Open vanhauser-thc opened 3 years ago
Probably atoi
decodes in a loop; concolic execution then can't reason about the loop as a whole (i.e., as an abstract construct with many possible paths through it), but instead sees only the check of the loop condition in each iteration. It will generate a deviating input, but after that the outcome of the check becomes part of the path constraints and isn't reasoned about any further.
Example:
but none of the 29 generated inputs contain the correct value:
why is this the case?