Skip to content

Commit

Permalink
array_set: do not fail upon an invalid (void) pointer
Browse files Browse the repository at this point in the history
Even when the pointer cannot be successfully dereferenced, symex must
not yield an invariant failure.
  • Loading branch information
tautschnig committed Feb 13, 2024
1 parent 9c7bccc commit 10d5258
Show file tree
Hide file tree
Showing 3 changed files with 23 additions and 0 deletions.
7 changes: 7 additions & 0 deletions regression/cbmc/Array_operations3/main.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
int main()
{
void *p;
__CPROVER_array_set(p, 0);
__CPROVER_assert(
*(char *)p == 0, "should fail: array_set had no effect on invalid object");
}
11 changes: 11 additions & 0 deletions regression/cbmc/Array_operations3/test.desc
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
CORE
main.c

^\[main.assertion.1\] line 5 should fail: array_set had no effect on invalid object: FAILURE$
^VERIFICATION FAILED$
^EXIT=10$
^SIGNAL=0$
--
^warning: ignoring
--
An array_set on an invalid pointer must not result in an invariant failure.
5 changes: 5 additions & 0 deletions src/goto-symex/symex_other.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -183,6 +183,11 @@ void goto_symext::symex_other(
// obtain the actual array(s)
process_array_expr(state, array_expr);

// if we dereferenced a void pointer, we may get a zero-sized (failed)
// object -- nothing to be assigned
if(array_expr.type().id() == ID_empty)
return;

// prepare to build the array_of
exprt value = clean_expr(code.op1(), state, false);

Expand Down

0 comments on commit 10d5258

Please sign in to comment.