Skip to content

Commit cd84294

Browse files
committed
Add regression test for object accessed through integer pointer
1 parent 03ab5c7 commit cd84294

File tree

2 files changed

+31
-0
lines changed

2 files changed

+31
-0
lines changed
Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#include <assert.h>
2+
#include <stdlib.h>
3+
4+
void main()
5+
{
6+
char *p = malloc(1);
7+
__CPROVER_assume(
8+
__CPROVER_POINTER_OBJECT(p) == 2);
9+
assert(0); // fails as expected
10+
11+
// same value as the malloc'd pointer above
12+
char *q = (char *)((size_t)2 << sizeof(char *) * 8 - 8);
13+
14+
*p = 1;
15+
*q = 2;
16+
17+
assert(*p == 1); // currently succeeds
18+
}
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
KNOWNBUG
2+
main.c
3+
--pointer-check --no-simplify --no-propagation
4+
^EXIT=10$
5+
^SIGNAL=0$
6+
\[main.assertion.1\] .*: FAILURE
7+
\[main.assertion.2\] .*: FAILURE
8+
--
9+
^warning: ignoring
10+
--
11+
The assertion should fail as q has the same value as p. However since q was
12+
initialized via an integer literal it points into __CPROVER_memory, and not to
13+
the malloced memory. Issue #5327.

0 commit comments

Comments
 (0)