Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use the widened bounds to update bounds in context #804

Closed
secure-sw-dev-bot opened this issue Jan 16, 2022 · 3 comments
Closed

Use the widened bounds to update bounds in context #804

secure-sw-dev-bot opened this issue Jan 16, 2022 · 3 comments

Comments

@secure-sw-dev-bot
Copy link

This issue was copied from checkedc/checkedc-clang#808


Use the widened bounds calculated by the analysis in BoundsAnalysis.cpp to
widen the bounds of nt_array_ptr.

@secure-sw-dev-bot
Copy link
Author

Comment from @mgrang:

This PR depends on the bounds context PR (checkedc/checkedc-clang#807). Once that is merged, I will add tests to this PR. Also in order to add tests for loops to this PR the PRS (checkedc/checkedc-clang#803, checkedc/checkedc-clang#804 and checkedc/checkedc-clang#805) need to merge.
I have tests this PR locally.

@secure-sw-dev-bot
Copy link
Author

Comment from @mgrang:

In the latest change set, I have fixed the handling of bounds killed by a statement. For bounds killed by a statement, we reset the bounds to the declared bounds. So we first gather the declared bounds and then store them in a declared bounds context. Then when we find that the bounds for a variable are killed by a statement we reset those bounds from the declared context.

We still do not handle the following case:

void f(nt_array_ptr p : count(len), int len) {
    if (*(p + len + 1) {} // We need an out-of-bounds error here.
}

The reason the above case is not handled is that the upper bound of p is (p + len). But the checker does not currently understand that the dereference should only be at the upper bound. The bounds widening algo correctly handles this by not widening the bounds after the dereference.

@secure-sw-dev-bot
Copy link
Author

Comment from @mgrang:

Closing this in favor of checkedc/checkedc-clang#821

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant