ApproxSymate / klee

KLEE Symbolic Virtual Machine for Numerical Precision Analysis
Other
0 stars 0 forks source link

Symbolic index fix #58

Closed domainexpert closed 6 years ago

domainexpert commented 6 years ago

Fixes crashes due to symbolic index. This is done by assuming that retrieved error for symbolic indices is 0, as it can be assumed that the value is non-approximable in that case.

Secondly, this also fixes crashes due to mismatched type returned by ErrorState::propagateError(), which sometimes returns Boolean expression, from the construction of path condition constraint with error, when the expected return type is 8-bits. The path condition constraint with error is now separated from the actual error value (which is 0 in case of conditional). ErrorState::propagateError() has been made to return a pair of them.

Tested on get_sign.c, same output before and after this patch:

#include <klee/klee.h>

int calculate_output(int x, int y)
{
    int z;

    if (x < 5) {
        z = x + y;
    } else {
        z = x * y;
    }
    return z;
}

int main()
{
    int output;
    int input_x, input_y;

    klee_make_symbolic(&input_x, sizeof(input_x), "input_x");
    klee_make_symbolic(&input_y, sizeof(input_y), "input_y");

    klee_track_error(&input_x, "input_x_error");
    klee_track_error(&input_y, "input_y_error");

    output = calculate_output(input_x, input_y);

    klee_bound_error(output, "output", 1.3);

    return 0;
}
Himeshi commented 6 years ago

Brilliant idea! Thanks @domainexpert!