Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

For Java skip the check for dereference of a deallocated or dead object #89

Closed
wants to merge 129 commits into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
129 commits
Select commit Hold shift + click to select a range
b1d8917
Permit linking of functions with ellipsis against fixed argument length
tautschnig Mar 31, 2016
ed522f7
Handle more cases of transparent-union vs. member type linking conflicts
tautschnig Mar 31, 2016
7ef5cf9
Support klibc's version of __assert_fail, cleanup of assert handling
tautschnig Apr 11, 2016
ad24b5a
Permit preprocessor command within __attribute__
tautschnig Apr 11, 2016
a210c2d
Refactor OS-specific path concatenation into utility function
tautschnig Apr 14, 2016
7656b6c
Store the current working directory with each translation unit
tautschnig Apr 14, 2016
ff703e9
Use working-directory information to print full names
tautschnig Apr 14, 2016
72e9b36
New goto-instrument option --list-eloc
tautschnig Apr 21, 2016
777744b
package creation for El Capitan
May 8, 2016
4ab9720
Merge branch 'master' of https://www.github.com/diffblue/cbmc
May 10, 2016
82a9203
Merge branch 'master' of https://www.github.com/diffblue/cbmc
May 10, 2016
f62bf5c
For Java skip the check for dereference of a deallocated or dead object
cristina-david May 12, 2016
20ecd87
Merge branch 'master' of https://www.github.com/diffblue/cbmc
May 12, 2016
0c51062
+ regression test for NULL object dereferencing in Java
cristina-david May 13, 2016
3138148
return something in ctime and asctime
May 14, 2016
4a97f9e
return something in strerror
May 14, 2016
72aa254
return something in setlocale and localeconv
May 14, 2016
5a5bb12
missing object file
May 14, 2016
0114f7e
source locations in location coverage
May 16, 2016
c58a5e1
decision and condition coverage
May 16, 2016
45b619e
Started type checking jsil programs
Apr 9, 2016
4fe44e8
Improvements to Jsil type checking
May 16, 2016
e9b1c21
Added jsil mode to be supported by goto_convert_functions
May 16, 2016
5435ed5
Modified taint analysis to match procedure calls from languages other…
May 16, 2016
0066b66
goto-gcc: stop early on errors, minor cleanup
tautschnig Mar 11, 2016
0c09ec0
Extend goto-gcc to also work as a wrapper for more compiler names
tautschnig Mar 11, 2016
48d0726
Properly handle extended ld names
tautschnig Mar 12, 2016
237195c
Run ld where required
tautschnig Mar 13, 2016
d18cd64
Properly identify the base name of a file
tautschnig Mar 17, 2016
2e4ce20
No hyrid binary if /dev/null when is goto-gcc's output file
tautschnig Mar 17, 2016
a8114b3
GCC's -m16 is actually a 32-bit machine emulation!
tautschnig Mar 17, 2016
9877d6c
get_base_name is semantically equivalent to translation_unit
tautschnig Apr 3, 2016
61f76cb
goto-cc: when input file is stdin, copy it into a file to replay mult…
tautschnig May 2, 2016
70a313b
Ensure that cleanup of .saved temporary files happens even if gcc fails
tautschnig May 2, 2016
ad1b396
Add -z option handling to goto-gcc
Apr 29, 2016
16f8b29
beautify coverage output
May 17, 2016
868a6b3
Merge pull request #91 from tautschnig/jsil-type-checking
May 17, 2016
97e8deb
Merge pull request #83 from tautschnig/list-eloc
May 17, 2016
244b099
Merge pull request #75 from tautschnig/full-path
May 17, 2016
7067366
remove tabs
May 17, 2016
2e243a3
Merge branch 'tautschnig-whitespace-cleanup'
May 17, 2016
f42d659
Merge pull request #52 from tautschnig/linking-functions
May 18, 2016
7dbad59
Merge pull request #36 from tautschnig/goto-gcc-bugfixes-extensions
May 18, 2016
fe7d0f0
new interface for run()
May 18, 2016
2a33794
do generate dummy code for empty ifthenelse
May 18, 2016
7de7b08
conjunction and disjunction on lists
May 18, 2016
62e3ce7
fix output of literal expressions
May 18, 2016
eac49f2
conjunction and disjunction now take initializer_lists
May 18, 2016
4996502
get rid of conjunction and disjunction taking initializer_lists
May 18, 2016
e35f6b7
fix for bmc_cover
May 18, 2016
3f01cce
Support __attribute__((constructor))
tautschnig Apr 17, 2016
838e780
Extended linking conflict reporting
tautschnig Mar 18, 2016
9c2b02f
Permit some (ab)use of void f(void) in place of a full function decla…
tautschnig Mar 18, 2016
32b6124
Fix type renaming of array types with non-constant size
tautschnig Mar 20, 2016
927b9ff
Array-size symbols may also trigger a type renaming
tautschnig Mar 20, 2016
4030c96
Cleanup
tautschnig Feb 24, 2016
1eeaf5c
Removed unused include
tautschnig Mar 31, 2016
bb80cdc
Transparent unions require argument conversion, do this for all union…
tautschnig Apr 5, 2016
db61ac8
Do not skip attributes of pointer types
tautschnig Mar 17, 2016
36f81d6
Linking for weak symbols
tautschnig Mar 18, 2016
1e093ab
weak symbols need not necessarily be treated as file-local
tautschnig Apr 17, 2016
84e7611
Further weak-symbol-linking fixes
tautschnig May 16, 2016
471a7a0
initialize cond_literal and guard_literal
May 19, 2016
7d4e004
make bmc_cover work, and test it
May 19, 2016
701c331
further work on --cover
