pghs975uc
/
infer_clone
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'ef78ba83cf'
${ noResults }
infer_clone/infer/tests/codetoanalyze/java/bufferoverrun/issues.exp

22 lines
5.1 KiB
Raw Normal View History Unescape

[inferbo] Pruning collection.size in Java Summary: It prunes the size of collections when the size function is called in the condition expression. The diff extended the alias domain to understand temporary variables of SIL from Java. Depends on D16761461 Reviewed By: ezgicicek Differential Revision: D16761611 fbshipit-source-id: 849c5c71c
5 years ago
codetoanalyze/java/bufferoverrun/Array.java, codetoanalyze.java.bufferoverrun.Array.call_iterate_collection_Bad():void, 7, BUFFER_OVERRUN_L1, no_bucket, ERROR, [Array declaration,Through,Through,Through,Through,Through,Call,<Length trace>,Array declaration,Array access: Offset: 5 Size: 5 by call to `void Array.iterate_collection_Bad(ArrayList)` ]
[inferbo] Model Java collections using arrays Reviewed By: ezgicicek, skcho Differential Revision: D13190960 fbshipit-source-id: fba435f34
6 years ago
codetoanalyze/java/bufferoverrun/Array.java, codetoanalyze.java.bufferoverrun.Array.collection_remove_from_empty_Bad():java.util.ArrayList, 2, BUFFER_OVERRUN_L1, no_bucket, ERROR, [<Length trace>,Array declaration,Array access: Offset: 0 Size: 0]
[inferbo] Check collection constructor size Reviewed By: mbouaziz Differential Revision: D14122995 fbshipit-source-id: eeb2fceab
6 years ago
codetoanalyze/java/bufferoverrun/Array.java, codetoanalyze.java.bufferoverrun.Array.negative_alloc_Bad():void, 1, INFERBO_ALLOC_IS_NEGATIVE, no_bucket, ERROR, [Allocation: Length: -1]
[inferbo] Prune (p=null) Summary: This diff unset powloc and arrayblk values of p when assume(p==Null). Reviewed By: mbouaziz, jvillard Differential Revision: D13415366 fbshipit-source-id: a491a957f
6 years ago
codetoanalyze/java/bufferoverrun/Array.java, codetoanalyze.java.bufferoverrun.Array.null_pruning1_Bad():void, 2, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, [Here]
[inferbo,cost] Fix java arrays Reviewed By: mbouaziz, ddino Differential Revision: D15602327 fbshipit-source-id: d17253a15
6 years ago
codetoanalyze/java/bufferoverrun/Array.java, codetoanalyze.java.bufferoverrun.Array.null_pruning1_Bad():void, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [<Length trace>,Array declaration,Array access: Offset: 10 Size: 5]
[inferbo] Prune (p=null) Summary: This diff unset powloc and arrayblk values of p when assume(p==Null). Reviewed By: mbouaziz, jvillard Differential Revision: D13415366 fbshipit-source-id: a491a957f
6 years ago
codetoanalyze/java/bufferoverrun/Array.java, codetoanalyze.java.bufferoverrun.Array.null_pruning1_Good():void, 2, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, [Here]
[inferbo,cost] Fix java arrays Reviewed By: mbouaziz, ddino Differential Revision: D15602327 fbshipit-source-id: d17253a15
6 years ago
codetoanalyze/java/bufferoverrun/Array.java, codetoanalyze.java.bufferoverrun.Array.null_pruning2_Bad():void, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [<Length trace>,Array declaration,Array access: Offset: 10 Size: 5]
codetoanalyze/java/bufferoverrun/Array.java, codetoanalyze.java.bufferoverrun.Array.null_pruning2_Good_FP():void, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [<Length trace>,Array declaration,Array access: Offset: 10 Size: 5]
[inferbo] Extend Simple alias domain Summary: This diff extends the `Simple` alias domain to address Java's temporary variables better. It now has an additional field to denote an alias temporary variable. Reviewed By: jvillard Differential Revision: D17421907 fbshipit-source-id: 8b8b47461
5 years ago
codetoanalyze/java/bufferoverrun/Array.java, codetoanalyze.java.bufferoverrun.Array.prune_assign_exp_Bad():void, 4, BUFFER_OVERRUN_L2, no_bucket, ERROR, [<Offset trace>,Call,Assignment,Assignment,Assignment,Assignment,<Length trace>,Array declaration,Array access: Offset: [0, 4] Size: 3]
