pghs975uc
/
infer_clone
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '5dff755691'
${ noResults }
infer_clone/infer/tests/codetoanalyze/c/bufferoverrun/issues.exp

129 lines
20 KiB
Raw Normal View History Unescape

[Inferbo] Simplify interval pretty-print Summary: - `[b, b]` is simplified in `b` - `[x.lb, x.ub]` is simplified in `x` Reviewed By: skcho Differential Revision: D9103775 fbshipit-source-id: e3c7b3d01
6 years ago
codetoanalyze/c/bufferoverrun/arith.c, modulo_signed_Bad, 2, BUFFER_OVERRUN_L3, no_bucket, ERROR, [ArrayDeclaration,Parameter: i,ArrayAccess: Offset: [-4, 4] Size: 5]
codetoanalyze/c/bufferoverrun/arith.c, modulo_signed_neg_Bad, 2, BUFFER_OVERRUN_L3, no_bucket, ERROR, [ArrayDeclaration,Parameter: i,ArrayAccess: Offset: [-4, 4] Size: 5]
codetoanalyze/c/bufferoverrun/arith.c, plus_linear_min2_Good_FP, 2, BUFFER_OVERRUN_L2, no_bucket, ERROR, [ArrayDeclaration,Call,Assignment,Return,ArrayAccess: Offset: [0, 14] Size: 10]
codetoanalyze/c/bufferoverrun/arith.c, plus_linear_min3_Good_FP, 2, BUFFER_OVERRUN_L2, no_bucket, ERROR, [ArrayDeclaration,Call,Assignment,Return,ArrayAccess: Offset: [0, 25] Size: 20]
codetoanalyze/c/bufferoverrun/arith.c, plus_linear_min_Bad, 2, BUFFER_OVERRUN_L2, no_bucket, ERROR, [ArrayDeclaration,Call,Assignment,Return,ArrayAccess: Offset: [0, 19] Size: 19]
Inferbo/perf: path rather than symbols Reviewed By: ddino Differential Revision: D8371727 fbshipit-source-id: 88e3bb3
7 years ago
codetoanalyze/c/bufferoverrun/array_dynlength.c, init_variable_array, 3, BUFFER_OVERRUN_L2, no_bucket, ERROR, [Offset: [3xlen.lb + 1, 3xlen.ub + 1] Size: [3xlen.lb + 1, 3xlen.ub + 1]]
[Inferbo] Simplify interval pretty-print Summary: - `[b, b]` is simplified in `b` - `[x.lb, x.ub]` is simplified in `x` Reviewed By: skcho Differential Revision: D9103775 fbshipit-source-id: e3c7b3d01
6 years ago
codetoanalyze/c/bufferoverrun/array_field.c, array_field_access_Bad, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,Assignment,ArrayAccess: Offset: 20 Size: 10]
codetoanalyze/c/bufferoverrun/array_field.c, decreasing_pointer_Bad, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [Assignment,Assignment,Assignment,ArrayAccess: Offset: -1 Size: 2]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/c/bufferoverrun/break_continue_return.c, break_continue_return, 4, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/break_continue_return.c, break_continue_return, 13, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, []
[Inferbo] Simplify interval pretty-print Summary: - `[b, b]` is simplified in `b` - `[x.lb, x.ub]` is simplified in `x` Reviewed By: skcho Differential Revision: D9103775 fbshipit-source-id: e3c7b3d01
6 years ago
codetoanalyze/c/bufferoverrun/break_continue_return.c, break_continue_return, 16, BUFFER_OVERRUN_L2, no_bucket, ERROR, [ArrayDeclaration,Assignment,ArrayAccess: Offset: [0, 10] Size: 10]
codetoanalyze/c/bufferoverrun/cast.c, cast2_Good_FP, 2, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 4 Size: 4]
[inferbo] Report calls without () Summary: This is not needed. Reviewed By: skcho Differential Revision: D9372037 fbshipit-source-id: 9c9a90ba6
6 years ago
codetoanalyze/c/bufferoverrun/do_while.c, do_while, 2, BUFFER_OVERRUN_L4, no_bucket, ERROR, [ArrayDeclaration,Assignment,Call,Parameter: a,Assignment,ArrayAccess: Offset: [0, +oo] Size: 10 by call to `do_while_sub` ]
