|
|
@ -35,9 +35,14 @@ struct
|
|
|
|
|
|
|
|
|
|
|
|
type extras = Typ.Procname.t -> Procdesc.t option
|
|
|
|
type extras = Typ.Procname.t -> Procdesc.t option
|
|
|
|
|
|
|
|
|
|
|
|
let set_uninitialized (typ : Typ.t) loc mem = match typ.desc with
|
|
|
|
let set_uninitialized node (typ : Typ.t) loc mem = match typ.desc with
|
|
|
|
| Tint _ | Tfloat _ -> Dom.Mem.weak_update_heap loc Dom.Val.Itv.top mem
|
|
|
|
| Tint _ | Tfloat _ -> Dom.Mem.weak_update_heap loc Dom.Val.Itv.top mem
|
|
|
|
| _ -> mem
|
|
|
|
| _ ->
|
|
|
|
|
|
|
|
if Config.bo_debug >= 3 then
|
|
|
|
|
|
|
|
L.out "/!\\ Do not know how to uninitialize type %a at %a@\n"
|
|
|
|
|
|
|
|
(Typ.pp Pp.text) typ
|
|
|
|
|
|
|
|
Location.pp (CFG.loc node);
|
|
|
|
|
|
|
|
mem
|
|
|
|
|
|
|
|
|
|
|
|
(* NOTE: heuristic *)
|
|
|
|
(* NOTE: heuristic *)
|
|
|
|
let get_malloc_info : Exp.t -> Typ.t * Int.t option * Exp.t
|
|
|
|
let get_malloc_info : Exp.t -> Typ.t * Int.t option * Exp.t
|
|
|
@ -58,8 +63,12 @@ struct
|
|
|
|
let v = Sem.eval_array_alloc pname node typ ?stride Itv.zero length 0 1 in
|
|
|
|
let v = Sem.eval_array_alloc pname node typ ?stride Itv.zero length 0 1 in
|
|
|
|
mem
|
|
|
|
mem
|
|
|
|
|> Dom.Mem.add_stack (Loc.of_id id) v
|
|
|
|
|> Dom.Mem.add_stack (Loc.of_id id) v
|
|
|
|
|> set_uninitialized typ (Dom.Val.get_array_locs v)
|
|
|
|
|> set_uninitialized node typ (Dom.Val.get_array_locs v)
|
|
|
|
| _ -> mem
|
|
|
|
| _ ->
|
|
|
|
|
|
|
|
if Config.bo_debug >= 3 then
|
|
|
|
|
|
|
|
L.out "/!\\ Do not know where to model malloc at %a@\n"
|
|
|
|
|
|
|
|
Location.pp (CFG.loc node);
|
|
|
|
|
|
|
|
mem
|
|
|
|
|
|
|
|
|
|
|
|
let model_realloc
|
|
|
|
let model_realloc
|
|
|
|
: Typ.Procname.t -> (Ident.t * Typ.t) option -> (Exp.t * Typ.t) list -> CFG.node
|
|
|
|
: Typ.Procname.t -> (Ident.t * Typ.t) option -> (Exp.t * Typ.t) list -> CFG.node
|
|
|
@ -72,6 +81,9 @@ struct
|
|
|
|
| Some (id, _) ->
|
|
|
|
| Some (id, _) ->
|
|
|
|
Dom.Mem.add_stack (Loc.of_id id) value mem
|
|
|
|
Dom.Mem.add_stack (Loc.of_id id) value mem
|
|
|
|
| None ->
|
|
|
|
| None ->
|
|
|
|
|
|
|
|
if Config.bo_debug >= 3 then
|
|
|
|
|
|
|
|
L.out "/!\\ Do not know where to model value %a@\n"
|
|
|
|
|
|
|
|
Dom.Val.pp value;
|
|
|
|
mem
|
|
|
|
mem
|
|
|
|
|
|
|
|
|
|
|
|
let model_infer_print
|
|
|
|
let model_infer_print
|
|
|
@ -95,7 +107,7 @@ struct
|
|
|
|
let v = Sem.eval_array_alloc pname node typ ?stride Itv.zero length 0 1 in
|
|
|
|
let v = Sem.eval_array_alloc pname node typ ?stride Itv.zero length 0 1 in
|
|
|
|
mem
|
|
|
|
mem
|
|
|
|
|> Dom.Mem.add_stack (Loc.of_pvar array_pvar) v
|
|
|
|
|> Dom.Mem.add_stack (Loc.of_pvar array_pvar) v