[inferbo] Address collection add in loop Summary: This diff addresses collection adds in loop. For example, ``` ArrayList<...> a = new ArrayList<>(); for (int i = 0; i < size; i++) { a.add(...); } // we want to know the size of `a` here! ``` This is a common pattern on initializing a collection in Java. How we did: Instead of adopting general (but complicated) solutions such as relational domain, we extended the current alias domain of inferbo, to be able to handle this specific case: * An array `a` should have size 0, at the entry of the loop. * The iterating variable `i` should start with 0. * `add` should be called once inside the loop. Reviewed By: jvillard Differential Revision: D17319350 fbshipit-source-id: 99b6acae1
5 years ago
codetoanalyze/java/bufferoverrun/ArrayListTest.java, ArrayListTest.add_in_loop_bad():void, 5, BUFFER_OVERRUN_L1, no_bucket, ERROR, [<Length trace>,Array declaration,Array access: Offset: 6 Size: 5]
[inferbo] Introduce inequality for size alias target Summary: This diff introduces an inequality for the size alias targets, in order to get preciser array lengths after loops. The alias domain in inferbo was able to express strict equality between alias source and its targets, e.g. x=size(array). Now, for the size alias target, it can express less than or equal relations, e.g. x>=size(array). Reviewed By: ezgicicek Differential Revision: D17606222 fbshipit-source-id: 2557d3bd0
5 years ago
codetoanalyze/java/bufferoverrun/ArrayListTest.java, ArrayListTest.add_in_loop_by_param2_bad(java.util.ArrayList):void, 7, BUFFER_OVERRUN_L2, no_bucket, ERROR, [<Offset trace>,Array declaration,Assignment,<Length trace>,Assignment,Array declaration,Array access: Offset: [0, b.length] Size: b.length]
[inferbo] Address collection add in loop Summary: This diff addresses collection adds in loop. For example, ``` ArrayList<...> a = new ArrayList<>(); for (int i = 0; i < size; i++) { a.add(...); } // we want to know the size of `a` here! ``` This is a common pattern on initializing a collection in Java. How we did: Instead of adopting general (but complicated) solutions such as relational domain, we extended the current alias domain of inferbo, to be able to handle this specific case: * An array `a` should have size 0, at the entry of the loop. * The iterating variable `i` should start with 0. * `add` should be called once inside the loop. Reviewed By: jvillard Differential Revision: D17319350 fbshipit-source-id: 99b6acae1
5 years ago
codetoanalyze/java/bufferoverrun/ArrayListTest.java, ArrayListTest.add_in_loop_by_param_bad(java.util.ArrayList):void, 5, BUFFER_OVERRUN_L1, no_bucket, ERROR, [<Offset trace>,Assignment,Array declaration,Assignment,<Length trace>,Parameter `b.elements[*]`,Assignment,Array declaration,Array access: Offset: b.length + 1 Size: b.length]
[inferbo] Extend alias for collection iteration loop Summary: This diff extends the alias domain to analyze loop with list comprehensions form in Java precisely. ``` list2 = new List(); for (Element e : list1) { list2.add(e); } ``` 1. `IteratorOffset` is a relation between a iterator offset and a length of another array. For example, in the above example, after n-times of iterations, the offset of the iterator (if it exists) and the length of `list2` are the same as `n`. 2. `IteratorHasNext` is a relation between iterator and its `hasNext` result. 3. At the conditional nodes, it prunes the alias list length of `list2` by that of `list1`. * if `hasNext(list1's iterator)` is true, `list2`'s length is pruned by `< list1's length` * if `hasNext(list1's iterator)` is false, `list2`'s length is pruned by `= list1's length` Reviewed By: ezgicicek Differential Revision: D17667128 fbshipit-source-id: 41fb23a45
5 years ago
codetoanalyze/java/bufferoverrun/ArrayListTest.java, ArrayListTest.add_in_loop_iterator_bad(java.util.ArrayList):void, 5, BUFFER_OVERRUN_L1, no_bucket, ERROR, [<Offset trace>,Parameter `b.elements[*]`,Assignment,<Length trace>,Array declaration,Array access: Offset: b.length + 1 Size: b.length]
