[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$apiParty6fBuHLCPZ1LTYs42XHdVbjpSDOYYPYzyxeAGwSN5Tp8":3,"$apiPartyfD2PKROdNs1SDONnZpkg840PUE9OJOuClWd4x4spnLU":563,"$apiPartyfD2PKROdNs1SDONnZpkg840PUE9OJOuClWd4x4spnLU$H93EERW16b":563},{"product_data":4,"scene_data":21,"task_data":407,"modality_data":441,"domain_data":478},[5,9,12,15,18],{"name":6,"value":7,"add_value":8,"describe":8},"Rivo","1","",{"name":10,"value":11,"add_value":8,"describe":8},"Cubo","2",{"name":13,"value":14,"add_value":8,"describe":8},"Moye","3",{"name":16,"value":17,"add_value":8,"describe":8},"Juro","4",{"name":19,"value":20,"add_value":8,"describe":8},"Ordo","5",[22,73,135,197,232,267,302,337,372],{"name":23,"value":7,"add_value":24,"describe":25,"children":26},"Home & Indoor","sofa","AI enhances everyday home life. Our datasets cover real indoor scenes to support smart devices, robotics, and home intelligence.",[27,29,31,33,35,37,40,43,46,49,52,55,58,61,64,67,70],{"name":28,"value":7},"Living Room",{"name":30,"value":11},"Bedroom",{"name":32,"value":14},"Kitchen",{"name":34,"value":17},"Dining Area",{"name":36,"value":20},"Bathroom",{"name":38,"value":39},"Entrance \u002F Foyer","6",{"name":41,"value":42},"Corridor \u002F Hallway","7",{"name":44,"value":45},"Staircase","8",{"name":47,"value":48},"Home Office","9",{"name":50,"value":51},"Hobby \u002F Game Room","10",{"name":53,"value":54},"Worship Space","11",{"name":56,"value":57},"Garage","12",{"name":59,"value":60},"Utility \u002F Laundry Room","13",{"name":62,"value":63},"Pantry","14",{"name":65,"value":66},"Basement","15",{"name":68,"value":69},"Garden","16",{"name":71,"value":72},"Balcony","17",{"name":74,"value":11,"add_value":75,"describe":76,"children":77},"Office & Educational","workshop","AI is reshaping work and learning. Our datasets capture offices and classrooms to power automation and next-generation productivity tools.",[78,81,84,87,90,93,96,99,102,105,108,111,114,117,120,123,126,129,132],{"name":79,"value":80},"Open Office","18",{"name":82,"value":83},"Private Office","19",{"name":85,"value":86},"Co-working Space","20",{"name":88,"value":89},"Reception \u002F Lobby","21",{"name":91,"value":92},"Conference Room","22",{"name":94,"value":95},"Huddle Room \u002F Booth","23",{"name":97,"value":98},"Lecture Hall \u002F Auditorium","24",{"name":100,"value":101},"Classroom","25",{"name":103,"value":104},"Science Laboratory","26",{"name":106,"value":107},"Library","27",{"name":109,"value":110},"Design Studio","28",{"name":112,"value":113},"Pantry \u002F Breakroom","29",{"name":115,"value":116},"Cafeteria \u002F Canteen","30",{"name":118,"value":119},"Restroom (Commercial)","31",{"name":121,"value":122},"Gymnasium \u002F Sports Hall","32",{"name":124,"value":125},"Server Room","33",{"name":127,"value":128},"Mailroom \u002F Logistics","34",{"name":130,"value":131},"Janitorial Closet","35",{"name":133,"value":134},"Corridor \u002F Elevators","36",{"name":136,"value":14,"add_value":137,"describe":138,"children":139},"Healthcare & Medical","love-and-help","AI is advancing modern healthcare. Our datasets include clinics and hospitals to enable clinical insights and medical automation.",[140,143,146,149,152,155,158,161,164,167,170,173,176,179,182,185,188,191,194],{"name":141,"value":142},"Operating Theatre \u002F OR","37",{"name":144,"value":145},"Consultation Room","38",{"name":147,"value":148},"Treatment Room","39",{"name":150,"value":151},"Dental Clinic","40",{"name":153,"value":154},"Inpatient Ward","41",{"name":156,"value":157},"Nurse Station","42",{"name":159,"value":160},"ICU","43",{"name":162,"value":163},"NICU (Neonatal ICU)","44",{"name":165,"value":166},"Emergency Room (ER)","45",{"name":168,"value":169},"Hospital Corridor","46",{"name":171,"value":172},"Waiting Area","47",{"name":174,"value":175},"CT\u002FMRI","48",{"name":177,"value":178},"Medical Laboratory","49",{"name":180,"value":181},"Phlebotomy Room","50",{"name":183,"value":184},"Rehabilitation Gym","51",{"name":186,"value":187},"Assisted Living Room","52",{"name":189,"value":190},"Pharmacy","53",{"name":192,"value":193},"Sterile Processing Dept","54",{"name":195,"value":196},"Medical Storage","55",{"name":198,"value":17,"add_value":199,"describe":200,"children":201},"Business & Public Service","business","AI is elevating commercial and public services. Our datasets span retail, dining, and service centers to improve intelligent operations.",[202,205,208,211,214,217,220,223,226,229],{"name":203,"value":204},"Shopping Mall Atrium","86",{"name":206,"value":207},"Supermarket Shelf","87",{"name":209,"value":210},"Self-Checkout Counter","88",{"name":212,"value":213},"Restaurant Dining Hall","89",{"name":215,"value":216},"Commercial