## Buffer Overflow (Critical)

### Trigger Signals

- Array/pointer index access (`arr[i]`, `*(ptr + i)`, `ptr[offset]`) without bounds checking
- Unsafe function calls (`strcpy`, `sprintf`, `gets`, `memcpy` without length parameter)
- Slice/pointer operations in Rust `unsafe` blocks (`slice::get_unchecked`, `ptr::read_unaligned`)
- Write operations on fixed-size buffers (`char buf[256]`, `[u8; N]`)

### Judgment Process

1. **Identify buffer operations**: `Read` extracts array accesses, pointer arithmetic, and unsafe function calls, marking buffers and their declared sizes
2. **Trace index/length origin**:
   - Constant index → check whether within buffer range (`0 <= i < N`)
   - Variable index → `find_references` traces the origin of the index value, determining whether out-of-bounds is possible
   - External input as index/length → must have bounds validation
3. **Check unsafe function alternatives**: `Read` confirms whether safe alternatives are used (`strncpy`, `snprintf`, `memcpy_s`)
4. **Check Rust unsafe blocks**: `Read` confirms whether bounds validation logic exists within unsafe blocks, or whether safe API alternatives are available

### Evidence Construction

After confirming a defect, the output must include:
- Buffer declaration (type and size, with file:line number)
- Out-of-bounds access point (origin and value of index/offset)
- Trigger condition (what input would cause out-of-bounds access)
- Security impact (stack overflow can lead to code execution, heap overflow can lead to data tampering)

### Exclusions

- Already has bounds checking (`if (i < len)`, `assert(i < N)`)
- Already using safe functions (`strncpy` with length parameter, `snprintf`)
- Rust safe code (compiler guarantees bounds checking)
- Code already covered by ASan/UBSan detection (need to confirm CI integration)
