Skip to content

Commit 22b0e07

Browse files
remi-delmas-3000tautschnig
authored andcommitted
CONTRACTS: bugfix: make ptr_pred_ctx_reset_call call reset instead of init function
Fixes a copy and paste bug that results in a soundness bug. The method ptr_pred_ctx_reset_call generated a call to the INIT function instead of the intended RESET function, which resulted in separation checks for the __CPROVER_is fresh memory predicate failing to work across function calls between requires and ensures clauses.
1 parent e01fcdb commit 22b0e07

File tree

3 files changed

+26
-1
lines changed

3 files changed

+26
-1
lines changed
Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
// clang-format off
2+
int *foo(int *p)
3+
__CPROVER_requires(__CPROVER_is_fresh(p, sizeof(int)))
4+
__CPROVER_ensures(__CPROVER_is_fresh(__CPROVER_return_value, sizeof(int)))
5+
// clang-format on
6+
{
7+
return p;
8+
}
9+
10+
int main()
11+
{
12+
int *p;
13+
foo(p);
14+
}
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
CORE dfcc-only
2+
main.c
3+
--dfcc main --enforce-contract foo
4+
^\[foo.postcondition.\d+\].*Check ensures clause of contract contract::foo for function foo: FAILURE$
5+
^EXIT=10$
6+
^SIGNAL=0$
7+
^VERIFICATION FAILED$
8+
--
9+
--
10+
This test checks that __CPROVER_is_fresh separation checks fail when the
11+
return value aliases with a parameter that was required to be fresh.

src/goto-instrument/contracts/dynamic-frames/dfcc_library.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -903,7 +903,7 @@ const code_function_callt dfcc_libraryt::ptr_pred_ctx_reset_call(
903903
const source_locationt &source_location)
904904
{
905905
code_function_callt call(
906-
dfcc_fun_symbol[dfcc_funt::PTR_PRED_CTX_INIT].symbol_expr(),
906+
dfcc_fun_symbol[dfcc_funt::PTR_PRED_CTX_RESET].symbol_expr(),
907907
{ptr_pred_ctx_ptr});
908908
call.add_source_location() = source_location;
909909
return call;

0 commit comments

Comments
 (0)