@@ -997,7 +997,7 @@ int vfscanf(FILE *restrict stream, const char *restrict format, va_list arg)
997997 }
998998
999999 (void )* format ;
1000- while ((__CPROVER_size_t )__CPROVER_POINTER_OFFSET (arg ) <
1000+ while ((__CPROVER_size_t )__CPROVER_POINTER_OFFSET (* ( void * * ) & arg ) <
10011001 __CPROVER_OBJECT_SIZE (arg ))
10021002 {
10031003 void * a = va_arg (arg , void * );
@@ -1046,7 +1046,7 @@ __CPROVER_HIDE:;
10461046 }
10471047
10481048 (void )* format ;
1049- while ((__CPROVER_size_t )__CPROVER_POINTER_OFFSET (arg ) <
1049+ while ((__CPROVER_size_t )__CPROVER_POINTER_OFFSET (* ( void * * ) & arg ) <
10501050 __CPROVER_OBJECT_SIZE (arg ))
10511051 {
10521052 void * a = va_arg (arg , void * );
@@ -1095,7 +1095,7 @@ int __stdio_common_vfscanf(
10951095 }
10961096
10971097 (void )* format ;
1098- while ((__CPROVER_size_t )__CPROVER_POINTER_OFFSET (args ) <
1098+ while ((__CPROVER_size_t )__CPROVER_POINTER_OFFSET (* ( void * * ) & args ) <
10991099 __CPROVER_OBJECT_SIZE (args ))
11001100 {
11011101 void * a = va_arg (args , void * );
@@ -1174,7 +1174,7 @@ __CPROVER_HIDE:;
11741174 int result = __VERIFIER_nondet_int ();
11751175 (void )* s ;
11761176 (void )* format ;
1177- while ((__CPROVER_size_t )__CPROVER_POINTER_OFFSET (arg ) <
1177+ while ((__CPROVER_size_t )__CPROVER_POINTER_OFFSET (* ( void * * ) & arg ) <
11781178 __CPROVER_OBJECT_SIZE (arg ))
11791179 {
11801180 void * a = va_arg (arg , void * );
@@ -1209,7 +1209,7 @@ __CPROVER_HIDE:;
12091209 int result = __VERIFIER_nondet_int ();
12101210 (void )* s ;
12111211 (void )* format ;
1212- while ((__CPROVER_size_t )__CPROVER_POINTER_OFFSET (arg ) <
1212+ while ((__CPROVER_size_t )__CPROVER_POINTER_OFFSET (* ( void * * ) & arg ) <
12131213 __CPROVER_OBJECT_SIZE (arg ))
12141214 {
12151215 void * a = va_arg (arg , void * );
@@ -1250,7 +1250,7 @@ int __stdio_common_vsscanf(
12501250
12511251 (void )* s ;
12521252 (void )* format ;
1253- while ((__CPROVER_size_t )__CPROVER_POINTER_OFFSET (args ) <
1253+ while ((__CPROVER_size_t )__CPROVER_POINTER_OFFSET (* ( void * * ) & args ) <
12541254 __CPROVER_OBJECT_SIZE (args ))
12551255 {
12561256 void * a = va_arg (args , void * );
0 commit comments