symbiotic icon indicating copy to clipboard operation
symbiotic copied to clipboard

Undetected integer overflows in constant-folded expressions

Open lzaoral opened this issue 2 years ago • 0 comments

Code:

#include <limits.h>
int a = (INT_MAX + 1) - 5;

IR:

@a = dso_local global i32 2147483643, align 4

The easiest solution seems to be parsing of the overflow warnings emitted by clang. However, we still need to check that the expression is reachable (clang generates these warnings even if such expression is wrapped in if (0) statement) and to generate a suitable witness.

$ clang -Winteger-overflow -S -emit-llvm const.c -o const.ll
const.c:2:18: warning: overflow in expression; result is -2147483648 with type 'int' [-Winteger-overflow]
int a = (INT_MAX + 1) - 5;
                 ^
const.c:2:23: warning: overflow in expression; result is 2147483643 with type 'int' [-Winteger-overflow]
int a = (INT_MAX + 1) - 5;

2 warnings generated.

Related: https://gitlab.com/sosy-lab/benchmarking/sv-benchmarks/-/issues/1327

lzaoral avatar Feb 16 '22 10:02 lzaoral