Skip to content

Commit 063d80a

Browse files
authored
Merge pull request #5750 from tautschnig/fix-5718
Fix unpack_array_vector to produce an array of bytes
2 parents 7d6cb94 + 1b46a0e commit 063d80a

File tree

3 files changed

+42
-15
lines changed

3 files changed

+42
-15
lines changed
Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#include <stdlib.h>
2+
#include <string.h>
3+
4+
int __VERIFIER_nondet_int();
5+
6+
void main()
7+
{
8+
size_t size;
9+
__CPROVER_assume(size >= 2);
10+
// limit the size to ensure size * sizeof(int) wouldn't overflow, and we don't
11+
// reach the maximum object size
12+
__CPROVER_assume(size <= 1000);
13+
14+
int *dest_buffer = malloc(size * sizeof(int));
15+
int *src_buffer = malloc(size * sizeof(int));
16+
src_buffer[0] = 42;
17+
src_buffer[1] = __VERIFIER_nondet_int();
18+
19+
memcpy(dest_buffer, src_buffer, size * sizeof(int));
20+
__CPROVER_assert(dest_buffer[0] == 42, "should pass");
21+
__CPROVER_assert(dest_buffer[1] == 42, "should fail");
22+
}
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
CORE
2+
main.c
3+
4+
^\[main.assertion.1\] line 20 should pass: SUCCESS$
5+
^\[main.assertion.2\] line 21 should fail: FAILURE$
6+
^\*\* 1 of \d+ failed
7+
^VERIFICATION FAILED$
8+
^EXIT=10$
9+
^SIGNAL=0$
10+
--
11+
^warning: ignoring

src/solvers/lowering/byte_operators.cpp

Lines changed: 9 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -475,26 +475,17 @@ static exprt unpack_array_vector(
475475
body};
476476
}
477477

478-
optionalt<exprt> array_vector_size;
479-
optionalt<typet> subtype;
480-
if(src.type().id() == ID_vector)
481-
{
482-
array_vector_size = to_vector_type(src.type()).size();
483-
subtype = to_vector_type(src.type()).subtype();
484-
}
485-
else
486-
{
487-
array_vector_size = to_array_type(src.type()).size();
488-
subtype = to_array_type(src.type()).subtype();
489-
}
478+
const exprt array_vector_size = src.type().id() == ID_vector
479+
? to_vector_type(src.type()).size()
480+
: to_array_type(src.type()).size();
490481

491482
return array_comprehension_exprt{
492483
std::move(array_comprehension_index),
493484
std::move(body),
494485
array_typet{
495-
*subtype,
496-
mult_exprt{*array_vector_size,
497-
from_integer(el_bytes, array_vector_size->type())}}};
486+
bv_typet{8},
487+
mult_exprt{array_vector_size,
488+
from_integer(el_bytes, array_vector_size.type())}}};
498489
}
499490

500491
exprt::operandst byte_operands;
@@ -1034,6 +1025,9 @@ exprt lower_byte_extract(const byte_extract_exprt &src, const namespacet &ns)
10341025
byte_extract_exprt unpacked(src);
10351026
unpacked.op() = unpack_rec(
10361027
src.op(), little_endian, lower_bound_int_opt, upper_bound_int_opt, ns);
1028+
CHECK_RETURN(
1029+
to_bitvector_type(to_type_with_subtype(unpacked.op().type()).subtype())
1030+
.get_width() == 8);
10371031

10381032
if(src.type().id()==ID_array)
10391033
{

0 commit comments

Comments
 (0)