Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

No pointer check or bounds check failure and incorrect program equation for access of array in struct with negative index #8588

Open
andreast271 opened this issue Feb 10, 2025 · 0 comments

Comments

@andreast271
Copy link
Contributor

CBMC version: 6.4.1
OS: Linux x86_64

Test case:

#include <assert.h>
struct St {
  char a[2];
  char b[2];
};

int main() {
  struct St data = {{1,2},{3,4}};
  data.b[-1] = 5;
  assert(data.a[1] == 2);
  return 0;
}  

The index expression data.b[-1] is for most compilers equivalent to *(data.b - 1) == *(data.a + 1). I expected CBMC to either model this correctly, or produce a failing pointer check or array bounds check. However, neither is happening. The assertion is passing, so *(data.a + 1) is unchanged by the assignment preceding the assertion. Pointer check and bounds check do not produce an assertion, let alone a failing one.
The report by cbmc is the following:

$ cbmc neg_idx.c --pointer-check --bounds-check 
CBMC version 6.4.1 (cbmc-6.4.1) 64-bit x86_64 linux
Type-checking neg_idx
Generating GOTO Program
Adding CPROVER library (x86_64)
Removal of function pointers and virtual functions
Generic Property Instrumentation
Starting Bounded Model Checking

** Results:
neg_idx.c function main
[main.assertion.1] line 11 assertion data.a[1] == 2: SUCCESS

** 0 of 1 failed (1 iterations)
VERIFICATION SUCCESSFUL
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant