Skip to content

Commit a73309e

Browse files
Add length assumption at assign_string_constant beginning
This is to make sure that the length of the array before the assignment isn't unconstrained. Otherwise it could be set to be arbitrarily large by the solver which will causes invalid traces.
1 parent 8c7609e commit a73309e

File tree

2 files changed

+8
-0
lines changed

2 files changed

+8
-0
lines changed

src/goto-symex/goto_symex.cpp

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,11 @@ void goto_symext::assign_string_constant(
199199
const ssa_exprt &char_array,
200200
const array_exprt &new_char_array)
201201
{
202+
// We need to make sure that the length of the previous array isn't
203+
// unconstrained, otherwise it could be arbitrarily large which causes
204+
// invalid traces
205+
symex_assume(state, equal_exprt{length, from_integer(0, length.type())});
206+
202207
// assign length of string
203208
symex_assign.assign_symbol(length, expr_skeletont{}, new_length, {});
204209

src/goto-symex/goto_symex.h

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -590,6 +590,9 @@ class goto_symext
590590
/// "abc", the symbol will be named "abc_constant_char_array"). Then, the
591591
/// expression `&sym[0]` is assigned to `char_array` (assuming `sym` denotes
592592
/// the symbol holding the string data given by `new_char_array`.
593+
/// The assignment is preceeded by a assume statements ensuring `length`
594+
/// before this call was zero, this is to avoid letting the previous array
595+
/// unconstrained.
593596
///
594597
/// \param state: goto symex state
595598
/// \param symex_assign: object handling symbol assignments

0 commit comments

Comments
 (0)