Skip to content

Commit f592f1e

Browse files
committed
Add regression tests for quantifier checks.
These are checked against `--pointer-check` and one of them is sourced from the code reported in #6231.
1 parent 74ba975 commit f592f1e

File tree

4 files changed

+72
-0
lines changed

4 files changed

+72
-0
lines changed
Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#include <assert.h>
2+
#include <stdlib.h>
3+
4+
int main() {
5+
char *a = malloc(1);
6+
7+
// lots of errors with `--pointer-check` enabled
8+
assert(*a == *a);
9+
10+
// no errors even with `--pointer-check` enabled
11+
assert(
12+
__CPROVER_forall {
13+
int i ; (0 <= i && i < 1) ==> *(a+i) == *(a+i)
14+
}
15+
);
16+
}
Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
CORE
2+
test.c
3+
--pointer-check
4+
^EXIT=0$
5+
^SIGNAL=0$
6+
\[main\.assertion\.2\] line \d+ assertion __CPROVER_forall \{ int i ; \(0 <= i && i < 1\) ==> \*\(a\+i\) == \*\(a\+i\) \}: SUCCESS
7+
\[main\.pointer_dereference\.7\] line \d+ dereference failure: pointer NULL in a\[\(signed long int\)i\]: SUCCESS
8+
\[main\.pointer_dereference\.8\] line \d+ dereference failure: pointer invalid in a\[\(signed long int\)i\]: SUCCESS
9+
\[main\.pointer_dereference\.9\] line \d+ dereference failure: deallocated dynamic object in a\[\(signed long int\)i\]: SUCCESS
10+
\[main\.pointer_dereference\.10\] line \d+ dereference failure: dead object in a\[\(signed long int\)i\]: SUCCESS
11+
\[main\.pointer_dereference\.11\] line \d+ dereference failure: pointer outside object bounds in a\[\(signed long int\)i\]: SUCCESS
12+
\[main\.pointer_dereference\.12\] line \d+ dereference failure: invalid integer address in a\[\(signed long int\)i\]: SUCCESS
13+
^VERIFICATION SUCCESSFUL$
14+
--
15+
--
16+
This is fixing an issue first reported in https://github.com/diffblue/cbmc/issues/6231
Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#include <assert.h>
2+
#include <stdlib.h>
3+
4+
int main() {
5+
char *a = malloc(128);
6+
7+
assert(
8+
__CPROVER_forall {
9+
int i ; (0 <= i && i < 1) ==> *(a+i) == *(a+i)
10+
}
11+
);
12+
13+
assert(
14+
__CPROVER_forall {
15+
int j; !(0 <= j && j < 1) || (j == 0 && *(a+j) == *(a+j))
16+
});
17+
}
Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
CORE
2+
test.c
3+
--pointer-check
4+
^EXIT=0$
5+
^SIGNAL=0$
6+
\[main\.assertion\.1\] line \d+ assertion __CPROVER_forall \{ int i ; \(0 <= i && i < 1\) ==> \*\(a\+i\) == \*\(a\+i\) \}: SUCCESS
7+
\[main\.pointer_dereference\.1\] line \d dereference failure: pointer NULL in a\[\(signed long int\)i\]: SUCCESS
8+
\[main\.pointer_dereference\.2\] line \d dereference failure: pointer invalid in a\[\(signed long int\)i\]: SUCCESS
9+
\[main\.pointer_dereference\.3\] line \d dereference failure: deallocated dynamic object in a\[\(signed long int\)i\]: SUCCESS
10+
\[main\.pointer_dereference\.4\] line \d dereference failure: dead object in a\[\(signed long int\)i\]: SUCCESS
11+
\[main\.pointer_dereference\.5\] line \d dereference failure: pointer outside object bounds in a\[\(signed long int\)i\]: SUCCESS
12+
\[main\.pointer_dereference\.6\] line \d dereference failure: invalid integer address in a\[\(signed long int\)i\]: SUCCESS
13+
\[main\.assertion.2] line \d+ assertion __CPROVER_forall \{ int j; \!\(0 <= j && j < 1\) || \(j == 0 && \*\(a\+j\) == \*\(a+j\)\) \}: SUCCESS
14+
\[main\.pointer_dereference\.7] line \d+ dereference failure: pointer NULL in a\[\(signed long int\)j\]: SUCCESS
15+
\[main\.pointer_dereference\.8] line \d+ dereference failure: pointer invalid in a\[\(signed long int\)j\]: SUCCESS
16+
\[main\.pointer_dereference\.9] line \d+ dereference failure: deallocated dynamic object in a\[\(signed long int\)j\]: SUCCESS
17+
\[main\.pointer_dereference\.10] line \d+ dereference failure: dead object in a\[\(signed long int\)j\]: SUCCESS
18+
\[main\.pointer_dereference\.11] line \d+ dereference failure: pointer outside object bounds in a\[\(signed long int\)j\]: SUCCESS
19+
\[main\.pointer_dereference\.12] line \d+ dereference failure: invalid integer address in a\[\(signed long int\)j\]: SUCCESS
20+
^VERIFICATION SUCCESSFUL$
21+
--
22+
--
23+
This is fixing an issue first reported in https://github.com/diffblue/cbmc/issues/6231

0 commit comments

Comments
 (0)