goblint / analyzer

Static analysis framework for C
https://goblint.in.tum.de
MIT License
160 stars 72 forks source link

SV-Comp incorrect result in no-overflow tasks #1501

Open DrMichaelPetter opened 4 weeks ago

DrMichaelPetter commented 4 weeks ago

Straight from no-overflow  on ldv-regression/test_overflow.i ; we are not flagging any overflow here.


#include <stdlib.h>
#include <stdio.h>

void __blast_assert()
{
 ERROR: {reach_error();abort();}
}

ssize_t getService();
int globalSize;

int
main(int argc, char* argv[]) {
 long int retVal;
 retVal = getService();
 ((sizeof(retVal)==globalSize) ? (0) : __blast_assert ());
 printf("returned value: %ld\n", retVal);
 return 0;
}

ssize_t getService() {
 ssize_t localVar = 999999999999;
 globalSize = sizeof(localVar);
 printf("localVar: %zd\n", localVar);
 return localVar;
}

Correct me if I am wrong, but I thought that ssize_t localVar = 999999999999; is the culprit on 32bit architectures. However, we do not flag an overflow even on

//SKIP PARAM: --sets  exp.architecture 32bit  --set ana.specification "CHECK( init(main()), LTL(G ! overflow) )" --conf conf/svcomp22.json

#include <sys/types.h>

int main(){
    ssize_t a = 999999999999; // WARN
    return a?0:1;
}

If we let gcc -Wall -c -m32 test.c try with this minimal example, it flags the overflow in that line. Is this what the sv-comp task would require us to do, too?

sim642 commented 4 weeks ago

exp.architecture only applies to preprocessing (which isn't used in SV-COMP anyway) right now. If this is based on 32bit architecture, then it's just another instance of #54 revealing itself.