codetoanalyze/c/bufferoverrun/duplicates.c, one_alarm_is_enough, 2, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,Call,Parameter: arr,ArrayAccess: Offset: 1 Size: 1 by call to `two_accesses` ]
codetoanalyze/c/bufferoverrun/duplicates.c, tsa_one_alarm_Bad, 0, BUFFER_OVERRUN_L1, no_bucket, ERROR, [Call,ArrayDeclaration,Parameter: n,ArrayAccess: Offset: 3 Size: 1 by call to `two_symbolic_accesses` ]
codetoanalyze/c/bufferoverrun/duplicates.c, tsa_two_alarms_Bad, 0, BUFFER_OVERRUN_L1, no_bucket, ERROR, [Call,ArrayDeclaration,Parameter: n,ArrayAccess: Offset: -1 Size: 1 by call to `two_symbolic_accesses` ]
codetoanalyze/c/bufferoverrun/duplicates.c, tsa_two_alarms_Bad, 0, BUFFER_OVERRUN_L1, no_bucket, ERROR, [Call,ArrayDeclaration,Parameter: n,ArrayAccess: Offset: 1 Size: 1 by call to `two_symbolic_accesses` ]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/c/bufferoverrun/external.c, extern_bad, 5, BUFFER_OVERRUN_U5, no_bucket, ERROR, [Unknown value from: lib,Assignment,ArrayAccess: Offset: [-oo, +oo] Size: [0, +oo]]
[Inferbo] Simplify interval pretty-print Summary: - `[b, b]` is simplified in `b` - `[x.lb, x.ub]` is simplified in `x` Reviewed By: skcho Differential Revision: D9103775 fbshipit-source-id: e3c7b3d01
6 years ago
codetoanalyze/c/bufferoverrun/external.c, extern_bad, 10, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 30 Size: 10]
codetoanalyze/c/bufferoverrun/for_loop.c, call_two_loops_Bad, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,Assignment,Call,Parameter: m,Assignment,Return,ArrayAccess: Offset: 15 Size: 10]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/c/bufferoverrun/for_loop.c, for_loop, 10, BUFFER_OVERRUN_L3, no_bucket, ERROR, [Call,ArrayDeclaration,Assignment,Assignment,Return,Assignment,Assignment,ArrayAccess: Offset: [0, 9] Size: [5, 10]]
[Inferbo] Simplify interval pretty-print Summary: - `[b, b]` is simplified in `b` - `[x.lb, x.ub]` is simplified in `x` Reviewed By: skcho Differential Revision: D9103775 fbshipit-source-id: e3c7b3d01
6 years ago
codetoanalyze/c/bufferoverrun/function_call.c, call_by_arr_bad, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,Call,Assignment,ArrayAccess: Offset: -1 Size: 10]
codetoanalyze/c/bufferoverrun/function_call.c, call_by_ptr_bad, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,Call,Assignment,ArrayAccess: Offset: -1 Size: 10]
codetoanalyze/c/bufferoverrun/function_call.c, call_by_struct_ptr_bad, 5, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,Call,Assignment,ArrayAccess: Offset: -1 Size: 10]
[inferbo] Return unknown value on non-const function calls Summary: It returns unknown values on non-const function calls like on unknown function calls. Reviewed By: mbouaziz Differential Revision: D9478862 fbshipit-source-id: 4b795ec55
6 years ago
codetoanalyze/c/bufferoverrun/function_call.c, call_function_ptr_bad, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 10 Size: 10]
codetoanalyze/c/bufferoverrun/function_call.c, call_function_ptr_good_FP, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 10 Size: 10]
[inferbo] Report calls without () Summary: This is not needed. Reviewed By: skcho Differential Revision: D9372037 fbshipit-source-id: 9c9a90ba6
6 years ago
