klee

klee copied to clipboard

Why does klee report an out of bound pointer on the call to fail? Seems to happen during the implicit cast to basic_ios

#include <fstream>

int main() {
  std::ifstream f("somefile");
  return f.fail();
}

What setup are you using (which version of KLEE/LLVM/STP)?

latest KLEE, LLVM 3.4, STP is irrelevant.

$ clang++ -emit-llvm -c -g -o fail.bc fail.cpp
$ klee fail.bc
KLEE: output directory is "/data/klee/klee-out-0"
KLEE: WARNING: undefined reference to function: _ZNKSt9basic_iosIcSt11char_traitsIcEE4failEv
KLEE: WARNING: undefined reference to function: _ZNSt14basic_ifstreamIcSt11char_traitsIcEEC1EPKcSt13_Ios_Openmode
KLEE: WARNING: undefined reference to function: _ZNSt14basic_ifstreamIcSt11char_traitsIcEED1Ev
KLEE: WARNING: undefined reference to function: _ZSt9terminatev
KLEE: WARNING: undefined reference to function: __cxa_begin_catch
KLEE: WARNING: undefined reference to function: __gxx_personality_v0
KLEE: WARNING ONCE: calling external: _ZNSt14basic_ifstreamIcSt11char_traitsIcEEC1EPKcSt13_Ios_Openmode(46690048, 46518992, 8)
KLEE: ERROR: /data/klee/fail.cpp:5: memory error: out of bound pointer
KLEE: NOTE: now ignoring this error at this location

KLEE: done: total instructions = 12
KLEE: done: completed paths = 1
KLEE: done: generated tests = 1

This test executes external function calls into the C++ standard library to initalize buffers. This is not supported (and has not been supported in 2014).

C++ support has since been added to KLEE.