File tree Expand file tree Collapse file tree 2 files changed +61
-2
lines changed Expand file tree Collapse file tree 2 files changed +61
-2
lines changed Original file line number Diff line number Diff line change 1
- CORE
1
+ KNOWNBUG
2
2
main.c
3
3
--heap --intervals --pointer-check --no-assertions
4
4
^EXIT=0$
5
5
^SIGNAL=0$
6
6
^VERIFICATION SUCCESSFUL$
7
+ --
8
+ --
9
+ CBMC 5.9 introduced changes to its implementation of some built-in functions,
10
+ the ones affecting this test are malloc and free. Malloc changes have been
11
+ already accounted for in 2LS codebase, however the control flow of free
12
+ is most likely causing problems in this test making one of the asserts fail:
13
+
14
+ [main.pointer_dereference.27] dereference failure: deallocated dynamic object in *p: UNKNOWN
15
+
16
+ This may be related to double free assertion, where GOTO changed from:
17
+
18
+ ...
19
+ IF !(__CPROVER_deallocated == ptr) THEN GOTO 6
20
+ // 144 file <builtin-library-free> line 18 function free
21
+ ASSERT 0 != 0 // double free
22
+ // 145 no location
23
+ ASSUME 0 != 0
24
+ // 146 file <builtin-library-free> line 29 function free
25
+ 6: _Bool record;
26
+ ...
27
+
28
+ to:
29
+ ASSERT ptr == NULL || __CPROVER_deallocated != ptr // double free
30
+
31
+ Note the new ptr == NULL condition, this could be the root cause of
32
+ the problem. However further investigation is required
33
+ and will be done once the CBMC rebase is completed. According to the
34
+ C standard, free(NULL) is a valid construct (no operation) but 2LS doesn't
35
+ seem to handle this case correctly.
Original file line number Diff line number Diff line change 1
- CORE
1
+ KNOWNBUG
2
2
main.c
3
3
--heap --intervals --pointer-check --no-assertions
4
4
^EXIT=0$
5
5
^SIGNAL=0$
6
6
^VERIFICATION SUCCESSFUL$
7
+ --
8
+ --
9
+ CBMC 5.9 introduced changes to its implementation of some built-in functions,
10
+ the ones affecting this test are malloc and free. Malloc changes have been
11
+ already accounted for in 2LS codebase, however the control flow of free
12
+ is most likely causing problems in this test making one of the asserts fail:
13
+
14
+ [main.pointer_dereference.27] dereference failure: deallocated dynamic object in *p: UNKNOWN
15
+
16
+ This may be related to double free assertion, where GOTO changed from:
17
+
18
+ ...
19
+ IF !(__CPROVER_deallocated == ptr) THEN GOTO 6
20
+ // 144 file <builtin-library-free> line 18 function free
21
+ ASSERT 0 != 0 // double free
22
+ // 145 no location
23
+ ASSUME 0 != 0
24
+ // 146 file <builtin-library-free> line 29 function free
25
+ 6: _Bool record;
26
+ ...
27
+
28
+ to:
29
+ ASSERT ptr == NULL || __CPROVER_deallocated != ptr // double free
30
+
31
+ Note the new ptr == NULL condition, this could be the root cause of
32
+ the problem. However further investigation is required
33
+ and will be done once the CBMC rebase is completed. According to the
34
+ C standard, free(NULL) is a valid construct (no operation) but 2LS doesn't
35
+ seem to handle this case correctly.
36
+
You can’t perform that action at this time.
0 commit comments