codetoanalyze/c/bufferoverrun/function_call.c, function_call, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,Call,Parameter: arr,Assignment,ArrayAccess: Offset: 100 Size: 10 by call to `arr_access` ]
[inferbo] Simplify memory instantiation of function call Summary: It simplifies abstract memory instantiations of function calls. Now it instantiates callee memories by directly evaluating symbol paths, rather than constructing `subst_map`. main changes are: - no construction of `subst_map` and `trace_map` - no symbol table in Inferbo's summary - no `Symbol_not_found` exception (for when a required symbol was unavailable in `subst_map`) Reviewed By: mbouaziz Differential Revision: D9495597 fbshipit-source-id: 18cdcd6f7
6 years ago
codetoanalyze/c/bufferoverrun/get_field.c, FP_call_get_field_Good, 3, BUFFER_OVERRUN_L5, no_bucket, ERROR, [ArrayDeclaration,Call,Call,Assignment,Return,Assignment,Return,ArrayAccess: Offset: [-oo, +oo] Size: 5]
codetoanalyze/c/bufferoverrun/get_field.c, call_get_field_Bad, 3, BUFFER_OVERRUN_L5, no_bucket, ERROR, [ArrayDeclaration,Call,Call,Assignment,Return,Assignment,Return,ArrayAccess: Offset: [-oo, +oo] Size: 5]
codetoanalyze/c/bufferoverrun/get_field.c, call_get_field_cond_Bad, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 10 Size: 5]
[inferbo] Add a test case of global constant Summary: `CONDITION_ALWAYS_**` can be introduced by global constants. Reviewed By: ezgicicek, mbouaziz Differential Revision: D9478528 fbshipit-source-id: 7b1a46e7a
6 years ago
codetoanalyze/c/bufferoverrun/global.c, compare_global_const_enum_bad_FN, 2, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/global.c, compare_global_const_enum_bad_FN, 2, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, []
[Inferbo] Simplify interval pretty-print Summary: - `[b, b]` is simplified in `b` - `[x.lb, x.ub]` is simplified in `x` Reviewed By: skcho Differential Revision: D9103775 fbshipit-source-id: e3c7b3d01
6 years ago
codetoanalyze/c/bufferoverrun/global.c, compare_global_variable_bad, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 10 Size: 10]
codetoanalyze/c/bufferoverrun/goto_loop.c, goto_loop, 11, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,Assignment,ArrayAccess: Offset: [10, +oo] Size: 10]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/c/bufferoverrun/inf_loop.c, inf_loop, 4, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, []
[Inferbo] Simplify interval pretty-print Summary: - `[b, b]` is simplified in `b` - `[x.lb, x.ub]` is simplified in `x` Reviewed By: skcho Differential Revision: D9103775 fbshipit-source-id: e3c7b3d01
6 years ago
codetoanalyze/c/bufferoverrun/issue_kinds.c, False_Issue_Type_l3_unknown_function_Bad, 5, BUFFER_OVERRUN_U5, no_bucket, ERROR, [Call,Assignment,Assignment,Return,ArrayDeclaration,Assignment,Unknown value from: unknown_function,Assignment,ArrayAccess: Offset: 10 Size: [5, +oo]]
[inferbo] Alloc site in the trace for INFERBO_ALLOC_xx issues Reviewed By: skcho Differential Revision: D9398353 fbshipit-source-id: 0d2e5c961
6 years ago
codetoanalyze/c/bufferoverrun/issue_kinds.c, alloc_is_big_Bad, 0, INFERBO_ALLOC_IS_BIG, no_bucket, ERROR, [Alloc: Length: 2000000000]
codetoanalyze/c/bufferoverrun/issue_kinds.c, alloc_is_negative_Bad, 0, INFERBO_ALLOC_IS_NEGATIVE, no_bucket, ERROR, [Alloc: Length: -2]
codetoanalyze/c/bufferoverrun/issue_kinds.c, alloc_is_zero_Bad, 0, INFERBO_ALLOC_IS_ZERO, no_bucket, ERROR, [Alloc: Length: 0]
codetoanalyze/c/bufferoverrun/issue_kinds.c, alloc_may_be_big_Bad, 0, INFERBO_ALLOC_MAY_BE_BIG, no_bucket, ERROR, [Call,Assignment,Return,Alloc: Length: [1, 1000000001]]
codetoanalyze/c/bufferoverrun/issue_kinds.c, alloc_may_be_big_Good_FP, 1, INFERBO_ALLOC_MAY_BE_BIG, no_bucket, ERROR, [Call,Assignment,Return,Alloc: Length: [1, 1000000001]]
codetoanalyze/c/bufferoverrun/issue_kinds.c, alloc_may_be_negative_Bad, 0, INFERBO_ALLOC_MAY_BE_NEGATIVE, no_bucket, ERROR, [Call,Assignment,Return,Alloc: Length: [-5, 5]]
codetoanalyze/c/bufferoverrun/issue_kinds.c, alloc_may_be_negative_Good_FP, 0, INFERBO_ALLOC_MAY_BE_NEGATIVE, no_bucket, ERROR, [Call,Assignment,Return,Alloc: Length: [-5, 5]]
[inferbo] Propagate INFERBO_ALLOC_MAY_BE_ even when the bound is infinity Reviewed By: skcho Differential Revision: D9398450 fbshipit-source-id: 7b676615e
6 years ago
codetoanalyze/c/bufferoverrun/issue_kinds.c, call_to_alloc_may_be_big2_is_big_Bad, 1, INFERBO_ALLOC_IS_BIG, no_bucket, ERROR, [Call,Parameter: n,Alloc: Length: [100000000, +oo] by call to `alloc_may_be_big2_Silenced` ]
[inferbo] Fail if trying to substitute non-symbolic conditions Reviewed By: ezgicicek Differential Revision: D9377804 fbshipit-source-id: 609fd1594
6 years ago
codetoanalyze/c/bufferoverrun/issue_kinds.c, l1_call_to_s2_symbolic_widened_Bad, 0, BUFFER_OVERRUN_L1, no_bucket, ERROR, [Offset: [1, +oo] Size: 1 by call to `s2_symbolic_widened_Bad` ]
[Inferbo] Simplify interval pretty-print Summary: - `[b, b]` is simplified in `b` - `[x.lb, x.ub]` is simplified in `x` Reviewed By: skcho Differential Revision: D9103775 fbshipit-source-id: e3c7b3d01
6 years ago
codetoanalyze/c/bufferoverrun/issue_kinds.c, l1_concrete_overrun_Bad, 2, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 10 Size: 10]
codetoanalyze/c/bufferoverrun/issue_kinds.c, l1_concrete_underrun_Bad, 2, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: -1 Size: 10]
codetoanalyze/c/bufferoverrun/issue_kinds.c, l1_symbolic_overrun_Bad, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,Parameter: i,ArrayAccess: Offset: [max(10, i.lb), i.ub] Size: 10]
codetoanalyze/c/bufferoverrun/issue_kinds.c, l1_symbolic_underrun_Bad, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,Parameter: i,ArrayAccess: Offset: [i.lb, min(-1, i.ub)] Size: 10]
codetoanalyze/c/bufferoverrun/issue_kinds.c, l1_unknown_function_Bad, 5, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,Unknown value from: unknown_function,Assignment,ArrayAccess: Offset: 10 Size: 5]
codetoanalyze/c/bufferoverrun/issue_kinds.c, l2_concrete_no_overrun_Good_FP, 2, BUFFER_OVERRUN_L2, no_bucket, ERROR, [ArrayDeclaration,Call,Assignment,Return,ArrayAccess: Offset: [0, 10] Size: 10]
codetoanalyze/c/bufferoverrun/issue_kinds.c, l2_concrete_no_underrun_Good_FP, 2, BUFFER_OVERRUN_L2, no_bucket, ERROR, [ArrayDeclaration,Call,Assignment,Return,ArrayAccess: Offset: [-1, 9] Size: 9]
codetoanalyze/c/bufferoverrun/issue_kinds.c, l2_concrete_overrun_Bad, 2, BUFFER_OVERRUN_L2, no_bucket, ERROR, [ArrayDeclaration,Call,Assignment,Return,ArrayAccess: Offset: [0, 10] Size: 10]
codetoanalyze/c/bufferoverrun/issue_kinds.c, l2_concrete_underrun_Bad, 2, BUFFER_OVERRUN_L2, no_bucket, ERROR, [ArrayDeclaration,Call,Assignment,Return,ArrayAccess: Offset: [-1, 9] Size: 9]