[inferbo] Add missing list initialization with initial capacity Summary: Correct the models of ArrayList initialization. Basically, there are two ways to initialize: - by setting an initial capacity, which creates an empty list - by passing another collection as an argument Before, we had only modeled the second case which was resulting in wrong memory model for the first case. This diff fixes that. Reviewed By: skcho Differential Revision: D16711055 fbshipit-source-id: e82faf191
5 years ago
codetoanalyze/java/bufferoverrun/ArrayListTest.java, ArrayListTest.alloc_is_negative_bad():void, 2, INFERBO_ALLOC_IS_NEGATIVE, no_bucket, ERROR, [Allocation: Length: -1]
[inferbo] Extend alias for collection iteration loop Summary: This diff extends the alias domain to analyze loop with list comprehensions form in Java precisely. ``` list2 = new List(); for (Element e : list1) { list2.add(e); } ``` 1. `IteratorOffset` is a relation between a iterator offset and a length of another array. For example, in the above example, after n-times of iterations, the offset of the iterator (if it exists) and the length of `list2` are the same as `n`. 2. `IteratorHasNext` is a relation between iterator and its `hasNext` result. 3. At the conditional nodes, it prunes the alias list length of `list2` by that of `list1`. * if `hasNext(list1's iterator)` is true, `list2`'s length is pruned by `< list1's length` * if `hasNext(list1's iterator)` is false, `list2`'s length is pruned by `= list1's length` Reviewed By: ezgicicek Differential Revision: D17667128 fbshipit-source-id: 41fb23a45
5 years ago
codetoanalyze/java/bufferoverrun/ArrayListTest.java, ArrayListTest.remove_in_loop_iterator_good_FP(java.util.ArrayList):void, 14, BUFFER_OVERRUN_L1, no_bucket, ERROR, [<Offset trace>,Parameter `b.elements[*]`,Assignment,<Length trace>,Parameter `b.elements[*]`,Array access: Offset: b.length Size: b.length]
[inferbo,cost] Fix java arrays Reviewed By: mbouaziz, ddino Differential Revision: D15602327 fbshipit-source-id: d17253a15
6 years ago
codetoanalyze/java/bufferoverrun/ArrayMember.java, codetoanalyze.java.bufferoverrun.ArrayMember.load_array_member_Bad():void, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [<Offset trace>,Parameter `this.buf[*]`,Assignment,<Length trace>,Array declaration,Array access: Offset: [max(10, this.buf[*].lb), min(10, this.buf[*].ub)] Size: 10]
[inferbo] Extract abstract domain functor for 'set represented by its smallest element' Reviewed By: skcho Differential Revision: D14243106 fbshipit-source-id: 900fbad3b
6 years ago
codetoanalyze/java/bufferoverrun/CompressedData.java, codetoanalyze.java.bufferoverrun.CompressedData.decompressData(codetoanalyze.java.bufferoverrun.CompressedData$D):int, 9, INTEGER_OVERFLOW_L5, no_bucket, ERROR, [<LHS trace>,Parameter `this.yy`,<RHS trace>,Parameter `d.cci[*].s`,Assignment,Binary operation: ([0, this.yy - 1] × d.cci[*].s):signed32]
[inferbo] Add models for Java's Integer Summary: Add models for Java's Integer class. Reviewed By: skcho Differential Revision: D16668118 fbshipit-source-id: 05b3c8736
5 years ago
codetoanalyze/java/bufferoverrun/External.java, External.external_function_Bad(external.library.SomeExternalClass):void, 1, INTEGER_OVERFLOW_L5, no_bucket, ERROR, [<LHS trace>,Assignment,<RHS trace>,Assignment,Binary operation: ([-oo, +oo] + [-oo, +oo]):signed32]
[inferbo] Add Java String constructor models Summary: This diff adds models of Java String. In order to keep the precision of cost checker, I fixed cost models for String in this diff too. Reviewed By: ngorogiannis Differential Revision: D17203309 fbshipit-source-id: 8cc2814fc
5 years ago
codetoanalyze/java/bufferoverrun/StringTest.java, StringTest.constant_Bad():void, 2, BUFFER_OVERRUN_L1, no_bucket, ERROR, [<Length trace>,Array declaration,Array access: Offset: 5 Size: 5]
codetoanalyze/java/bufferoverrun/StringTest.java, StringTest.constant_explicit_constructor_Bad():void, 2, BUFFER_OVERRUN_L1, no_bucket, ERROR, [<Length trace>,Array declaration,Array access: Offset: 5 Size: 5]
codetoanalyze/java/bufferoverrun/StringTest.java, StringTest.copy_constructor_Bad():void, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [<Length trace>,Array declaration,Array access: Offset: 5 Size: 5]