOPS_HOME, "oracle", "crashes")

CLANG        = os.environ.get("CYCLOPS_CLANG", "clang")

ASAN_CLASS = [

    (r"heap-buffer-overflow.*WRITE",   ("heap OOB WRITE",   "CRITICAL")),

    (r"stack-buffer-overflow.*WRITE",  ("stack OOB WRITE",  "CRITICAL")),

    (r"global-buffer-overflow.*WRITE", ("global OOB WRITE", "HIGH")),

    (r"heap-use-after-free",           ("use-after-free",   "CRITICAL")),

    (r"double-free",                   ("double-free",      "HIGH")),

    (r"WRITE of size",                 ("OOB WRITE",        "CRITICAL")),

    (r"heap-buffer-overflow.*READ",    ("heap OOB READ",    "MEDIUM")),

    (r"stack-buffer-overflow.*READ",   ("stack OOB READ",   "MEDIUM")),

    (r"SEGV on unknown address",       ("SEGV",             "HIGH")),

    (r"stack-overflow",                ("stack exhaustion", "LOW")),

    (r"out-of-memory",                 ("OOM",              "LOW")),

]

def compile_harness(harness_c, target_srcs, out_bin, extra_flags=None):

    """clang -fsanitize=fuzzer,address. Returns (ok, log)."""

    cmd = [CLANG, "-g", "-O1", "-fsanitize=fuzzer,address,undefined",

           "-fno-omit-frame-pointer", harness_c] + list(target_srcs) + \

          (extra_flags or []) + ["-o", out_bin]

    p = subprocess.run(cmd, capture_output=True, text=True)

    return p.returncode == 0, (p.stderr or "") + (p.stdout or "")

def triage(asan_text):

    """Classify the sanitizer report -> (primitive, severity, exploitable)."""

    for pat, (prim, sev) in ASAN_CLASS:

        if re.search(pat, asan_text, re.I):

            exploitable = sev in ("CRITICAL", "HIGH") and "WRITE" in prim.upper() \

                          or "use-after-free" in prim or prim == "SEGV"

            return prim, sev, exploitable

    return "unknown-fault", "MEDIUM", False

def run_fuzz(fuzz_bin, seconds=120, corpus=None):

    """Run libFuzzer. Returns (crashed, crash_input_path, asan_text)."""

    os.makedirs(CRASH_DIR, exist_ok=True)

    artifact = os.path.join(CRASH_DIR, "crash-")

    args = [fuzz_bin, f"-max_total_time={seconds}", "-print_final_stats=1",

            f"-artifact_prefix={artifact}"]

    if corpus:

        args.append(corpus)

    p = subprocess.run(args, capture_output=True, text=True)

    txt = (p.stderr or "") + (p.stdout or "")

    crashed = ("ERROR: AddressSanitizer" in txt or "ERROR: libFuzzer" in txt

               or "SUMMARY: " in txt or "runtime error:" in txt)

    crash_input = None

    found = sorted(glob.glob(artifact + "*"))

    if found:

        crash_input = found[-1]

    return crashed, crash_input, txt

def prove_memory_corruption(target_id, hypothesis_id, impact_family,

                            harness_c, target_srcs, extra_flags=None,

                            seconds=120, repo=""):

    """Full oracle run for one parser target. Returns a result dict."""

    m = Memory()

    os.makedirs(CRASH_DIR, exist_ok=True)

    out_bin = os.path.join(CRASH_DIR, f"fuzz_{target_id[:8]}")

    ok, log = compile_harness(harness_c, target_srcs, out_bin, extra_flags)

    if not ok:

        return {"status": "BUILD_FAILED", "log": log[-2000:]}

    crashed, crash_input, asan = run_fuzz(out_bin, seconds=seconds)

    if not crashed:

        m.add_proof(hypothesis_id, "DISPROVEN", "libfuzzer+asan", "",

                    f"fuzzed {seconds}s, no crash reached the sink")

        return {"status": "NO_CRASH", "seconds": seconds}

    prim, sev, exploitable = triage(asan)

    report_path = os.path.join(CRASH_DIR, f"report_{target_id[:8]}.txt")

    with open(report_path, "w") as fh:

        fh.write(asan)

    summary = f"{prim}; ASan-confirmed; reproducer={crash_input}"

    pid = m.add_proof(hypothesis_id, "REPLICA_CONFIRMED", "libfuzzer+asan",

                      report_path, summary)

    result = {"status": "CRASH", "primitive": prim, "severity": sev,

              "exploitable": exploitable, "reproducer": crash_input,

              "report": report_path, "proof": pid}

    if exploitable:

        fid = m.promote_to_finding(

            hypothesis_id, impact_family, sev,

            f"{repo}: {prim} in parser -> {impact_family}",

            novel=False, cve_checked=False)

        result["finding"] = fid

    else:

        m.clear_axis(target_id, "memory-corruption", f"{prim}@{hypothesis_id[:8]}",

                     "LOW", f"{prim} reproduced but not an RCE-capable primitive")

        result["note"] = "crash is not RCE-capable; logged as low axis, not a P1 finding"

    return result

if __name__ == "__main__":

    print("oracle module - invoked by orchestrator. See prove_memory_corruption().")