codetoanalyze/c/bufferoverrun/issue_kinds.c, l2_symbolic_overrun_Bad, 2, BUFFER_OVERRUN_L2, no_bucket, ERROR, [Offset: n Size: n]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/c/bufferoverrun/issue_kinds.c, l3_concrete_no_overrun_Good_FP, 2, BUFFER_OVERRUN_L3, no_bucket, ERROR, [Offset: [0, 10] Size: [5, 15]]
[Inferbo] Simplify interval pretty-print Summary: - `[b, b]` is simplified in `b` - `[x.lb, x.ub]` is simplified in `x` Reviewed By: skcho Differential Revision: D9103775 fbshipit-source-id: e3c7b3d01
6 years ago
codetoanalyze/c/bufferoverrun/issue_kinds.c, l3_concrete_no_underrun_Good_FP, 2, BUFFER_OVERRUN_L3, no_bucket, ERROR, [ArrayDeclaration,Call,Assignment,Return,ArrayAccess: Offset: [-1, 9] Size: 10]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/c/bufferoverrun/issue_kinds.c, l3_concrete_overrun_Bad, 2, BUFFER_OVERRUN_L3, no_bucket, ERROR, [Offset: [0, 10] Size: [5, 15]]
[Inferbo] Simplify interval pretty-print Summary: - `[b, b]` is simplified in `b` - `[x.lb, x.ub]` is simplified in `x` Reviewed By: skcho Differential Revision: D9103775 fbshipit-source-id: e3c7b3d01
6 years ago
codetoanalyze/c/bufferoverrun/issue_kinds.c, l3_concrete_underrun_Bad, 2, BUFFER_OVERRUN_L3, no_bucket, ERROR, [ArrayDeclaration,Call,Assignment,Return,ArrayAccess: Offset: [-1, 9] Size: 10]
codetoanalyze/c/bufferoverrun/issue_kinds.c, l4_widened_no_overrun_Good_FP, 3, BUFFER_OVERRUN_L4, no_bucket, ERROR, [ArrayDeclaration,Assignment,ArrayAccess: Offset: [0, +oo] Size: 10]
codetoanalyze/c/bufferoverrun/issue_kinds.c, l4_widened_overrun_Bad, 3, BUFFER_OVERRUN_L4, no_bucket, ERROR, [ArrayDeclaration,Assignment,ArrayAccess: Offset: [0, +oo] Size: 10]
codetoanalyze/c/bufferoverrun/issue_kinds.c, l5_external_Warn_Bad, 2, BUFFER_OVERRUN_U5, no_bucket, ERROR, [ArrayDeclaration,Unknown value from: unknown_function,ArrayAccess: Offset: [-oo, +oo] Size: 10]
codetoanalyze/c/bufferoverrun/issue_kinds.c, s2_symbolic_widened_Bad, 3, BUFFER_OVERRUN_S2, no_bucket, ERROR, [Offset: [n.lb, +oo] Size: n]
codetoanalyze/c/bufferoverrun/issue_kinds.c, s2_symbolic_widened_Good_FP, 3, BUFFER_OVERRUN_S2, no_bucket, ERROR, [Offset: [n.lb, +oo] Size: n]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/c/bufferoverrun/models.c, exit_bo_good_unreachable_bad, 2, UNREACHABLE_CODE, no_bucket, ERROR, []
[Inferbo] Simplify interval pretty-print Summary: - `[b, b]` is simplified in `b` - `[x.lb, x.ub]` is simplified in `x` Reviewed By: skcho Differential Revision: D9103775 fbshipit-source-id: e3c7b3d01
6 years ago
codetoanalyze/c/bufferoverrun/models.c, fgetc_255_bad, 4, BUFFER_OVERRUN_L2, no_bucket, ERROR, [ArrayDeclaration,Assignment,ArrayAccess: Offset: [0, 255] Size: 255]
codetoanalyze/c/bufferoverrun/models.c, fgetc_256_bad, 3, BUFFER_OVERRUN_L2, no_bucket, ERROR, [ArrayDeclaration,Assignment,ArrayAccess: Offset: [0, 256] Size: 256]
codetoanalyze/c/bufferoverrun/models.c, fgetc_m1_bad, 3, BUFFER_OVERRUN_L3, no_bucket, ERROR, [ArrayDeclaration,Assignment,ArrayAccess: Offset: [-1, 255] Size: 10000]
Added model for memcpy C function to inferBO Reviewed By: mbouaziz Differential Revision: D9768893 fbshipit-source-id: b0e2ed894
6 years ago
codetoanalyze/c/bufferoverrun/models.c, memcpy_bad1, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 44 Size: 40]