Kitchen","90",{"name":218,"value":219},"Hotel Lobby","91",{"name":221,"value":222},"Subway Platform","92",{"name":224,"value":225},"Security Checkpoint","93",{"name":227,"value":228},"Underground Parking","94",{"name":230,"value":231},"Bank Teller Zone","95",{"name":233,"value":20,"add_value":234,"describe":235,"children":236},"Industrial & Manufacturing","robot-arm","AI is modernizing industry. Our datasets capture factories and logistics spaces to support robotics and intelligent manufacturing.",[237,240,243,246,249,252,255,258,261,264],{"name":238,"value":239},"Final Assembly Line","96",{"name":241,"value":242},"Quality Control Station","97",{"name":244,"value":245},"Robotic Welding Cell","98",{"name":247,"value":248},"CNC Machining Center","99",{"name":250,"value":251},"Cleanroom","100",{"name":253,"value":254},"Automated Warehouse","101",{"name":256,"value":257},"Loading Dock","102",{"name":259,"value":260},"Sorting Center","103",{"name":262,"value":263},"Chemical Plant","104",{"name":265,"value":266},"Power Substation","105",{"name":268,"value":39,"add_value":269,"describe":270,"children":271},"Transportation & Driving","car","AI is revolutionizing mobility. Our datasets capture road networks, vehicle dynamics and traffic scenarios to support autonomous driving and intelligent transportation systems.",[272,275,278,281,284,287,290,293,296,299],{"name":273,"value":274},"Urban Intersection","56",{"name":276,"value":277},"Highway \u002F Expressway","57",{"name":279,"value":280},"Tunnel","58",{"name":282,"value":283},"Roundabout","59",{"name":285,"value":286},"School \u002F Hospital Zone","60",{"name":288,"value":289},"Toll Station","61",{"name":291,"value":292},"Construction Zone","62",{"name":294,"value":295},"Parking Garage","63",{"name":297,"value":298},"Driver Cabin","64",{"name":300,"value":301},"Adverse Weather","65",{"name":303,"value":42,"add_value":304,"describe":305,"children":306},"Outdoor & Construction","tent-tree","AI is optimizing outdoor operations. Our datasets capture construction sites, open-air work zones and outdoor infrastructure to support smart construction and autonomous outdoor machinery.",[307,310,313,316,319,322,325,328,331,334],{"name":308,"value":309},"Excavation Site","66",{"name":311,"value":312},"Scaffolding Area","67",{"name":314,"value":315},"Material Storage Yard","68",{"name":317,"value":318},"Site Entrance","69",{"name":320,"value":321},"Roadwork Zone","70",{"name":323,"value":324},"Bridge Infrastructure","71",{"name":326,"value":327},"Transmission Line","72",{"name":329,"value":330},"Open-pit Mine","73",{"name":332,"value":333},"Tunneling Site","74",{"name":335,"value":336},"Post-Disaster Rubble","75",{"name":338,"value":45,"add_value":339,"describe":340,"children":341},"Nature, Aerial & Aquatic","global-loop","AI is exploring the natural world. Our datasets capture terrestrial landscapes, aerial vistas and aquatic ecosystems to support environmental monitoring and autonomous exploration systems.",[342,345,348,351,354,357,360,363,366,369],{"name":343,"value":344},"Deep Forest","76",{"name":346,"value":347},"Farmland \u002F Crops","77",{"name":349,"value":350},"River \u002F Lake","78",{"name":352,"value":353},"Open Ocean","79",{"name":355,"value":356},"Underwater Coral Reef","80",{"name":358,"value":359},"Fish Farm","81",{"name":361,"value":362},"Mountain Terrain","82",{"name":364,"value":365},"Urban Low Altitude","83",{"name":367,"value":368},"Fire Scene","84",{"name":370,"value":371},"Desert \u002F Gobi","85",{"name":373,"value":48,"add_value":374,"describe":375,"children":376},"Virtul & Digital","siri","AI is reshaping the virtual realm. Our datasets capture digital twins, virtual environments and simulated spaces to support metaverse development and intelligent digital interaction.",[377,380,383,386,389,392,395,398,401,404],{"name":378,"value":379},"VR Social Space","106",{"name":381,"value":382},"Synthetic Driving Sim","107",{"name":384,"value":385},"Digital Twin City","108",{"name":387,"value":388},"FPS \u002F MOBA Game","109",{"name":390,"value":391},"Robotics Gym","110",{"name":393,"value":394},"AR Navigation","111",{"name":396,"value":397},"Virtual Showroom","112",{"name":399,"value":400},"Code \u002F IDE Interface","113",{"name":402,"value":403},"App GUI Screen","114",{"name":405,"value":406},"Synthetic