Reproof

Is this crash real, already reported, or already fixed?

Reproof runs a report's input against the vulnerable and the fixed build, searches OSV and public pages for the same crash, and checks git ancestry before it says a release has the fix. A person makes the decision. Reproof files nothing upstream.

No login and no key. Pick one of the 63 reports or read the saved evaluation.

63 public reports

Pick one of the 10 featured ARVO reports, or open the 53 more from the 100-bug run and search them. Each has already run from its sandbox checkpoints in a recorded evaluation. Triage runs the claim, both builds, the crash parse, the duplicate search, and a public-status lookup.

Reports
53 more from the 100-bug run30 projects. Search by project, bug, crash type or id.

Loading the reports.

37 other drawn tasks are not offered: 29 never got both sandbox checkpoints, 7 ran but measured no crash on either build and 1 has both checkpoints but no run that finished. Every task of the run

jq: heap-buffer-overflow in decToString

ARVO 42530604, OSV-2023-1239

public OSS-Fuzz OSV report OSV-2023-1239; this is not a private report

Heap-buffer-overflow in decToString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64574

```
Crash type: Heap-buffer-overflow WRITE 1
Crash state:
decToString
decNumberToString
jv_number_get_literal
```

Triage makes real model, sandbox, and search calls now. Show recorded result makes none.

Limits

This browser can run 1 triage at a time. This address can start 8 triages per hour. Everyone shares 60 triages per day. Each instance sends no new public-status lookup when a lookup's credit hold no longer fits in 100 Tavily credits for the UTC day, and a lookup of the same measured crash is reused for 60 minutes. On Vercel, each function instance keeps its own count file. Instances do not share a disk.

Measured

These numbers are the saved ARVO 10 evaluation. They are not a new run.

See the registered run on 100 bugs, every task listed, misses first.

The sandboxes cost 5.5 times the model calls.
Model calls
0.00141720 USD
Sandbox checkpoints and runs
0.00775084 USD

0.00916804 USD for all 10 tasks together, from 1349 input and 1125 output tokens.

  • 4 DUPLICATE
  • 6 REPRODUCED
  • 10 of 10 tasks completed
  • 10 fixes clean
  • 10 claims agreed
  • 7 crash states agreed
  • 4 duplicate candidates
  • 40.709021 seconds

On 2026-10-05, review of the saved cards found that the phase 1 table counted four self-matches; the duplicate search now excludes every OSV record mapped to the task's own OSS-Fuzz issue.

  1. ARVO 42530604jqREPRODUCEDno duplicate candidate0.00089983 USD4.728560 seconds
  2. ARVO 42507851libplistREPRODUCEDno duplicate candidate0.00085585 USD3.681775 seconds
  3. ARVO 42496387wasm3REPRODUCEDno duplicate candidate0.00088013 USD3.801278 seconds
  4. ARVO 42508524libplistDUPLICATEOSV-2022-1470.00082598 USD3.790634 seconds
  5. ARVO 42536108minizREPRODUCEDno duplicate candidate0.00091249 USD3.865316 seconds
  6. ARVO 42536112minizREPRODUCEDno duplicate candidate0.00091473 USD4.976644 seconds
  7. ARVO 42508390libplistDUPLICATEOSV-2022-930.00086489 USD4.181501 seconds
  8. ARVO 42531297jqDUPLICATEOSV-2025-3630.00107367 USD4.021922 seconds
  9. ARVO 42531223jqREPRODUCEDno duplicate candidate0.00106409 USD3.637580 seconds
  10. ARVO 42476752libspngDUPLICATEOSV-2020-3070.00087638 USD4.023811 seconds