Skip to content

Commit aa04475

Browse files
committed
[smt_convt] Fix comparison of invalid pointers
The SMT conversion routines crashed on encoding of comparisons over invalid pointers. This change fixes this behavior by ignoring comparisons against invalid pointers.
1 parent 0edf9a5 commit aa04475

File tree

3 files changed

+26
-0
lines changed

3 files changed

+26
-0
lines changed

regression/cbmc/memset_null/main.c

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#include <stdlib.h>
2+
#include <string.h>
3+
4+
void main()
5+
{
6+
char *data = nondet() ? NULL : malloc(8);
7+
memset(data, 0, 8);
8+
memset(data, 0, 8);
9+
}

regression/cbmc/memset_null/test.desc

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
CORE
2+
main.c
3+
4+
^\[main.precondition_instance.1\] line .* memset destination region writeable: FAILURE$
5+
^\[main.precondition_instance.2\] line .* memset destination region writeable: FAILURE$
6+
^EXIT=10$
7+
^SIGNAL=0$
8+
^VERIFICATION FAILED$
9+
--
10+
--
11+
This test case checks that byte operations (e.g. memset) oninvalid and `NULL`
12+
pointers are correctly encoded in SMT2.

src/solvers/smt2/smt2_conv.cpp

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4247,6 +4247,11 @@ void smt2_convt::set_to(const exprt &expr, bool value)
42474247
if(expr.id() == ID_equal && value)
42484248
{
42494249
const equal_exprt &equal_expr=to_equal_expr(expr);
4250+
if(equal_expr.lhs().type().id() == ID_empty)
4251+
{
4252+
// ignore equality checking on pointers with empty type
4253+
return;
4254+
}
42504255

42514256
if(equal_expr.lhs().id()==ID_symbol)
42524257
{

0 commit comments

Comments
 (0)