sv-benchmarks icon indicating copy to clipboard operation
sv-benchmarks copied to clipboard

Invalid dereference in loops termination benchmark

Open xvitovs1 opened this issue 6 years ago • 1 comments

There can be an invalid dereference in benchmark loops/verisec_OpenSER__cases1_stripFullBoth_arr_false-unreach-call_true-termination.i on line 61 which leads to undefined behavior.

The benchmark is labeled as false-unreach-call, which means that the assertion __VERIFIER_assert(j - start + 1 < 2) can fail. In that case, the call on the previous line to strncpy(str2, str+start, j-start+1) leads to invalid dereference, as str2 is an array of size 2.

xvitovs1 avatar Nov 28 '18 09:11 xvitovs1

Note: this is a sideeffect from the conversion of r_strncpy from an undefined function to the actual function.

danieldietsch avatar Nov 28 '18 10:11 danieldietsch