|
|
|
|
|> set_uninitialized typ (Dom.Val.get_array_locs v)
|
|
|
|
|> set_uninitialized node typ (Dom.Val.get_array_locs v)
|
|
|
|
| _ :: _ :: [] ->
|
|
|
|
| _ :: _ :: [] ->
|
|
|
|
failwithf "Unexpected type of arguments for __set_array_length()"
|
|
|
|
failwithf "Unexpected type of arguments for __set_array_length()"
|
|
|
|
| _ ->
|
|
|
|
| _ ->
|
|
|
@ -116,7 +128,11 @@ struct
|
|
|
|
| "realloc" -> model_realloc pname ret params node mem
|
|
|
|
| "realloc" -> model_realloc pname ret params node mem
|
|
|
|
| "__set_array_length" -> model_infer_set_array_length pname node params mem loc
|
|
|
|
| "__set_array_length" -> model_infer_set_array_length pname node params mem loc
|
|
|
|
| "strlen" -> model_by_value Dom.Val.Itv.nat ret mem
|
|
|
|
| "strlen" -> model_by_value Dom.Val.Itv.nat ret mem
|
|
|
|
| _ ->
|
|
|
|
| proc_name ->
|
|
|
|
|
|
|
|
if Config.bo_debug >= 3 then
|
|
|
|
|
|
|
|
L.out "/!\\ Unknown call to %s at %a@\n"
|
|
|
|
|
|
|
|
proc_name
|
|
|
|
|
|
|
|
Location.pp loc;
|
|
|
|
model_by_value Dom.Val.Itv.top ret mem
|
|
|
|
model_by_value Dom.Val.Itv.top ret mem
|
|
|
|
|
|
|
|
|
|
|
|
let rec declare_array
|
|
|
|
let rec declare_array
|
|
|
@ -176,7 +192,9 @@ struct
|
|
|
|
(Dom.Mem.add_heap field v mem, sym_num + 4)
|
|
|
|
(Dom.Mem.add_heap field v mem, sym_num + 4)
|
|
|
|
| _ ->
|
|
|
|
| _ ->
|
|
|
|
if Config.bo_debug >= 3 then
|
|
|
|
if Config.bo_debug >= 3 then
|
|
|
|
L.out "decl_fld of unhandled type: %a@." (Typ.pp Pp.text) typ;
|
|
|
|
L.out "/!\\ decl_fld of unhandled type: %a at %a@."
|
|
|
|
|
|
|
|
(Typ.pp Pp.text) typ
|
|
|
|
|
|
|
|
Location.pp (CFG.loc node);
|
|
|
|
(mem, sym_num)
|
|
|
|
(mem, sym_num)
|
|
|
|
in
|
|
|
|
in
|
|
|
|
match typ.Typ.desc with
|
|
|
|
match typ.Typ.desc with
|
|
|
@ -285,7 +303,14 @@ struct
|
|
|
|
(* array allocation in stack e.g., int arr[10] *)
|
|
|
|
(* array allocation in stack e.g., int arr[10] *)
|
|
|
|
let (mem, inst_num) = List.fold ~f:try_decl_arr ~init:(mem, 1) locals in
|
|
|
|
let (mem, inst_num) = List.fold ~f:try_decl_arr ~init:(mem, 1) locals in
|
|
|
|
declare_symbolic_parameter pdesc tenv node inst_num mem
|
|
|
|
declare_symbolic_parameter pdesc tenv node inst_num mem
|
|
|
|
| Call _
|
|
|
|
| Call (_, fun_exp, _, loc, _) ->
|
|
|
|
|
|
|
|
let () =
|
|
|
|
|
|
|
|
if Config.bo_debug >= 3 then
|
|
|
|
|
|
|
|
L.out "/!\\ Call to non-const function %a at %a"
|
|
|
|
|
|
|
|
Exp.pp fun_exp
|
|
|
|
|
|
|
|
Location.pp loc
|
|
|
|
|
|
|
|
in
|
|
|
|
|
|
|
|
mem
|
|
|
|
| Remove_temps _
|
|
|
|
| Remove_temps _
|
|
|
|
| Abstract _
|
|
|
|
| Abstract _
|
|
|
|
| Nullify _ -> mem
|
|
|
|
| Nullify _ -> mem
|
|
|
|