Skip to content

Commit

Permalink
[smt_convt] Fix comparison of invalid pointers
Browse files Browse the repository at this point in the history
The SMT conversion routines crashed on encoding of comparisons over invalid
pointers.
This change fixes this behavior by ignoring comparisons against invalid
pointers.
  • Loading branch information
SaswatPadhi committed Apr 16, 2021
1 parent 0edf9a5 commit 7663a57
Show file tree
Hide file tree
Showing 3 changed files with 26 additions and 0 deletions.
9 changes: 9 additions & 0 deletions regression/cbmc/memset_null/main.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
#include <stdlib.h>
#include <string.h>

void main()
{
char *data = nondet() ? NULL : malloc(8);
memset(data, 0, 8);
memset(data, 0, 8);
}
12 changes: 12 additions & 0 deletions regression/cbmc/memset_null/test.desc
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
CORE
main.c

^\[main.precondition_instance.1\] line .* memset destination region writeable: FAILURE$
^\[main.precondition_instance.2\] line .* memset destination region writeable: FAILURE$
^EXIT=10$
^SIGNAL=0$
^VERIFICATION FAILED$
--
--
This test case checks that byte operations (e.g. memset) oninvalid and `NULL`
pointers are correctly encoded in SMT2.
5 changes: 5 additions & 0 deletions src/solvers/smt2/smt2_conv.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -4247,6 +4247,11 @@ void smt2_convt::set_to(const exprt &expr, bool value)
if(expr.id() == ID_equal && value)
{
const equal_exprt &equal_expr=to_equal_expr(expr);
if(equal_expr.lhs().type().id() == ID_empty)
{
// ignore equality checking over expressions with empty (void) type
return;
}

if(equal_expr.lhs().id()==ID_symbol)
{
Expand Down

0 comments on commit 7663a57

Please sign in to comment.