symbiotic
symbiotic copied to clipboard
Undetected integer overflows in constant-folded expressions
Code:
#include <limits.h>
int a = (INT_MAX + 1) - 5;
IR:
@a = dso_local global i32 2147483643, align 4
The easiest solution seems to be parsing of the overflow warnings emitted by clang
. However, we still need to check that the expression is reachable (clang
generates these warnings even if such expression is wrapped in if (0)
statement) and to generate a suitable witness.
$ clang -Winteger-overflow -S -emit-llvm const.c -o const.ll
const.c:2:18: warning: overflow in expression; result is -2147483648 with type 'int' [-Winteger-overflow]
int a = (INT_MAX + 1) - 5;
^
const.c:2:23: warning: overflow in expression; result is 2147483643 with type 'int' [-Winteger-overflow]
int a = (INT_MAX + 1) - 5;
2 warnings generated.
Related: https://gitlab.com/sosy-lab/benchmarking/sv-benchmarks/-/issues/1327