May 19, 2016
08faebc
fix Minisat 2.2.1 URL
May 19, 2016
f141d77
java entry point with nondet structs
danpoe May 17, 2016
9864d8c
missing cassert header
May 19, 2016
014d9ec
another attempt at cassert
May 19, 2016
1e4845e
For Java skip the check for dereference of a deallocated or dead object
cristina-david May 12, 2016
c019f86
+ regression test for NULL object dereferencing in Java
cristina-david May 13, 2016
5c679e1
+ test generating a type mismatch for enum in java
cristina-david May 20, 2016
4939505
+ test failing to find a null pointer dereferencing when some classes…
cristina-david May 20, 2016
b17b7cc
+ test generating a warning (ignoring java_string_literal) when instr…
cristina-david May 20, 2016
61e11f0
Merge branch 'java_pointer_checks' of https://github.com/cristina-dav…
cristina-david May 20, 2016
fb2da2e
more work on MC/DC
May 23, 2016
9140a76
missing header
May 24, 2016
fe72590
another go at superflous deads
May 24, 2016
92484aa
added script to run datastax benchmarks and changed test.pl to suppor…
marcelosousa May 24, 2016
d625351
Merge branch 'master' of https://github.com/diffblue/cbmc
May 24, 2016
e6517b3
more work on unnecessary destructor calls
May 24, 2016
f02d8b3
test.pl now supports multiple .desc files in directory
marcelosousa May 25, 2016
cd40222
another test for branch coverage
May 25, 2016
022b14b
no malloc for void or when we don't know the type size
danpoe May 25, 2016
dac6154
Merge pull request #93 from danpoe/function-nondet-structs
peterschrammel May 25, 2016
c7c1b40
use ranged for
May 25, 2016
e3923c1
bugfix for multiple instances
May 25, 2016
707e70f
another test for branch coverage
May 26, 2016
72a6d3e
Merge branch 'master' of https://github.com/diffblue/cbmc
May 27, 2016
e506ff4
do not cover existing assertions
May 27, 2016
800d72c
more tests
May 27, 2016
3309d9c
test that assertions are ignore
May 27, 2016
123fd85
Merge pull request #96 from marcelosousa/regression-script-changes
May 30, 2016
0f407cd
Merge pull request #77 from tautschnig/attribute-constructor
May 30, 2016
d35ad31
Merge pull request #66 from tautschnig/assert-cleanup
May 30, 2016
f0e0c40
Merge pull request #20 from tautschnig/parser-cleanup
May 30, 2016
f1044cf
Merge pull request #38 from tautschnig/linking-arrays-and-compound-types
May 30, 2016
8d3958a
Merge pull request #49 from tautschnig/weak-symbols
May 30, 2016
33e5060
Merge pull request #58 from tautschnig/transparent-union
May 30, 2016
279fe2f
Merge pull request #67 from tautschnig/attributes-preprocessor
May 30, 2016
44571af
Merge branch 'master' of https://www.github.com/diffblue/cbmc
May 30, 2016
3018e8f
make typecheckt API more similar to old one for transition
May 30, 2016
b05f4c1
use new messaging API in typecheckers
May 30, 2016
cb90b89
use new messaging API in Java typechecker
May 30, 2016
6fa1fdc
Do not add unreachable instructions during goto conversion
tautschnig Apr 14, 2016
3898017
Dead code analysis: no need to skip known-dead instructions with rece…
tautschnig Apr 14, 2016
46a10b4
Object descriptor should skip typecasts
tautschnig Mar 6, 2016
03c1b41
Do not require a constant member offset when building a byte-extract …
tautschnig Mar 18, 2016
0c14ab2
Merge pull request #73 from tautschnig/no-dead-instructions
May 30, 2016
1f62eef
more MC/DC
Jun 1, 2016
49c1acf
fix java_string_literals
Jun 1, 2016
3983942
more MC/DC
Jun 1, 2016
639974d
MC/DC now works
Jun 2, 2016
5a775c1
Fix consistency error in SSA level 1 renaming
tautschnig Jun 5, 2016
962b7d6
Support for postfixed __attribute__((constructor))
tautschnig Jun 5, 2016
5a64339
Fix java bytecode translation of control-flow joins
tautschnig Jun 6, 2016
80c6482
Merge pull request #103 from tautschnig/java-bytecode-converter
Jun 6, 2016
02b6628
test from \#104
Jun 6, 2016
0a7971e
Merge pull request #102 from tautschnig/attribute-constructor-bugfix
Jun 6, 2016
4b4bbb8
Merge pull request #33 from tautschnig/object-descriptor-build-fixes
Jun 6, 2016
1fb8689
Merge pull request #101 from tautschnig/ssa-level1-bugfix
Jun 6, 2016
1fcc4ea
added test for static methods
Jun 7, 2016
5b67c01
methods can now be specified without java:: prefix and without type s…
Jun 7, 2016
2070c24
For Java skip the check for dereference of a deallocated or dead object
cristina-david May 12, 2016
6ccc353
+ regression test for NULL object dereferencing in Java
cristina-david May 13, 2016
5f4f49c
+ test generating a type mismatch for enum in java
cristina-david May 20, 2016
300416d
+ test failing to find a null pointer dereferencing when some classes…
cristina-david May 20, 2016
bd2ac45
+ test generating a warning (ignoring java_string_literal) when instr…
cristina-david May 20, 2016
286bf3f
Merge branch 'java_pointer_checks' of https://github.com/cristina-dav…
cristina-david Jun 7, 2016
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion COMPILING
Original file line number Diff line number Diff line change
Expand Up @@ -142,7 +142,7 @@ Follow these instructions:
1) You need a SAT solver (in source). We recommend MiniSat2. Using a
browser, download from