Face\u002FID","115",[408,411,414,417,420,423,426,429,432,435,438],{"name":409,"value":7,"add_value":410,"describe":8},"Classification","rubric",{"name":412,"value":11,"add_value":413,"describe":8},"Detection","radar",{"name":415,"value":14,"add_value":416,"describe":8},"Segmentation","segmentation",{"name":418,"value":17,"add_value":419,"describe":8},"Tacking","crosshairs",{"name":421,"value":20,"add_value":422,"describe":8},"Estimation","streamline",{"name":424,"value":39,"add_value":425,"describe":8},"QA","qa",{"name":427,"value":42,"add_value":428,"describe":8},"Recognition","finger-scan",{"name":430,"value":45,"add_value":431,"describe":8},"Control","control",{"name":433,"value":48,"add_value":434,"describe":8},"Extraction","extraction",{"name":436,"value":51,"add_value":437,"describe":8},"Retrieval","retrieval",{"name":439,"value":54,"add_value":440,"describe":8},"Forecast","forecast",[442,445,448,451,454,457,460,463,466,469,472,475],{"name":443,"value":7,"add_value":444,"describe":8},"Audio","audio",{"name":446,"value":11,"add_value":447,"describe":8},"Image","image",{"name":449,"value":14,"add_value":450,"describe":8},"Text","text",{"name":452,"value":17,"add_value":453,"describe":8},"Video","video",{"name":455,"value":20,"add_value":456,"describe":8},"Multi","multi",{"name":458,"value":39,"add_value":459,"describe":8},"Document","document",{"name":461,"value":42,"add_value":462,"describe":8},"Time-Series","time-series",{"name":464,"value":45,"add_value":465,"describe":8},"3D cloud","cloud",{"name":467,"value":48,"add_value":468,"describe":8},"Code","code",{"name":470,"value":51,"add_value":471,"describe":8},"Event","event",{"name":473,"value":54,"add_value":474,"describe":8},"Motion","motion",{"name":476,"value":57,"add_value":477,"describe":8},"Interaction","interaction",[479,482,487,491,494,499,504,509,514,519,524,528,532,536,540,544,548,552,556,559],{"id":480,"value":480,"name":233,"intro":481,"add_value":234,"describe":481},2,"智能质检：利用图像识别、多模态模型对产品外观或声音、振动等数据进行分析，自动识别缺陷，提高质量控制效率。\n工业知识问答与文档理解：通过大模型理解和总结技术文档、操作手册，实现快速问答、知识检索和培训支持。\n安全监测与风险预警：实时分析视频、传感器和操作日志，识别潜在危险行为或异常状态，提前预警，保障人员和设备安全。",{"id":483,"value":483,"name":484,"intro":485,"add_value":486,"describe":485},3,"Finance & Insurance","风险评估与预测：分析大量客户数据，评估信用风险、市场风险等，预测违约概率、股价走势等，辅助金融机构决策。\n智能投顾：根据客户风险偏好、资产状况等，提供个性化投资组合建议，实时调整投资策略。\n反欺诈检测：通过分析交易数据、用户行为，识别异常交易和欺诈行为，保障金融安全。","funds",{"id":488,"value":488,"name":489,"intro":490,"add_value":269,"describe":490},1,"Transport & Automotive","智能座舱：打造多模态交互的 AI 座舱，通过语音、手势、面部识别等实现人机交互，如语音控制导航、音乐播放。\n驾驶员状态监测：识别疲劳、分心、抽烟、打电话等行为，通过大模型判断危险等级，触发相应提醒或干预机制。\n智能驾驶：AI 用于环境感知、路径规划与决策控制，使车辆能识别道路、行人、障碍物等，实现自适应巡航、自动泊车、车道保持等功能，提升驾驶安全性与便利性。",{"id":492,"value":492,"name":136,"intro":493,"add_value":137,"describe":493},4,"医学影像诊断：分析 CT、MRI 等影像，辅助医生检测疾病、识别病灶，如 AI 系统可快速发现肺部结节。\n医患对话助手：通过自然语言处理理解患者问题，提供初步健康建议或就诊指导，缓解医生接诊压力。\n智能健康管理：根据用户健康数据，提供个性化健康建议、疾病预警，如智能手环结合 AI 分析用户运动、睡眠、心率等数据。",{"id":495,"value":495,"name":496,"intro":497,"add_value":498,"describe":497},6,"Smart Devices","多模态交互：支持语音、手势、眼神等多种交互方式，如 AI 眼镜可通过语音指令实现翻译、搜索功能。\n智能感知与处理：使设备能感知环境、理解用户需求，如智能音箱根据环境噪音自动调节音量。\n个性化服务：根据用户使用习惯和偏好，提供个性化功能与服务，如智能手表为用户定制运动健身计划。","microscope",{"id":500,"value":500,"name":501,"intro":502,"add_value":503,"describe":502},8,"Law & Government","智能法律问答：面向公众或企业用户，提供合规、劳动法、婚姻继承、知识产权等常见法律问题的智能解答。\n合同审查与风险识别：利用大模型分析合同内容，识别潜在风险条款、漏洞或不合理约定，提升合同审核质量。\n法律知识图谱构建：自动梳理法规、案例、条文之间的引用关系，构建语义化知识图谱，支持智能分析和推理。","hammer",{"id":505,"value":505,"name":506,"intro":507,"add_value":508,"describe":507},7,"Education & Training","个性化学习：根据学生学习进度、能力和知识掌握情况，推送个性化学习内容与练习，如智能辅导系统为学生制定专属学习计划。\n智能教学辅助：AI 助教协助教师进行作业批改、答疑解惑，还可分析教学数据，为教师提供教学反馈，优化教学方法。\n虚拟学习环境：利用 AI 创建虚拟实验、历史场景等，让学生沉浸式学习，如在虚拟化学实验室中进行实验操作。","degree-hat",{"id":510,"value":510,"name":511,"intro":512,"add_value":513,"describe":512},5,"Agriculture & Food","作物病虫害识别与防治：通过图像识别分析农作物叶片、果实等症状，识别病虫害类型，给出防治建议，减少产量损失。\n农产品质量检测：利用图像和传感器数据，识别果蔬等农产品的成熟度、外观缺陷，进行自动分级，提高市场竞争力。\n农情监测与预测：利用卫星遥感、气象和传感器数据，结合大模型预测作物长势、干旱、洪涝等农情变化。","ph-farm",{"id":515,"value":515,"name":516,"intro":517,"add_value":518,"describe":517},9,"Retail & E-commerce","智能客服：通过自然语言对话理解用户需求，提供产品推荐、订单查询、退换货支持等服务，提升客户满意度。\n个性化营销推荐：基于用户浏览、购买、偏好等行为数据，生成个性化推荐内容与优惠策略，提高转化率和客单价。\n商品内容生成：自动撰写商品标题、卖点描述、使用说明等内容，适用于海量SKU的内容生产与多语言发布。","buy",{"id":520,"value":520,"name":521,"intro":522,"add_value":523,"describe":8},10,"Security & Protection",null,"safe-shield-line",{"id":525,"value":525,"name":526,"intro":522,"add_value":527,"describe":8},11,"Environment & Climate","weather",{"id":529,"value":529,"name":530,"intro":522,"add_value":531,"describe":8},12,"Energy & Resource","energy-leaf",{"id":533,"value":533,"name":534,"intro":522,"add_value":535,"describe":8},13,"Express & Logistics","speed-outline",{"id":537,"value":537,"name":538,"intro":522,"add_value":539,"describe":8},15,"Sports","baseball-outline",{"id":541,"value":541,"name":542,"intro":522,"add_value":543,"describe":8},16,"General Data","daily-booth",{"id":545,"value":545,"name":546,"intro":522,"add_value":547,"describe":8},17,"Content & Media","media",{"id":549,"value":549,"name":550,"intro":522,"add_value":551,"describe":8},18,"Construction","construction",{"id":553,"value":553,"name":554,"intro":522,"add_value":555,"describe":8},19,"IT & Telecom","tech",{"id":557,"value":557,"name":558,"intro":522,"add_value":498,"describe":8},20,"Science & Research",{"id":560,"value":560,"name":561,"intro":522,"add_value":562,"describe":8},21,"Language & Culture","lang",{"id":564,"unique_code":565,"title":566,"icon":8,"intro":567,"cate":483,"detail":568,"create_time":569,"update_time":570,"price":571,"view_count":572,"download_count":573,"unit":573,"amount":574,"is_create_order":573,"enterprise_id":488,"seo_keywords":575,"seo_description":576,"data_format":577,"file_size":578,"apply_scene":579,"training_task":580,"version":581,"dataset_type_id":492,"dataset_scene_id":553,"sample_file":582,"banner":8,"unit_name":8,"cate_name":449,"icon_url":8,"banner_url":8,"sample_file_url":8,"data_dict":583,"qa_list":634,"sample_metadatas":651,"text_sample_content":695,"enterprise_name":696,"enterprise_logo":697,"data_distribution":698},1127,"d6410db07efc00b39f23c91f6601f223","Embedded Firmware Update and Bootloader Security Code Reasoning Dataset","Train models to pinpoint firmware security defects and explain their impact using annotated update and boot workflow code.","\u003Cp>This dataset focuses on source code for firmware update, boot, and rollback workflows in IoT and OT devices, paired with security analysis examples. Samples identify issue categories, vulnerable locations, execution paths, root causes, security impacts, and remediation guidance, with emphasis on validation logic, state transitions, and trust boundaries. It supports training and evaluating models that reason about firmware code paths, locate security defects, and explain failure causes, making it suitable for code SFT and firmware security debugging.\u003C\u002Fp>","2026-10-10 18:26:41","2026-10-19 17:19:32","0.00",28,0,5000,"firmware security dataset, bootloader security, IoT vulnerability analysis, OT security, code reasoning, firmware update security, root cause analysis, code SFT","Source code for IoT and OT firmware update, boot, and rollback workflows, with defect locations, execution paths, root cause analysis, and remediation guidance.","JSON","0.4GB","embedded firmware security, secure bootloader development, firmware vulnerability analysis","security defect detection, code reasoning, vulnerability impact analysis","V1.0","rivo\u002Fsample-packages\u002F1cd19689-bf64-4503-ab37-90466469d391\u002F20261010.zip",[584,589,594,599,604,609,614,619,624,629],{"id":573,"name":585,"field":586,"intro":587,"type":588},"File Name","file_name","File name","string",{"id":590,"name":591,"field":592,"intro":593,"type":588},8194,"Programming Language","language","Programming language identified from the source code.",{"id":595,"name":596,"field":597,"intro":598,"type":588},8195,"Root Cause Analysis","root_cause","Explanation of why the defect occurs, including errors in validation, state management, or trust boundary handling.",{"id":600,"name":601,"field":602,"intro":603,"type":588},8196,"Remediation","remediation","Code changes or security controls recommended to address the underlying cause of the defect.",{"id":605,"name":606,"field":607,"intro":608,"type":588},8197,"Source Code","source_code","Source code for firmware update, bootloader, or rollback workflows used in security analysis.",{"id":610,"name":611,"field":612,"intro":613,"type":588},8198,"Related Function","function_name","Name of the function associated with the security issue or a critical state transition.",{"id":615,"name":616,"field":617,"intro":618,"type":588},8199,"Execution Path","execution_path","Code path taken when the issue is triggered and the related state changes.",{"id":620,"name":621,"field":622,"intro":623,"type":588},8200,"Issue Category","issue_category","Category of the security issue, such as a validation defect, state transition error, or trust boundary issue.",{"id":625,"name":626,"field":627,"intro":628,"type":588},8201,"Security Impact","security_impact","Potential effects of the defect on firmware integrity, device booting, or update and rollback security.",{"id":630,"name":631,"field":632,"intro":633,"type":588},8202,"Vulnerable Location","vulnerable_location","Code location, statement, or logic branch associated with the defect.",[635,639,643,647],{"id":636,"question":637,"answer":638},5958,"What does the dataset contain?","It includes source code for firmware update, bootloader, or rollback workflows, along with structured information such as issue category, related function, vulnerable location, execution path, root cause, security impact, and