codetoanalyze/c/bufferoverrun/models.c, memcpy_bad2, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 44 Size: 40]
codetoanalyze/c/bufferoverrun/models.c, memcpy_bad3, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: -1 Size: 40]
codetoanalyze/c/bufferoverrun/models.c, memcpy_bad4, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 8 Size: 4]
Wired up model for memmove which is identical to memcopy Reviewed By: skcho Differential Revision: D9810324 fbshipit-source-id: d06d411db
6 years ago
codetoanalyze/c/bufferoverrun/models.c, memmove_bad1, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 44 Size: 40]
codetoanalyze/c/bufferoverrun/models.c, memmove_bad2, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 44 Size: 40]
codetoanalyze/c/bufferoverrun/models.c, memmove_bad3, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: -1 Size: 40]
codetoanalyze/c/bufferoverrun/models.c, memmove_bad4, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 8 Size: 4]
Added inferBO model for the C memset function. Reviewed By: mbouaziz Differential Revision: D9833430 fbshipit-source-id: 9ed377789
6 years ago
codetoanalyze/c/bufferoverrun/models.c, memset_bad1, 2, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 44 Size: 40]
codetoanalyze/c/bufferoverrun/models.c, memset_bad2, 2, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: -1 Size: 40]
codetoanalyze/c/bufferoverrun/models.c, memset_bad3, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,Assignment,ArrayAccess: Offset: 8 Size: 4]
[Inferbo] Simplify interval pretty-print Summary: - `[b, b]` is simplified in `b` - `[x.lb, x.ub]` is simplified in `x` Reviewed By: skcho Differential Revision: D9103775 fbshipit-source-id: e3c7b3d01
6 years ago
codetoanalyze/c/bufferoverrun/nested_loop.c, nested_loop, 7, BUFFER_OVERRUN_L2, no_bucket, ERROR, [ArrayDeclaration,Assignment,ArrayAccess: Offset: [0, 10] Size: 10]
codetoanalyze/c/bufferoverrun/nested_loop_with_label.c, nested_loop_with_label, 6, BUFFER_OVERRUN_L4, no_bucket, ERROR, [ArrayDeclaration,Assignment,ArrayAccess: Offset: [0, +oo] Size: 10]
codetoanalyze/c/bufferoverrun/pointer_arith.c, FP_pointer_arith5_Ok, 5, BUFFER_OVERRUN_L2, no_bucket, ERROR, [ArrayDeclaration,Assignment,ArrayAccess: Offset: [3, 2043] Size: 1024]
codetoanalyze/c/bufferoverrun/pointer_arith.c, array_pointer_arith_Bad, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,Assignment,ArrayAccess: Offset: 10 Size: 10]
[inferbo] Report calls without () Summary: This is not needed. Reviewed By: skcho Differential Revision: D9372037 fbshipit-source-id: 9c9a90ba6
6 years ago
codetoanalyze/c/bufferoverrun/pointer_arith.c, call_pointer_arith3_Bad, 2, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,Call,Parameter: p,Parameter: x,ArrayAccess: Offset: 10 Size: 5 by call to `pointer_arith3` ]
codetoanalyze/c/bufferoverrun/pointer_arith.c, call_pointer_arith4_Bad, 0, BUFFER_OVERRUN_L1, no_bucket, ERROR, [Call,ArrayDeclaration,Parameter: x,ArrayAccess: Offset: 10 Size: 5 by call to `FN_pointer_arith4_Bad` ]
[Inferbo] Simplify interval pretty-print Summary: - `[b, b]` is simplified in `b` - `[x.lb, x.ub]` is simplified in `x` Reviewed By: skcho Differential Revision: D9103775 fbshipit-source-id: e3c7b3d01
6 years ago