http://minisat.se/downloads/minisat-2.2.1.tar.gz
http://ftp.debian.org/debian/pool/main/m/minisat2/minisat2_2.2.1.orig.tar.gz

and then unpack with

Expand Down
55 changes: 55 additions & 0 deletions regression/ansi-c/gcc_attributes7/main.i
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
struct X {
int a;
};

struct S {
struct X x __attribute__((aligned(
# 81 "ring.h" 3 4
16
# 81 "ring.h"
)));
struct X x2 __attribute__((aligned(
# 82 "ring.h" 3 4
(((
# 82 "ring.h"
sizeof(struct X)
# 82 "ring.h" 3 4
)+16 -1)&~(16 -1))
# 82 "ring.h"
)));
};

typedef int int8_t
# 194 "/usr/include/x86_64-linux-gnu/sys/types.h"
__attribute__(
# 194 "/usr/include/x86_64-linux-gnu/sys/types.h" 3 4
(__mode__ (__QI__))
# 194 "/usr/include/x86_64-linux-gnu/sys/types.h"
)
# 194 "/usr/include/x86_64-linux-gnu/sys/types.h" 3 4
;

int extundelete_process_dir_block(int fs,
int b
# 29 "block.h" 3 4
__attribute__(
# 29 "block.h"
(unused)
# 29 "block.h" 3 4
)
# 29 "block.h"
,
int ref_offset
# 30 "block.h" 3 4
__attribute__(
# 30 "block.h"
(unused)
# 30 "block.h" 3 4
)
# 30 "block.h"
,
void *priv_data);

int main()
{
}
8 changes: 8 additions & 0 deletions regression/ansi-c/gcc_attributes7/test.desc
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
CORE
main.i