remediation guidance.",{"id":640,"question":641,"answer":642},5959,"Which capabilities can it help train?","The dataset is suited to training models to trace firmware code paths, identify validation defects and state transition errors, reason about trust boundary issues, and suggest fixes based on root cause analysis. It can also support security debugging and model evaluation.",{"id":644,"question":645,"answer":646},5960,"How are the samples annotated?","Samples are organized into fields covering source code, programming language, and related functions, as well as analytical annotations for defect location, root cause, and security impact. Actual coverage and annotation completeness depend on the delivered dataset.",{"id":648,"question":649,"answer":650},5961,"How can the dataset be accessed and used?","The dataset can be obtained through the channels supported by its provider. Delivery format, access method, and usage rights are subject to the product listing or license agreement. Follow the applicable license and conduct research, training, or evaluation in an appropriate security environment.",[652,669,682],{"id":653,"relate_table":654,"relate_id":655,"file_size":573,"file_name":656,"path":8,"duration":573,"cate":483,"file_format":657,"audio_rate":8,"audio_channel":522,"audio_bit_depth":522,"quality":8,"annotation":658,"cate_name":659,"language":660,"root_cause":661,"remediation":662,"source_code":663,"function_name":664,"execution_path":665,"issue_category":666,"security_impact":667,"vulnerable_location":668},14782,"union_cubo",353668469,"样例_3.json","json","{\"language\": \"C\", \"root_cause\": \"The code establishes that the image matches the supplied key, but not that the key is authorized to sign firmware for this device. It therefore treats attacker-controlled verification material as a trust anchor.\", \"remediation\": \"Verify update signatures against a trust anchor provisioned independently of the request, such as an immutable public key or a certificate chain validated to a pinned root. Reject caller-supplied keys unless they are authenticated and authorized by that trust chain.\", \"source_code\": \"#include \u003Cstdbool.h>\\n#include \u003Cstddef.h>\\n#include \u003Cstdint.h>\\n\\nstruct update_request {\\n    const uint8_t *image;\\n    size_t image_len;\\n    const uint8_t *signature;\\n    size_t signature_len;\\n    const uint8_t *public_key;\\n    size_t public_key_len;\\n};\\n\\nextern bool verify_detached(const uint8_t *, size_t, const uint8_t *, size_t, const uint8_t *, size_t);\\nextern bool write_update(const uint8_t *, size_t);\\n\\nbool accept_update(const struct update_request *request)\\n{\\n    if (request == NULL || request->image == NULL ||\\n        request->signature == NULL || request->public_key == NULL) return false;\\n    if (!verify_detached(request->image, request->image_len,\\n                         request->signature, request->signature_len,\\n                         request->public_key, request->public_key_len)) return false;\\n    return write_update(request->image, request->image_len);\\n}\", \"function_name\": \"accept_update\", \"execution_path\": \"A caller provides an image, signature, and public key. The function verifies the signature using that same caller-supplied key and, if verification succeeds, writes the image as an update. No trusted-key lookup or validation is present in the shown path.\", \"issue_category\": \"Trust boundary and authentication flaw\", \"security_impact\": \"A caller able to submit updates can generate a key pair, sign an unauthorized image, and provide the corresponding public key. If the verifier accepts it, the function proceeds to write that image, undermining firmware authenticity and integrity.\", \"vulnerable_location\": \"The verification call uses request->public_key, which is supplied as part of the update request, without checking it against a trusted key or certificate chain.\"}","文本","C","The code establishes that the image matches the supplied key, but not that the key is authorized to sign firmware for this device. It therefore treats attacker-controlled verification material as a trust anchor.","Verify update signatures against a trust anchor provisioned independently of the request, such as an immutable public key or a certificate chain validated to a pinned root. Reject caller-supplied keys unless they are authenticated and authorized by that trust chain.","#include \u003Cstdbool.h>\n#include \u003Cstddef.h>\n#include \u003Cstdint.h>\n\nstruct update_request {\n    const uint8_t *image;\n    size_t image_len;\n    const uint8_t *signature;\n    size_t signature_len;\n    const uint8_t *public_key;\n    size_t