codetoanalyze/c/bufferoverrun/pointer_arith.c, pointer_arith_bad, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 10 Size: 10]
[inferbo] Report calls without () Summary: This is not needed. Reviewed By: skcho Differential Revision: D9372037 fbshipit-source-id: 9c9a90ba6
6 years ago
codetoanalyze/c/bufferoverrun/prune_alias.c, FP_call_prune_arrblk_eq_Ok, 2, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,Assignment,Call,Parameter: x,ArrayAccess: Offset: [15, 5] Size: 5 by call to `prune_arrblk_eq` ]
[Inferbo] Simplify interval pretty-print Summary: - `[b, b]` is simplified in `b` - `[x.lb, x.ub]` is simplified in `x` Reviewed By: skcho Differential Revision: D9103775 fbshipit-source-id: e3c7b3d01
6 years ago
codetoanalyze/c/bufferoverrun/prune_alias.c, FP_prune_alias_exp_Ok, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 1 Size: 1]
[inferbo] Report calls without () Summary: This is not needed. Reviewed By: skcho Differential Revision: D9372037 fbshipit-source-id: 9c9a90ba6
6 years ago
codetoanalyze/c/bufferoverrun/prune_alias.c, call_prune_arrblk_ne_Bad, 2, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,Assignment,Call,Parameter: x,ArrayAccess: Offset: 5 Size: 5 by call to `prune_arrblk_ne` ]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/c/bufferoverrun/prune_alias.c, prune_alias_and_Ok, 3, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/prune_alias.c, prune_alias_and_Ok, 3, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/prune_alias.c, prune_alias_eq_Ok, 3, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/prune_alias.c, prune_alias_exp_Ok, 3, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/prune_alias.c, prune_alias_ge_Ok, 3, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/prune_alias.c, prune_alias_gt_Ok, 3, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/prune_alias.c, prune_alias_le_Ok, 3, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/prune_alias.c, prune_alias_lt_Ok, 3, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/prune_alias.c, prune_alias_ne_Ok, 3, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/prune_alias.c, prune_alias_not_Ok, 3, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/prune_alias.c, prune_alias_not_Ok, 7, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/prune_alias.c, prune_alias_not_Ok, 11, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/prune_alias.c, prune_alias_or_Ok, 3, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/prune_alias.c, prune_alias_or_Ok, 3, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/prune_constant.c, prune_constant_false_Ok, 3, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/prune_constant.c, prune_constant_not_Bad, 3, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, []
[Inferbo] Simplify interval pretty-print Summary: - `[b, b]` is simplified in `b` - `[x.lb, x.ub]` is simplified in `x` Reviewed By: skcho Differential Revision: D9103775 fbshipit-source-id: e3c7b3d01
6 years ago
codetoanalyze/c/bufferoverrun/prune_constant.c, prune_constant_not_Bad, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,Assignment,ArrayAccess: Offset: 1 Size: 1]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/c/bufferoverrun/prune_constant.c, prune_constant_true_Ok, 3, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/prune_constant.c, prune_constant_value_Ok, 3, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, []