^EXIT=0$
^SIGNAL=0$
--
^warning: ignoring
^CONVERSION ERROR$
20 changes: 20 additions & 0 deletions regression/cbmc-cover/Makefile
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
default: tests.log

test:
@if ! ../test.pl -c ../../../src/cbmc/cbmc ; then \
../failed-tests-printer.pl ; \
exit 1 ; \
fi

tests.log: ../test.pl
@if ! ../test.pl -c ../../../src/cbmc/cbmc ; then \
../failed-tests-printer.pl ; \
exit 1 ; \
fi

show:
@for dir in *; do \
if [ -d "$$dir" ]; then \
vim -o "$$dir/*.c" "$$dir/*.out"; \
fi; \
done;
11 changes: 11 additions & 0 deletions regression/cbmc-cover/assertion1/main.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
int main()
{
int input1, input2;

__CPROVER_assert(!input1, "");

if(input1)
{
__CPROVER_assert(!input1, ""); // will work, we ignore the assertion
}
}
9 changes: 9 additions & 0 deletions regression/cbmc-cover/assertion1/test.desc
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
CORE
main.c
--cover assertion
^EXIT=0$
^SIGNAL=0$
^\[main.assertion.1\] file main.c line 5 function main: SATISFIED$
^\[main.assertion.2\] file main.c line 9 function main: SATISFIED$
--
^warning: ignoring
17 changes: 17 additions & 0 deletions regression/cbmc-cover/branch1/main.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
int main()
{
int input1, input2;

if(input1)
{
if(input1) // dependent
{
}
}
else
{
if(input2) // independent
{
}
}
}
13 changes: 13 additions & 0 deletions regression/cbmc-cover/branch1/test.desc
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
CORE
main.c
--cover branch
^EXIT=0$
^SIGNAL=0$
^\[main.1\] file main.c line 5 function main function main block 1 branch false: SATISFIED$
^\[main.2\] file main.c line 5 function main function main block 1 branch true: SATISFIED$
^\[main.3\] file main.c line 7 function main function main block 2 branch false: FAILED$
^\[main.4\] file main.c line 7 function main function main block 2 branch true: SATISFIED$
^\[main.5\] file main.c line 13 function main function main block 4 branch false: SATISFIED$
^\[main.6\] file main.c line 13 function main function main block 4 branch true: SATISFIED$
--
^warning: ignoring
9 changes: 9 additions & 0 deletions regression/cbmc-cover/branch2/main.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
#include <stdio.h>

int main()
{
int ch;
while((ch=getc(stdin))!=-1)
{
}
}
9 changes: 9 additions & 0 deletions regression/cbmc-cover/branch2/test.desc
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
CORE
main.c
--cover branch --unwind 2
^EXIT=0$
^SIGNAL=0$
^\[main.1\] file main.c line 6 function main function main block 2 branch false: SATISFIED
^\[main.2\] file main.c line 6 function main function main block 2 branch true: SATISFIED
--
^warning: ignoring
20 changes: 20 additions & 0 deletions regression/cbmc-cover/branch3/main.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
#include <assert.h>
#include <stdio.h>

int main()
{
char ch;
unsigned state=0;
while((ch=getc(stdin))!=-1)
{
switch(state)
{
case 0: if(ch=='<') state=1; else state=0; break;
case 1: if(ch=='h') state=2; else state=0; break;
case 2: if(ch=='t') state=3; else state=0; break;
case 3: if(ch=='m') state=4; else state=0; break;
case 4: if(ch=='l') state=5; else state=0; break;
default:;
}
}
}
8 changes: 8 additions & 0 deletions regression/cbmc-cover/branch3/test.desc
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
CORE
main.c
--cover branch --unwind 6
^EXIT=0$
^SIGNAL=0$
^\*\* 22 of 22 covered (100.0%), using .* iterations$
--
^warning: ignoring
17 changes: 17 additions & 0 deletions regression/cbmc-cover/condition1/main.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
int main()
{
int input1, input2;

if(input1 && input2)
{
}
else if(input1)
{
}
else if(input2)
{
if(input1) // can't be true
{
}
}
}
18 changes: 18 additions & 0 deletions regression/cbmc-cover/condition1/test.desc
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
CORE
main.c
--cover condition
^EXIT=0$
^SIGNAL=0$
^\[main.1] file main.c line 5 function main condition .* false: SATISFIED
^\[main.2] file main.c line 5 function main condition .* true: SATISFIED
^\[main.3] file main.c line 5 function main condition .* false: SATISFIED
^\[main.4] file main.c line 5 function main condition .* true: SATISFIED
^\[main.5] file main.c line 8 function main condition .* false: SATISFIED
^\[main.6] file main.c line 8 function main condition .* true: SATISFIED
^\[main.7] file main.c line 11 function main condition .* false: SATISFIED
^\[main.8] file main.c line 11 function main condition .* true: SATISFIED
^\[main.9] file main.c line 13 function main condition .* false: FAILED
^\[main.10] file main.c line 13 function main condition .* true: SATISFIED
^\*\* 9 of 10 covered (90.0%)
--
^warning: ignoring
15 changes: 15 additions & 0 deletions regression/cbmc-cover/cover1/main.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
int main()
{
int input1, input2;

