search

ApproxSymate / klee

KLEE Symbolic Virtual Machine for Numerical Precision Analysis
Other
0 stars 0 forks source link

Fix to crash due to deallocated Array object #66

Closed domainexpert closed 6 years ago

domainexpert commented 6 years ago

This fix assigns Executor::arrayCache, which is more permanent, to ErrorState::errorArrayCache to prevent crashes such as the following:

0  klee            0x0000000000f5bfe2 llvm::sys::PrintStackTrace(_IO_FILE*) + 50
1  klee            0x0000000000f5b834
2  libpthread.so.0 0x00002ae1dd900390
3  libc.so.6       0x00002ae1de63c746 strlen + 38
4  klee            0x0000000000590ffb klee::PrettyExpressionBuilder::getInitialArray[abi:cxx11](klee::Array const*) + 75
5  klee            0x0000000000591495 klee::PrettyExpressionBuilder::getArrayForUpdate[abi:cxx11](klee::Array const*, klee::UpdateNode const*) + 341
6  klee            0x000000000059052a klee::PrettyExpressionBuilder::constructActual[abi:cxx11](klee::ref<klee::Expr>) + 5258
7  klee            0x0000000000590093 klee::PrettyExpressionBuilder::constructActual[abi:cxx11](klee::ref<klee::Expr>) + 4083
8  klee            0x000000000059065f klee::PrettyExpressionBuilder::constructActual[abi:cxx11](klee::ref<klee::Expr>) + 5567
9  klee            0x000000000058ff82 klee::PrettyExpressionBuilder::constructActual[abi:cxx11](klee::ref<klee::Expr>) + 3810
10 klee            0x000000000058f403 klee::PrettyExpressionBuilder::constructActual[abi:cxx11](klee::ref<klee::Expr>) + 867
11 klee            0x000000000058f403 klee::PrettyExpressionBuilder::constructActual[abi:cxx11](klee::ref<klee::Expr>) + 867
12 klee            0x00000000005914ea klee::PrettyExpressionBuilder::construct[abi:cxx11](klee::ref<klee::Expr>) + 74
13 klee            0x000000000055dcf7
14 klee            0x0000000000567a56 klee::Executor::terminateStateOnExit(klee::ExecutionState&) + 38
15 klee            0x0000000000596fe7 klee::SpecialFunctionHandler::handle(klee::ExecutionState&, llvm::Function*, klee::KInstruction*, std::vector<klee::ref<klee::Expr>, std::allocator<klee::ref<klee::Expr> > >&) + 199
16 klee            0x0000000000568077 klee::Executor::callExternalFunction(klee::ExecutionState&, klee::KInstruction*, llvm::Function*, std::vector<klee::ref<klee::Expr>, std::allocator<klee::ref<klee::Expr> > >&) + 87
17 klee            0x0000000000570caa klee::Executor::executeCall(klee::ExecutionState&, klee::KInstruction*, llvm::Function*, std::vector<klee::Cell, std::allocator<klee::Cell> >&) + 2266
18 klee            0x0000000000573575 klee::Executor::executeInstruction(klee::ExecutionState&, klee::KInstruction*) + 9173
19 klee            0x0000000000578d38 klee::Executor::run(klee::ExecutionState&) + 1768
20 klee            0x00000000005795aa klee::Executor::runFunctionAsMain(llvm::Function*, int, char**, char**) + 1818
21 klee            0x0000000000547850 main + 11280
22 libc.so.6       0x00002ae1de5d1830 __libc_start_main + 240
23 klee            0x000000000055a929 _start + 41
Makefile:44: recipe for target 'memdjpeg.klee' failed
make: *** [memdjpeg.klee] Segmentation fault (core dumped)

The crash was because ErrorState::errorArrayCache was cleared (deallocated) too soon when it is still needed by PrettyExpressionBuilder. By substituting the original ErrorState::errorArrayCache with Executor::arrayCache, the array cache is still available when it is used by PrettyExpressionBuilder.