[Inferbo] Simplify interval pretty-print Summary: - `[b, b]` is simplified in `b` - `[x.lb, x.ub]` is simplified in `x` Reviewed By: skcho Differential Revision: D9103775 fbshipit-source-id: e3c7b3d01
6 years ago
codetoanalyze/c/bufferoverrun/relation.c, FP_array_access2_Ok, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 3 Size: 1]
codetoanalyze/c/bufferoverrun/relation.c, FP_array_access3_Ok, 5, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 3 Size: 1]
codetoanalyze/c/bufferoverrun/relation.c, FP_array_access4_Ok, 5, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 3 Size: 1]
[inferbo] Report calls without () Summary: This is not needed. Reviewed By: skcho Differential Revision: D9372037 fbshipit-source-id: 9c9a90ba6
6 years ago
codetoanalyze/c/bufferoverrun/relation.c, FP_call_array_access_Ok, 0, BUFFER_OVERRUN_L1, no_bucket, ERROR, [Call,ArrayDeclaration,Parameter: x,ArrayAccess: Offset: -1 Size: 1 by call to `array_access_Ok` ]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/c/bufferoverrun/sizeof.c, FN_static_stride_bad, 5, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/sizeof.c, eval_sizeof_bad, 1, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, []
[Inferbo] Simplify interval pretty-print Summary: - `[b, b]` is simplified in `b` - `[x.lb, x.ub]` is simplified in `x` Reviewed By: skcho Differential Revision: D9103775 fbshipit-source-id: e3c7b3d01
6 years ago
codetoanalyze/c/bufferoverrun/sizeof.c, eval_sizeof_bad, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 1 Size: 0]
codetoanalyze/c/bufferoverrun/trivial.c, trivial, 2, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 10 Size: 10]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/c/bufferoverrun/unreachable.c, FP_loop_once_intentional_good, 3, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/unreachable.c, FP_loop_with_break_good, 1, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/unreachable.c, FP_loop_with_exit_good, 1, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/unreachable.c, FP_loop_with_return_good, 1, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/unreachable.c, FP_loop_with_unreachable_good, 1, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/unreachable.c, condition_always_false_bad, 1, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/unreachable.c, condition_always_true_bad, 1, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/unreachable.c, condition_always_true_with_else_bad, 1, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/unreachable.c, infinite_loop_bad, 1, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/unreachable.c, never_loops_bad, 1, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, []
codetoanalyze/c/bufferoverrun/unreachable.c, unreachable_statement_exit_bad, 1, UNREACHABLE_CODE, no_bucket, ERROR, []
[Inferbo] Simplify interval pretty-print Summary: - `[b, b]` is simplified in `b` - `[x.lb, x.ub]` is simplified in `x` Reviewed By: skcho Differential Revision: D9103775 fbshipit-source-id: e3c7b3d01
6 years ago
codetoanalyze/c/bufferoverrun/while_loop.c, while_loop, 3, BUFFER_OVERRUN_L4, no_bucket, ERROR, [ArrayDeclaration,Assignment,Assignment,ArrayAccess: Offset: [0, +oo] Size: 10]