__CPROVER_cover(input1);
__CPROVER_cover(!input1);

if(input1)
{
__CPROVER_cover(!input1); // won't work
}

// should not produce a goal
__CPROVER_assert(input1, "");
}
11 changes: 11 additions & 0 deletions regression/cbmc-cover/cover1/test.desc
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
CORE
main.c
--cover cover
^EXIT=0$
^SIGNAL=0$
^\[main.1] file main.c line 5 function main condition .*: SATISFIED$
^\[main.2] file main.c line 6 function main condition .*: SATISFIED$
^\[main.3] file main.c line 10 function main condition .*: FAILED$
^\*\* 2 of 3 covered (66.7%), using .* iterations$
--
^warning: ignoring
11 changes: 11 additions & 0 deletions regression/cbmc-cover/decision1/main.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
int main()
{
int input1, input2, input3;

if(input1 && input2 && input3)
{
}
else
{
}
}
8 changes: 8 additions & 0 deletions regression/cbmc-cover/decision1/test.desc
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
CORE
main.c
--cover decision
^EXIT=0$
^SIGNAL=0$
^\*\* 2 of 2 covered (100.0%), using 2 iterations$
--
^warning: ignoring
15 changes: 15 additions & 0 deletions regression/cbmc-cover/location1/main.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
int main()
{
int input1;
int x=0;

if(input1)
{
x=1;
}

if(input1 && !x)
{
x=2; // I am dead!
}
}
13 changes: 13 additions & 0 deletions regression/cbmc-cover/location1/test.desc
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
CORE
main.c
--cover location
^EXIT=0$
^SIGNAL=0$
^\[main.1\] file main.c line 3 function main block 1: SATISFIED$
^\[main.2\] file main.c line 8 function main block 2: SATISFIED$
^\[main.3\] file main.c line 11 function main block 3: SATISFIED$
^\[main.4\] file main.c line 13 function main block 4: FAILED$
^\[main.5\] file main.c line 15 function main block 5: SATISFIED$
^\*\* 4 of 5 covered (80.0%)
--
^warning: ignoring
14 changes: 14 additions & 0 deletions regression/cbmc-cover/mcdc1/main.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
int main()
{
// Condition and decision coverage can be had with 2 tests,
// but MC/DC needs six (n+1 for n conditions).

__CPROVER_bool A, B, C, D, E;

if ((A || B) && C && D && E)
{
}
else
{
}
}
8 changes: 8 additions & 0 deletions regression/cbmc-cover/mcdc1/test.desc
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
CORE
main.c
--cover mcdc
^EXIT=0$
^SIGNAL=0$
^\*\* .* of .* covered (100.0%), using 6 iterations$
--
^warning: ignoring
Binary file added regression/cbmc-java/enum1/enum1$Name.class
Binary file not shown.
Binary file added regression/cbmc-java/enum1/enum1.class
Binary file not shown.
27 changes: 27 additions & 0 deletions regression/cbmc-java/enum1/enum1.java
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
public class enum1 {

public enum Name {
ASCII(1, String.class),
BIGINT(2, Long.class),
BOOLEAN(3, Boolean.class),
COUNTER(4, Long.class);

final int protocolId;
final Class<?> javaType;

private Name(int protocolId, Class<?> javaType) {
this.protocolId = protocolId;
this.javaType = javaType;
}

};

public static void main(String args[]) {
int i = 0;
for (Name t : Name.values()) {
i += t.protocolId;
}

}
}

8 changes: 8 additions & 0 deletions regression/cbmc-java/enum1/test.desc
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
CORE
enum1.class

^EXIT=0$
^SIGNAL=0$
^VERIFICATION SUCCESSFUL$
--
^warning: ignoring
Binary file added regression/cbmc-java/function1/Main.class
Binary file not shown.
19 changes: 19 additions & 0 deletions regression/cbmc-java/function1/Main.java
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@

class Other
{
public void fail()
{
assert i == 0;
}

private int i;
}

public class Main
{
public static void main(String[] args)
{
Other o = new Other();
}
}

Binary file added regression/cbmc-java/function1/Other.class
Binary file not shown.
Loading