public_key_len;\n};\n\nextern bool verify_detached(const uint8_t *, size_t, const uint8_t *, size_t, const uint8_t *, size_t);\nextern bool write_update(const uint8_t *, size_t);\n\nbool accept_update(const struct update_request *request)\n{\n    if (request == NULL || request->image == NULL ||\n        request->signature == NULL || request->public_key == NULL) return false;\n    if (!verify_detached(request->image, request->image_len,\n                         request->signature, request->signature_len,\n                         request->public_key, request->public_key_len)) return false;\n    return write_update(request->image, request->image_len);\n}","accept_update","A caller provides an image, signature, and public key. The function verifies the signature using that same caller-supplied key and, if verification succeeds, writes the image as an update. No trusted-key lookup or validation is present in the shown path.","Trust boundary and authentication flaw","A caller able to submit updates can generate a key pair, sign an unauthorized image, and provide the corresponding public key. If the verifier accepts it, the function proceeds to write that image, undermining firmware authenticity and integrity.","The verification call uses request->public_key, which is supplied as part of the update request, without checking it against a trusted key or certificate chain.",{"id":670,"relate_table":654,"relate_id":671,"file_size":573,"file_name":672,"path":8,"duration":573,"cate":483,"file_format":657,"audio_rate":8,"audio_channel":522,"audio_bit_depth":522,"quality":8,"annotation":673,"cate_name":659,"language":660,"root_cause":674,"remediation":675,"source_code":676,"function_name":677,"execution_path":678,"issue_category":679,"security_impact":680,"vulnerable_location":681},14781,1538624627,"样例_2.json","{\"language\": \"C\", \"root_cause\": \"The code commits the success state before establishing that the candidate image can pass verification and boot. It also discards the pending marker before there is a successful boot confirmation, so the transition is not recoverable through the state shown here.\", \"remediation\": \"Keep the existing active slot and pending state until the candidate has been verified and successfully confirmed by a defined post-boot mechanism. Persist trial-attempt state separately, retain the previous slot as a fallback, and commit the new active slot only after confirmation.\", \"source_code\": \"#include \u003Cstdbool.h>\\n#include \u003Cstdint.h>\\n\\nstruct boot_state {\\n    uint32_t active_slot;\\n    uint32_t pending_slot;\\n    bool pending;\\n    bool confirmed;\\n};\\n\\nextern bool read_state(struct boot_state *);\\nextern bool write_state(const struct boot_state *);\\nextern bool verify_and_boot(uint32_t);\\n\\nbool select_and_boot(struct boot_state *state)\\n{\\n    if (!read_state(state)) return false;\\n    if (state->pending) {\\n        state->active_slot = state->pending_slot;\\n        state->pending = false;\\n        state->confirmed = true;\\n        if (!write_state(state)) return false;\\n    }\\n    return verify_and_boot(state->active_slot);\\n}\", \"function_name\": \"select_and_boot\", \"execution_path\": \"On boot, read_state loads a pending update. The function commits the candidate slot as active and confirmed, clears the pending flag, and persists that state. It then calls verify_and_boot for the candidate. If verification or booting fails, the persisted state no longer identifies the update as pending, and the previous active slot is not selected by this function.\", \"issue_category\": \"Boot-state transition error\", \"security_impact\": \"A candidate that fails verification or cannot boot can leave the device repeatedly selecting that slot, preventing normal startup and defeating the intended rollback path. The shown verification call still limits execution of an invalid image; the demonstrated impact is loss of recovery and availability.\", \"vulnerable_location\": \"In the pending-update branch, active_slot is changed and pending is cleared while confirmed is set before write_state and verify_and_boot are called.