Skip to content

Commit 6ba2178

Browse files
committed
Symex: ignore assignments to string constant even through type casts
We previously ignored various forms of strings already, but failed to consider the case where an array was created by simplification due to type casts.
1 parent 06b377d commit 6ba2178

File tree

3 files changed

+29
-1
lines changed

3 files changed

+29
-1
lines changed
Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
typedef char array_t[2][2];
2+
3+
void foo(array_t(*a))
4+
{
5+
unsigned char i = 0;
6+
unsigned char j = 0;
7+
(*a)[i][j] = 0;
8+
}
9+
10+
unsigned char main()
11+
{
12+
char *x = "abcd";
13+
foo(x);
14+
__CPROVER_assert(x[0] == 'a', "a");
15+
}
Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
CORE
2+
main.c
3+
4+
^VERIFICATION SUCCESSFUL$
5+
^EXIT=0$
6+
^SIGNAL=0$
7+
--
8+
^l2_rename_rvalues case `array' not handled
9+
^warning: ignoring
10+
--
11+
The assignment to a C string constant should be ignored by symex, even when it
12+
happens via a type cast to a two-dimensional array.

src/goto-symex/goto_symex_state.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -251,7 +251,8 @@ class goto_symex_statet final : public goto_statet
251251
// simplifies to a plain constant.
252252
return lvalue.id() == ID_string_constant || lvalue.id() == ID_null_object ||
253253
lvalue.id() == "zero_string" || lvalue.id() == "is_zero_string" ||
254-
lvalue.id() == "zero_string_length" || lvalue.id() == ID_constant;
254+
lvalue.id() == "zero_string_length" || lvalue.id() == ID_constant ||
255+
lvalue.id() == ID_array;
255256
}
256257

257258
private:

0 commit comments

Comments
 (0)