\"}","The code commits the success state before establishing that the candidate image can pass verification and boot. It also discards the pending marker before there is a successful boot confirmation, so the transition is not recoverable through the state shown here.","Keep the existing active slot and pending state until the candidate has been verified and successfully confirmed by a defined post-boot mechanism. Persist trial-attempt state separately, retain the previous slot as a fallback, and commit the new active slot only after confirmation.","#include \u003Cstdbool.h>\n#include \u003Cstdint.h>\n\nstruct boot_state {\n    uint32_t active_slot;\n    uint32_t pending_slot;\n    bool pending;\n    bool confirmed;\n};\n\nextern bool read_state(struct boot_state *);\nextern bool write_state(const struct boot_state *);\nextern bool verify_and_boot(uint32_t);\n\nbool select_and_boot(struct boot_state *state)\n{\n    if (!read_state(state)) return false;\n    if (state->pending) {\n        state->active_slot = state->pending_slot;\n        state->pending = false;\n        state->confirmed = true;\n        if (!write_state(state)) return false;\n    }\n    return verify_and_boot(state->active_slot);\n}","select_and_boot","On boot, read_state loads a pending update. The function commits the candidate slot as active and confirmed, clears the pending flag, and persists that state. It then calls verify_and_boot for the candidate. If verification or booting fails, the persisted state no longer identifies the update as pending, and the previous active slot is not selected by this function.","Boot-state transition error","A candidate that fails verification or cannot boot can leave the device repeatedly selecting that slot, preventing normal startup and defeating the intended rollback path. The shown verification call still limits execution of an invalid image; the demonstrated impact is loss of recovery and availability.","In the pending-update branch, active_slot is changed and pending is cleared while confirmed is set before write_state and verify_and_boot are called.",{"id":683,"relate_table":654,"relate_id":684,"file_size":573,"file_name":685,"path":8,"duration":573,"cate":483,"file_format":657,"audio_rate":8,"audio_channel":522,"audio_bit_depth":522,"quality":8,"annotation":686,"cate_name":659,"language":660,"root_cause":687,"remediation":688,"source_code":689,"function_name":690,"execution_path":691,"issue_category":692,"security_impact":693,"vulnerable_location":694},14780,1561895266,"样例_1.json","{\"language\": \"C\", \"root_cause\": \"The code treats the header's payload_len as sufficient evidence of available input data. It does not validate the declared length against the actual packet boundary before any consumer reads the payload.\", \"remediation\": \"After confirming packet_len is at least sizeof(h), reject the packet when h.payload_len > packet_len - sizeof(h). Perform this subtraction-based bounds check before verification, and pass only the validated payload span to subsequent functions.\", \"source_code\": \"#include \u003Cstdbool.h>\\n#include \u003Cstddef.h>\\n#include \u003Cstdint.h>\\n#include \u003Cstring.h>\\n\\n#define MAX_PAYLOAD 262144U\\n\\nstruct image_header {\\n    uint32_t payload_len;\\n    uint8_t signature[64];\\n};\\n\\nextern bool verify_signature(const struct image_header *, const uint8_t *, uint32_t);\\nextern bool flash_write(uint32_t, const uint8_t *, uint32_t);\\n\\nbool install_image(const uint8_t *packet, uint32_t packet_len, uint32_t slot)\\n{\\n    struct image_header h;\\n    if (packet_len \u003C sizeof(h)) return false;\\n    memcpy(&h, packet, sizeof(h));\\n    if (h.payload_len > MAX_PAYLOAD) return false;\\n    const uint8_t *payload = packet + sizeof(h);\\n    if (!verify_signature(&h, payload, h.payload_len)) return false;\\n    return flash_write(slot, payload, h.payload_len);\\n}\", \"function_name\": \"install_image\", \"execution_path\": \"A packet at least sizeof(h) bytes long is accepted for header parsing. If its declared payload length is within MAX_PAYLOAD but exceeds the bytes remaining in the packet, the function passes a pointer into the packet and the oversized declared length to signature verification. If execution continues, it passes the same range to flash_write.\", \"issue_category\": \"Input length validation defect\", \"security_impact\": \"A truncated or malformed update can cause reads beyond the received packet in the verifier or flash-writing path, potentially causing a fault or denial of service. The snippet still invokes signature verification, so this defect alone does not establish that an unsigned image can be installed.\", \"vulnerable_location\": \"After parsing the header, the function checks the declared payload against MAX_PAYLOAD but never checks that packet_len - sizeof(h) is at least h.payload_len before passing payload to verify_signature and flash_write.\"}","The code treats the header's payload_len as sufficient evidence of available input data. It does not validate the declared length against the actual packet boundary before any consumer reads the payload.","After confirming packet_len is at least sizeof(h), reject the packet when h.payload_len > packet_len - sizeof(h). Perform this subtraction-based bounds check before verification, and pass only the validated payload span to subsequent functions.","#include \u003Cstdbool.h>\n#include \u003Cstddef.h>\n#include \u003Cstdint.h>\n#include \u003Cstring.h>\n\n#define MAX_PAYLOAD 262144U\n\nstruct image_header {\n    uint32_t payload_len;\n    uint8_t signature[64];\n};\n\nextern bool verify_signature(const struct image_header *, const uint8_t *, uint32_t);\nextern bool flash_write(uint32_t, const uint8_t *, uint32_t);\n\nbool install_image(const uint8_t *packet, uint32_t packet_len, uint32_t slot)\n{\n    struct image_header h;\n    if (packet_len \u003C sizeof(h)) return false;\n    memcpy(&h, packet, sizeof(h));\n    if (h.payload_len > MAX_PAYLOAD) return false;\n    const uint8_t *payload = packet + sizeof(h);\n    if (!verify_signature(&h, payload, h.payload_len)) return false;\n    return flash_write(slot, payload, h.payload_len);\n}","install_image","A packet at least sizeof(h) bytes long is accepted for header parsing. If its declared payload length is within MAX_PAYLOAD but exceeds the bytes remaining in the packet, the function passes a pointer into the packet and the oversized declared length to signature verification. If execution continues, it passes the same range to flash_write.","Input length validation defect","A truncated or malformed update can cause reads beyond the received packet in the verifier or flash-writing path, potentially causing a fault or denial of service. The snippet still invokes signature verification, so this defect alone does not establish that an unsigned image can be installed.","After parsing the header, the function checks the declared payload against MAX_PAYLOAD but never checks that packet_len - sizeof(h) is at least h.payload_len before passing payload to verify_signature and flash_write.","{\"language\":\"C\",\"root_cause\":\"The code establishes that the image matches the supplied key, but not that the key is authorized to sign firmware for this device. It therefore treats attacker-controlled verification material as a trust anchor.\",\"remediation\":\"Verify update signatures against a trust anchor provisioned independently of the request, such as an immutable public key or a certificate chain validated to a pinned root. Reject caller-supplied keys unless they are authenticated and authorized by that trust chain.\",\"source_code\":\"#include \u003Cstdbool.h>\\n#include \u003Cstddef.h>\\n#include \u003Cstdint.h>\\n\\nstruct update_request {\\n    const uint8_t *image;\\n    size_t image_len;\\n    const uint8_t *signature;\\n    size_t signature_len;\\n    const uint8_t *public_key;\\n    size_t public_key_len;\\n};\\n\\nextern bool verify_detached(const uint8_t *, size_t, const uint8_t *, size_t, const uint8_t *, size_t);\\nextern bool write_update(const uint8_t *, size_t);\\n\\nbool accept_update(const struct update_request *request)\\n{\\n    if (request == NULL || request->image == NULL ||\\n        request->signature == NULL || request->public_key == NULL) return false;\\n    if (!verify_detached(request->image, request->image_len,\\n                         request->signature, request->signature_len,\\n                         request->public_key, request->public_key_len)) return false;\\n    return write_update(request->image, request->image_len);\\n}\",\"function_name\":\"accept_update\",\"execution_path\":\"A caller provides an image, signature, and public key. The function verifies the signature using that same caller-supplied key and, if verification succeeds, writes the image as an update. No trusted-key lookup or validation is present in the shown path.\",\"issue_category\":\"Trust boundary and authentication flaw\",\"security_impact\":\"A caller able to submit updates can generate a key pair, sign an unauthorized image, and provide the corresponding public key. If the verifier accepts it, the function proceeds to write that image, undermining firmware authenticity and integrity.\",\"vulnerable_location\":\"The verification call uses request->public_key, which is supplied as part of the update request, without checking it against a trusted key or certificate chain.\"}","MOBIUSI INC","https:\u002F\u002Fstatic.mobiusi.com\u002Fmobiwusi\u002F20250829\u002F7bf4ac62b4533e2b809998a6f1c5491e.png?Expires=1792463130&OSSAccessKeyId=LTAI5tH8MQqhgeiAtrzCHrxM&Signature=v6Tr8jBrdm4s5wU1SnnyGsYg%2Bhw%3D&x-oss-process=image%2Fresize%2Cm_fill%2Cw_35%2Ch_35",[699,705],{"type":700,"title":701,"count_data":702},"bar","Length distribution",[703],{"name":704,"value":483},"1k lower",{"type":706,"title":707,"count_data":708},"pie","Language distribution",[709],{"name":710,"value":483},"English"]